1 <?xml version='
1.0' encoding='UTF-
8'
?>
2 <?xml-stylesheet type=
"text/xsl" href=
"ipfix.xsl"?>
3 <?oxygen RNGSchema=
"ipfix.rng" type=
"xml"?>
4 <registry xmlns=
"http://www.iana.org/assignments" id=
"ipfix">
5 <title>IP Flow Information Export (IPFIX) Entities
</title>
6 <created>2007-
05-
10</created>
7 <updated>2012-
12-
05</updated>
8 <note>For the IPFIX schema, please see
<xref type=
"uri" data=
"http://www.iana.org/assignments/xml-registry/schema/ipfix.xsd"/>.
</note>
10 <registry id=
"ipfix-information-elements">
11 <title>IPFIX Information Elements
</title>
12 <registration_rule>Expert Review
</registration_rule>
13 <expert>Primary expert - Nevil Brownlee and Secondary expert - Juergen Quittek
</expert>
14 <xref type=
"rfc" data=
"rfc5102"/>
15 <note>Values
0-
127: NFv9-compatible
</note>
18 <elementId>0</elementId>
19 <status>current
</status>
21 <xref type=
"rfc" data=
"rfc5102"/>
25 <name>octetDeltaCount
</name>
26 <dataType>unsigned64
</dataType>
27 <group>flowCounter
</group>
28 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
29 <elementId>1</elementId>
30 <applicability>data
</applicability>
31 <status>current
</status>
34 The number of octets since the previous report (if any)
35 in incoming packets for this Flow at the Observation Point.
36 The number of octets includes IP header(s) and IP payload.
40 <xref type=
"rfc" data=
"rfc5102"/>
44 <name>packetDeltaCount
</name>
45 <dataType>unsigned64
</dataType>
46 <group>flowCounter
</group>
47 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
48 <elementId>2</elementId>
49 <applicability>data
</applicability>
50 <status>current
</status>
53 The number of incoming packets since the previous report
54 (if any) for this Flow at the Observation Point.
57 <units>packets
</units>
58 <xref type=
"rfc" data=
"rfc5102"/>
62 <name>deltaFlowCount
</name>
63 <dataType>unsigned64
</dataType>
64 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
65 <elementId>3</elementId>
66 <status>current
</status>
69 The conservative count of Original Flows contributing
70 to this Aggregated Flow; may be distributed via any of the methods
71 expressed by the valueDistributionMethod Information Element.
74 <xref type=
"draft" data=
"RFC-ietf-ipfix-a9n-08"/>
78 <name>protocolIdentifier
</name>
79 <dataType>unsigned8
</dataType>
80 <group>ipHeader
</group>
81 <dataTypeSemantics>identifier
</dataTypeSemantics>
82 <elementId>4</elementId>
83 <applicability>all
</applicability>
84 <status>current
</status>
87 The value of the protocol number in the IP packet header.
88 The protocol number identifies the IP packet payload type.
89 Protocol numbers are defined in the IANA Protocol Numbers
93 In Internet Protocol version
4 (IPv4), this is carried in the
94 Protocol field. In Internet Protocol version
6 (IPv6), this
95 is carried in the Next Header field in the last extension
101 See
<xref type=
"rfc" data=
"rfc791"/> for the specification of the IPv4
103 See
<xref type=
"rfc" data=
"rfc2460"/> for the specification of the
105 See the list of protocol numbers assigned by IANA at
<xref type=
"registry" data=
"protocol-numbers"/>.
108 <xref type=
"rfc" data=
"rfc5102"/>
112 <name>ipClassOfService
</name>
113 <dataType>unsigned8
</dataType>
114 <group>ipHeader
</group>
115 <dataTypeSemantics>identifier
</dataTypeSemantics>
116 <elementId>5</elementId>
117 <applicability>all
</applicability>
118 <status>current
</status>
121 For IPv4 packets, this is the value of the TOS field in
122 the IPv4 packet header. For IPv6 packets, this is the
123 value of the Traffic Class field in the IPv6 packet header.
128 See
<xref type=
"rfc" data=
"rfc1812"/> (Section
5.3.2) and
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4 TOS field.
129 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the IPv6
133 <xref type=
"rfc" data=
"rfc5102"/>
137 <name>tcpControlBits
</name>
138 <dataType>unsigned8
</dataType>
139 <group>minMax
</group>
140 <dataTypeSemantics>flags
</dataTypeSemantics>
141 <elementId>6</elementId>
142 <applicability>all
</applicability>
143 <status>current
</status>
146 TCP control bits observed for packets of this Flow.
147 The information is encoded in a set of bit fields.
148 For each TCP control bit, there is a bit in this
149 set. A bit is set to
1 if any observed packet of this
150 Flow has the corresponding TCP control bit set to
1.
151 A value of
0 for a bit indicates that the corresponding
152 bit was not set in any of the observed packets
157 +-----+-----+-----+-----+-----+-----+-----+-----+
158 | Reserved | URG | ACK | PSH | RST | SYN | FIN |
159 +-----+-----+-----+-----+-----+-----+-----+-----+
161 Reserved: Reserved for future use by TCP. Must be zero.
162 URG: Urgent Pointer field significant
163 ACK: Acknowledgment field significant
165 RST: Reset the connection
166 SYN: Synchronize sequence numbers
167 FIN: No more data from sender
172 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
173 control bits in the TCP header.
176 <xref type=
"rfc" data=
"rfc5102"/>
180 <name>sourceTransportPort
</name>
181 <dataType>unsigned16
</dataType>
182 <group>transportHeader
</group>
183 <dataTypeSemantics>identifier
</dataTypeSemantics>
184 <elementId>7</elementId>
185 <applicability>all
</applicability>
186 <status>current
</status>
189 The source port identifier in the transport header.
190 For the transport protocols UDP, TCP, and SCTP, this is the
191 source port number given in the respective header. This
192 field MAY also be used for future transport protocols that
193 have
16-bit source port identifiers.
198 See
<xref type=
"rfc" data=
"rfc768"/> for the definition of the UDP
200 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
202 See
<xref type=
"rfc" data=
"rfc4960"/> for the definition of SCTP.
205 Additional information on defined UDP and TCP port numbers can be
206 found at
<xref type=
"registry" data=
"port-numbers"/>.
209 <xref type=
"rfc" data=
"rfc5102"/>
213 <name>sourceIPv4Address
</name>
214 <dataType>ipv4Address
</dataType>
215 <group>ipHeader
</group>
216 <dataTypeSemantics>identifier
</dataTypeSemantics>
217 <elementId>8</elementId>
218 <applicability>all
</applicability>
219 <status>current
</status>
222 The IPv4 source address in the IP packet header.
227 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4
228 source address field.
231 <xref type=
"rfc" data=
"rfc5102"/>
235 <name>sourceIPv4PrefixLength
</name>
236 <dataType>unsigned8
</dataType>
237 <group>ipHeader
</group>
238 <elementId>9</elementId>
239 <applicability>option
</applicability>
240 <status>current
</status>
243 The number of contiguous bits that are relevant in the
244 sourceIPv4Prefix Information Element.
249 <xref type=
"rfc" data=
"rfc5102"/>
253 <name>ingressInterface
</name>
254 <dataType>unsigned32
</dataType>
256 <dataTypeSemantics>identifier
</dataTypeSemantics>
257 <elementId>10</elementId>
258 <applicability>all
</applicability>
259 <status>current
</status>
262 The index of the IP interface where packets of this Flow
263 are being received. The value matches the value of managed
264 object 'ifIndex' as defined in RFC
2863.
265 Note that ifIndex values are not assigned statically to an
266 interface and that the interfaces may be renumbered every
267 time the device's management system is re-initialized, as
268 specified in RFC
2863.
273 See
<xref type=
"rfc" data=
"rfc2863"/> for the definition of the
277 <xref type=
"rfc" data=
"rfc5102"/>
281 <name>destinationTransportPort
</name>
282 <dataType>unsigned16
</dataType>
283 <group>transportHeader
</group>
284 <dataTypeSemantics>identifier
</dataTypeSemantics>
285 <elementId>11</elementId>
286 <applicability>all
</applicability>
287 <status>current
</status>
290 The destination port identifier in the transport header.
291 For the transport protocols UDP, TCP, and SCTP, this is the
292 destination port number given in the respective header.
293 This field MAY also be used for future transport protocols
294 that have
16-bit destination port identifiers.
299 See
<xref type=
"rfc" data=
"rfc768"/> for the definition of the UDP
300 destination port field.
301 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
302 destination port field.
303 See
<xref type=
"rfc" data=
"rfc4960"/> for the definition of SCTP.
306 Additional information on defined UDP and TCP port numbers can be
307 found at
<xref type=
"registry" data=
"port-numbers"/>.
310 <xref type=
"rfc" data=
"rfc5102"/>
314 <name>destinationIPv4Address
</name>
315 <dataType>ipv4Address
</dataType>
316 <group>ipHeader
</group>
317 <dataTypeSemantics>identifier
</dataTypeSemantics>
318 <elementId>12</elementId>
319 <applicability>all
</applicability>
320 <status>current
</status>
323 The IPv4 destination address in the IP packet header.
328 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4
329 destination address field.
332 <xref type=
"rfc" data=
"rfc5102"/>
336 <name>destinationIPv4PrefixLength
</name>
337 <dataType>unsigned8
</dataType>
338 <group>ipHeader
</group>
339 <elementId>13</elementId>
340 <applicability>option
</applicability>
341 <status>current
</status>
344 The number of contiguous bits that are relevant in the
345 destinationIPv4Prefix Information Element.
350 <xref type=
"rfc" data=
"rfc5102"/>
354 <name>egressInterface
</name>
355 <dataType>unsigned32
</dataType>
357 <dataTypeSemantics>identifier
</dataTypeSemantics>
358 <elementId>14</elementId>
359 <applicability>all
</applicability>
360 <status>current
</status>
363 The index of the IP interface where packets of
364 this Flow are being sent. The value matches the value of
365 managed object 'ifIndex' as defined in RFC
2863.
366 Note that ifIndex values are not assigned statically to an
367 interface and that the interfaces may be renumbered every
368 time the device's management system is re-initialized, as
369 specified in RFC
2863.
374 See
<xref type=
"rfc" data=
"rfc2863"/> for the definition of the
378 <xref type=
"rfc" data=
"rfc5102"/>
382 <name>ipNextHopIPv4Address
</name>
383 <dataType>ipv4Address
</dataType>
384 <group>derived
</group>
385 <dataTypeSemantics>identifier
</dataTypeSemantics>
386 <elementId>15</elementId>
387 <applicability>data
</applicability>
388 <status>current
</status>
391 The IPv4 address of the next IPv4 hop.
394 <xref type=
"rfc" data=
"rfc5102"/>
398 <name>bgpSourceAsNumber
</name>
399 <dataType>unsigned32
</dataType>
400 <group>derived
</group>
401 <dataTypeSemantics>identifier
</dataTypeSemantics>
402 <elementId>16</elementId>
403 <applicability>all
</applicability>
404 <status>current
</status>
407 The autonomous system (AS) number of the source IP address.
408 If AS path information for this Flow is only available as
409 an unordered AS set (and not as an ordered AS sequence),
410 then the value of this Information Element is
0.
415 See
<xref type=
"rfc" data=
"rfc4271"/> for a description of BGP-
4, and
416 see
<xref type=
"rfc" data=
"rfc1930"/> for the definition of the AS
420 <xref type=
"rfc" data=
"rfc5102"/>
424 <name>bgpDestinationAsNumber
</name>
425 <dataType>unsigned32
</dataType>
426 <group>derived
</group>
427 <dataTypeSemantics>identifier
</dataTypeSemantics>
428 <elementId>17</elementId>
429 <applicability>all
</applicability>
430 <status>current
</status>
433 The autonomous system (AS) number of the destination IP
434 address. If AS path information for this Flow is only
435 available as an unordered AS set (and not as an ordered AS
436 sequence), then the value of this Information Element is
0.
441 See
<xref type=
"rfc" data=
"rfc4271"/> for a description of BGP-
4, and
442 see
<xref type=
"rfc" data=
"rfc1930"/> for the definition of the AS
446 <xref type=
"rfc" data=
"rfc5102"/>
450 <name>bgpNextHopIPv4Address
</name>
451 <dataType>ipv4Address
</dataType>
452 <group>derived
</group>
453 <dataTypeSemantics>identifier
</dataTypeSemantics>
454 <elementId>18</elementId>
455 <applicability>all
</applicability>
456 <status>current
</status>
459 The IPv4 address of the next (adjacent) BGP hop.
464 See
<xref type=
"rfc" data=
"rfc4271"/> for a description of BGP-
4.
467 <xref type=
"rfc" data=
"rfc5102"/>
471 <name>postMCastPacketDeltaCount
</name>
472 <dataType>unsigned64
</dataType>
473 <group>flowCounter
</group>
474 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
475 <elementId>19</elementId>
476 <applicability>data
</applicability>
477 <status>current
</status>
480 The number of outgoing multicast packets since the
481 previous report (if any) sent for packets of this Flow
482 by a multicast daemon within the Observation Domain.
483 This property cannot necessarily be observed at the
484 Observation Point, but may be retrieved by other means.
487 <units>packets
</units>
488 <xref type=
"rfc" data=
"rfc5102"/>
492 <name>postMCastOctetDeltaCount
</name>
493 <dataType>unsigned64
</dataType>
494 <group>flowCounter
</group>
495 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
496 <elementId>20</elementId>
497 <applicability>data
</applicability>
498 <status>current
</status>
501 The number of octets since the previous report (if any)
502 in outgoing multicast packets sent for packets of this
503 Flow by a multicast daemon within the Observation Domain.
504 This property cannot necessarily be observed at the
505 Observation Point, but may be retrieved by other means.
506 The number of octets includes IP header(s) and IP payload.
509 <units>octets
</units>
510 <xref type=
"rfc" data=
"rfc5102"/>
514 <name>flowEndSysUpTime
</name>
515 <dataType>unsigned32
</dataType>
516 <group>timestamp
</group>
517 <elementId>21</elementId>
518 <applicability>data
</applicability>
519 <status>current
</status>
522 The relative timestamp of the last packet of this Flow.
523 It indicates the number of milliseconds since the
524 last (re-)initialization of the IPFIX Device (sysUpTime).
527 <units>milliseconds
</units>
528 <xref type=
"rfc" data=
"rfc5102"/>
532 <name>flowStartSysUpTime
</name>
533 <dataType>unsigned32
</dataType>
534 <group>timestamp
</group>
535 <elementId>22</elementId>
536 <applicability>data
</applicability>
537 <status>current
</status>
540 The relative timestamp of the first packet of this Flow.
541 It indicates the number of milliseconds since the
542 last (re-)initialization of the IPFIX Device (sysUpTime).
545 <units>milliseconds
</units>
546 <xref type=
"rfc" data=
"rfc5102"/>
550 <name>postOctetDeltaCount
</name>
551 <dataType>unsigned64
</dataType>
552 <group>flowCounter
</group>
553 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
554 <elementId>23</elementId>
555 <applicability>data
</applicability>
556 <status>current
</status>
559 The definition of this Information Element is identical
560 to the definition of Information Element
561 'octetDeltaCount', except that it reports a
562 potentially modified value caused by a middlebox
563 function after the packet passed the Observation Point.
566 <units>octets
</units>
567 <xref type=
"rfc" data=
"rfc5102"/>
571 <name>postPacketDeltaCount
</name>
572 <dataType>unsigned64
</dataType>
573 <group>flowCounter
</group>
574 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
575 <elementId>24</elementId>
576 <applicability>data
</applicability>
577 <status>current
</status>
580 The definition of this Information Element is identical
581 to the definition of Information Element
582 'packetDeltaCount', except that it reports a
583 potentially modified value caused by a middlebox
584 function after the packet passed the Observation Point.
587 <units>packets
</units>
588 <xref type=
"rfc" data=
"rfc5102"/>
592 <name>minimumIpTotalLength
</name>
593 <dataType>unsigned64
</dataType>
594 <group>minMax
</group>
595 <elementId>25</elementId>
596 <applicability>all
</applicability>
597 <status>current
</status>
600 Length of the smallest packet observed for this Flow.
601 The packet length includes the IP header(s) length and
602 the IP payload length.
605 <units>octets
</units>
608 See
<xref type=
"rfc" data=
"rfc791"/> for the specification of the IPv4
610 See
<xref type=
"rfc" data=
"rfc2460"/> for the specification of the
612 See
<xref type=
"rfc" data=
"rfc2675"/> for the specification of the
613 IPv6 jumbo payload length.
616 <xref type=
"rfc" data=
"rfc5102"/>
620 <name>maximumIpTotalLength
</name>
621 <dataType>unsigned64
</dataType>
622 <group>minMax
</group>
623 <elementId>26</elementId>
624 <applicability>all
</applicability>
625 <status>current
</status>
628 Length of the largest packet observed for this Flow.
629 The packet length includes the IP header(s) length and
630 the IP payload length.
633 <units>octets
</units>
636 See
<xref type=
"rfc" data=
"rfc791"/> for the specification of the IPv4
638 See
<xref type=
"rfc" data=
"rfc2460"/> for the specification of the
640 See
<xref type=
"rfc" data=
"rfc2675"/> for the specification of the
641 IPv6 jumbo payload length.
644 <xref type=
"rfc" data=
"rfc5102"/>
648 <name>sourceIPv6Address
</name>
649 <dataType>ipv6Address
</dataType>
650 <group>ipHeader
</group>
651 <dataTypeSemantics>identifier
</dataTypeSemantics>
652 <elementId>27</elementId>
653 <applicability>all
</applicability>
654 <status>current
</status>
657 The IPv6 source address in the IP packet header.
662 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the Source
663 Address field in the IPv6 header.
666 <xref type=
"rfc" data=
"rfc5102"/>
670 <name>destinationIPv6Address
</name>
671 <dataType>ipv6Address
</dataType>
672 <group>ipHeader
</group>
673 <dataTypeSemantics>identifier
</dataTypeSemantics>
674 <elementId>28</elementId>
675 <applicability>all
</applicability>
676 <status>current
</status>
679 The IPv6 destination address in the IP packet header.
684 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the
685 Destination Address field in the IPv6 header.
688 <xref type=
"rfc" data=
"rfc5102"/>
692 <name>sourceIPv6PrefixLength
</name>
693 <dataType>unsigned8
</dataType>
694 <group>ipHeader
</group>
695 <elementId>29</elementId>
696 <applicability>option
</applicability>
697 <status>current
</status>
700 The number of contiguous bits that are relevant in the
701 sourceIPv6Prefix Information Element.
706 <xref type=
"rfc" data=
"rfc5102"/>
710 <name>destinationIPv6PrefixLength
</name>
711 <dataType>unsigned8
</dataType>
712 <group>ipHeader
</group>
713 <elementId>30</elementId>
714 <applicability>option
</applicability>
715 <status>current
</status>
718 The number of contiguous bits that are relevant in the
719 destinationIPv6Prefix Information Element.
724 <xref type=
"rfc" data=
"rfc5102"/>
728 <name>flowLabelIPv6
</name>
729 <dataType>unsigned32
</dataType>
730 <group>ipHeader
</group>
731 <dataTypeSemantics>identifier
</dataTypeSemantics>
732 <elementId>31</elementId>
733 <applicability>all
</applicability>
734 <status>current
</status>
737 The value of the IPv6 Flow Label field in the IP packet header.
742 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the
743 Flow Label field in the IPv6 packet header.
746 <xref type=
"rfc" data=
"rfc5102"/>
750 <name>icmpTypeCodeIPv4
</name>
751 <dataType>unsigned16
</dataType>
752 <group>transportHeader
</group>
753 <dataTypeSemantics>identifier
</dataTypeSemantics>
754 <elementId>32</elementId>
755 <applicability>all
</applicability>
756 <status>current
</status>
759 Type and Code of the IPv4 ICMP message. The combination of
760 both values is reported as (ICMP type *
256) + ICMP code.
765 See
<xref type=
"rfc" data=
"rfc792"/> for the definition of the IPv4
766 ICMP type and code fields.
769 <xref type=
"rfc" data=
"rfc5102"/>
773 <name>igmpType
</name>
774 <dataType>unsigned8
</dataType>
775 <group>transportHeader
</group>
776 <dataTypeSemantics>identifier
</dataTypeSemantics>
777 <elementId>33</elementId>
778 <applicability>all
</applicability>
779 <status>current
</status>
782 The type field of the IGMP message.
787 See
<xref type=
"rfc" data=
"rfc3376"/> for the definition of the IGMP
791 <xref type=
"rfc" data=
"rfc5102"/>
795 <elementId>34-
35</elementId>
797 <xref type=
"rfc" data=
"rfc5102"/>
801 <name>flowActiveTimeout
</name>
802 <dataType>unsigned16
</dataType>
804 <elementId>36</elementId>
805 <applicability>all
</applicability>
806 <status>current
</status>
809 The number of seconds after which an active Flow is timed out
810 anyway, even if there is still a continuous flow of packets.
813 <units>seconds
</units>
814 <xref type=
"rfc" data=
"rfc5102"/>
818 <name>flowIdleTimeout
</name>
819 <dataType>unsigned16
</dataType>
821 <elementId>37</elementId>
822 <applicability>all
</applicability>
823 <status>current
</status>
826 A Flow is considered to be timed out if no packets belonging
827 to the Flow have been observed for the number of seconds
828 specified by this field.
831 <units>seconds
</units>
832 <xref type=
"rfc" data=
"rfc5102"/>
836 <elementId>38-
39</elementId>
838 <xref type=
"rfc" data=
"rfc5102"/>
842 <name>exportedOctetTotalCount
</name>
843 <dataType>unsigned64
</dataType>
844 <group>processCounter
</group>
845 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
846 <elementId>40</elementId>
847 <applicability>data
</applicability>
848 <status>current
</status>
851 The total number of octets that the Exporting Process
852 has sent since the Exporting Process (re-)initialization
853 to a particular Collecting Process.
854 The value of this Information Element is calculated by
855 summing up the IPFIX Message Header length values of all
856 IPFIX Messages that were successfully sent to the Collecting
857 Process. The reported number excludes octets in the IPFIX
858 Message that carries the counter value.
859 If this Information Element is sent to a particular
860 Collecting Process, then by default it specifies the number
861 of octets sent to this Collecting Process.
864 <units>octets
</units>
865 <xref type=
"rfc" data=
"rfc5102"/>
869 <name>exportedMessageTotalCount
</name>
870 <dataType>unsigned64
</dataType>
871 <group>processCounter
</group>
872 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
873 <elementId>41</elementId>
874 <applicability>data
</applicability>
875 <status>current
</status>
878 The total number of IPFIX Messages that the Exporting Process
879 has sent since the Exporting Process (re-)initialization to
880 a particular Collecting Process.
881 The reported number excludes the IPFIX Message that carries
883 If this Information Element is sent to a particular
884 Collecting Process, then by default it specifies the number
885 of IPFIX Messages sent to this Collecting Process.
888 <units>messages
</units>
889 <xref type=
"rfc" data=
"rfc5102"/>
893 <name>exportedFlowRecordTotalCount
</name>
894 <dataType>unsigned64
</dataType>
895 <group>processCounter
</group>
896 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
897 <elementId>42</elementId>
898 <applicability>data
</applicability>
899 <status>current
</status>
902 The total number of Flow Records that the Exporting
903 Process has sent as Data Records since the Exporting
904 Process (re-)initialization to a particular Collecting
905 Process. The reported number excludes Flow Records in
906 the IPFIX Message that carries the counter value.
907 If this Information Element is sent to a particular
908 Collecting Process, then by default it specifies the number
909 of Flow Records sent to this process.
913 <xref type=
"rfc" data=
"rfc5102"/>
917 <elementId>43</elementId>
919 <xref type=
"rfc" data=
"rfc5102"/>
923 <name>sourceIPv4Prefix
</name>
924 <dataType>ipv4Address
</dataType>
925 <group>ipHeader
</group>
926 <elementId>44</elementId>
927 <applicability>data
</applicability>
928 <status>current
</status>
931 IPv4 source address prefix.
934 <xref type=
"rfc" data=
"rfc5102"/>
938 <name>destinationIPv4Prefix
</name>
939 <dataType>ipv4Address
</dataType>
940 <group>ipHeader
</group>
941 <elementId>45</elementId>
942 <applicability>data
</applicability>
943 <status>current
</status>
945 <paragraph> IPv4 destination address prefix.
</paragraph>
947 <xref type=
"rfc" data=
"rfc5102"/>
951 <name>mplsTopLabelType
</name>
952 <dataType>unsigned8
</dataType>
953 <group>derived
</group>
954 <dataTypeSemantics>identifier
</dataTypeSemantics>
955 <elementId>46</elementId>
956 <applicability>data
</applicability>
957 <status>current
</status>
960 This field identifies the control protocol that allocated the
961 top-of-stack label. Values for this field are listed in the
962 MPLS label type registry. See
963 <xref type=
"uri" data=
"http://www.iana.org/assignments/ipfix/ipfix.xml#ipfix-mpls-label-type"/>
968 See
<xref type=
"rfc" data=
"rfc3031"/> for the MPLS label structure.
969 See
<xref type=
"rfc" data=
"rfc4364"/> for the association of MPLS
970 labels with Virtual Private Networks (VPNs).
971 See
<xref type=
"rfc" data=
"rfc4271"/> for BGP and BGP routing.
972 See
<xref type=
"rfc" data=
"rfc5036"/> for Label Distribution Protocol
974 See the list of MPLS label types assigned by IANA at
<xref type=
"registry" data=
"mpls-label-values"/>.
977 <xref type=
"rfc" data=
"rfc5102"/>
981 <name>mplsTopLabelIPv4Address
</name>
982 <dataType>ipv4Address
</dataType>
983 <group>derived
</group>
984 <dataTypeSemantics>identifier
</dataTypeSemantics>
985 <elementId>47</elementId>
986 <applicability>data
</applicability>
987 <status>current
</status>
990 The IPv4 address of the system that the MPLS top label will
991 cause this Flow to be forwarded to.
996 See
<xref type=
"rfc" data=
"rfc3031"/> for the association between MPLS
997 labels and IP addresses.
1000 <xref type=
"rfc" data=
"rfc5102"/>
1004 <elementId>48-
51</elementId>
1006 <xref type=
"rfc" data=
"rfc5102"/>
1010 <name>minimumTTL
</name>
1011 <dataType>unsigned8
</dataType>
1012 <group>minMax
</group>
1013 <elementId>52</elementId>
1014 <applicability>data
</applicability>
1015 <status>current
</status>
1018 Minimum TTL value observed for any packet in this Flow.
1024 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4
1026 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the IPv6
1030 <xref type=
"rfc" data=
"rfc5102"/>
1034 <name>maximumTTL
</name>
1035 <dataType>unsigned8
</dataType>
1036 <group>minMax
</group>
1037 <elementId>53</elementId>
1038 <applicability>data
</applicability>
1039 <status>current
</status>
1042 Maximum TTL value observed for any packet in this Flow.
1048 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4
1050 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the IPv6
1054 <xref type=
"rfc" data=
"rfc5102"/>
1058 <name>fragmentIdentification
</name>
1059 <dataType>unsigned32
</dataType>
1060 <group>ipHeader
</group>
1061 <dataTypeSemantics>identifier
</dataTypeSemantics>
1062 <elementId>54</elementId>
1063 <applicability>data
</applicability>
1064 <status>current
</status>
1067 The value of the Identification field
1068 in the IPv4 packet header or in the IPv6 Fragment header,
1069 respectively. The value is
0 for IPv6 if there is
1075 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4
1076 Identification field.
1077 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the
1078 Identification field in the IPv6 Fragment header.
1081 <xref type=
"rfc" data=
"rfc5102"/>
1085 <name>postIpClassOfService
</name>
1086 <dataType>unsigned8
</dataType>
1087 <group>ipHeader
</group>
1088 <dataTypeSemantics>identifier
</dataTypeSemantics>
1089 <elementId>55</elementId>
1090 <applicability>all
</applicability>
1091 <status>current
</status>
1094 The definition of this Information Element is identical
1095 to the definition of Information Element
1096 'ipClassOfService', except that it reports a
1097 potentially modified value caused by a middlebox
1098 function after the packet passed the Observation Point.
1103 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4
1105 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the IPv6
1106 Traffic Class field.
1107 See
<xref type=
"rfc" data=
"rfc3234"/> for the definition of
1111 <xref type=
"rfc" data=
"rfc5102"/>
1115 <name>sourceMacAddress
</name>
1116 <dataType>macAddress
</dataType>
1117 <group>subIpHeader
</group>
1118 <dataTypeSemantics>identifier
</dataTypeSemantics>
1119 <elementId>56</elementId>
1120 <applicability>data
</applicability>
1121 <status>current
</status>
1124 The IEEE
802 source MAC address field.
1128 <paragraph>See IEEE
.802-
3.2002.
</paragraph>
1130 <xref type=
"rfc" data=
"rfc5102"/>
1134 <name>postDestinationMacAddress
</name>
1135 <dataType>macAddress
</dataType>
1136 <group>subIpHeader
</group>
1137 <dataTypeSemantics>identifier
</dataTypeSemantics>
1138 <elementId>57</elementId>
1139 <applicability>data
</applicability>
1140 <status>current
</status>
1143 The definition of this Information Element is identical
1144 to the definition of Information Element
1145 'destinationMacAddress', except that it reports a
1146 potentially modified value caused by a middlebox
1147 function after the packet passed the Observation Point.
1151 <paragraph>See IEEE
.802-
3.2002.
</paragraph>
1153 <xref type=
"rfc" data=
"rfc5102"/>
1158 <dataType>unsigned16
</dataType>
1159 <group>subIpHeader
</group>
1160 <dataTypeSemantics>identifier
</dataTypeSemantics>
1161 <elementId>58</elementId>
1162 <applicability>data
</applicability>
1163 <status>current
</status>
1166 Virtual LAN identifier associated with ingress interface. For dot1q vlans, see
243
1171 <paragraph>See IEEE
.802-
1Q
.2003.
</paragraph>
1173 <xref type=
"rfc" data=
"rfc5102"/>
1177 <name>postVlanId
</name>
1178 <dataType>unsigned16
</dataType>
1179 <group>subIpHeader
</group>
1180 <dataTypeSemantics>identifier
</dataTypeSemantics>
1181 <elementId>59</elementId>
1182 <applicability>data
</applicability>
1183 <status>current
</status>
1186 Virtual LAN identifier associated with egress interface. For postdot1q vlans, see
254 postDot1qVlanId.
1190 <paragraph>See IEEE
.802-
1Q
.2003.
</paragraph>
1192 <xref type=
"rfc" data=
"rfc5102"/>
1196 <name>ipVersion
</name>
1197 <dataType>unsigned8
</dataType>
1198 <group>ipHeader
</group>
1199 <dataTypeSemantics>identifier
</dataTypeSemantics>
1200 <elementId>60</elementId>
1201 <applicability>all
</applicability>
1202 <status>current
</status>
1205 The IP version field in the IP packet header.
1210 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of the version
1211 field in the IPv4 packet header.
1212 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the
1213 version field in the IPv6 packet header.
1214 Additional information on defined version numbers can be found at
1215 <xref type=
"registry" data=
"version-numbers"/>.
1218 <xref type=
"rfc" data=
"rfc5102"/>
1222 <name>flowDirection
</name>
1223 <dataType>unsigned8
</dataType>
1225 <dataTypeSemantics>identifier
</dataTypeSemantics>
1226 <elementId>61</elementId>
1227 <applicability>data
</applicability>
1228 <status>current
</status>
1231 The direction of the Flow observed at the Observation
1232 Point. There are only two values defined.
1239 <xref type=
"rfc" data=
"rfc5102"/>
1243 <name>ipNextHopIPv6Address
</name>
1244 <dataType>ipv6Address
</dataType>
1245 <group>derived
</group>
1246 <dataTypeSemantics>identifier
</dataTypeSemantics>
1247 <elementId>62</elementId>
1248 <applicability>data
</applicability>
1249 <status>current
</status>
1252 The IPv6 address of the next IPv6 hop.
1255 <xref type=
"rfc" data=
"rfc5102"/>
1259 <name>bgpNextHopIPv6Address
</name>
1260 <dataType>ipv6Address
</dataType>
1261 <group>derived
</group>
1262 <dataTypeSemantics>identifier
</dataTypeSemantics>
1263 <elementId>63</elementId>
1264 <applicability>all
</applicability>
1265 <status>current
</status>
1268 The IPv6 address of the next (adjacent) BGP hop.
1273 See
<xref type=
"rfc" data=
"rfc4271"/> for a description of BGP-
4.
1276 <xref type=
"rfc" data=
"rfc5102"/>
1280 <name>ipv6ExtensionHeaders
</name>
1281 <dataType>unsigned32
</dataType>
1282 <group>minMax
</group>
1283 <dataTypeSemantics>flags
</dataTypeSemantics>
1284 <elementId>64</elementId>
1285 <applicability>all
</applicability>
1286 <status>current
</status>
1289 IPv6 extension headers observed in packets of this Flow.
1290 The information is encoded in a set of bit fields. For
1291 each IPv6 option header, there is a bit in this set.
1292 The bit is set to
1 if any observed packet of this Flow
1293 contains the corresponding IPv6 extension header.
1294 Otherwise, if no observed packet of this Flow contained
1295 the respective IPv6 extension header, the value of the
1296 corresponding bit is
0.
1300 +-----+-----+-----+-----+-----+-----+-----+-----+
1301 | DST | HOP | Res | UNK |FRA0 | RH |FRA1 | Res | ...
1302 +-----+-----+-----+-----+-----+-----+-----+-----+
1304 8 9 10 11 12 13 14 15
1305 +-----+-----+-----+-----+-----+-----+-----+-----+
1306 ... | Reserved | MOB | ESP | AH | PAY | ...
1307 +-----+-----+-----+-----+-----+-----+-----+-----+
1309 16 17 18 19 20 21 22 23
1310 +-----+-----+-----+-----+-----+-----+-----+-----+
1311 ... | Reserved | ...
1312 +-----+-----+-----+-----+-----+-----+-----+-----+
1313 24 25 26 27 28 29 30 31
1314 +-----+-----+-----+-----+-----+-----+-----+-----+
1316 +-----+-----+-----+-----+-----+-----+-----+-----+
1318 Bit IPv6 Option Description
1319 0, DST
60 Destination option header
1320 1, HOP
0 Hop-by-hop option header
1322 3, UNK Unknown Layer
4 header
1323 (compressed, encrypted, not supported)
1324 4, FRA0
44 Fragment header - first fragment
1325 5, RH
43 Routing header
1326 6, FRA1
44 Fragmentation header - not first fragment
1329 12, MOB
135 IPv6 mobility [RFC3775]
1330 13, ESP
50 Encrypted security payload
1331 14, AH
51 Authentication Header
1332 15, PAY
108 Payload compression header
1338 See
<xref type=
"rfc" data=
"rfc2460"/> for the general definition of
1339 IPv6 extension headers and for the specification of the hop-by-hop
1340 options header, the routing header, the fragment header, and the
1341 destination options header.
1342 See
<xref type=
"rfc" data=
"rfc4302"/> for the specification of the
1343 authentication header.
1344 See
<xref type=
"rfc" data=
"rfc4303"/> for the specification of the
1345 encapsulating security payload.
1347 The diagram provided in
<xref type=
"rfc" data=
"rfc5102"/> is incorrect.
1348 The diagram in this registry is taken from Errata
1738. See
<xref type=
"rfc-errata" data=
"1738"/>
1351 <xref type=
"rfc" data=
"rfc5102"/>
1355 <elementId>65-
69</elementId>
1357 <xref type=
"rfc" data=
"rfc5102"/>
1361 <name>mplsTopLabelStackSection
</name>
1362 <dataType>octetArray
</dataType>
1363 <group>subIpHeader
</group>
1364 <dataTypeSemantics>identifier
</dataTypeSemantics>
1365 <elementId>70</elementId>
1366 <applicability>all
</applicability>
1367 <status>current
</status>
1370 The Label, Exp, and S fields from the top MPLS label
1371 stack entry, i.e., from the last label that was pushed.
1374 The size of this Information Element is
3 octets.
1378 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
1379 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1381 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1383 Label: Label Value,
20 bits
1384 Exp: Experimental Use,
3 bits
1385 S: Bottom of Stack,
1 bit
1390 See
<xref type=
"rfc" data=
"rfc3032"/>.
1393 <xref type=
"rfc" data=
"rfc5102"/>
1397 <name>mplsLabelStackSection2
</name>
1398 <dataType>octetArray
</dataType>
1399 <group>subIpHeader
</group>
1400 <dataTypeSemantics>identifier
</dataTypeSemantics>
1401 <elementId>71</elementId>
1402 <applicability>all
</applicability>
1403 <status>current
</status>
1406 The Label, Exp, and S fields from the label stack entry that
1407 was pushed immediately before the label stack entry that would
1408 be reported by mplsTopLabelStackSection. See the definition of
1409 mplsTopLabelStackSection for further details.
1412 The size of this Information Element is
3 octets.
1417 See
<xref type=
"rfc" data=
"rfc3032"/>.
1420 <xref type=
"rfc" data=
"rfc5102"/>
1424 <name>mplsLabelStackSection3
</name>
1425 <dataType>octetArray
</dataType>
1426 <group>subIpHeader
</group>
1427 <dataTypeSemantics>identifier
</dataTypeSemantics>
1428 <elementId>72</elementId>
1429 <applicability>all
</applicability>
1430 <status>current
</status>
1433 The Label, Exp, and S fields from the label stack entry that
1434 was pushed immediately before the label stack entry that would
1435 be reported by mplsLabelStackSection2. See the definition of
1436 mplsTopLabelStackSection for further details.
1439 The size of this Information Element is
3 octets.
1444 See
<xref type=
"rfc" data=
"rfc3032"/>.
1447 <xref type=
"rfc" data=
"rfc5102"/>
1451 <name>mplsLabelStackSection4
</name>
1452 <dataType>octetArray
</dataType>
1453 <group>subIpHeader
</group>
1454 <dataTypeSemantics>identifier
</dataTypeSemantics>
1455 <elementId>73</elementId>
1456 <applicability>all
</applicability>
1457 <status>current
</status>
1460 The Label, Exp, and S fields from the label stack entry that
1461 was pushed immediately before the label stack entry that would
1462 be reported by mplsLabelStackSection3. See the definition of
1463 mplsTopLabelStackSection for further details.
1466 The size of this Information Element is
3 octets.
1471 See
<xref type=
"rfc" data=
"rfc3032"/>.
1474 <xref type=
"rfc" data=
"rfc5102"/>
1478 <name>mplsLabelStackSection5
</name>
1479 <dataType>octetArray
</dataType>
1480 <group>subIpHeader
</group>
1481 <dataTypeSemantics>identifier
</dataTypeSemantics>
1482 <elementId>74</elementId>
1483 <applicability>all
</applicability>
1484 <status>current
</status>
1487 The Label, Exp, and S fields from the label stack entry that
1488 was pushed immediately before the label stack entry that would
1489 be reported by mplsLabelStackSection4. See the definition of
1490 mplsTopLabelStackSection for further details.
1493 The size of this Information Element is
3 octets.
1498 See
<xref type=
"rfc" data=
"rfc3032"/>.
1501 <xref type=
"rfc" data=
"rfc5102"/>
1505 <name>mplsLabelStackSection6
</name>
1506 <dataType>octetArray
</dataType>
1507 <group>subIpHeader
</group>
1508 <dataTypeSemantics>identifier
</dataTypeSemantics>
1509 <elementId>75</elementId>
1510 <applicability>all
</applicability>
1511 <status>current
</status>
1514 The Label, Exp, and S fields from the label stack entry that
1515 was pushed immediately before the label stack entry that would
1516 be reported by mplsLabelStackSection5. See the definition of
1517 mplsTopLabelStackSection for further details.
1520 The size of this Information Element is
3 octets.
1525 See
<xref type=
"rfc" data=
"rfc3032"/>.
1528 <xref type=
"rfc" data=
"rfc5102"/>
1532 <name>mplsLabelStackSection7
</name>
1533 <dataType>octetArray
</dataType>
1534 <group>subIpHeader
</group>
1535 <dataTypeSemantics>identifier
</dataTypeSemantics>
1536 <elementId>76</elementId>
1537 <applicability>all
</applicability>
1538 <status>current
</status>
1541 The Label, Exp, and S fields from the label stack entry that
1542 was pushed immediately before the label stack entry that would
1543 be reported by mplsLabelStackSection6. See the definition of
1544 mplsTopLabelStackSection for further details.
1547 The size of this Information Element is
3 octets.
1552 See
<xref type=
"rfc" data=
"rfc3032"/>.
1555 <xref type=
"rfc" data=
"rfc5102"/>
1559 <name>mplsLabelStackSection8
</name>
1560 <dataType>octetArray
</dataType>
1561 <group>subIpHeader
</group>
1562 <dataTypeSemantics>identifier
</dataTypeSemantics>
1563 <elementId>77</elementId>
1564 <applicability>all
</applicability>
1565 <status>current
</status>
1568 The Label, Exp, and S fields from the label stack entry that
1569 was pushed immediately before the label stack entry that would
1570 be reported by mplsLabelStackSection7. See the definition of
1571 mplsTopLabelStackSection for further details.
1574 The size of this Information Element is
3 octets.
1579 See
<xref type=
"rfc" data=
"rfc3032"/>.
1582 <xref type=
"rfc" data=
"rfc5102"/>
1586 <name>mplsLabelStackSection9
</name>
1587 <dataType>octetArray
</dataType>
1588 <group>subIpHeader
</group>
1589 <dataTypeSemantics>identifier
</dataTypeSemantics>
1590 <elementId>78</elementId>
1591 <applicability>all
</applicability>
1592 <status>current
</status>
1595 The Label, Exp, and S fields from the label stack entry that
1596 was pushed immediately before the label stack entry that would
1597 be reported by mplsLabelStackSection8. See the definition of
1598 mplsTopLabelStackSection for further details.
1601 The size of this Information Element is
3 octets.
1606 See
<xref type=
"rfc" data=
"rfc3032"/>.
1609 <xref type=
"rfc" data=
"rfc5102"/>
1613 <name>mplsLabelStackSection10
</name>
1614 <dataType>octetArray
</dataType>
1615 <group>subIpHeader
</group>
1616 <dataTypeSemantics>identifier
</dataTypeSemantics>
1617 <elementId>79</elementId>
1618 <applicability>all
</applicability>
1619 <status>current
</status>
1622 The Label, Exp, and S fields from the label stack entry that
1623 was pushed immediately before the label stack entry that would
1624 be reported by mplsLabelStackSection9. See the definition of
1625 mplsTopLabelStackSection for further details.
1628 The size of this Information Element is
3 octets.
1633 See
<xref type=
"rfc" data=
"rfc3032"/>.
1636 <xref type=
"rfc" data=
"rfc5102"/>
1640 <name>destinationMacAddress
</name>
1641 <dataType>macAddress
</dataType>
1642 <group>subIpHeader
</group>
1643 <dataTypeSemantics>identifier
</dataTypeSemantics>
1644 <elementId>80</elementId>
1645 <applicability>data
</applicability>
1646 <status>current
</status>
1649 The IEEE
802 destination MAC address field.
1654 See IEEE
.802-
3.2002.
1657 <xref type=
"rfc" data=
"rfc5102"/>
1661 <name>postSourceMacAddress
</name>
1662 <dataType>macAddress
</dataType>
1663 <group>subIpHeader
</group>
1664 <dataTypeSemantics>identifier
</dataTypeSemantics>
1665 <elementId>81</elementId>
1666 <applicability>data
</applicability>
1667 <status>current
</status>
1670 The definition of this Information Element is identical
1671 to the definition of Information Element
1672 'sourceMacAddress', except that it reports a
1673 potentially modified value caused by a middlebox
1674 function after the packet passed the Observation Point.
1679 See IEEE
.802-
3.2002.
1682 <xref type=
"rfc" data=
"rfc5102"/>
1686 <name>interfaceName
</name>
1687 <dataType>string
</dataType>
1688 <elementId>82</elementId>
1689 <status>current
</status>
1692 A short name uniquely describing an interface, eg
"Eth1/0".
1697 See
<xref type=
"rfc" data=
"rfc2863"/> for the definition of the ifName object.
1700 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
1704 <name>interfaceDescription
</name>
1705 <dataType>string
</dataType>
1706 <elementId>83</elementId>
1707 <status>current
</status>
1710 The description of an interface, eg
"FastEthernet 1/0" or
"ISP
1716 See
<xref type=
"rfc" data=
"rfc2863"/> for the definition of the ifDescr object.
1719 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
1723 <elementId>84</elementId>
1725 <xref type=
"rfc" data=
"rfc5102"/>
1729 <name>octetTotalCount
</name>
1730 <dataType>unsigned64
</dataType>
1731 <group>flowCounter
</group>
1732 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
1733 <elementId>85</elementId>
1734 <applicability>all
</applicability>
1735 <status>current
</status>
1738 The total number of octets in incoming packets
1739 for this Flow at the Observation Point since the Metering
1740 Process (re-)initialization for this Observation Point. The
1741 number of octets includes IP header(s) and IP payload.
1744 <units>octets
</units>
1745 <xref type=
"rfc" data=
"rfc5102"/>
1749 <name>packetTotalCount
</name>
1750 <dataType>unsigned64
</dataType>
1751 <group>flowCounter
</group>
1752 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
1753 <elementId>86</elementId>
1754 <applicability>all
</applicability>
1755 <status>current
</status>
1758 The total number of incoming packets for this Flow
1759 at the Observation Point since the Metering Process
1760 (re-)initialization for this Observation Point.
1763 <units>packets
</units>
1764 <xref type=
"rfc" data=
"rfc5102"/>
1768 <elementId>87</elementId>
1770 <xref type=
"rfc" data=
"rfc5102"/>
1774 <name>fragmentOffset
</name>
1775 <dataType>unsigned16
</dataType>
1776 <group>ipHeader
</group>
1777 <dataTypeSemantics>identifier
</dataTypeSemantics>
1778 <elementId>88</elementId>
1779 <applicability>all
</applicability>
1780 <status>current
</status>
1783 The value of the IP fragment offset field in the
1784 IPv4 packet header or the IPv6 Fragment header,
1785 respectively. The value is
0 for IPv6 if there is
1791 See
<xref type=
"rfc" data=
"rfc791"/> for the specification of the
1792 fragment offset in the IPv4 header.
1793 See
<xref type=
"rfc" data=
"rfc2460"/> for the specification of the
1794 fragment offset in the IPv6 Fragment header.
1797 <xref type=
"rfc" data=
"rfc5102"/>
1801 <elementId>89</elementId>
1806 <name>mplsVpnRouteDistinguisher
</name>
1807 <dataType>octetArray
</dataType>
1808 <group>derived
</group>
1809 <dataTypeSemantics>identifier
</dataTypeSemantics>
1810 <elementId>90</elementId>
1811 <applicability>all
</applicability>
1812 <status>current
</status>
1815 The value of the VPN route distinguisher of a corresponding
1816 entry in a VPN routing and forwarding table. Route
1817 distinguisher ensures that the same address can be used in
1818 several different MPLS VPNs and that it is possible for BGP to
1819 carry several completely different routes to that address, one
1820 for each VPN. According to RFC
4364, the size of
1821 mplsVpnRouteDistinguisher is
8 octets. However, in RFC
4382 an
1822 octet string with flexible length was chosen for representing a
1823 VPN route distinguisher by object MplsL3VpnRouteDistinguisher.
1824 This choice was made in order to be open to future changes of
1825 the size. This idea was adopted when choosing octetArray as
1826 abstract data type for this Information Element. The maximum
1827 length of this Information Element is
256 octets.
1832 See
<xref type=
"rfc" data=
"rfc4364"/> for the specification of the
1833 route distinguisher. See
<xref type=
"rfc" data=
"rfc4382"/> for the
1834 specification of the MPLS/BGP Layer
3 Virtual Private Network (VPN)
1835 Management Information Base.
1838 <xref type=
"rfc" data=
"rfc5102"/>
1842 <name>mplsTopLabelPrefixLength
</name>
1843 <dataType>unsigned8
</dataType>
1844 <dataTypeSemantics>identifier
</dataTypeSemantics>
1845 <elementId>91</elementId>
1846 <status>current
</status>
1849 The prefix length of the subnet of the mplsTopLabelIPv4Address that
1850 the MPLS top label will cause the Flow to be forwarded to.
1857 See
<xref type=
"rfc" data=
"rfc3031"/> for the association between
1858 MPLS labels and prefix lengths.
1861 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
1864 <elementId>92-
93</elementId>
1866 <xref type=
"rfc" data=
"rfc5102"/>
1870 <name>applicationDescription
</name>
1871 <dataType>string
</dataType>
1872 <elementId>94</elementId>
1873 <status>current
</status>
1876 Specifies the description of an application.
1883 <xref type=
"rfc" data=
"rfc6759"/>
1887 <name>applicationId
</name>
1888 <dataType>octetArray
</dataType>
1889 <dataTypeSemantics>identifier
</dataTypeSemantics>
1890 <elementId>95</elementId>
1891 <status>current
</status>
1894 Specifies an Application ID per
<xref type=
"rfc" data=
"rfc6759"/>.
1899 See section
4 of
<xref type=
"rfc" data=
"rfc6759"/> for the applicationId Information Element Specification.
1902 <xref type=
"rfc" data=
"rfc6759"/>
1906 <name>applicationName
</name>
1907 <dataType>string
</dataType>
1908 <elementId>96</elementId>
1909 <status>current
</status>
1912 Specifies the name of an application.
1919 <xref type=
"rfc" data=
"rfc6759"/>
1923 <elementId>97</elementId>
1925 <xref type=
"rfc" data=
"rfc5102"/>
1929 <name>postIpDiffServCodePoint
</name>
1930 <dataType>unsigned8
</dataType>
1931 <dataTypeSemantics>identifier
</dataTypeSemantics>
1932 <elementId>98</elementId>
1933 <status>current
</status>
1936 The definition of this Information Element is identical to the
1937 definition of Information Element 'ipDiffServCodePoint', except
1938 that it reports a potentially modified value caused by a
1939 middlebox function after the packet passed the Observation
1946 See
<xref type=
"rfc" data=
"rfc3260"/> for the definition of the Differentiated
1947 Services Field. See section
5.3.2 of
<xref type=
"rfc" data=
"rfc1812"/> and
1948 <xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4 TOS field. See
1949 <xref type=
"rfc" data=
"rfc2460"/> for the definition of the IPv6 Traffic Class
1950 field. See the IPFIX Information Model
<xref type=
"rfc" data=
"rfc5102"/> for the
1951 'ipDiffServCodePoint' specification.
1954 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
1958 <name>multicastReplicationFactor
</name>
1959 <dataType>unsigned32
</dataType>
1960 <dataTypeSemantics>quantity
</dataTypeSemantics>
1961 <elementId>99</elementId>
1962 <status>current
</status>
1965 The amount of multicast replication that's applied to a traffic
1971 See
<xref type=
"rfc" data=
"rfc1112"/> for the specification of reserved IPv4
1972 multicast addresses. See
<xref type=
"rfc" data=
"rfc4291"/> for the
1973 specification of reserved IPv6 multicast addresses.
1976 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
1980 <elementId>100</elementId>
1982 <xref type=
"rfc" data=
"rfc5102"/>
1986 <name>classificationEngineId
</name>
1987 <dataType>unsigned8
</dataType>
1988 <dataTypeSemantics>identifier
</dataTypeSemantics>
1989 <elementId>101</elementId>
1990 <status>current
</status>
1993 A unique identifier for the engine that determined the
1994 Selector ID. Thus, the Classification Engine ID defines
1995 the context for the Selector ID. The Classification
1996 Engine can be considered a specific registry for
1997 application assignments.
2000 Values for this field are listed in the Classification
2001 Engine IDs registry. See
2002 <xref type=
"uri" data=
"http://www.iana.org/assignments/ipfix/ipfix.xml#classification-engine-ids"/>
2005 <xref type=
"rfc" data=
"rfc6759"/>
2009 <elementId>102-
127</elementId>
2011 <xref type=
"rfc" data=
"rfc5102"/>
2015 <name>bgpNextAdjacentAsNumber
</name>
2016 <dataType>unsigned32
</dataType>
2017 <group>derived
</group>
2018 <dataTypeSemantics>identifier
</dataTypeSemantics>
2019 <elementId>128</elementId>
2020 <applicability>all
</applicability>
2021 <status>current
</status>
2024 The autonomous system (AS) number of the first AS in the AS
2025 path to the destination IP address. The path is deduced
2026 by looking up the destination IP address of the Flow in the
2027 BGP routing information base. If AS path information for
2028 this Flow is only available as an unordered AS set (and not
2029 as an ordered AS sequence), then the value of this Information
2035 See
<xref type=
"rfc" data=
"rfc4271"/> for a description of BGP-
4, and
2036 see
<xref type=
"rfc" data=
"rfc1930"/> for the definition of the AS
2040 <xref type=
"rfc" data=
"rfc5102"/>
2044 <name>bgpPrevAdjacentAsNumber
</name>
2045 <dataType>unsigned32
</dataType>
2046 <group>derived
</group>
2047 <dataTypeSemantics>identifier
</dataTypeSemantics>
2048 <elementId>129</elementId>
2049 <applicability>all
</applicability>
2050 <status>current
</status>
2053 The autonomous system (AS) number of the last AS in the AS
2054 path from the source IP address. The path is deduced
2055 by looking up the source IP address of the Flow in the BGP
2056 routing information base. If AS path information for this
2057 Flow is only available as an unordered AS set (and not as
2058 an ordered AS sequence), then the value of this Information
2059 Element is
0. In case of BGP asymmetry, the
2060 bgpPrevAdjacentAsNumber might not be able to report the correct
2066 See
<xref type=
"rfc" data=
"rfc4271"/> for a description of BGP-
4, and
2067 see
<xref type=
"rfc" data=
"rfc1930"/> for the definition of the AS
2071 <xref type=
"rfc" data=
"rfc5102"/>
2075 <name>exporterIPv4Address
</name>
2076 <dataType>ipv4Address
</dataType>
2077 <group>config
</group>
2078 <dataTypeSemantics>identifier
</dataTypeSemantics>
2079 <elementId>130</elementId>
2080 <applicability>all
</applicability>
2081 <status>current
</status>
2084 The IPv4 address used by the Exporting Process. This is used
2085 by the Collector to identify the Exporter in cases where the
2086 identity of the Exporter may have been obscured by the use of
2090 <xref type=
"rfc" data=
"rfc5102"/>
2094 <name>exporterIPv6Address
</name>
2095 <dataType>ipv6Address
</dataType>
2096 <group>config
</group>
2097 <dataTypeSemantics>identifier
</dataTypeSemantics>
2098 <elementId>131</elementId>
2099 <applicability>all
</applicability>
2100 <status>current
</status>
2103 The IPv6 address used by the Exporting Process. This is used
2104 by the Collector to identify the Exporter in cases where the
2105 identity of the Exporter may have been obscured by the use of
2109 <xref type=
"rfc" data=
"rfc5102"/>
2113 <name>droppedOctetDeltaCount
</name>
2114 <dataType>unsigned64
</dataType>
2115 <group>flowCounter
</group>
2116 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
2117 <elementId>132</elementId>
2118 <applicability>data
</applicability>
2119 <status>current
</status>
2122 The number of octets since the previous report (if any)
2123 in packets of this Flow dropped by packet treatment.
2124 The number of octets includes IP header(s) and IP payload.
2127 <units>octets
</units>
2128 <xref type=
"rfc" data=
"rfc5102"/>
2132 <name>droppedPacketDeltaCount
</name>
2133 <dataType>unsigned64
</dataType>
2134 <group>flowCounter
</group>
2135 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
2136 <elementId>133</elementId>
2137 <applicability>data
</applicability>
2138 <status>current
</status>
2141 The number of packets since the previous report (if any)
2142 of this Flow dropped by packet treatment.
2145 <units>packets
</units>
2146 <xref type=
"rfc" data=
"rfc5102"/>
2150 <name>droppedOctetTotalCount
</name>
2151 <dataType>unsigned64
</dataType>
2152 <group>flowCounter
</group>
2153 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
2154 <elementId>134</elementId>
2155 <applicability>data
</applicability>
2156 <status>current
</status>
2159 The total number of octets in packets of this Flow dropped
2160 by packet treatment since the Metering Process
2161 (re-)initialization for this Observation Point.
2162 The number of octets includes IP header(s) and IP payload.
2165 <units>octets
</units>
2166 <xref type=
"rfc" data=
"rfc5102"/>
2170 <name>droppedPacketTotalCount
</name>
2171 <dataType>unsigned64
</dataType>
2172 <group>flowCounter
</group>
2173 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
2174 <elementId>135</elementId>
2175 <applicability>data
</applicability>
2176 <status>current
</status>
2179 The number of packets of this Flow dropped by packet
2180 treatment since the Metering Process
2181 (re-)initialization for this Observation Point.
2184 <units>packets
</units>
2185 <xref type=
"rfc" data=
"rfc5102"/>
2189 <name>flowEndReason
</name>
2190 <dataType>unsigned8
</dataType>
2192 <dataTypeSemantics>identifier
</dataTypeSemantics>
2193 <elementId>136</elementId>
2194 <applicability>data
</applicability>
2195 <status>current
</status>
2198 The reason for Flow termination. The range of values includes
2203 The Flow was terminated because it was considered to be
2205 0x02: active timeout
2206 The Flow was terminated for reporting purposes while it was
2207 still active, for example, after the maximum lifetime of
2208 unreported Flows was reached.
2209 0x03: end of Flow detected
2210 The Flow was terminated because the Metering Process
2211 detected signals indicating the end of the Flow,
2212 for example, the TCP FIN flag.
2214 The Flow was terminated because of some external event,
2215 for example, a shutdown of the Metering Process initiated
2216 by a network management application.
2217 0x05: lack of resources
2218 The Flow was terminated because of lack of resources
2219 available to the Metering Process and/or the Exporting
2223 <xref type=
"rfc" data=
"rfc5102"/>
2227 <name>commonPropertiesId
</name>
2228 <dataType>unsigned64
</dataType>
2229 <group>scope
</group>
2230 <dataTypeSemantics>identifier
</dataTypeSemantics>
2231 <elementId>137</elementId>
2232 <applicability>option
</applicability>
2233 <status>current
</status>
2236 An identifier of a set of common properties that is
2237 unique per Observation Domain and Transport Session.
2238 Typically, this Information Element is used to link to
2239 information reported in separate Data Records.
2242 <xref type=
"rfc" data=
"rfc5102"/>
2246 <name>observationPointId
</name>
2247 <dataType>unsigned32
</dataType>
2248 <group>scope
</group>
2249 <dataTypeSemantics>identifier
</dataTypeSemantics>
2250 <elementId>138</elementId>
2251 <applicability>option
</applicability>
2252 <status>current
</status>
2255 An identifier of an Observation Point that is unique per
2256 Observation Domain. It is RECOMMENDED that this identifier is
2257 also unique per IPFIX Device. Typically, this Information
2258 Element is used for limiting the scope of other Information
2262 <xref type=
"rfc" data=
"rfc5102"/>
2266 <name>icmpTypeCodeIPv6
</name>
2267 <dataType>unsigned16
</dataType>
2268 <group>transportHeader
</group>
2269 <dataTypeSemantics>identifier
</dataTypeSemantics>
2270 <elementId>139</elementId>
2271 <applicability>all
</applicability>
2272 <status>current
</status>
2275 Type and Code of the IPv6 ICMP message. The combination of
2276 both values is reported as (ICMP type *
256) + ICMP code.
2281 See
<xref type=
"rfc" data=
"rfc4443"/> for the definition of the IPv6
2282 ICMP type and code fields.
2285 <xref type=
"rfc" data=
"rfc5102"/>
2289 <name>mplsTopLabelIPv6Address
</name>
2290 <dataType>ipv6Address
</dataType>
2291 <group>derived
</group>
2292 <dataTypeSemantics>identifier
</dataTypeSemantics>
2293 <elementId>140</elementId>
2294 <applicability>data
</applicability>
2295 <status>current
</status>
2298 The IPv6 address of the system that the MPLS top label will
2299 cause this Flow to be forwarded to.
2304 See
<xref type=
"rfc" data=
"rfc3031"/> for the association between MPLS
2305 labels and IP addresses.
2308 <xref type=
"rfc" data=
"rfc5102"/>
2312 <name>lineCardId
</name>
2313 <dataType>unsigned32
</dataType>
2314 <group>scope
</group>
2315 <dataTypeSemantics>identifier
</dataTypeSemantics>
2316 <elementId>141</elementId>
2317 <applicability>option
</applicability>
2318 <status>current
</status>
2321 An identifier of a line card that is unique per IPFIX
2322 Device hosting an Observation Point. Typically, this
2323 Information Element is used for limiting the scope
2324 of other Information Elements.
2327 <xref type=
"rfc" data=
"rfc5102"/>
2332 <dataType>unsigned32
</dataType>
2333 <group>scope
</group>
2334 <dataTypeSemantics>identifier
</dataTypeSemantics>
2335 <elementId>142</elementId>
2336 <applicability>option
</applicability>
2337 <status>current
</status>
2340 An identifier of a line port that is unique per IPFIX
2341 Device hosting an Observation Point. Typically, this
2342 Information Element is used for limiting the scope
2343 of other Information Elements.
2346 <xref type=
"rfc" data=
"rfc5102"/>
2350 <name>meteringProcessId
</name>
2351 <dataType>unsigned32
</dataType>
2352 <group>scope
</group>
2353 <dataTypeSemantics>identifier
</dataTypeSemantics>
2354 <elementId>143</elementId>
2355 <applicability>option
</applicability>
2356 <status>current
</status>
2359 An identifier of a Metering Process that is unique per
2360 IPFIX Device. Typically, this Information Element is used
2361 for limiting the scope of other Information Elements.
2362 Note that process identifiers are typically assigned
2364 The Metering Process may be re-started with a different ID.
2367 <xref type=
"rfc" data=
"rfc5102"/>
2371 <name>exportingProcessId
</name>
2372 <dataType>unsigned32
</dataType>
2373 <group>scope
</group>
2374 <dataTypeSemantics>identifier
</dataTypeSemantics>
2375 <elementId>144</elementId>
2376 <applicability>option
</applicability>
2377 <status>current
</status>
2380 An identifier of an Exporting Process that is unique per
2381 IPFIX Device. Typically, this Information Element is used
2382 for limiting the scope of other Information Elements.
2383 Note that process identifiers are typically assigned
2384 dynamically. The Exporting Process may be re-started
2385 with a different ID.
2388 <xref type=
"rfc" data=
"rfc5102"/>
2392 <name>templateId
</name>
2393 <dataType>unsigned16
</dataType>
2394 <group>scope
</group>
2395 <dataTypeSemantics>identifier
</dataTypeSemantics>
2396 <elementId>145</elementId>
2397 <applicability>option
</applicability>
2398 <status>current
</status>
2401 An identifier of a Template that is locally unique within a
2402 combination of a Transport session and an Observation Domain.
2405 Template IDs
0-
255 are reserved for Template Sets, Options
2406 Template Sets, and other reserved Sets yet to be created.
2407 Template IDs of Data Sets are numbered from
256 to
65535.
2410 Typically, this Information Element is used for limiting
2411 the scope of other Information Elements.
2412 Note that after a re-start of the Exporting Process Template
2413 identifiers may be re-assigned.
2416 <xref type=
"rfc" data=
"rfc5102"/>
2420 <name>wlanChannelId
</name>
2421 <dataType>unsigned8
</dataType>
2422 <group>subIpHeader
</group>
2423 <dataTypeSemantics>identifier
</dataTypeSemantics>
2424 <elementId>146</elementId>
2425 <applicability>data
</applicability>
2426 <status>current
</status>
2429 The identifier of the
802.11 (Wi-Fi) channel used.
2434 See IEEE
.802-
11.1999.
2437 <xref type=
"rfc" data=
"rfc5102"/>
2441 <name>wlanSSID
</name>
2442 <dataType>string
</dataType>
2443 <group>subIpHeader
</group>
2444 <elementId>147</elementId>
2445 <applicability>data
</applicability>
2446 <status>current
</status>
2449 The Service Set IDentifier (SSID) identifying an
802.11
2450 (Wi-Fi) network used. According to IEEE
.802-
11.1999, the
2451 SSID is encoded into a string of up to
32 characters.
2456 See IEEE
.802-
11.1999.
2459 <xref type=
"rfc" data=
"rfc5102"/>
2464 <dataType>unsigned64
</dataType>
2465 <group>scope
</group>
2466 <dataTypeSemantics>identifier
</dataTypeSemantics>
2467 <elementId>148</elementId>
2468 <applicability>option
</applicability>
2469 <status>current
</status>
2472 An identifier of a Flow that is unique within an Observation
2473 Domain. This Information Element can be used to distinguish
2474 between different Flows if Flow Keys such as IP addresses and
2475 port numbers are not reported or are reported in separate
2479 <xref type=
"rfc" data=
"rfc5102"/>
2483 <name>observationDomainId
</name>
2484 <dataType>unsigned32
</dataType>
2485 <group>scope
</group>
2486 <dataTypeSemantics>identifier
</dataTypeSemantics>
2487 <elementId>149</elementId>
2488 <applicability>option
</applicability>
2489 <status>current
</status>
2492 An identifier of an Observation Domain that is locally
2493 unique to an Exporting Process. The Exporting Process uses
2494 the Observation Domain ID to uniquely identify to the
2495 Collecting Process the Observation Domain where Flows
2496 were metered. It is RECOMMENDED that this identifier is
2497 also unique per IPFIX Device.
2500 A value of
0 indicates that no specific Observation Domain
2501 is identified by this Information Element.
2504 Typically, this Information Element is used for limiting
2505 the scope of other Information Elements.
2508 <xref type=
"rfc" data=
"rfc5102"/>
2512 <name>flowStartSeconds
</name>
2513 <dataType>dateTimeSeconds
</dataType>
2514 <group>timestamp
</group>
2515 <elementId>150</elementId>
2516 <applicability>data
</applicability>
2517 <status>current
</status>
2520 The absolute timestamp of the first packet of this Flow.
2523 <units>seconds
</units>
2524 <xref type=
"rfc" data=
"rfc5102"/>
2528 <name>flowEndSeconds
</name>
2529 <dataType>dateTimeSeconds
</dataType>
2530 <group>timestamp
</group>
2531 <elementId>151</elementId>
2532 <applicability>data
</applicability>
2533 <status>current
</status>
2536 The absolute timestamp of the last packet of this Flow.
2539 <units>seconds
</units>
2540 <xref type=
"rfc" data=
"rfc5102"/>
2544 <name>flowStartMilliseconds
</name>
2545 <dataType>dateTimeMilliseconds
</dataType>
2546 <group>timestamp
</group>
2547 <elementId>152</elementId>
2548 <applicability>data
</applicability>
2549 <status>current
</status>
2552 The absolute timestamp of the first packet of this Flow.
2555 <units>milliseconds
</units>
2556 <xref type=
"rfc" data=
"rfc5102"/>
2560 <name>flowEndMilliseconds
</name>
2561 <dataType>dateTimeMilliseconds
</dataType>
2562 <group>timestamp
</group>
2563 <elementId>153</elementId>
2564 <applicability>data
</applicability>
2565 <status>current
</status>
2568 The absolute timestamp of the last packet of this Flow.
2571 <units>milliseconds
</units>
2572 <xref type=
"rfc" data=
"rfc5102"/>
2576 <name>flowStartMicroseconds
</name>
2577 <dataType>dateTimeMicroseconds
</dataType>
2578 <group>timestamp
</group>
2579 <elementId>154</elementId>
2580 <applicability>data
</applicability>
2581 <status>current
</status>
2584 The absolute timestamp of the first packet of this Flow.
2587 <units>microseconds
</units>
2588 <xref type=
"rfc" data=
"rfc5102"/>
2592 <name>flowEndMicroseconds
</name>
2593 <dataType>dateTimeMicroseconds
</dataType>
2594 <group>timestamp
</group>
2595 <elementId>155</elementId>
2596 <applicability>data
</applicability>
2597 <status>current
</status>
2600 The absolute timestamp of the last packet of this Flow.
2603 <units>microseconds
</units>
2604 <xref type=
"rfc" data=
"rfc5102"/>
2608 <name>flowStartNanoseconds
</name>
2609 <dataType>dateTimeNanoseconds
</dataType>
2610 <group>timestamp
</group>
2611 <elementId>156</elementId>
2612 <applicability>data
</applicability>
2613 <status>current
</status>
2616 The absolute timestamp of the first packet of this Flow.
2619 <units>nanoseconds
</units>
2620 <xref type=
"rfc" data=
"rfc5102"/>
2624 <name>flowEndNanoseconds
</name>
2625 <dataType>dateTimeNanoseconds
</dataType>
2626 <group>timestamp
</group>
2627 <elementId>157</elementId>
2628 <applicability>data
</applicability>
2629 <status>current
</status>
2632 The absolute timestamp of the last packet of this Flow.
2635 <units>nanoseconds
</units>
2636 <xref type=
"rfc" data=
"rfc5102"/>
2640 <name>flowStartDeltaMicroseconds
</name>
2641 <dataType>unsigned32
</dataType>
2642 <group>timestamp
</group>
2643 <elementId>158</elementId>
2644 <applicability>data
</applicability>
2645 <status>current
</status>
2648 This is a relative timestamp only valid within the scope
2649 of a single IPFIX Message. It contains the negative time
2650 offset of the first observed packet of this Flow relative
2651 to the export time specified in the IPFIX Message Header.
2654 <units>microseconds
</units>
2657 See the
<xref type=
"rfc" data=
"rfc5101">IPFIX protocol
2658 specification
</xref> for the definition of the IPFIX Message Header.
2661 <xref type=
"rfc" data=
"rfc5102"/>
2665 <name>flowEndDeltaMicroseconds
</name>
2666 <dataType>unsigned32
</dataType>
2667 <group>timestamp
</group>
2668 <elementId>159</elementId>
2669 <applicability>data
</applicability>
2670 <status>current
</status>
2673 This is a relative timestamp only valid within the scope
2674 of a single IPFIX Message. It contains the negative time
2675 offset of the last observed packet of this Flow relative
2676 to the export time specified in the IPFIX Message Header.
2679 <units>microseconds
</units>
2682 See the
<xref type=
"rfc" data=
"rfc5101">IPFIX protocol
2683 specification
</xref> for the definition of the IPFIX Message Header.
2686 <xref type=
"rfc" data=
"rfc5102"/>
2690 <name>systemInitTimeMilliseconds
</name>
2691 <dataType>dateTimeMilliseconds
</dataType>
2692 <group>timestamp
</group>
2693 <elementId>160</elementId>
2694 <applicability>data
</applicability>
2695 <status>current
</status>
2698 The absolute timestamp of the last (re-)initialization of the
2702 <units>milliseconds
</units>
2703 <xref type=
"rfc" data=
"rfc5102"/>
2707 <name>flowDurationMilliseconds
</name>
2708 <dataType>unsigned32
</dataType>
2710 <elementId>161</elementId>
2711 <applicability>data
</applicability>
2712 <status>current
</status>
2715 The difference in time between the first observed packet
2716 of this Flow and the last observed packet of this Flow.
2719 <units>milliseconds
</units>
2720 <xref type=
"rfc" data=
"rfc5102"/>
2724 <name>flowDurationMicroseconds
</name>
2725 <dataType>unsigned32
</dataType>
2727 <elementId>162</elementId>
2728 <applicability>data
</applicability>
2729 <status>current
</status>
2732 The difference in time between the first observed packet
2733 of this Flow and the last observed packet of this Flow.
2736 <units>microseconds
</units>
2737 <xref type=
"rfc" data=
"rfc5102"/>
2741 <name>observedFlowTotalCount
</name>
2742 <dataType>unsigned64
</dataType>
2743 <group>processCounter
</group>
2744 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
2745 <elementId>163</elementId>
2746 <applicability>data
</applicability>
2747 <status>current
</status>
2750 The total number of Flows observed in the Observation Domain
2751 since the Metering Process (re-)initialization for this
2755 <units>flows
</units>
2756 <xref type=
"rfc" data=
"rfc5102"/>
2760 <name>ignoredPacketTotalCount
</name>
2761 <dataType>unsigned64
</dataType>
2762 <group>processCounter
</group>
2763 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
2764 <elementId>164</elementId>
2765 <applicability>data
</applicability>
2766 <status>current
</status>
2769 The total number of observed IP packets that the
2770 Metering Process did not process since the
2771 (re-)initialization of the Metering Process.
2774 <units>packets
</units>
2775 <xref type=
"rfc" data=
"rfc5102"/>
2779 <name>ignoredOctetTotalCount
</name>
2780 <dataType>unsigned64
</dataType>
2781 <group>processCounter
</group>
2782 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
2783 <elementId>165</elementId>
2784 <applicability>data
</applicability>
2785 <status>current
</status>
2788 The total number of octets in observed IP packets
2789 (including the IP header) that the Metering Process
2790 did not process since the (re-)initialization of the
2794 <units>octets
</units>
2795 <xref type=
"rfc" data=
"rfc5102"/>
2799 <name>notSentFlowTotalCount
</name>
2800 <dataType>unsigned64
</dataType>
2801 <group>processCounter
</group>
2802 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
2803 <elementId>166</elementId>
2804 <applicability>data
</applicability>
2805 <status>current
</status>
2808 The total number of Flow Records that were generated by the
2809 Metering Process and dropped by the Metering Process or
2810 by the Exporting Process instead of being sent to the
2811 Collecting Process. There are several potential reasons for
2812 this including resource shortage and special Flow export
2816 <units>flows
</units>
2817 <xref type=
"rfc" data=
"rfc5102"/>
2821 <name>notSentPacketTotalCount
</name>
2822 <dataType>unsigned64
</dataType>
2823 <group>processCounter
</group>
2824 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
2825 <elementId>167</elementId>
2826 <applicability>data
</applicability>
2827 <status>current
</status>
2830 The total number of packets in Flow Records that were
2831 generated by the Metering Process and dropped
2832 by the Metering Process or by the Exporting Process
2833 instead of being sent to the Collecting Process.
2834 There are several potential reasons for this including
2835 resource shortage and special Flow export policies.
2838 <units>packets
</units>
2839 <xref type=
"rfc" data=
"rfc5102"/>
2843 <name>notSentOctetTotalCount
</name>
2844 <dataType>unsigned64
</dataType>
2845 <group>processCounter
</group>
2846 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
2847 <elementId>168</elementId>
2848 <applicability>data
</applicability>
2849 <status>current
</status>
2852 The total number of octets in packets in Flow Records
2853 that were generated by the Metering Process and
2854 dropped by the Metering Process or by the Exporting
2855 Process instead of being sent to the Collecting Process.
2856 There are several potential reasons for this including
2857 resource shortage and special Flow export policies.
2860 <units>octets
</units>
2861 <xref type=
"rfc" data=
"rfc5102"/>
2865 <name>destinationIPv6Prefix
</name>
2866 <dataType>ipv6Address
</dataType>
2867 <group>ipHeader
</group>
2868 <elementId>169</elementId>
2869 <applicability>data
</applicability>
2870 <status>current
</status>
2872 <paragraph> IPv6 destination address prefix.
</paragraph>
2874 <xref type=
"rfc" data=
"rfc5102"/>
2878 <name>sourceIPv6Prefix
</name>
2879 <dataType>ipv6Address
</dataType>
2880 <group>ipHeader
</group>
2881 <elementId>170</elementId>
2882 <applicability>data
</applicability>
2883 <status>current
</status>
2886 IPv6 source address prefix.
2889 <xref type=
"rfc" data=
"rfc5102"/>
2893 <name>postOctetTotalCount
</name>
2894 <dataType>unsigned64
</dataType>
2895 <group>flowCounter
</group>
2896 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
2897 <elementId>171</elementId>
2898 <applicability>all
</applicability>
2899 <status>current
</status>
2902 The definition of this Information Element is identical
2903 to the definition of Information Element
2904 'octetTotalCount', except that it reports a
2905 potentially modified value caused by a middlebox
2906 function after the packet passed the Observation Point.
2909 <units>octets
</units>
2910 <xref type=
"rfc" data=
"rfc5102"/>
2914 <name>postPacketTotalCount
</name>
2915 <dataType>unsigned64
</dataType>
2916 <group>flowCounter
</group>
2917 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
2918 <elementId>172</elementId>
2919 <applicability>all
</applicability>
2920 <status>current
</status>
2923 The definition of this Information Element is identical
2924 to the definition of Information Element
2925 'packetTotalCount', except that it reports a
2926 potentially modified value caused by a middlebox
2927 function after the packet passed the Observation Point.
2930 <units>packets
</units>
2931 <xref type=
"rfc" data=
"rfc5102"/>
2935 <name>flowKeyIndicator
</name>
2936 <dataType>unsigned64
</dataType>
2937 <group>config
</group>
2938 <dataTypeSemantics>flags
</dataTypeSemantics>
2939 <elementId>173</elementId>
2940 <applicability>all
</applicability>
2941 <status>current
</status>
2944 This set of bit fields is used for marking the Information
2945 Elements of a Data Record that serve as Flow Key. Each bit
2946 represents an Information Element in the Data Record with
2947 the n-th bit representing the n-th Information Element.
2948 A bit set to value
1 indicates that the corresponding
2949 Information Element is a Flow Key of the reported Flow.
2950 A bit set to value
0 indicates that this is not the case.
2953 If the Data Record contains more than
64 Information Elements,
2954 the corresponding Template SHOULD be designed such that all
2955 Flow Keys are among the first
64 Information Elements, because
2956 the flowKeyIndicator only contains
64 bits. If the Data Record
2957 contains less than
64 Information Elements, then the bits in
2958 the flowKeyIndicator for which no corresponding Information
2959 Element exists MUST have the value
0.
2962 <xref type=
"rfc" data=
"rfc5102"/>
2966 <name>postMCastPacketTotalCount
</name>
2967 <dataType>unsigned64
</dataType>
2968 <group>flowCounter
</group>
2969 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
2970 <elementId>174</elementId>
2971 <applicability>data
</applicability>
2972 <status>current
</status>
2975 The total number of outgoing multicast packets sent for
2976 packets of this Flow by a multicast daemon within the
2977 Observation Domain since the Metering Process
2978 (re-)initialization. This property cannot necessarily
2979 be observed at the Observation Point, but may be retrieved
2983 <units>packets
</units>
2984 <xref type=
"rfc" data=
"rfc5102"/>
2988 <name>postMCastOctetTotalCount
</name>
2989 <dataType>unsigned64
</dataType>
2990 <group>flowCounter
</group>
2991 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
2992 <elementId>175</elementId>
2993 <applicability>data
</applicability>
2994 <status>current
</status>
2997 The total number of octets in outgoing multicast packets
2998 sent for packets of this Flow by a multicast daemon in the
2999 Observation Domain since the Metering Process
3000 (re-)initialization. This property cannot necessarily be
3001 observed at the Observation Point, but may be retrieved by
3003 The number of octets includes IP header(s) and IP payload.
3006 <units>octets
</units>
3007 <xref type=
"rfc" data=
"rfc5102"/>
3011 <name>icmpTypeIPv4
</name>
3012 <dataType>unsigned8
</dataType>
3013 <group>transportHeader
</group>
3014 <dataTypeSemantics>identifier
</dataTypeSemantics>
3015 <elementId>176</elementId>
3016 <applicability>all
</applicability>
3017 <status>current
</status>
3020 Type of the IPv4 ICMP message.
3025 See
<xref type=
"rfc" data=
"rfc792"/> for the definition of the IPv4
3029 <xref type=
"rfc" data=
"rfc5102"/>
3033 <name>icmpCodeIPv4
</name>
3034 <dataType>unsigned8
</dataType>
3035 <group>transportHeader
</group>
3036 <dataTypeSemantics>identifier
</dataTypeSemantics>
3037 <elementId>177</elementId>
3038 <applicability>all
</applicability>
3039 <status>current
</status>
3042 Code of the IPv4 ICMP message.
3047 See
<xref type=
"rfc" data=
"rfc792"/> for the definition of the IPv4
3051 <xref type=
"rfc" data=
"rfc5102"/>
3055 <name>icmpTypeIPv6
</name>
3056 <dataType>unsigned8
</dataType>
3057 <group>transportHeader
</group>
3058 <dataTypeSemantics>identifier
</dataTypeSemantics>
3059 <elementId>178</elementId>
3060 <applicability>all
</applicability>
3061 <status>current
</status>
3064 Type of the IPv6 ICMP message.
3069 See
<xref type=
"rfc" data=
"rfc4443"/> for the definition of the IPv6
3073 <xref type=
"rfc" data=
"rfc5102"/>
3077 <name>icmpCodeIPv6
</name>
3078 <dataType>unsigned8
</dataType>
3079 <group>transportHeader
</group>
3080 <dataTypeSemantics>identifier
</dataTypeSemantics>
3081 <elementId>179</elementId>
3082 <applicability>all
</applicability>
3083 <status>current
</status>
3086 Code of the IPv6 ICMP message.
3091 See
<xref type=
"rfc" data=
"rfc4443"/> for the definition of the IPv6
3095 <xref type=
"rfc" data=
"rfc5102"/>
3099 <name>udpSourcePort
</name>
3100 <dataType>unsigned16
</dataType>
3101 <group>transportHeader
</group>
3102 <dataTypeSemantics>identifier
</dataTypeSemantics>
3103 <elementId>180</elementId>
3104 <applicability>all
</applicability>
3105 <status>current
</status>
3108 The source port identifier in the UDP header.
3113 See
<xref type=
"rfc" data=
"rfc768"/> for the definition of the UDP
3115 Additional information on defined UDP port numbers can be found at
3116 <xref type=
"registry" data=
"port-numbers"/>.
3119 <xref type=
"rfc" data=
"rfc5102"/>
3123 <name>udpDestinationPort
</name>
3124 <dataType>unsigned16
</dataType>
3125 <group>transportHeader
</group>
3126 <dataTypeSemantics>identifier
</dataTypeSemantics>
3127 <elementId>181</elementId>
3128 <applicability>all
</applicability>
3129 <status>current
</status>
3132 The destination port identifier in the UDP header.
3137 See
<xref type=
"rfc" data=
"rfc768"/> for the definition of the UDP
3138 destination port field.
3139 Additional information on defined UDP port numbers can be found at
3140 <xref type=
"registry" data=
"port-numbers"/>.
3143 <xref type=
"rfc" data=
"rfc5102"/>
3147 <name>tcpSourcePort
</name>
3148 <dataType>unsigned16
</dataType>
3149 <group>transportHeader
</group>
3150 <dataTypeSemantics>identifier
</dataTypeSemantics>
3151 <elementId>182</elementId>
3152 <applicability>all
</applicability>
3153 <status>current
</status>
3156 The source port identifier in the TCP header.
3161 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
3163 Additional information on defined TCP port numbers can be found at
3164 <xref type=
"registry" data=
"port-numbers"/>.
3167 <xref type=
"rfc" data=
"rfc5102"/>
3171 <name>tcpDestinationPort
</name>
3172 <dataType>unsigned16
</dataType>
3173 <group>transportHeader
</group>
3174 <dataTypeSemantics>identifier
</dataTypeSemantics>
3175 <elementId>183</elementId>
3176 <applicability>all
</applicability>
3177 <status>current
</status>
3180 The destination port identifier in the TCP header.
3185 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
3186 destination port field.
3187 Additional information on defined TCP port numbers can be found at
3188 <xref type=
"registry" data=
"port-numbers"/>.
3191 <xref type=
"rfc" data=
"rfc5102"/>
3195 <name>tcpSequenceNumber
</name>
3196 <dataType>unsigned32
</dataType>
3197 <group>transportHeader
</group>
3198 <elementId>184</elementId>
3199 <applicability>all
</applicability>
3200 <status>current
</status>
3203 The sequence number in the TCP header.
3208 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
3212 <xref type=
"rfc" data=
"rfc5102"/>
3216 <name>tcpAcknowledgementNumber
</name>
3217 <dataType>unsigned32
</dataType>
3218 <group>transportHeader
</group>
3219 <elementId>185</elementId>
3220 <applicability>all
</applicability>
3221 <status>current
</status>
3224 The acknowledgement number in the TCP header.
3229 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
3230 acknowledgement number.
3233 <xref type=
"rfc" data=
"rfc5102"/>
3237 <name>tcpWindowSize
</name>
3238 <dataType>unsigned16
</dataType>
3239 <group>transportHeader
</group>
3240 <elementId>186</elementId>
3241 <applicability>all
</applicability>
3242 <status>current
</status>
3245 The window field in the TCP header.
3246 If the TCP window scale is supported,
3247 then TCP window scale must be known
3248 to fully interpret the value of this information.
3253 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
3255 See
<xref type=
"rfc" data=
"rfc1323"/> for the definition of the TCP
3259 <xref type=
"rfc" data=
"rfc5102"/>
3263 <name>tcpUrgentPointer
</name>
3264 <dataType>unsigned16
</dataType>
3265 <group>transportHeader
</group>
3266 <elementId>187</elementId>
3267 <applicability>all
</applicability>
3268 <status>current
</status>
3271 The urgent pointer in the TCP header.
3276 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
3280 <xref type=
"rfc" data=
"rfc5102"/>
3284 <name>tcpHeaderLength
</name>
3285 <dataType>unsigned8
</dataType>
3286 <group>transportHeader
</group>
3287 <elementId>188</elementId>
3288 <applicability>all
</applicability>
3289 <status>current
</status>
3292 The length of the TCP header. Note that the value of this
3293 Information Element is different from the value of the Data
3294 Offset field in the TCP header. The Data Offset field
3295 indicates the length of the TCP header in units of
4 octets.
3296 This Information Elements specifies the length of the TCP
3297 header in units of octets.
3300 <units>octets
</units>
3303 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
3307 <xref type=
"rfc" data=
"rfc5102"/>
3311 <name>ipHeaderLength
</name>
3312 <dataType>unsigned8
</dataType>
3313 <group>ipHeader
</group>
3314 <elementId>189</elementId>
3315 <applicability>all
</applicability>
3316 <status>current
</status>
3319 The length of the IP header. For IPv6, the value of this
3320 Information Element is
40.
3323 <units>octets
</units>
3326 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4
3328 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the IPv6
3332 <xref type=
"rfc" data=
"rfc5102"/>
3336 <name>totalLengthIPv4
</name>
3337 <dataType>unsigned16
</dataType>
3338 <group>ipHeader
</group>
3339 <elementId>190</elementId>
3340 <applicability>all
</applicability>
3341 <status>current
</status>
3344 The total length of the IPv4 packet.
3347 <units>octets
</units>
3350 See
<xref type=
"rfc" data=
"rfc791"/> for the specification of the IPv4
3354 <xref type=
"rfc" data=
"rfc5102"/>
3358 <name>payloadLengthIPv6
</name>
3359 <dataType>unsigned16
</dataType>
3360 <group>ipHeader
</group>
3361 <elementId>191</elementId>
3362 <applicability>all
</applicability>
3363 <status>current
</status>
3366 This Information Element reports the value of the Payload
3367 Length field in the IPv6 header. Note that IPv6 extension
3368 headers belong to the payload. Also note that in case of a
3369 jumbo payload option the value of the Payload Length field in
3370 the IPv6 header is zero and so will be the value reported
3371 by this Information Element.
3374 <units>octets
</units>
3377 See
<xref type=
"rfc" data=
"rfc2460"/> for the specification of the IPv6
3379 See
<xref type=
"rfc" data=
"rfc2675"/> for the specification of the IPv6
3380 jumbo payload option.
3383 <xref type=
"rfc" data=
"rfc5102"/>
3388 <dataType>unsigned8
</dataType>
3389 <group>ipHeader
</group>
3390 <elementId>192</elementId>
3391 <applicability>all
</applicability>
3392 <status>current
</status>
3395 For IPv4, the value of the Information Element matches
3396 the value of the Time to Live (TTL) field in the IPv4 packet
3397 header. For IPv6, the value of the Information Element
3398 matches the value of the Hop Limit field in the IPv6
3405 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4
3407 See
<xref type=
"rfc" data=
"rfc2675"/> for the definition of the IPv6
3411 <xref type=
"rfc" data=
"rfc5102"/>
3415 <name>nextHeaderIPv6
</name>
3416 <dataType>unsigned8
</dataType>
3417 <group>ipHeader
</group>
3418 <elementId>193</elementId>
3419 <applicability>all
</applicability>
3420 <status>current
</status>
3423 The value of the Next Header field of the IPv6 header.
3424 The value identifies the type of the following IPv6
3425 extension header or of the following IP payload.
3426 Valid values are defined in the IANA
3427 Protocol Numbers registry.
3432 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the IPv6
3434 See the list of protocol numbers assigned by IANA at
<xref type=
"registry" data=
"protocol-numbers"/>.
3437 <xref type=
"rfc" data=
"rfc5102"/>
3441 <name>mplsPayloadLength
</name>
3442 <dataType>unsigned32
</dataType>
3443 <group>subIpHeader
</group>
3444 <elementId>194</elementId>
3445 <applicability>all
</applicability>
3446 <status>current
</status>
3449 The size of the MPLS packet without the label stack.
3452 <units>octets
</units>
3455 See
<xref type=
"rfc" data=
"rfc3031"/> for the specification of MPLS
3457 See
<xref type=
"rfc" data=
"rfc3032"/> for the specification of the
3461 <xref type=
"rfc" data=
"rfc5102"/>
3465 <name>ipDiffServCodePoint
</name>
3466 <dataType>unsigned8
</dataType>
3467 <group>ipHeader
</group>
3468 <dataTypeSemantics>identifier
</dataTypeSemantics>
3469 <elementId>195</elementId>
3470 <applicability>all
</applicability>
3471 <status>current
</status>
3474 The value of a Differentiated Services Code Point (DSCP)
3475 encoded in the Differentiated Services field. The
3476 Differentiated Services field spans the most significant
3477 6 bits of the IPv4 TOS field or the IPv6 Traffic Class
3478 field, respectively.
3481 This Information Element encodes only the
6 bits of the
3482 Differentiated Services field. Therefore, its value may
3489 See
<xref type=
"rfc" data=
"rfc3260"/> for the definition of the
3490 Differentiated Services field.
3491 See
<xref type=
"rfc" data=
"rfc1812"/> (Section
5.3.2) and
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4 TOS field.
3492 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the IPv6
3493 Traffic Class field.
3496 <xref type=
"rfc" data=
"rfc5102"/>
3500 <name>ipPrecedence
</name>
3501 <dataType>unsigned8
</dataType>
3502 <group>ipHeader
</group>
3503 <dataTypeSemantics>identifier
</dataTypeSemantics>
3504 <elementId>196</elementId>
3505 <applicability>all
</applicability>
3506 <status>current
</status>
3509 The value of the IP Precedence. The IP Precedence value
3510 is encoded in the first
3 bits of the IPv4 TOS field
3511 or the IPv6 Traffic Class field, respectively.
3514 This Information Element encodes only these
3 bits.
3515 Therefore, its value may range from
0 to
7.
3521 See
<xref type=
"rfc" data=
"rfc1812"/> (Section
5.3.3) and
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IP Precedence.
3522 See
<xref type=
"rfc" data=
"rfc1812"/> (Section
5.3.2) and
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4 TOS field.
3523 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of the IPv6
3524 Traffic Class field.
3527 <xref type=
"rfc" data=
"rfc5102"/>
3531 <name>fragmentFlags
</name>
3532 <dataType>unsigned8
</dataType>
3533 <group>ipHeader
</group>
3534 <dataTypeSemantics>flags
</dataTypeSemantics>
3535 <elementId>197</elementId>
3536 <applicability>all
</applicability>
3537 <status>current
</status>
3540 Fragmentation properties indicated by flags in the IPv4
3541 packet header or the IPv6 Fragment header, respectively.
3545 Bit
0: (RS) Reserved.
3546 The value of this bit MUST be
0 until specified
3548 Bit
1: (DF)
0 = May Fragment,
1 = Don't Fragment.
3549 Corresponds to the value of the DF flag in the
3550 IPv4 header. Will always be
0 for IPv6 unless
3551 a
"don't fragment" feature is introduced to IPv6.
3552 Bit
2: (MF)
0 = Last Fragment,
1 = More Fragments.
3553 Corresponds to the MF flag in the IPv4 header
3554 or to the M flag in the IPv6 Fragment header,
3555 respectively. The value is
0 for IPv6 if there
3556 is no fragment header.
3557 Bits
3-
7: (DC) Don't Care.
3558 The values of these bits are irrelevant.
3561 +---+---+---+---+---+---+---+---+
3562 | R | D | M | D | D | D | D | D |
3563 | S | F | F | C | C | C | C | C |
3564 +---+---+---+---+---+---+---+---+
3569 See
<xref type=
"rfc" data=
"rfc791"/> for the specification of the IPv4
3571 See
<xref type=
"rfc" data=
"rfc2460"/> for the specification of the
3572 IPv6 Fragment header.
3575 <xref type=
"rfc" data=
"rfc5102"/>
3579 <name>octetDeltaSumOfSquares
</name>
3580 <dataType>unsigned64
</dataType>
3581 <group>flowCounter
</group>
3582 <elementId>198</elementId>
3583 <applicability>data
</applicability>
3584 <status>current
</status>
3587 The sum of the squared numbers of octets per incoming
3588 packet since the previous report (if any) for this
3589 Flow at the Observation Point.
3590 The number of octets includes IP header(s) and IP payload.
3593 <xref type=
"rfc" data=
"rfc5102"/>
3597 <name>octetTotalSumOfSquares
</name>
3598 <dataType>unsigned64
</dataType>
3599 <group>flowCounter
</group>
3600 <elementId>199</elementId>
3601 <applicability>all
</applicability>
3602 <status>current
</status>
3605 The total sum of the squared numbers of octets in incoming
3606 packets for this Flow at the Observation Point since the
3607 Metering Process (re-)initialization for this Observation
3608 Point. The number of octets includes IP header(s) and IP
3612 <units>octets
</units>
3613 <xref type=
"rfc" data=
"rfc5102"/>
3617 <name>mplsTopLabelTTL
</name>
3618 <dataType>unsigned8
</dataType>
3619 <group>subIpHeader
</group>
3620 <elementId>200</elementId>
3621 <applicability>all
</applicability>
3622 <status>current
</status>
3625 The TTL field from the top MPLS label stack entry,
3626 i.e., the last label that was pushed.
3632 See
<xref type=
"rfc" data=
"rfc3032"/> for the specification of the TTL
3636 <xref type=
"rfc" data=
"rfc5102"/>
3640 <name>mplsLabelStackLength
</name>
3641 <dataType>unsigned32
</dataType>
3642 <group>subIpHeader
</group>
3643 <elementId>201</elementId>
3644 <applicability>all
</applicability>
3645 <status>current
</status>
3648 The length of the MPLS label stack in units of octets.
3651 <units>octets
</units>
3654 See
<xref type=
"rfc" data=
"rfc3032"/> for the specification of the
3658 <xref type=
"rfc" data=
"rfc5102"/>
3662 <name>mplsLabelStackDepth
</name>
3663 <dataType>unsigned32
</dataType>
3664 <group>subIpHeader
</group>
3665 <elementId>202</elementId>
3666 <applicability>all
</applicability>
3667 <status>current
</status>
3670 The number of labels in the MPLS label stack.
3673 <units>label stack entries
</units>
3676 See
<xref type=
"rfc" data=
"rfc3032"/> for the specification of the
3680 <xref type=
"rfc" data=
"rfc5102"/>
3684 <name>mplsTopLabelExp
</name>
3685 <dataType>unsigned8
</dataType>
3686 <group>subIpHeader
</group>
3687 <dataTypeSemantics>flags
</dataTypeSemantics>
3688 <elementId>203</elementId>
3689 <applicability>all
</applicability>
3690 <status>current
</status>
3693 The Exp field from the top MPLS label stack entry,
3694 i.e., the last label that was pushed.
3697 Bits
0-
4: Don't Care, value is irrelevant.
3698 Bits
5-
7: MPLS Exp field.
3701 +---+---+---+---+---+---+---+---+
3702 | don't care | Exp |
3703 +---+---+---+---+---+---+---+---+
3708 See
<xref type=
"rfc" data=
"rfc3032"/> for the specification of the
3710 See
<xref type=
"rfc" data=
"rfc3270"/> for usage of the Exp field.
3713 <xref type=
"rfc" data=
"rfc5102"/>
3717 <name>ipPayloadLength
</name>
3718 <dataType>unsigned32
</dataType>
3719 <group>derived
</group>
3720 <elementId>204</elementId>
3721 <applicability>all
</applicability>
3722 <status>current
</status>
3725 The effective length of the IP payload.
3728 For IPv4 packets, the value of this Information Element is
3729 the difference between the total length of the IPv4 packet
3730 (as reported by Information Element totalLengthIPv4) and the
3731 length of the IPv4 header (as reported by Information Element
3735 For IPv6, the value of the Payload Length field
3736 in the IPv6 header is reported except in the case that
3737 the value of this field is zero and that there is a valid
3738 jumbo payload option. In this case, the value of the
3739 Jumbo Payload Length field in the jumbo payload option
3743 <units>octets
</units>
3746 See
<xref type=
"rfc" data=
"rfc791"/> for the specification of IPv4
3748 See
<xref type=
"rfc" data=
"rfc2460"/> for the specification of the
3749 IPv6 payload length.
3750 See
<xref type=
"rfc" data=
"rfc2675"/> for the specification of the
3751 IPv6 jumbo payload length.
3754 <xref type=
"rfc" data=
"rfc5102"/>
3758 <name>udpMessageLength
</name>
3759 <dataType>unsigned16
</dataType>
3760 <group>transportHeader
</group>
3761 <elementId>205</elementId>
3762 <applicability>all
</applicability>
3763 <status>current
</status>
3766 The value of the Length field in the UDP header.
3769 <units>octets
</units>
3772 See
<xref type=
"rfc" data=
"rfc768"/> for the specification of the UDP
3776 <xref type=
"rfc" data=
"rfc5102"/>
3780 <name>isMulticast
</name>
3781 <dataType>unsigned8
</dataType>
3782 <group>ipHeader
</group>
3783 <dataTypeSemantics>flags
</dataTypeSemantics>
3784 <elementId>206</elementId>
3785 <applicability>data
</applicability>
3786 <status>current
</status>
3789 If the IP destination address is not a reserved multicast
3790 address, then the value of all bits of the octet (including
3791 the reserved ones) is zero.
3794 The first bit of this octet is set to
1 if the Version
3795 field of the IP header has the value
4 and if the
3796 Destination Address field contains a reserved multicast
3797 address in the range from
224.0.0.0 to
239.255.255.255.
3798 Otherwise, this bit is set to
0.
3801 The second and third bits of this octet are reserved for
3805 The remaining bits of the octet are only set to values
3806 other than zero if the IP Destination Address is a
3807 reserved IPv6 multicast address. Then the fourth bit
3808 of the octet is set to the value of the T flag in the
3809 IPv6 multicast address and the remaining four bits are
3810 set to the value of the scope field in the IPv6
3815 +------+------+------+------+------+------+------+------+
3816 | IPv6 multicast scope | T | RES. | RES. | MCv4 |
3817 +------+------+------+------+------+------+------+------+
3819 Bits
0-
3: set to value of multicast scope if IPv6 multicast
3820 Bit
4: set to value of T flag, if IPv6 multicast
3821 Bits
5-
6: reserved for future use
3822 Bit
7: set to
1 if IPv4 multicast
3827 See
<xref type=
"rfc" data=
"rfc1112"/> for the specification of
3828 reserved IPv4 multicast addresses.
3829 See
<xref type=
"rfc" data=
"rfc4291"/> for the specification of
3830 reserved IPv6 multicast addresses and the definition of the T flag and
3831 the IPv6 multicast scope.
3832 The diagram provided in
<xref type=
"rfc" data=
"rfc5102"/> is incorrect.
3833 The diagram in this registry is taken from Errata
1736. See
<xref type=
"rfc-errata" data=
"1736"/>
3836 <xref type=
"rfc" data=
"rfc5102"/>
3840 <name>ipv4IHL
</name>
3841 <dataType>unsigned8
</dataType>
3842 <group>ipHeader
</group>
3843 <elementId>207</elementId>
3844 <applicability>all
</applicability>
3845 <status>current
</status>
3848 The value of the Internet Header Length (IHL) field in
3849 the IPv4 header. It specifies the length of the header
3850 in units of
4 octets. Please note that its unit is
3851 different from most of the other Information Elements
3852 reporting length values.
3855 <units>4 octets
</units>
3858 See
<xref type=
"rfc" data=
"rfc791"/> for the specification of the IPv4
3862 <xref type=
"rfc" data=
"rfc5102"/>
3866 <name>ipv4Options
</name>
3867 <dataType>unsigned32
</dataType>
3868 <group>minMax
</group>
3869 <dataTypeSemantics>flags
</dataTypeSemantics>
3870 <elementId>208</elementId>
3871 <applicability>all
</applicability>
3872 <status>current
</status>
3875 IPv4 options in packets of this Flow.
3876 The information is encoded in a set of bit fields. For
3877 each valid IPv4 option type, there is a bit in this set.
3878 The bit is set to
1 if any observed packet of this Flow
3879 contains the corresponding IPv4 option type. Otherwise,
3880 if no observed packet of this Flow contained the
3881 respective IPv4 option type, the value of the
3882 corresponding bit is
0.
3885 The list of valid IPv4 options is maintained by IANA.
3886 Note that for identifying an option not just the
5-bit
3887 Option Number, but all
8 bits of the Option Type need to
3888 match one of the IPv4 options specified at
3889 http://www.iana.org/assignments/ip-parameters.
3892 Options are mapped to bits according to their option numbers.
3893 Option number X is mapped to bit X.
3894 The mapping is illustrated by the figure below.
3898 +------+------+------+------+------+------+------+------+
3899 ... | RR |CIPSO |E-SEC | TS | LSR | SEC | NOP | EOOL |
3900 +------+------+------+------+------+------+------+------+
3902 8 9 10 11 12 13 14 15
3903 +------+------+------+------+------+------+------+------+
3904 ... |ENCODE| VISA | FINN | MTUR | MTUP | ZSU | SSR | SID | ...
3905 +------+------+------+------+------+------+------+------+
3907 16 17 18 19 20 21 22 23
3908 +------+------+------+------+------+------+------+------+
3909 ... | DPS |NSAPA | SDB |RTRALT|ADDEXT| TR | EIP |IMITD | ...
3910 +------+------+------+------+------+------+------+------+
3912 24 25 26 27 28 29 30 31
3913 +------+------+------+------+------+------+------+------+
3914 | | EXP | to be assigned by IANA | QS | UMP | ...
3915 +------+------+------+------+------+------+------+------+
3918 Bit Value Name Reference
3919 ---+-----+-------+------------------------------------
3920 0 7 RR Record Route, RFC
791
3921 1 134 CIPSO Commercial Security
3922 2 133 E-SEC Extended Security, RFC
1108
3923 3 68 TS Time Stamp, RFC
791
3924 4 131 LSR Loose Source Route, RFC791
3925 5 130 SEC Security, RFC
1108
3926 6 1 NOP No Operation, RFC
791
3927 7 0 EOOL End of Options List, RFC
791
3929 9 142 VISA Experimental Access Control
3930 10 205 FINN Experimental Flow Control
3931 11 12 MTUR (obsoleted) MTU Reply, RFC
1191
3932 12 11 MTUP (obsoleted) MTU Probe, RFC
1191
3933 13 10 ZSU Experimental Measurement
3934 14 137 SSR Strict Source Route, RFC
791
3935 15 136 SID Stream ID, RFC
791
3936 16 151 DPS Dynamic Packet State
3937 17 150 NSAPA NSAP Address
3938 18 149 SDB Selective Directed Broadcast
3939 19 147 ADDEXT Address Extension
3940 20 148 RTRALT Router Alert, RFC
2113
3941 21 82 TR Traceroute, RFC
3193
3942 22 145 EIP Extended Internet Protocol, RFC
1385
3943 23 144 IMITD IMI Traffic Descriptor
3944 25 30 EXP RFC3692-style Experiment
3945 25 94 EXP RFC3692-style Experiment
3946 25 158 EXP RFC3692-style Experiment
3947 25 222 EXP RFC3692-style Experiment
3948 30 25 QS Quick-Start
3949 31 152 UMP Upstream Multicast Pkt.
3950 ... ... ... Further options numbers
3951 may be assigned by IANA
3957 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of IPv4
3959 See the list of IPv4 option numbers assigned by IANA at
<xref type=
"registry" data=
"ip-parameters"/>.
3960 The diagram provided in
<xref type=
"rfc" data=
"rfc5102"/> is incorrect.
3961 The diagram in this registry is taken from Errata
1737. See
<xref type=
"rfc-errata" data=
"1737"/>
3964 <xref type=
"rfc" data=
"rfc5102"/>
3968 <name>tcpOptions
</name>
3969 <dataType>unsigned64
</dataType>
3970 <group>minMax
</group>
3971 <dataTypeSemantics>flags
</dataTypeSemantics>
3972 <elementId>209</elementId>
3973 <applicability>all
</applicability>
3974 <status>current
</status>
3977 TCP options in packets of this Flow.
3978 The information is encoded in a set of bit fields. For
3979 each TCP option, there is a bit in this set.
3980 The bit is set to
1 if any observed packet of this Flow
3981 contains the corresponding TCP option.
3982 Otherwise, if no observed packet of this Flow contained
3983 the respective TCP option, the value of the
3984 corresponding bit is
0.
3987 Options are mapped to bits according to their option
3988 numbers. Option number X is mapped to bit X.
3989 TCP option numbers are maintained by IANA.
3993 +-----+-----+-----+-----+-----+-----+-----+-----+
3994 |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 | ...
3995 +-----+-----+-----+-----+-----+-----+-----+-----+
3997 8 9 10 11 12 13 14 15
3998 +-----+-----+-----+-----+-----+-----+-----+-----+
3999 ... |
15 |
14 |
13 |
12 |
11 |
10 |
9 |
8 |...
4000 +-----+-----+-----+-----+-----+-----+-----+-----+
4002 16 17 18 19 20 21 22 23
4003 +-----+-----+-----+-----+-----+-----+-----+-----+
4004 ... |
23 |
22 |
21 |
20 |
19 |
18 |
17 |
16 |...
4005 +-----+-----+-----+-----+-----+-----+-----+-----+
4009 56 57 58 59 60 61 62 63
4010 +-----+-----+-----+-----+-----+-----+-----+-----+
4011 ... |
63 |
62 |
61 |
60 |
59 |
58 |
57 |
56 |
4012 +-----+-----+-----+-----+-----+-----+-----+-----+
4017 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of TCP
4019 See the list of TCP option numbers assigned by IANA at
<xref type=
"registry" data=
"tcp-parameters"/>.
4020 The diagram provided in
<xref type=
"rfc" data=
"rfc5102"/> is incorrect.
4021 The diagram in this registry is taken from Errata
1739. See
<xref type=
"rfc-errata" data=
"1739"/>
4024 <xref type=
"rfc" data=
"rfc5102"/>
4028 <name>paddingOctets
</name>
4029 <dataType>octetArray
</dataType>
4030 <group>padding
</group>
4031 <elementId>210</elementId>
4032 <applicability>option
</applicability>
4033 <status>current
</status>
4036 The value of this Information Element is always a sequence of
4040 <xref type=
"rfc" data=
"rfc5102"/>
4044 <name>collectorIPv4Address
</name>
4045 <dataType>ipv4Address
</dataType>
4046 <group>config
</group>
4047 <dataTypeSemantics>identifier
</dataTypeSemantics>
4048 <elementId>211</elementId>
4049 <applicability>all
</applicability>
4050 <status>current
</status>
4053 An IPv4 address to which the Exporting Process sends Flow
4057 <xref type=
"rfc" data=
"rfc5102"/>
4061 <name>collectorIPv6Address
</name>
4062 <dataType>ipv6Address
</dataType>
4063 <group>config
</group>
4064 <dataTypeSemantics>identifier
</dataTypeSemantics>
4065 <elementId>212</elementId>
4066 <applicability>all
</applicability>
4067 <status>current
</status>
4070 An IPv6 address to which the Exporting Process sends Flow
4074 <xref type=
"rfc" data=
"rfc5102"/>
4078 <name>exportInterface
</name>
4079 <dataType>unsigned32
</dataType>
4080 <group>config
</group>
4081 <dataTypeSemantics>identifier
</dataTypeSemantics>
4082 <elementId>213</elementId>
4083 <applicability>all
</applicability>
4084 <status>current
</status>
4087 The index of the interface from which IPFIX Messages sent
4088 by the Exporting Process to a Collector leave the IPFIX
4089 Device. The value matches the value of
4090 managed object 'ifIndex' as defined in RFC
2863.
4091 Note that ifIndex values are not assigned statically to an
4092 interface and that the interfaces may be renumbered every
4093 time the device's management system is re-initialized, as
4094 specified in RFC
2863.
4099 See
<xref type=
"rfc" data=
"rfc2863"/> for the definition of the
4103 <xref type=
"rfc" data=
"rfc5102"/>
4107 <name>exportProtocolVersion
</name>
4108 <dataType>unsigned8
</dataType>
4109 <group>config
</group>
4110 <dataTypeSemantics>identifier
</dataTypeSemantics>
4111 <elementId>214</elementId>
4112 <applicability>all
</applicability>
4113 <status>current
</status>
4116 The protocol version used by the Exporting Process for
4117 sending Flow information. The protocol version is given
4118 by the value of the Version Number field in the Message
4122 The protocol version is
10 for IPFIX and
9 for NetFlow
4124 A value of
0 indicates that no export protocol is in use.
4129 See the
<xref type=
"rfc" data=
"rfc5101">IPFIX protocol
4130 specification
</xref> for the definition of the IPFIX Message Header.
4131 See
<xref type=
"rfc" data=
"rfc3954"/> for the definition of the
4132 NetFlow version
9 message header.
4135 <xref type=
"rfc" data=
"rfc5102"/>
4139 <name>exportTransportProtocol
</name>
4140 <dataType>unsigned8
</dataType>
4141 <group>config
</group>
4142 <dataTypeSemantics>identifier
</dataTypeSemantics>
4143 <elementId>215</elementId>
4144 <applicability>all
</applicability>
4145 <status>current
</status>
4148 The value of the protocol number used by the Exporting Process
4149 for sending Flow information.
4150 The protocol number identifies the IP packet payload type.
4151 Protocol numbers are defined in the IANA Protocol Numbers
4155 In Internet Protocol version
4 (IPv4), this is carried in the
4156 Protocol field. In Internet Protocol version
6 (IPv6), this
4157 is carried in the Next Header field in the last extension
4158 header of the packet.
4163 See
<xref type=
"rfc" data=
"rfc791"/> for the specification of the IPv4
4165 See
<xref type=
"rfc" data=
"rfc2460"/> for the specification of the
4166 IPv6 protocol field.
4167 See the list of protocol numbers assigned by IANA at
<xref type=
"registry" data=
"protocol-numbers"/>.
4170 <xref type=
"rfc" data=
"rfc5102"/>
4174 <name>collectorTransportPort
</name>
4175 <dataType>unsigned16
</dataType>
4176 <group>config
</group>
4177 <dataTypeSemantics>identifier
</dataTypeSemantics>
4178 <elementId>216</elementId>
4179 <applicability>all
</applicability>
4180 <status>current
</status>
4183 The destination port identifier to which the Exporting
4184 Process sends Flow information. For the transport protocols
4185 UDP, TCP, and SCTP, this is the destination port number.
4186 This field MAY also be used for future transport protocols
4187 that have
16-bit source port identifiers.
4192 See
<xref type=
"rfc" data=
"rfc768"/> for the definition of the UDP
4193 destination port field.
4194 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
4195 destination port field.
4196 See
<xref type=
"rfc" data=
"rfc4960"/> for the definition of SCTP.
4199 Additional information on defined UDP and TCP port numbers can be
4200 found at
<xref type=
"registry" data=
"port-numbers"/>.
4203 <xref type=
"rfc" data=
"rfc5102"/>
4207 <name>exporterTransportPort
</name>
4208 <dataType>unsigned16
</dataType>
4209 <group>config
</group>
4210 <dataTypeSemantics>identifier
</dataTypeSemantics>
4211 <elementId>217</elementId>
4212 <applicability>all
</applicability>
4213 <status>current
</status>
4216 The source port identifier from which the Exporting
4217 Process sends Flow information. For the transport protocols
4218 UDP, TCP, and SCTP, this is the source port number.
4219 This field MAY also be used for future transport protocols
4220 that have
16-bit source port identifiers. This field may
4221 be useful for distinguishing multiple Exporting Processes
4222 that use the same IP address.
4227 See
<xref type=
"rfc" data=
"rfc768"/> for the definition of the UDP
4229 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
4231 See
<xref type=
"rfc" data=
"rfc4960"/> for the definition of SCTP.
4234 Additional information on defined UDP and TCP port numbers can be
4235 found at
<xref type=
"registry" data=
"port-numbers"/>.
4238 <xref type=
"rfc" data=
"rfc5102"/>
4242 <name>tcpSynTotalCount
</name>
4243 <dataType>unsigned64
</dataType>
4244 <group>flowCounter
</group>
4245 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
4246 <elementId>218</elementId>
4247 <applicability>data
</applicability>
4248 <status>current
</status>
4251 The total number of packets of this Flow with
4252 TCP
"Synchronize sequence numbers" (SYN) flag set.
4255 <units>packets
</units>
4258 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP SYN
4262 <xref type=
"rfc" data=
"rfc5102"/>
4266 <name>tcpFinTotalCount
</name>
4267 <dataType>unsigned64
</dataType>
4268 <group>flowCounter
</group>
4269 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
4270 <elementId>219</elementId>
4271 <applicability>data
</applicability>
4272 <status>current
</status>
4275 The total number of packets of this Flow with
4276 TCP
"No more data from sender" (FIN) flag set.
4279 <units>packets
</units>
4282 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP FIN
4286 <xref type=
"rfc" data=
"rfc5102"/>
4290 <name>tcpRstTotalCount
</name>
4291 <dataType>unsigned64
</dataType>
4292 <group>flowCounter
</group>
4293 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
4294 <elementId>220</elementId>
4295 <applicability>data
</applicability>
4296 <status>current
</status>
4299 The total number of packets of this Flow with
4300 TCP
"Reset the connection" (RST) flag set.
4303 <units>packets
</units>
4306 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP RST
4310 <xref type=
"rfc" data=
"rfc5102"/>
4314 <name>tcpPshTotalCount
</name>
4315 <dataType>unsigned64
</dataType>
4316 <group>flowCounter
</group>
4317 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
4318 <elementId>221</elementId>
4319 <applicability>data
</applicability>
4320 <status>current
</status>
4323 The total number of packets of this Flow with
4324 TCP
"Push Function" (PSH) flag set.
4327 <units>packets
</units>
4330 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP PSH
4334 <xref type=
"rfc" data=
"rfc5102"/>
4338 <name>tcpAckTotalCount
</name>
4339 <dataType>unsigned64
</dataType>
4340 <group>flowCounter
</group>
4341 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
4342 <elementId>222</elementId>
4343 <applicability>data
</applicability>
4344 <status>current
</status>
4347 The total number of packets of this Flow with
4348 TCP
"Acknowledgment field significant" (ACK) flag set.
4351 <units>packets
</units>
4354 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP ACK
4358 <xref type=
"rfc" data=
"rfc5102"/>
4362 <name>tcpUrgTotalCount
</name>
4363 <dataType>unsigned64
</dataType>
4364 <group>flowCounter
</group>
4365 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
4366 <elementId>223</elementId>
4367 <applicability>data
</applicability>
4368 <status>current
</status>
4371 The total number of packets of this Flow with
4372 TCP
"Urgent Pointer field significant" (URG) flag set.
4375 <units>packets
</units>
4378 See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP URG
4382 <xref type=
"rfc" data=
"rfc5102"/>
4386 <name>ipTotalLength
</name>
4387 <dataType>unsigned64
</dataType>
4388 <group>ipHeader
</group>
4389 <elementId>224</elementId>
4390 <applicability>all
</applicability>
4391 <status>current
</status>
4394 The total length of the IP packet.
4397 <units>octets
</units>
4400 See
<xref type=
"rfc" data=
"rfc791"/> for the specification of the IPv4
4402 See
<xref type=
"rfc" data=
"rfc2460"/> for the specification of the
4403 IPv6 payload length.
4404 See
<xref type=
"rfc" data=
"rfc2675"/> for the specification of the
4405 IPv6 jumbo payload length.
4408 <xref type=
"rfc" data=
"rfc5102"/>
4412 <name>postNATSourceIPv4Address
</name>
4413 <dataType>ipv4Address
</dataType>
4414 <dataTypeSemantics>identifier
</dataTypeSemantics>
4415 <elementId>225</elementId>
4416 <status>current
</status>
4419 The definition of this Information Element is identical to the
4420 definition of Information Element 'sourceIPv4Address', except
4421 that it reports a modified value caused by a NAT middlebox
4422 function after the packet passed the Observation Point.
4427 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4 source
4428 address field. See
<xref type=
"rfc" data=
"rfc3022"/> for the definition of
4429 NAT. See
<xref type=
"rfc" data=
"rfc3234"/> for the definition of middleboxes.
4432 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4435 <name>postNATDestinationIPv4Address
</name>
4436 <dataType>ipv4Address
</dataType>
4437 <dataTypeSemantics>identifier
</dataTypeSemantics>
4438 <elementId>226</elementId>
4439 <status>current
</status>
4442 The definition of this Information Element is identical to the
4443 definition of Information Element 'destinationIPv4Address',
4444 except that it reports a modified value caused by a NAT
4445 middlebox function after the packet passed the Observation
4451 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of the IPv4 destination
4452 address field. See
<xref type=
"rfc" data=
"rfc3022"/> for the definition of
4453 NAT. See
<xref type=
"rfc" data=
"rfc3234"/> for the definition of middleboxes.
4456 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4460 <name>postNAPTSourceTransportPort
</name>
4461 <dataType>unsigned16
</dataType>
4462 <dataTypeSemantics>identifier
</dataTypeSemantics>
4463 <elementId>227</elementId>
4464 <status>current
</status>
4467 The definition of this Information Element is identical to the
4468 definition of Information Element 'sourceTransportPort', except
4469 that it reports a modified value caused by a Network Address
4470 Port Translation (NAPT) middlebox function after the packet
4471 passed the Observation Point.
4476 See
<xref type=
"rfc" data=
"rfc768"/> for the definition of the UDP source port
4477 field. See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
4478 source port field. See
<xref type=
"rfc" data=
"rfc4960"/> for the definition of
4480 See
<xref type=
"rfc" data=
"rfc3022"/> for the definition of NAPT. See
<xref type=
"rfc" data=
"rfc3234"/> for the definition of middleboxes.
4481 Additional information on defined UDP and TCP port numbers can
4482 be found at http://www.iana.org/assignments/port-numbers.
4485 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4489 <name>postNAPTDestinationTransportPort
</name>
4490 <dataType>unsigned16
</dataType>
4491 <dataTypeSemantics>identifier
</dataTypeSemantics>
4492 <elementId>228</elementId>
4493 <status>current
</status>
4496 The definition of this Information Element is identical to the
4497 definition of Information Element 'destinationTransportPort',
4498 except that it reports a modified value caused by a Network
4499 Address Port Translation (NAPT) middlebox function after the
4500 packet passed the Observation Point.
4505 See
<xref type=
"rfc" data=
"rfc768"/> for the definition of the UDP source port
4506 field. See
<xref type=
"rfc" data=
"rfc793"/> for the definition of the TCP
4507 source port field. See
<xref type=
"rfc" data=
"rfc4960"/> for the definition of
4509 See
<xref type=
"rfc" data=
"rfc3022"/> for the definition of NAPT. See
<xref type=
"rfc" data=
"rfc3234"/> for the definition of middleboxes.
4510 Additional information on defined UDP and TCP port numbers can
4511 be found at http://www.iana.org/assignments/port-numbers.
4514 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4518 <name>natOriginatingAddressRealm
</name>
4519 <dataType>unsigned8
</dataType>
4520 <dataTypeSemantics>flags
</dataTypeSemantics>
4521 <elementId>229</elementId>
4522 <status>current
</status>
4525 Indicates whether the session was created because traffic
4526 originated in the private or public address realm.
4527 postNATSourceIPv4Address, postNATDestinationIPv4Address,
4528 postNAPTSourceTransportPort, and
4529 postNAPTDestinationTransportPort are qualified with the address
4530 realm in perspective.
4533 The allowed values are:
4544 See
<xref type=
"rfc" data=
"rfc3022"/> for the definition of NAT.
4547 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4550 <name>natEvent
</name>
4551 <dataType>unsigned8
</dataType>
4552 <elementId>230</elementId>
4553 <status>current
</status>
4556 Indicates a NAT event. The allowed values are:
4568 A Create event is generated when a NAT translation is created,
4569 whether dynamically or statically. A Delete event is generated
4570 when a NAT translation is deleted.
4575 See
<xref type=
"rfc" data=
"rfc3022"/> for the definition of NAT.
4578 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4581 <name>initiatorOctets
</name>
4582 <dataType>unsigned64
</dataType>
4583 <elementId>231</elementId>
4584 <status>current
</status>
4587 The total number of layer
4 payload bytes in a flow from the
4588 initiator. The initiator is the device which triggered the
4589 session creation, and remains the same for the life of the
4593 <units>octets
</units>
4596 See #
298, initiatorPackets.
4599 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4602 <name>responderOctets
</name>
4603 <dataType>unsigned64
</dataType>
4604 <elementId>232</elementId>
4605 <status>current
</status>
4608 The total number of layer
4 payload bytes in a flow from the
4609 responder. The responder is the device which replies to the
4610 initiator, and remains the same for the life of the session.
4613 <units>octets
</units>
4616 See #
299, responderPackets.
4620 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4624 <name>firewallEvent
</name>
4625 <dataType>unsigned8
</dataType>
4626 <elementId>233</elementId>
4627 <status>current
</status>
4630 Indicates a firewall event. The allowed values are:
4633 0 - Ignore (invalid)
4651 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4655 <name>ingressVRFID
</name>
4656 <dataType>unsigned32
</dataType>
4657 <elementId>234</elementId>
4658 <status>current
</status>
4661 An unique identifier of the VRFname where the packets of this
4662 flow are being received. This identifier is unique per Metering
4666 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4670 <name>egressVRFID
</name>
4671 <dataType>unsigned32
</dataType>
4672 <elementId>235</elementId>
4673 <status>current
</status>
4676 An unique identifier of the VRFname where the packets of this
4677 flow are being sent. This identifier is unique per Metering
4681 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4685 <name>VRFname
</name>
4686 <dataType>string
</dataType>
4687 <elementId>236</elementId>
4688 <status>current
</status>
4691 The name of a VPN Routing and Forwarding table (VRF).
4696 See
<xref type=
"rfc" data=
"rfc4364"/> for the definition of VRF.
4699 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4703 <name>postMplsTopLabelExp
</name>
4704 <dataType>unsigned8
</dataType>
4705 <group>subIpHeader
</group>
4706 <dataTypeSemantics>flags
</dataTypeSemantics>
4707 <elementId>237</elementId>
4708 <applicability>all
</applicability>
4709 <status>current
</status>
4712 The definition of this Information Element is identical to the
4713 definition of Information Element 'mplsTopLabelExp', except
4714 that it reports a potentially modified value caused by a
4715 middlebox function after the packet passed the Observation
4721 See
<xref type=
"rfc" data=
"rfc3032"/> for the specification of the Exp
4723 See
<xref type=
"rfc" data=
"rfc3270"/> for usage of the Exp field.
4726 <xref type=
"rfc" data=
"rfc5102"/>
4730 <name>tcpWindowScale
</name>
4731 <dataType>unsigned16
</dataType>
4732 <group>transportHeader
</group>
4733 <elementId>238</elementId>
4734 <applicability>all
</applicability>
4735 <status>current
</status>
4738 The scale of the window field in the TCP header.
4743 See
<xref type=
"rfc" data=
"rfc1323"/> for the definition of the TCP
4747 <xref type=
"rfc" data=
"rfc5102"/>
4751 <name>biflowDirection
</name>
4752 <dataType>unsigned8
</dataType>
4754 <dataTypeSemantics>identifier
</dataTypeSemantics>
4755 <elementId>239</elementId>
4756 <applicability>all
</applicability>
4757 <status>current
</status>
4759 <paragraph>A description of the direction assignment method used to
4760 assign the Biflow Source and Destination. This Information Element
4761 MAY be present in a Flow Data Record, or applied to all flows exported
4762 from an Exporting Process or Observation Domain using IPFIX Options.
4763 If this Information Element is not present in a Flow Record or
4764 associated with a Biflow via scope, it is assumed that the
4765 configuration of the direction assignment method is done out-of-band.
4766 Note that when using IPFIX Options to apply this Information Element
4767 to all flows within an Observation Domain or from an Exporting
4768 Process, the Option SHOULD be sent reliably. If reliable transport is
4769 not available (i.e., when using UDP), this Information Element SHOULD
4770 appear in each Flow Record. This field may take the following
4773 +-------+------------------+----------------------------------------+
4774 | Value | Name | Description |
4775 +-------+------------------+----------------------------------------+
4776 |
0x00 | arbitrary | Direction was assigned arbitrarily. |
4777 |
0x01 | initiator | The Biflow Source is the flow |
4778 | | | initiator, as determined by the |
4779 | | | Metering Process' best effort to |
4780 | | | detect the initiator. |
4781 |
0x02 | reverseInitiator | The Biflow Destination is the flow |
4782 | | | initiator, as determined by the |
4783 | | | Metering Process' best effort to |
4784 | | | detect the initiator. This value is |
4785 | | | provided for the convenience of |
4786 | | | Exporting Processes to revise an |
4787 | | | initiator estimate without re-encoding |
4788 | | | the Biflow Record. |
4789 |
0x03 | perimeter | The Biflow Source is the endpoint |
4790 | | | outside of a defined perimeter. The |
4791 | | | perimeter's definition is implicit in |
4792 | | | the set of Biflow Source and Biflow |
4793 | | | Destination addresses exported in the |
4794 | | | Biflow Records. |
4795 +-------+------------------+----------------------------------------+
4798 <xref type=
"rfc" data=
"rfc5103"/>
4802 <name>ethernetHeaderLength
</name>
4803 <dataType>unsigned8
</dataType>
4804 <dataTypeSemantics>identifier
</dataTypeSemantics>
4805 <elementId>240</elementId>
4806 <status>current
</status>
4809 The difference between the length of an Ethernet frame (minus the
4810 FCS) and the length of its MAC Client Data section (including any
4811 padding) as defined in section
3.1 of [IEEE
.802-
3.2005]. It does
4812 not include the Preamble, SFD and Extension field lengths.
4815 <units>octets
</units>
4821 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4825 <name>ethernetPayloadLength
</name>
4826 <dataType>unsigned16
</dataType>
4827 <dataTypeSemantics>identifier
</dataTypeSemantics>
4828 <elementId>241</elementId>
4829 <status>current
</status>
4832 The length of the MAC Client Data section (including any padding)
4833 of a frame as defined in section
3.1 of [IEEE
.802-
3.2005].
4836 <units>octets
</units>
4842 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4845 <name>ethernetTotalLength
</name>
4846 <dataType>unsigned16
</dataType>
4847 <dataTypeSemantics>identifier
</dataTypeSemantics>
4848 <elementId>242</elementId>
4849 <status>current
</status>
4852 The total length of the Ethernet frame (excluding the Preamble,
4853 SFD, Extension and FCS fields) as described in section
3.1 of
4857 <units>octets
</units>
4863 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4866 <name>dot1qVlanId
</name>
4867 <dataType>unsigned16
</dataType>
4868 <dataTypeSemantics>identifier
</dataTypeSemantics>
4869 <elementId>243</elementId>
4870 <status>current
</status>
4873 The value of the
12-bit VLAN Identifier portion of the Tag
4874 Control Information field of an Ethernet frame as described in
4875 section
3.5.5 of [IEEE
.802-
3.2005]. The structure and semantics
4876 within the Tag Control Information field are defined in IEEE
4877 P802.1Q. In case of a QinQ frame, it represents the outer tag's
4878 VLAN identifier and in case of an IEEE
802.1ad frame it
4879 represents the Service VLAN identifier in the S-TAG Tag Control
4880 Information (TCI) field as described in [IEEE
.802-
1ad
.2005].
4883 <units>octets
</units>
4889 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4892 <name>dot1qPriority
</name>
4893 <dataType>unsigned8
</dataType>
4894 <dataTypeSemantics>identifier
</dataTypeSemantics>
4895 <elementId>244</elementId>
4896 <status>current
</status>
4899 The value of the
3-bit User Priority portion of the Tag Control
4900 Information field of an Ethernet frame as described in section
4901 3.5.5 of [IEEE
.802-
3.2005]. The structure and semantics within
4902 the Tag Control Information field are defined in IEEE P802.1Q.
4903 In case of a QinQ frame, it represents the outer tag's
3-bit
4904 Class of Service (CoS) identifier and in case of an IEEE
802.1ad
4905 frame it represents the
3-bit Priority Code Point (PCP) portion
4906 of the S-TAG Tag Control Information (TCI) field as described in
4907 [IEEE
.802-
1ad
.2005].
4916 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4919 <name>dot1qCustomerVlanId
</name>
4920 <dataType>unsigned16
</dataType>
4921 <dataTypeSemantics>identifier
</dataTypeSemantics>
4922 <elementId>245</elementId>
4923 <status>current
</status>
4926 In case of a QinQ frame, it represents the inner tag's (*) VLAN
4927 identifier and in case of an IEEE
802.1ad frame it represents the
4928 Customer VLAN identifier in the C-TAG Tag Control Information
4929 (TCI) field as described in [IEEE
.802-
1ad
.2005].
4930 (*) Note: the
801.2Q tag directly following the outer one.
4939 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4942 <name>dot1qCustomerPriority
</name>
4943 <dataType>unsigned8
</dataType>
4944 <dataTypeSemantics>identifier
</dataTypeSemantics>
4945 <elementId>246</elementId>
4946 <status>current
</status>
4949 In case of a QinQ frame, it represents the inner tag's (*) Class
4950 of Service (CoS) identifier and in case of an IEEE
802.1ad frame
4951 it represents the
3-bit Priority Code Point (PCP) portion of the
4952 C-TAG Tag Control Information (TCI) field as described in
4953 [IEEE
.802-
1ad
.2005].
4954 (*) Note: the
801.2Q tag directly following the outer one.
4963 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4966 <name>metroEvcId
</name>
4967 <dataType>string
</dataType>
4968 <elementId>247</elementId>
4969 <status>current
</status>
4972 The EVC Service Attribute which uniquely identifies the Ethernet
4973 Virtual Connection (EVC) within a Metro Ethernet Network, as
4974 defined in section
6.2 of MEF
10.1. The MetroEVCID is encoded in
4975 a string of up to
100 characters.
4980 MEF
10.1 (Ethernet Services Attributes Phase
2)
4981 MEF16 (Ethernet Local Management Interface)
4984 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
4987 <name>metroEvcType
</name>
4988 <dataType>unsigned8
</dataType>
4989 <dataTypeSemantics>identifier
</dataTypeSemantics>
4990 <elementId>248</elementId>
4991 <status>current
</status>
4994 The
3-bit EVC Service Attribute which identifies the type of
4995 service provided by an EVC.
5000 MEF
10.1 (Ethernet Services Attributes Phase
2)
5001 MEF16 (Ethernet Local Management Interface)
5004 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5007 <name>pseudoWireId
</name>
5008 <dataType>unsigned32
</dataType>
5009 <dataTypeSemantics>identifier
</dataTypeSemantics>
5010 <elementId>249</elementId>
5011 <status>current
</status>
5014 A
32-bit non-zero connection identifier, which together with the
5015 pseudoWireType, identifies the Pseudo Wire (PW) as defined in RFC
5021 See
<xref type=
"rfc" data=
"rfc4447"/> for pseudowire definitions.
5024 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5027 <name>pseudoWireType
</name>
5028 <dataType>unsigned16
</dataType>
5029 <dataTypeSemantics>identifier
</dataTypeSemantics>
5030 <elementId>250</elementId>
5031 <status>current
</status>
5034 The value of this information element identifies the type of MPLS
5035 Pseudo Wire (PW) as defined in RFC
4446.
5040 See
<xref type=
"rfc" data=
"rfc4446"/> for the pseudowire type definition, and
5041 http://www.iana.org/assignments/pwe3-parameters for the IANA
5042 Pseudowire Types Registry.
5045 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5048 <name>pseudoWireControlWord
</name>
5049 <dataType>unsigned32
</dataType>
5050 <dataTypeSemantics>identifier
</dataTypeSemantics>
5051 <elementId>251</elementId>
5052 <status>current
</status>
5055 The
32-bit Preferred Pseudo Wire (PW) MPLS Control Word as
5056 defined in Section
3 of
<xref type=
"rfc" data=
"rfc4385"/>.
5061 See
<xref type=
"rfc" data=
"rfc4385"/> for the Pseudo Wire Control Word
5065 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5069 <name>ingressPhysicalInterface
</name>
5070 <dataType>unsigned32
</dataType>
5071 <dataTypeSemantics>identifier
</dataTypeSemantics>
5072 <elementId>252</elementId>
5073 <status>current
</status>
5076 The index of a networking device's physical interface (example, a
5077 switch port) where packets of this flow are being received.
5082 See
<xref type=
"rfc" data=
"rfc2863"/> for the definition of the ifIndex object.
5085 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5089 <name>egressPhysicalInterface
</name>
5090 <dataType>unsigned32
</dataType>
5091 <dataTypeSemantics>identifier
</dataTypeSemantics>
5092 <elementId>253</elementId>
5093 <status>current
</status>
5096 The index of a networking device's physical interface (example, a
5097 switch port) where packets of this flow are being sent.
5102 See
<xref type=
"rfc" data=
"rfc2863"/> for the definition of the ifIndex object.
5105 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5109 <name>postDot1qVlanId
</name>
5110 <dataType>unsigned16
</dataType>
5111 <dataTypeSemantics>identifier
</dataTypeSemantics>
5112 <elementId>254</elementId>
5113 <status>current
</status>
5116 The definition of this Information Element is identical to the
5117 definition of Information Element 'dot1qVlanId', except that it
5118 reports a potentially modified value caused by a middlebox
5119 function after the packet passed the Observation Point.
5128 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5132 <name>postDot1qCustomerVlanId
</name>
5133 <dataType>unsigned16
</dataType>
5134 <dataTypeSemantics>identifier
</dataTypeSemantics>
5135 <elementId>255</elementId>
5136 <status>current
</status>
5139 The definition of this Information Element is identical to the
5140 definition of Information Element 'dot1qCustomerVlanId', except
5141 that it reports a potentially modified value caused by a
5142 middlebox function after the packet passed the Observation Point.
5151 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5154 <name>ethernetType
</name>
5155 <dataType>unsigned16
</dataType>
5156 <dataTypeSemantics>identifier
</dataTypeSemantics>
5157 <elementId>256</elementId>
5158 <status>current
</status>
5161 The Ethernet type field of an Ethernet frame that identifies the
5162 MAC client protocol carried in the payload as defined in
5163 paragraph
1.4.349 of [IEEE
.802-
3.2005].
5169 Ethertype registry available at
5170 http://standards.ieee.org/regauth/ethertype/eth.txt
5173 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5177 <name>postIpPrecedence
</name>
5178 <dataType>unsigned8
</dataType>
5179 <dataTypeSemantics>identifier
</dataTypeSemantics>
5180 <elementId>257</elementId>
5181 <status>current
</status>
5184 The definition of this Information Element is identical to the
5185 definition of Information Element 'ipPrecedence', except that
5186 it reports a potentially modified value caused by a middlebox
5187 function after the packet passed the Observation Point.
5193 See
<xref type=
"rfc" data=
"rfc1812"/> (Section
5.3.3) and
5194 <xref type=
"rfc" data=
"rfc791"/> for the definition of the
5195 IP Precedence. See
<xref type=
"rfc" data=
"rfc1812"/>
5196 (Section
5.3.2) and
<xref type=
"rfc" data=
"rfc791"/> for the
5197 definition of the IPv4 TOS field. See
5198 <xref type=
"rfc" data=
"rfc2460"/> for the definition of the
5199 IPv6 Traffic Class field.
5202 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5206 <name>collectionTimeMilliseconds
</name>
5207 <dataType>dateTimeMilliseconds
</dataType>
5208 <elementId>258</elementId>
5209 <status>current
</status>
5212 The absolute timestamp at which the data within the
5213 scope containing this Information Element was received by a
5214 Collecting Process. This Information Element SHOULD be bound to
5215 its containing IPFIX Message via IPFIX Options and the
5216 messageScope Information Element, as defined below.
5219 <xref type=
"rfc" data=
"rfc5655"/>
5223 <name>exportSctpStreamId
</name>
5224 <dataType>unsigned16
</dataType>
5225 <dataTypeSemantics>identifier
</dataTypeSemantics>
5226 <elementId>259</elementId>
5227 <status>current
</status>
5230 The value of the SCTP Stream Identifier used by the
5231 Exporting Process for exporting IPFIX Message data. This is
5232 carried in the Stream Identifier field of the header of the SCTP
5233 DATA chunk containing the IPFIX Message(s).
5236 <xref type=
"rfc" data=
"rfc5655"/>
5240 <name>maxExportSeconds
</name>
5241 <dataType>dateTimeSeconds
</dataType>
5242 <elementId>260</elementId>
5243 <status>current
</status>
5246 The absolute Export Time of the latest IPFIX Message
5247 within the scope containing this Information Element. This
5248 Information Element SHOULD be bound to its containing IPFIX
5249 Transport Session via IPFIX Options and the sessionScope
5250 Information Element.
5253 <units>seconds
</units>
5254 <xref type=
"rfc" data=
"rfc5655"/>
5258 <name>maxFlowEndSeconds
</name>
5259 <dataType>dateTimeSeconds
</dataType>
5260 <elementId>261</elementId>
5261 <status>current
</status>
5264 The latest absolute timestamp of the last packet
5265 within any Flow within the scope containing this Information
5266 Element, rounded up to the second if necessary. This Information
5267 Element SHOULD be bound to its containing IPFIX Transport Session
5268 via IPFIX Options and the sessionScope Information Element.
5271 <units>seconds
</units>
5272 <xref type=
"rfc" data=
"rfc5655"/>
5276 <name>messageMD5Checksum
</name>
5277 <dataType>octetArray
</dataType>
5278 <elementId>262</elementId>
5279 <status>current
</status>
5282 The MD5 checksum of the IPFIX Message containing this
5283 record. This Information Element SHOULD be bound to its
5284 containing IPFIX Message via an options record and the
5285 messageScope Information Element, as defined below, and SHOULD
5286 appear only once in a given IPFIX Message. To calculate the value
5287 of this Information Element, first buffer the containing IPFIX
5288 Message, setting the value of this Information Element to all
5289 zeroes. Then calculate the MD5 checksum of the resulting buffer
5290 as defined in [RFC1321], place the resulting value in this
5291 Information Element, and export the buffered message. This
5292 Information Element is intended as a simple checksum only;
5293 therefore collision resistance and algorithm agility are not
5294 required, and MD5 is an appropriate message digest.
5296 This Information Element has a fixed length of
16 octets.
5299 <xref type=
"rfc" data=
"rfc5655"/>
5300 <xref type=
"rfc" data=
"rfc1321"/>
5304 <name>messageScope
</name>
5305 <dataType>unsigned8
</dataType>
5306 <elementId>263</elementId>
5307 <status>current
</status>
5310 The presence of this Information Element as scope in
5311 an Options Template signifies that the options described by the
5312 Template apply to the IPFIX Message that contains them. It is
5313 defined for general purpose message scoping of options, and
5314 proposed specifically to allow the attachment a checksum to a
5315 message via IPFIX Options. The value of this Information Element
5316 MUST be written as
0 by the File Writer or Exporting Process. The
5317 value of this Information Element MUST be ignored by the File
5318 Reader or the Collecting Process.
5321 <xref type=
"rfc" data=
"rfc5655"/>
5325 <name>minExportSeconds
</name>
5326 <dataType>dateTimeSeconds
</dataType>
5327 <elementId>264</elementId>
5328 <status>current
</status>
5331 The absolute Export Time of the earliest IPFIX Message
5332 within the scope containing this Information Element. This
5333 Information Element SHOULD be bound to its containing IPFIX
5334 Transport Session via an options record and the sessionScope
5335 Information Element.
5338 <units>seconds
</units>
5339 <xref type=
"rfc" data=
"rfc5655"/>
5343 <name>minFlowStartSeconds
</name>
5344 <dataType>dateTimeSeconds
</dataType>
5345 <elementId>265</elementId>
5346 <status>current
</status>
5349 The earliest absolute timestamp of the first packet
5350 within any Flow within the scope containing this Information
5351 Element, rounded down to the second if necessary. This
5352 Information Element SHOULD be bound to its containing IPFIX
5353 Transport Session via an options record and the sessionScope
5354 Information Element.
5357 <units>seconds
</units>
5358 <xref type=
"rfc" data=
"rfc5655"/>
5362 <name>opaqueOctets
</name>
5363 <dataType>octetArray
</dataType>
5364 <elementId>266</elementId>
5365 <status>current
</status>
5368 This Information Element is used to encapsulate non-
5369 IPFIX data into an IPFIX Message stream, for the purpose of
5370 allowing a non-IPFIX data processor to store a data stream inline
5371 within an IPFIX File. A Collecting Process or File Writer MUST
5372 NOT try to interpret this binary data. This Information Element
5373 differs from paddingOctets as its contents are meaningful in some
5374 non-IPFIX context, while the contents of paddingOctets MUST be
5375 0x00 and are intended only for Information Element alignment.
5378 <xref type=
"rfc" data=
"rfc5655"/>
5382 <name>sessionScope
</name>
5383 <dataType>unsigned8
</dataType>
5384 <elementId>267</elementId>
5385 <status>current
</status>
5388 The presence of this Information Element as scope in
5389 an Options Template signifies that the options described by the
5390 Template apply to the IPFIX Transport Session that contains them.
5391 Note that as all options are implicitly scoped to Transport
5392 Session and Observation Domain, this Information Element is
5393 equivalent to a
"null" scope. It is defined for general purpose
5394 session scoping of options, and proposed specifically to allow the
5395 attachment of time window to an IPFIX File via IPFIX Options. The
5396 value of this Information Element MUST be written as
0 by the File
5397 Writer or Exporting Process. The value of this Information
5398 Element MUST be ignored by the File Reader or the Collecting
5402 <xref type=
"rfc" data=
"rfc5655"/>
5406 <name>maxFlowEndMicroseconds
</name>
5407 <dataType>dateTimeMicroseconds
</dataType>
5408 <elementId>268</elementId>
5409 <status>current
</status>
5412 The latest absolute timestamp of the last packet
5413 within any Flow within the scope containing this Information
5414 Element, rounded up to the microsecond if necessary. This
5415 Information Element SHOULD be bound to its containing IPFIX
5416 Transport Session via IPFIX Options and the sessionScope
5417 Information Element. This Information Element SHOULD be used only
5418 in Transport Sessions containing Flow Records with microsecond-
5419 precision (or better) timestamp Information Elements.
5422 <units>microseconds
</units>
5423 <xref type=
"rfc" data=
"rfc5655"/>
5427 <name>maxFlowEndMilliseconds
</name>
5428 <dataType>dateTimeMilliseconds
</dataType>
5429 <elementId>269</elementId>
5430 <status>current
</status>
5433 The latest absolute timestamp of the last packet
5434 within any Flow within the scope containing this Information
5435 Element, rounded up to the millisecond if necessary. This
5436 Information Element SHOULD be bound to its containing IPFIX
5437 Transport Session via IPFIX Options and the sessionScope
5438 Information Element. This Information Element SHOULD be used only
5439 in Transport Sessions containing Flow Records with millisecond-
5440 precision (or better) timestamp Information Elements.
5443 <units>milliseconds
</units>
5444 <xref type=
"rfc" data=
"rfc5655"/>
5448 <name>maxFlowEndNanoseconds
</name>
5449 <dataType>dateTimeNanoseconds
</dataType>
5450 <elementId>270</elementId>
5451 <status>current
</status>
5454 The latest absolute timestamp of the last packet
5455 within any Flow within the scope containing this Information
5456 Element. This Information Element SHOULD be bound to its
5457 containing IPFIX Transport Session via IPFIX Options and the
5458 sessionScope Information Element. This Information Element SHOULD
5459 be used only in Transport Sessions containing Flow Records with
5460 nanosecond-precision timestamp Information Elements.
5463 <units>nanoseconds
</units>
5464 <xref type=
"rfc" data=
"rfc5655"/>
5468 <name>minFlowStartMicroseconds
</name>
5469 <dataType>dateTimeMicroseconds
</dataType>
5470 <elementId>271</elementId>
5471 <status>current
</status>
5474 The earliest absolute timestamp of the first packet
5475 within any Flow within the scope containing this Information
5476 Element, rounded down to the microsecond if necessary. This
5477 Information Element SHOULD be bound to its containing IPFIX
5478 Transport Session via an options record and the sessionScope
5479 Information Element. This Information Element SHOULD be used only
5480 in Transport Sessions containing Flow Records with microsecond-
5481 precision (or better) timestamp Information Elements.
5484 <units>microseconds
</units>
5485 <xref type=
"rfc" data=
"rfc5655"/>
5489 <name>minFlowStartMilliseconds
</name>
5490 <dataType>dateTimeMilliseconds
</dataType>
5491 <elementId>272</elementId>
5492 <status>current
</status>
5495 The earliest absolute timestamp of the first packet
5496 within any Flow within the scope containing this Information
5497 Element, rounded down to the millisecond if necessary. This
5498 Information Element SHOULD be bound to its containing IPFIX
5499 Transport Session via an options record and the sessionScope
5500 Information Element. This Information Element SHOULD be used only
5501 in Transport Sessions containing Flow Records with millisecond-
5502 precision (or better) timestamp Information Elements.
5505 <units>milliseconds
</units>
5506 <xref type=
"rfc" data=
"rfc5655"/>
5510 <name>minFlowStartNanoseconds
</name>
5511 <dataType>dateTimeNanoseconds
</dataType>
5512 <elementId>273</elementId>
5513 <status>current
</status>
5516 The earliest absolute timestamp of the first packet
5517 within any Flow within the scope containing this Information
5518 Element. This Information Element SHOULD be bound to its
5519 containing IPFIX Transport Session via an options record and the
5520 sessionScope Information Element. This Information Element SHOULD
5521 be used only in Transport Sessions containing Flow Records with
5522 nanosecond-precision timestamp Information Elements.
5525 <units>nanoseconds
</units>
5526 <xref type=
"rfc" data=
"rfc5655"/>
5530 <name>collectorCertificate
</name>
5531 <dataType>octetArray
</dataType>
5532 <elementId>274</elementId>
5533 <status>current
</status>
5536 The full X
.509 certificate, encoded in ASN
.1 DER
5537 format, used by the Collector when IPFIX Messages were transmitted
5538 using TLS or DTLS. This Information Element SHOULD be bound to
5539 its containing IPFIX Transport Session via an options record and
5540 the sessionScope Information Element, or to its containing IPFIX
5541 Message via an options record and the messageScope Information
5545 <xref type=
"rfc" data=
"rfc5655"/>
5549 <name>exporterCertificate
</name>
5550 <dataType>octetArray
</dataType>
5551 <elementId>275</elementId>
5552 <status>current
</status>
5555 The full X
.509 certificate, encoded in ASN
.1 DER
5556 format, used by the Collector when IPFIX Messages were transmitted
5557 using TLS or DTLS. This Information Element SHOULD be bound to
5558 its containing IPFIX Transport Session via an options record and
5559 the sessionScope Information Element, or to its containing IPFIX
5560 Message via an options record and the messageScope Information
5564 <xref type=
"rfc" data=
"rfc5655"/>
5568 <name>dataRecordsReliability
</name>
5569 <dataType>boolean
</dataType>
5570 <dataTypeSemantics>identifier
</dataTypeSemantics>
5571 <elementId>276</elementId>
5572 <status>current
</status>
5575 The export reliability of Data Records, within this SCTP
5576 stream, for the element(s) in the Options Template
5577 scope. A typical example of an element for which the
5578 export reliability will be reported is the templateID,
5579 as specified in the Data Records Reliability Options
5580 Template. A value of 'True' means that the Exporting
5581 Process MUST send any Data Records associated with the
5582 element(s) reliably within this SCTP stream. A value of
5583 'False' means that the Exporting Process MAY send any
5584 Data Records associated with the element(s) unreliably
5585 within this SCTP stream.
5588 <xref type=
"rfc" data=
"rfc6526"/>
5590 <record date=
"2010-09-16">
5591 <name>observationPointType
</name>
5592 <dataType>unsigned8
</dataType>
5593 <dataTypeSemantics>identifier
</dataTypeSemantics>
5594 <elementId>277</elementId>
5595 <status>current
</status>
5598 Type of observation point. Values assigned to date are:
5610 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5612 <record date=
"2010-10-19">
5613 <name>connectionCountNew
</name>
5614 <dataType>unsigned32
</dataType>
5615 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
5616 <elementId>278</elementId>
5617 <status>current
</status>
5619 <paragraph>This information element counts the number of TCP or UDP
5620 connections which were opened during the observation period. The
5621 observation period may be specified by the flow start and end timestamps.
5624 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5627 <record date=
"2010-10-19">
5628 <name>connectionSumDuration
</name>
5629 <dataType>unsigned64
</dataType>
5630 <elementId>279</elementId>
5631 <status>current
</status>
5633 <paragraph>This information element aggregates the total time in
5634 seconds for all of the TCP or UDP connections which were in use during
5635 the observation period. For example if there are
5 concurrent
5636 connections each for
10 seconds, the value would be
50 s.
5639 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5642 <record date=
"2010-10-19">
5643 <name>connectionTransactionId
</name>
5644 <dataType>unsigned64
</dataType>
5645 <dataTypeSemantics>identifier
</dataTypeSemantics>
5646 <elementId>280</elementId>
5647 <status>current
</status>
5649 <paragraph>This information element identifies a transaction within a
5650 connection. A transaction is a meaningful exchange of application data
5651 between two network devices or a client and server. A transactionId is
5652 assigned the first time a flow is reported, so that later reports for
5653 the same flow will have the same transactionId. A different
5654 transactionId is used for each transaction within a TCP or UDP
5655 connection. The identifiers need not be sequential.
5658 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5661 <record date=
"2010-10-19">
5662 <name>postNATSourceIPv6Address
</name>
5663 <dataType>ipv6Address
</dataType>
5664 <elementId>281</elementId>
5665 <status>current
</status>
5667 <paragraph>The definition of this Information Element is identical to
5668 the definition of Information Element 'sourceIPv6Address', except that
5669 it reports a modified value caused by a NAT64 middlebox function after
5670 the packet passed the Observation Point.
5672 See [RFC2460] for the definition of the Source Address field in the IPv6
5673 header. See [RFC3234] for the definition of middleboxes. See
5674 http://tools.ietf.org/html/draft-ietf-behave-v6v4-xlate-stateful-
12 for
5675 nat64 specification.
5678 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5681 <record date=
"2010-10-19">
5682 <name>postNATDestinationIPv6Address
</name>
5683 <dataType>ipv6Address
</dataType>
5684 <elementId>282</elementId>
5685 <status>current
</status>
5687 <paragraph>The definition of this Information Element is identical to
5688 the definition of Information Element 'destinationIPv6Address', except
5689 that it reports a modified value caused by a NAT64 middlebox function
5690 after the packet passed the Observation Point.
5692 See [RFC2460] for the definition of the Destination Address field in the
5693 IPv6 header. See [RFC3234] for the definition of middleboxes. See
5694 http://tools.ietf.org/html/draft-ietf-behave-v6v4-xlate-stateful-
12 for
5695 nat64 specification.
5698 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5701 <record date=
"2011-02-10">
5702 <name>natPoolId
</name>
5703 <dataType>unsigned32
</dataType>
5704 <dataTypeSemantics>identifier
</dataTypeSemantics>
5705 <elementId>283</elementId>
5706 <status>current
</status>
5708 <paragraph>Locally unique identifier of a NAT pool.
5711 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5714 <record date=
"2011-02-10">
5715 <name>natPoolName
</name>
5716 <dataType>string
</dataType>
5717 <elementId>284</elementId>
5718 <status>current
</status>
5720 <paragraph>The name of a NAT pool identified by a natPoolID.
5723 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
5727 <name>anonymizationFlags
</name>
5728 <dataType>unsigned16
</dataType>
5729 <dataTypeSemantics>flags
</dataTypeSemantics>
5730 <elementId>285</elementId>
5731 <status>current
</status>
5733 <paragraph>A flag word describing specialized modifications to
5734 the anonymization policy in effect for the anonymization technique
5735 applied to a referenced Information Element within a referenced
5736 Template. When flags are clear (
0), the normal policy (as
5737 described by anonymizationTechnique) applies without modification.
5740 MSB
14 13 12 11 10 9 8 7 6 5 4 3 2 1 LSB
5741 +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
5742 | Reserved |LOR|PmA| SC |
5743 +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
5745 anonymizationFlags IE
5747 +--------+----------+-----------------------------------------------+
5748 | bit(s) | name | description |
5751 +--------+----------+-----------------------------------------------+
5752 |
0-
1 | SC | Stability Class: see the Stability Class |
5753 | | | table below, and section Section
5.1. |
5754 |
2 | PmA | Perimeter Anonymization: when set (
1), |
5755 | | | source- Information Elements as described in |
5756 | | | [RFC5103] are interpreted as external |
5757 | | | addresses, and destination- Information |
5758 | | | Elements as described in [RFC5103] are |
5759 | | | interpreted as internal addresses, for the |
5760 | | | purposes of associating |
5761 | | | anonymizationTechnique to Information |
5762 | | | Elements only; see Section
7.2.2 for details. |
5763 | | | This bit MUST NOT be set when associated with |
5764 | | | a non-endpoint (i.e., source- or |
5765 | | | destination-) Information Element. SHOULD be |
5766 | | | consistent within a record (i.e., if a |
5767 | | | source- Information Element has this flag |
5768 | | | set, the corresponding destination- element |
5769 | | | SHOULD have this flag set, and vice-versa.) |
5770 |
3 | LOR | Low-Order Unchanged: when set (
1), the |
5771 | | | low-order bits of the anonymized Information |
5772 | | | Element contain real data. This modification |
5773 | | | is intended for the anonymization of |
5774 | | | network-level addresses while leaving |
5775 | | | host-level addresses intact in order to |
5776 | | | preserve host level-structure, which could |
5777 | | | otherwise be used to reverse anonymization. |
5778 | | | MUST NOT be set when associated with a |
5779 | | | truncation-based anonymizationTechnique. |
5780 |
4-
15 | Reserved | Reserved for future use: SHOULD be cleared |
5781 | | | (
0) by the Exporting Process and MUST be |
5782 | | | ignored by the Collecting Process. |
5783 +--------+----------+-----------------------------------------------+
5786 The Stability Class portion of this flags word describes the
5787 stability class of the anonymization technique applied to a
5788 referenced Information Element within a referenced Template.
5789 Stability classes refer to the stability of the parameters of the
5790 anonymization technique, and therefore the comparability of the
5791 mapping between the real and anonymized values over time. This
5792 determines which anonymized datasets may be compared with each
5793 other. Values are as follows:
5796 +-----+-----+-------------------------------------------------------+
5797 | Bit | Bit | Description |
5799 +-----+-----+-------------------------------------------------------+
5800 |
0 |
0 | Undefined: the Exporting Process makes no |
5801 | | | representation as to how stable the mapping is, or |
5802 | | | over what time period values of this field will |
5803 | | | remain comparable; while the Collecting Process MAY |
5804 | | | assume Session level stability, Session level |
5805 | | | stability is not guaranteed. Processes SHOULD assume |
5806 | | | this is the case in the absence of stability class |
5807 | | | information; this is the default stability class. |
5808 |
0 |
1 | Session: the Exporting Process will ensure that the |
5809 | | | parameters of the anonymization technique are stable |
5810 | | | during the Transport Session. All the values of the |
5811 | | | described Information Element for each Record |
5812 | | | described by the referenced Template within the |
5813 | | | Transport Session are comparable. The Exporting |
5814 | | | Process SHOULD endeavour to ensure at least this |
5815 | | | stability class. |
5816 |
1 |
0 | Exporter-Collector Pair: the Exporting Process will |
5817 | | | ensure that the parameters of the anonymization |
5818 | | | technique are stable across Transport Sessions over |
5819 | | | time with the given Collecting Process, but may use |
5820 | | | different parameters for different Collecting |
5821 | | | Processes. Data exported to different Collecting |
5822 | | | Processes are not comparable. |
5823 |
1 |
1 | Stable: the Exporting Process will ensure that the |
5824 | | | parameters of the anonymization technique are stable |
5825 | | | across Transport Sessions over time, regardless of |
5826 | | | the Collecting Process to which it is sent. |
5827 +-----+-----+-------------------------------------------------------+
5830 <xref type=
"rfc" data=
"rfc6235"/>
5834 <name>anonymizationTechnique
</name>
5835 <dataType>unsigned16
</dataType>
5836 <dataTypeSemantics>identifier
</dataTypeSemantics>
5837 <elementId>286</elementId>
5838 <status>current
</status>
5841 A description of the anonymization technique applied
5842 to a referenced Information Element within a referenced Template.
5843 Each technique may be applicable only to certain Information
5844 Elements and recommended only for certain Infomation Elements;
5845 these restrictions are noted in the table below.
5848 +-------+---------------------------+-----------------+-------------+
5849 | Value | Description | Applicable to | Recommended |
5851 +-------+---------------------------+-----------------+-------------+
5852 |
0 | Undefined: the Exporting | all | all |
5853 | | Process makes no | | |
5854 | | representation as to | | |
5855 | | whether the defined field | | |
5856 | | is anonymized or not. | | |
5857 | | While the Collecting | | |
5858 | | Process MAY assume that | | |
5859 | | the field is not | | |
5860 | | anonymized, it is not | | |
5861 | | guaranteed not to be. | | |
5862 | | This is the default | | |
5863 | | anonymization technique. | | |
5864 |
1 | None: the values exported | all | all |
5866 |
2 | Precision | all | all |
5867 | | Degradation/Truncation: | | |
5868 | | the values exported are | | |
5869 | | anonymized using simple | | |
5870 | | precision degradation or | | |
5871 | | truncation. The new | | |
5872 | | precision or number of | | |
5873 | | truncated bits is | | |
5874 | | implicit in the exported | | |
5875 | | data, and can be deduced | | |
5876 | | by the Collecting | | |
5878 |
3 | Binning: the values | all | all |
5879 | | exported are anonymized | | |
5880 | | into bins. | | |
5881 |
4 | Enumeration: the values | all | timestamps |
5882 | | exported are anonymized | | |
5883 | | by enumeration. | | |
5884 |
5 | Permutation: the values | all | identifiers |
5885 | | exported are anonymized | | |
5886 | | by permutation. | | |
5887 |
6 | Structured Permutation: | addresses | |
5888 | | the values exported are | | |
5889 | | anonymized by | | |
5890 | | permutation, preserving | | |
5891 | | bit-level structure as | | |
5892 | | appropriate; this | | |
5893 | | represents | | |
5894 | | prefix-preserving IP | | |
5895 | | address anonymization or | | |
5896 | | structured MAC address | | |
5897 | | anonymization. | | |
5898 |
7 | Reverse Truncation: the | addresses | |
5899 | | values exported are | | |
5900 | | anonymized using reverse | | |
5901 | | truncation. The number | | |
5902 | | of truncated bits is | | |
5903 | | implicit in the exported | | |
5904 | | data, and can be deduced | | |
5905 | | by the Collecting | | |
5907 |
8 | Noise: the values | non-identifiers | counters |
5908 | | exported are anonymized | | |
5909 | | by adding random noise to | | |
5910 | | each value. | | |
5911 |
9 | Offset: the values | all | timestamps |
5912 | | exported are anonymized | | |
5913 | | by adding a single offset | | |
5914 | | to all values. | | |
5915 +-------+---------------------------+-----------------+-------------+
5918 <xref type=
"rfc" data=
"rfc6235"/>
5922 <name>informationElementIndex
</name>
5923 <dataType>unsigned16
</dataType>
5924 <dataTypeSemantics>identifier
</dataTypeSemantics>
5925 <elementId>287</elementId>
5926 <status>current
</status>
5928 <paragraph>A zero-based index of an Information Element
5929 referenced by informationElementId within a Template referenced by
5930 templateId; used to disambiguate scope for templates containing
5931 multiple identical Information Elements.
</paragraph>
5933 <xref type=
"rfc" data=
"rfc6235"/>
5939 <dataType>string
</dataType>
5940 <elementId>288</elementId>
5941 <status>current
</status>
5943 <paragraph>Specifies if the Application ID is based on peer-to-peer
5947 Possible values are: {
"yes",
"y",
1 },
5948 {
"no",
"n",
2 } and {
"unassigned",
"u",
0 }.
5951 <xref type=
"rfc" data=
"rfc6759"/>
5955 <name>tunnelTechnology
5957 <dataType>string
</dataType>
5958 <elementId>289</elementId>
5959 <status>current
</status>
5961 <paragraph>Specifies if the Application ID is used as a tunnel technology.
5964 Possible values are: {
"yes",
"y",
1 }, {
"no",
"n",
2 } and
5965 {
"unassigned",
"u",
0 }.
5968 <xref type=
"rfc" data=
"rfc6759"/>
5972 <name>encryptedTechnology
5974 <dataType>string
</dataType>
5975 <elementId>290</elementId>
5976 <status>current
</status>
5978 <paragraph>Specifies if the Application ID is an encrypted networking
5981 <paragraph>Possible values are: {
"yes",
"y",
1 },
5982 {
"no",
"n",
2 } and {
"unassigned",
"u",
0 }.
5985 <xref type=
"rfc" data=
"rfc6759"/>
5989 <name>basicList
</name>
5990 <dataType>basicList
</dataType>
5991 <dataTypeSemantics>list
</dataTypeSemantics>
5992 <elementId>291</elementId>
5993 <status>current
</status>
5996 Specifies a generic Information Element with a basicList abstract
5997 data type. For example, a list of port numbers, a list of
5998 interface indexes, etc.
6001 <xref type=
"rfc" data=
"rfc6313"/>
6005 <name>subTemplateList
</name>
6006 <dataType>subTemplateList
</dataType>
6007 <dataTypeSemantics>list
</dataTypeSemantics>
6008 <elementId>292</elementId>
6009 <status>current
</status>
6012 Specifies a generic Information Element with a subTemplateList
6016 <xref type=
"rfc" data=
"rfc6313"/>
6020 <name>subTemplateMultiList
</name>
6021 <dataType>subTemplateMultiList
</dataType>
6022 <dataTypeSemantics>list
</dataTypeSemantics>
6023 <elementId>293</elementId>
6024 <status>current
</status>
6027 Specifies a generic Information Element with a
6028 subTemplateMultiList abstract data type.
6031 <xref type=
"rfc" data=
"rfc6313"/>
6035 <name>bgpValidityState
</name>
6036 <dataType>unsigned8
</dataType>
6037 <dataTypeSemantics>identifier
</dataTypeSemantics>
6038 <elementId>294</elementId>
6039 <status>current
</status>
6042 This element describes the
"validity state" of the BGP route correspondent source or destination IP address. If the
"validity state" for this Flow is only available, then the value of this Information Element is
255.
6047 See
<xref type=
"rfc" data=
"rfc4271"/> for a description of BGP-
4,
6048 <xref type=
"draft" data=
"draft-ietf-sidr-pfx-validate"/> for the
6049 definition of
"validity states" and
6050 <xref type=
"draft" data=
"draft-ietf-sidr-origin-validation-signaling"/>
6051 for the encoding of those
"validity states".
6054 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
6058 <name>IPSecSPI
</name>
6059 <dataType>unsigned32
</dataType>
6060 <dataTypeSemantics>identifier
</dataTypeSemantics>
6061 <elementId>295</elementId>
6062 <status>current
</status>
6065 IPSec Security Parameters Index (SPI).
6068 <range>0x0-
0xFFFFFFFF</range>
6071 See
<xref type=
"rfc" data=
"rfc2401"/> for the definition of SPI.
6074 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
6079 <dataType>unsigned32
</dataType>
6080 <dataTypeSemantics>identifier
</dataTypeSemantics>
6081 <elementId>296</elementId>
6082 <status>current
</status>
6085 GRE key, which is used for identifying an individual traffic flow within a tunnel.
6088 <range>0x0-
0xFFFFFFFF</range>
6091 See
<xref type=
"rfc" data=
"rfc1701"/> for the definition of GRE and the GRE Key.
6094 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
6098 <name>natType
</name>
6099 <dataType>unsigned8
</dataType>
6100 <dataTypeSemantics>identifier
</dataTypeSemantics>
6101 <elementId>297</elementId>
6102 <status>current
</status>
6105 The type of NAT treatment:
6120 4 IPv4--
>IPv4 (no NAT)
6126 6 IPv6--
>IPv6 (no NAT)
6132 See
<xref type=
"rfc" data=
"rfc3022"/> for the definition of NAT.
6133 See
<xref type=
"rfc" data=
"rfc1631"/> for the definition of NAT44.
6134 See
<xref type=
"rfc" data=
"rfc6144"/> for the definition of NAT64.
6135 See
<xref type=
"rfc" data=
"rfc6146"/> for the definition of NAT46.
6136 See
<xref type=
"rfc" data=
"rfc6296"/> for the definition of NAT66.
6137 See
<xref type=
"rfc" data=
"rfc791"/> for the definition of IPv4.
6138 See
<xref type=
"rfc" data=
"rfc2460"/> for the definition of IPv6.
6141 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
6145 <name>initiatorPackets
</name>
6146 <dataType>unsigned64
</dataType>
6147 <dataTypeSemantics>identifier
</dataTypeSemantics>
6148 <elementId>298</elementId>
6149 <status>current
</status>
6152 The total number of layer
4 packets in a flow from the
6153 initiator. The initiator is the device which triggered the
6154 session creation, and remains the same for the life of the
6158 <units>packets
</units>
6161 See #
231, initiatorOctets.
6164 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
6168 <name>responderPackets
</name>
6169 <dataType>unsigned64
</dataType>
6170 <dataTypeSemantics>identifier
</dataTypeSemantics>
6171 <elementId>299</elementId>
6172 <status>current
</status>
6175 The total number of layer
4 packets in a flow from the
6176 responder. The responder is the device which replies to the
6177 initiator, and remains the same for the life of the session.
6180 <units>packets
</units>
6183 See #
232, responderOctets.
6186 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
6190 <name>observationDomainName
</name>
6191 <dataType>string
</dataType>
6192 <elementId>300</elementId>
6193 <status>current
</status>
6196 The name of an observation domain identified by an
6197 observationDomainId.
6202 See #
149, observationDomainId.
6205 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
6209 <name>selectionSequenceId
</name>
6210 <dataType>unsigned64
</dataType>
6211 <dataTypeSemantics>identifier
</dataTypeSemantics>
6212 <elementId>301</elementId>
6213 <status>current
</status>
6216 From all the packets observed at an Observation Point, a subset of
6217 the packets is selected by a sequence of one or more Selectors.
6218 The selectionSequenceId is a unique value per Observation Domain,
6219 specifying the Observation Point and the sequence of Selectors
6220 through which the packets are selected.
6223 <xref type=
"rfc" data=
"rfc5477"/>
6227 <name>selectorId
</name>
6228 <dataType>unsigned64
</dataType>
6229 <dataTypeSemantics>identifier
</dataTypeSemantics>
6230 <elementId>302</elementId>
6231 <status>current
</status>
6234 The Selector ID is the unique ID identifying a Primitive Selector.
6235 Each Primitive Selector must have a unique ID in the Observation
6239 <xref type=
"rfc" data=
"rfc5477"/>
6240 <xref type=
"rfc-errata" data=
"2052"/>
6244 <name>informationElementId
</name>
6245 <dataType>unsigned16
</dataType>
6246 <dataTypeSemantics>identifier
</dataTypeSemantics>
6247 <elementId>303</elementId>
6248 <status>current
</status>
6251 This Information Element contains the ID of another Information
6255 <xref type=
"rfc" data=
"rfc5477"/>
6259 <name>selectorAlgorithm
</name>
6260 <dataType>unsigned16
</dataType>
6261 <dataTypeSemantics>identifier
</dataTypeSemantics>
6262 <elementId>304</elementId>
6263 <status>current
</status>
6266 This Information Element identifies the packet selection methods
6267 (e.g., Filtering, Sampling) that are applied by the Selection
6270 Most of these methods have parameters. Further Information
6271 Elements are needed to fully specify packet selection with these
6272 methods and all their parameters.
6274 The methods listed below are defined in [RFC5475]. For their parameters, Information Elements are defined in
6275 the information model document. The names of these Information
6276 Elements are listed for each method identifier.
6278 Further method identifiers may be added to the list below. It
6279 might be necessary to define new Information Elements to specify
6281 The selectorAlgorithm registry is maintained by IANA. New
6282 assignments for the registry will be administered by IANA, and
6283 are subject to Expert Review [RFC5226].
6285 The registry can be updated when specifications of the new
6286 method(s) and any new Information Elements are provided.
6288 The group of experts must double check the selectorAlgorithm
6289 definitions and Information Elements with already defined
6290 selectorAlgorithms and Information Elements for completeness,
6291 accuracy, and redundancy. Those experts will initially be drawn
6292 from the Working Group Chairs and document editors of the IPFIX
6293 and PSAMP Working Groups.
6295 The following packet selection methods identifiers are defined
6299 http://www.iana.org/assignments/psamp-parameters/psamp-parameters.xhtml
6302 There is a broad variety of possible parameters that could be used
6303 for Property match Filtering (
5) but currently there are no agreed
6304 parameters specified.
6307 <xref type=
"rfc" data=
"rfc5477"/>
6311 <name>samplingPacketInterval
</name>
6312 <dataType>unsigned32
</dataType>
6313 <dataTypeSemantics>quantity
</dataTypeSemantics>
6314 <elementId>305</elementId>
6315 <status>current
</status>
6318 This Information Element specifies the number of packets that are
6319 consecutively sampled. A value of
100 means that
100
6320 consecutive packets are sampled.
6322 For example, this Information Element may be used to describe the
6323 configuration of a systematic count-based Sampling Selector.
6326 <units>packets
</units>
6327 <xref type=
"rfc" data=
"rfc5477"/>
6331 <name>samplingPacketSpace
</name>
6332 <dataType>unsigned32
</dataType>
6333 <dataTypeSemantics>quantity
</dataTypeSemantics>
6334 <elementId>306</elementId>
6335 <status>current
</status>
6338 This Information Element specifies the number of packets between
6339 two
"samplingPacketInterval"s. A value of
100 means that the next
6340 interval starts
100 packets (which are not sampled) after the
6341 current
"samplingPacketInterval" is over.
6343 For example, this Information Element may be used to describe the
6344 configuration of a systematic count-based Sampling Selector.
6347 <units>packets
</units>
6348 <xref type=
"rfc" data=
"rfc5477"/>
6352 <name>samplingTimeInterval
</name>
6353 <dataType>unsigned32
</dataType>
6354 <dataTypeSemantics>quantity
</dataTypeSemantics>
6355 <elementId>307</elementId>
6356 <status>current
</status>
6359 This Information Element specifies the time interval in
6360 microseconds during which all arriving packets are sampled.
6362 For example, this Information Element may be used to describe the
6363 configuration of a systematic time-based Sampling Selector.
6366 <units>microseconds
</units>
6367 <xref type=
"rfc" data=
"rfc5477"/>
6371 <name>samplingTimeSpace
</name>
6372 <dataType>unsigned32
</dataType>
6373 <dataTypeSemantics>quantity
</dataTypeSemantics>
6374 <elementId>308</elementId>
6375 <status>current
</status>
6378 This Information Element specifies the time interval in
6379 microseconds between two
"samplingTimeInterval"s. A value of
100
6380 means that the next interval starts
100 microseconds (during which
6381 no packets are sampled) after the current
"samplingTimeInterval"
6384 For example, this Information Element may used to describe the
6385 configuration of a systematic time-based Sampling Selector.
6388 <units>microseconds
</units>
6389 <xref type=
"rfc" data=
"rfc5477"/>
6393 <name>samplingSize
</name>
6394 <dataType>unsigned32
</dataType>
6395 <dataTypeSemantics>quantity
</dataTypeSemantics>
6396 <elementId>309</elementId>
6397 <status>current
</status>
6400 This Information Element specifies the number of elements taken
6401 from the parent Population for random Sampling methods.
6403 For example, this Information Element may be used to describe the
6404 configuration of a random n-out-of-N Sampling Selector.
6407 <units>packets
</units>
6408 <xref type=
"rfc" data=
"rfc5477"/>
6412 <name>samplingPopulation
</name>
6413 <dataType>unsigned32
</dataType>
6414 <dataTypeSemantics>quantity
</dataTypeSemantics>
6415 <elementId>310</elementId>
6416 <status>current
</status>
6419 This Information Element specifies the number of elements in the
6420 parent Population for random Sampling methods.
6422 For example, this Information Element may be used to describe the
6423 configuration of a random n-out-of-N Sampling Selector.
6426 <units>packets
</units>
6427 <xref type=
"rfc" data=
"rfc5477"/>
6431 <name>samplingProbability
</name>
6432 <dataType>float64
</dataType>
6433 <dataTypeSemantics>quantity
</dataTypeSemantics>
6434 <elementId>311</elementId>
6435 <status>current
</status>
6438 This Information Element specifies the probability that a packet
6439 is sampled, expressed as a value between
0 and
1. The probability
6440 is equal for every packet. A value of
0 means no packet was
6441 sampled since the probability is
0.
6443 For example, this Information Element may be used to describe the
6444 configuration of a uniform probabilistic Sampling Selector.
6447 <xref type=
"rfc" data=
"rfc5477"/>
6451 <name>dataLinkFrameSize
</name>
6452 <dataType>unsigned16
</dataType>
6453 <elementId>312</elementId>
6454 <status>current
</status>
6457 This Information Element specifies the length of the selected data
6460 The data link layer is defined in [ISO/IEC
7498-
1:
1994].
6463 <xref type=
"draft" data=
"draft-ietf-ipfix-data-link-layer-monitoring"/>
6467 <name>ipHeaderPacketSection
</name>
6468 <dataType>octetArray
</dataType>
6469 <elementId>313</elementId>
6470 <status>current
</status>
6473 This Information Element, which may have a variable length,
6474 carries a series of octets from the start of the IP header of a
6477 With sufficient length, this element also reports octets from the
6478 IP payload, subject to [RFC2804]. See the Security Considerations
6481 The size of the exported section may be constrained due to
6482 limitations in the IPFIX protocol.
6484 The data for this field MUST NOT be padded.
6487 <xref type=
"rfc" data=
"rfc5477"/>
6491 <name>ipPayloadPacketSection
</name>
6492 <dataType>octetArray
</dataType>
6493 <elementId>314</elementId>
6494 <status>current
</status>
6497 This Information Element, which may have a variable length,
6498 carries a series of octets from the start of the IP payload of a
6501 The IPv4 payload is that part of the packet that follows the IPv4
6502 header and any options, which [RFC0791] refers to as
"data" or
6503 "data octets". For example, see the examples in [RFC0791], APPENDIX A.
6505 The IPv6 payload is the rest of the packet following the
40 octet
6506 IPv6 header. Note that any extension headers present are
6507 considered part of the payload. See [RFC2460] for the IPv6
6510 The size of the exported section may be constrained due to
6511 limitations in the IPFIX protocol.
6513 The data for this field MUST NOT be padded.
6516 <xref type=
"rfc" data=
"rfc5477"/>
6520 <name>dataLinkFrameSection
</name>
6521 <dataType>octetArray
</dataType>
6522 <elementId>315</elementId>
6523 <status>current
</status>
6526 This Information Element carries n octets from the data link frame
6527 of a selected frame, starting sectionOffset octets into the frame.
6529 The sectionObservedOctets expresses how much data was observed,
6530 while the remainder is padding.
6532 When the sectionObservedOctets field corresponding to this
6533 Information Element exists, this Information Element MAY have a
6534 fixed length and MAY be padded, or MAY have a variable length.
6536 When the sectionObservedOctets field corresponding to this
6537 Information Element does not exist, this Information Element
6538 SHOULD have a variable length and MUST NOT be padded. In this
6539 case, the size of the exported section may be constrained due to
6540 limitations in the IPFIX protocol.
6542 Further Information Elements, i.e., dataLinkFrameType and
6543 dataLinkFrameSize are needed to specify the data link type and the
6544 size of the data link frame of this Information Element. A set of
6545 these Information Elements MAY be contained in a structured data
6546 type, as expressed in
<xref type=
"rfc" data=
"rfc6313"/>. Or a set of these Information
6547 Elements MAY be contained in one Flow Record as shown in Appendix
6548 C of
<xref type=
"draft" data=
"draft-ietf-ipfix-data-link-layer-monitoring"/>.
6550 The data link layer is defined in [ISO/IEC
7498-
1:
1994].
6553 <xref type=
"draft" data=
"draft-ietf-ipfix-data-link-layer-monitoring"/>
6557 <name>mplsLabelStackSection
</name>
6558 <dataType>octetArray
</dataType>
6559 <elementId>316</elementId>
6560 <status>current
</status>
6563 This Information Element, which may have a variable length,
6564 carries the first n octets from the MPLS label stack of a sampled
6567 With sufficient length, this element also reports octets from the
6568 MPLS payload, subject to [RFC2804]. See the Security
6569 Considerations section.
6571 See [RFC3031] for the specification of MPLS packets.
6573 See [RFC3032] for the specification of the MPLS label stack.
6575 The size of the exported section may be constrained due to
6576 limitations in the IPFIX protocol.
6578 The data for this field MUST NOT be padded.
6581 <xref type=
"rfc" data=
"rfc5477"/>
6585 <name>mplsPayloadPacketSection
</name>
6586 <dataType>octetArray
</dataType>
6587 <elementId>317</elementId>
6588 <status>current
</status>
6591 This Information Element, which may have a variable length,
6592 carries the first n octets from the MPLS payload of a sampled
6593 packet, being data that follows immediately after the MPLS label
6596 See [RFC3031] for the specification of MPLS packets.
6598 See [RFC3032] for the specification of the MPLS label stack.
6600 The size of the exported section may be constrained due to
6601 limitations in the IPFIX protocol.
6603 The data for this field MUST NOT be padded.
6606 <xref type=
"rfc" data=
"rfc5477"/>
6610 <name>selectorIdTotalPktsObserved
</name>
6611 <dataType>unsigned64
</dataType>
6612 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
6613 <elementId>318</elementId>
6614 <status>current
</status>
6617 This Information Element specifies the total number of packets
6618 observed by a Selector, for a specific value of SelectorId.
6620 This Information Element should be used in an Options Template
6621 scoped to the observation to which it refers. See Section
3.4.2.1
6622 of the IPFIX protocol document [RFC5101].
6625 <units>packets
</units>
6626 <xref type=
"rfc" data=
"rfc5477"/>
6630 <name>selectorIdTotalPktsSelected
</name>
6631 <dataType>unsigned64
</dataType>
6632 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
6633 <elementId>319</elementId>
6634 <status>current
</status>
6637 This Information Element specifies the total number of packets
6638 selected by a Selector, for a specific value of SelectorId.
6640 This Information Element should be used in an Options Template
6641 scoped to the observation to which it refers. See Section
3.4.2.1
6642 of the IPFIX protocol document [RFC5101].
6645 <units>packets
</units>
6646 <xref type=
"rfc" data=
"rfc5477"/>
6650 <name>absoluteError
</name>
6651 <dataType>float64
</dataType>
6652 <dataTypeSemantics>quantity
</dataTypeSemantics>
6653 <elementId>320</elementId>
6654 <status>current
</status>
6657 This Information Element specifies the maximum possible
6658 measurement error of the reported value for a given Information
6659 Element. The absoluteError has the same unit as the Information
6660 Element with which it is associated. The real value of the metric can
6661 differ by absoluteError (positive or negative) from the measured
6664 This Information Element provides only the error for measured
6665 values. If an Information Element contains an estimated value
6666 (from Sampling), the confidence boundaries and confidence level
6667 have to be provided instead, using the upperCILimit, lowerCILimit,
6668 and confidenceLevel Information Elements.
6670 This Information Element should be used in an Options Template
6671 scoped to the observation to which it refers. See Section
3.4.2.1
6672 of the IPFIX protocol document [RFC5101].
6675 <units>The units of the Information Element for which the error is specified.
</units>
6676 <xref type=
"rfc" data=
"rfc5477"/>
6680 <name>relativeError
</name>
6681 <dataType>float64
</dataType>
6682 <dataTypeSemantics>quantity
</dataTypeSemantics>
6683 <elementId>321</elementId>
6684 <status>current
</status>
6687 This Information Element specifies the maximum possible positive
6688 or negative error ratio for the reported value for a given
6689 Information Element as percentage of the measured value. The real
6690 value of the metric can differ by relativeError percent (positive
6691 or negative) from the measured value.
6693 This Information Element provides only the error for measured
6694 values. If an Information Element contains an estimated value
6695 (from Sampling), the confidence boundaries and confidence level
6696 have to be provided instead, using the upperCILimit, lowerCILimit,
6697 and confidenceLevel Information Elements.
6699 This Information Element should be used in an Options Template
6700 scoped to the observation to which it refers. See Section
3.4.2.1
6701 of the IPFIX protocol document [RFC5101].
6704 <xref type=
"rfc" data=
"rfc5477"/>
6708 <name>observationTimeSeconds
</name>
6709 <dataType>dateTimeSeconds
</dataType>
6710 <dataTypeSemantics>quantity
</dataTypeSemantics>
6711 <elementId>322</elementId>
6712 <status>current
</status>
6715 This Information Element specifies the absolute time in seconds of
6719 <units>seconds
</units>
6720 <xref type=
"rfc" data=
"rfc5477"/>
6724 <name>observationTimeMilliseconds
</name>
6725 <dataType>dateTimeMilliseconds
</dataType>
6726 <dataTypeSemantics>quantity
</dataTypeSemantics>
6727 <elementId>323</elementId>
6728 <status>current
</status>
6731 This Information Element specifies the absolute time in
6732 milliseconds of an observation.
6735 <units>milliseconds
</units>
6736 <xref type=
"rfc" data=
"rfc5477"/>
6740 <name>observationTimeMicroseconds
</name>
6741 <dataType>dateTimeMicroseconds
</dataType>
6742 <dataTypeSemantics>quantity
</dataTypeSemantics>
6743 <elementId>324</elementId>
6744 <status>current
</status>
6747 This Information Element specifies the absolute time in
6748 microseconds of an observation.
6751 <units>microseconds
</units>
6752 <xref type=
"rfc" data=
"rfc5477"/>
6756 <name>observationTimeNanoseconds
</name>
6757 <dataType>dateTimeNanoseconds
</dataType>
6758 <dataTypeSemantics>quantity
</dataTypeSemantics>
6759 <elementId>325</elementId>
6760 <status>current
</status>
6763 This Information Element specifies the absolute time in
6764 nanoseconds of an observation.
6767 <units>nanoseconds
</units>
6768 <xref type=
"rfc" data=
"rfc5477"/>
6772 <name>digestHashValue
</name>
6773 <dataType>unsigned64
</dataType>
6774 <dataTypeSemantics>quantity
</dataTypeSemantics>
6775 <elementId>326</elementId>
6776 <status>current
</status>
6779 This Information Element specifies the value from the digest hash
6782 See also Sections
6.2,
3.8 and
7.1 of [RFC5475].
6785 <xref type=
"rfc" data=
"rfc5477"/>
6789 <name>hashIPPayloadOffset
</name>
6790 <dataType>unsigned64
</dataType>
6791 <dataTypeSemantics>quantity
</dataTypeSemantics>
6792 <elementId>327</elementId>
6793 <status>current
</status>
6796 This Information Element specifies the IP payload offset used by a
6797 Hash-based Selection Selector.
6799 See also Sections
6.2,
3.8 and
7.1 of [RFC5475].
6802 <xref type=
"rfc" data=
"rfc5477"/>
6806 <name>hashIPPayloadSize
</name>
6807 <dataType>unsigned64
</dataType>
6808 <dataTypeSemantics>quantity
</dataTypeSemantics>
6809 <elementId>328</elementId>
6810 <status>current
</status>
6813 This Information Element specifies the IP payload size used by a
6814 Hash-based Selection Selector. See also Sections
6.2,
3.8 and
7.1 of
6818 <xref type=
"rfc" data=
"rfc5477"/>
6822 <name>hashOutputRangeMin
</name>
6823 <dataType>unsigned64
</dataType>
6824 <dataTypeSemantics>quantity
</dataTypeSemantics>
6825 <elementId>329</elementId>
6826 <status>current
</status>
6829 This Information Element specifies the value for the beginning of
6830 a hash function's potential output range.
6832 See also Sections
6.2,
3.8 and
7.1 of [RFC5475].
6835 <xref type=
"rfc" data=
"rfc5477"/>
6839 <name>hashOutputRangeMax
</name>
6840 <dataType>unsigned64
</dataType>
6841 <dataTypeSemantics>quantity
</dataTypeSemantics>
6842 <elementId>330</elementId>
6843 <status>current
</status>
6846 This Information Element specifies the value for the end of a hash
6847 function's potential output range.
6849 See also Sections
6.2,
3.8 and
7.1 of [RFC5475].
6852 <xref type=
"rfc" data=
"rfc5477"/>
6856 <name>hashSelectedRangeMin
</name>
6857 <dataType>unsigned64
</dataType>
6858 <dataTypeSemantics>quantity
</dataTypeSemantics>
6859 <elementId>331</elementId>
6860 <status>current
</status>
6863 This Information Element specifies the value for the beginning of
6864 a hash function's selected range.
6866 See also Sections
6.2,
3.8 and
7.1 of [RFC5475].
6869 <xref type=
"rfc" data=
"rfc5477"/>
6873 <name>hashSelectedRangeMax
</name>
6874 <dataType>unsigned64
</dataType>
6875 <dataTypeSemantics>quantity
</dataTypeSemantics>
6876 <elementId>332</elementId>
6877 <status>current
</status>
6880 This Information Element specifies the value for the end of a hash
6881 function's selected range.
6883 See also Sections
6.2,
3.8 and
7.1 of [RFC5475].
6886 <xref type=
"rfc" data=
"rfc5477"/>
6890 <name>hashDigestOutput
</name>
6891 <dataType>boolean
</dataType>
6892 <dataTypeSemantics>quantity
</dataTypeSemantics>
6893 <elementId>333</elementId>
6894 <status>current
</status>
6897 This Information Element contains a boolean value that is TRUE if
6898 the output from this hash Selector has been configured to be
6899 included in the packet report as a packet digest, else FALSE.
6901 See also Sections
6.2,
3.8 and
7.1 of [RFC5475].
6904 <xref type=
"rfc" data=
"rfc5477"/>
6908 <name>hashInitialiserValue
</name>
6909 <dataType>unsigned64
</dataType>
6910 <dataTypeSemantics>quantity
</dataTypeSemantics>
6911 <elementId>334</elementId>
6912 <status>current
</status>
6915 This Information Element specifies the initialiser value to the
6918 See also Sections
6.2,
3.8 and
7.1 of [RFC5475].
6921 <xref type=
"rfc" data=
"rfc5477"/>
6925 <name>selectorName
</name>
6926 <dataType>string
</dataType>
6927 <elementId>335</elementId>
6928 <status>current
</status>
6931 The name of a selector identified by a selectorID. Globally
6932 unique per Metering Process.
6935 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
6939 <name>upperCILimit
</name>
6940 <dataType>float64
</dataType>
6941 <dataTypeSemantics>quantity
</dataTypeSemantics>
6942 <elementId>336</elementId>
6943 <status>current
</status>
6946 This Information Element specifies the upper limit of a confidence
6947 interval. It is used to provide an accuracy statement for an
6948 estimated value. The confidence limits define the range in which
6949 the real value is assumed to be with a certain probability p.
6950 Confidence limits always need to be associated with a confidence
6951 level that defines this probability p. Please note that a
6952 confidence interval only provides a probability that the real
6953 value lies within the limits. That means the real value can lie
6954 outside the confidence limits.
6956 The upperCILimit, lowerCILimit, and confidenceLevel Information
6957 Elements should all be used in an Options Template scoped to the
6958 observation to which they refer. See Section
3.4.2.1 of the IPFIX
6959 protocol document [RFC5101].
6961 Note that the upperCILimit, lowerCILimit, and confidenceLevel are
6962 all required to specify confidence, and should be disregarded
6963 unless all three are specified together.
6966 <xref type=
"rfc" data=
"rfc5477"/>
6970 <name>lowerCILimit
</name>
6971 <dataType>float64
</dataType>
6972 <dataTypeSemantics>quantity
</dataTypeSemantics>
6973 <elementId>337</elementId>
6974 <status>current
</status>
6977 This Information Element specifies the lower limit of a confidence
6978 interval. For further information, see the description of
6981 The upperCILimit, lowerCILimit, and confidenceLevel Information
6982 Elements should all be used in an Options Template scoped to the
6983 observation to which they refer. See Section
3.4.2.1 of the IPFIX
6984 protocol document [RFC5101].
6986 Note that the upperCILimit, lowerCILimit, and confidenceLevel are
6987 all required to specify confidence, and should be disregarded
6988 unless all three are specified together.
6991 <xref type=
"rfc" data=
"rfc5477"/>
6995 <name>confidenceLevel
</name>
6996 <dataType>float64
</dataType>
6997 <dataTypeSemantics>quantity
</dataTypeSemantics>
6998 <elementId>338</elementId>
6999 <status>current
</status>
7002 This Information Element specifies the confidence level. It is
7003 used to provide an accuracy statement for estimated values. The
7004 confidence level provides the probability p with which the real
7005 value lies within a given range. A confidence level always needs
7006 to be associated with confidence limits that define the range in
7007 which the real value is assumed to be.
7009 The upperCILimit, lowerCILimit, and confidenceLevel Information
7010 Elements should all be used in an Options Template scoped to the
7011 observation to which they refer. See Section
3.4.2.1 of the IPFIX
7012 protocol document [RFC5101].
7014 Note that the upperCILimit, lowerCILimit, and confidenceLevel are
7015 all required to specify confidence, and should be disregarded
7016 unless all three are specified together.
7019 <xref type=
"rfc" data=
"rfc5477"/>
7022 <name>informationElementDataType
</name>
7023 <dataType>unsigned8
</dataType>
7024 <elementId>339</elementId>
7025 <status>current
</status>
7028 A description of the abstract data type of an IPFIX
7029 information element.These are taken from the abstract data types
7030 defined in section
3.1 of the IPFIX Information Model [RFC5102];
7031 see that section for more information on the types described
7032 in the informationElementDataType sub-registry.
7034 These types are registered in the IANA IPFIX Information Element
7035 Data Type subregistry. This subregistry is intended to assign
7036 numbers for type names, not to provide a mechanism for adding data
7037 types to the IPFIX Protocol, and as such requires a Standards
7038 Action [RFC5226] to modify.
7041 <xref type=
"rfc" data=
"rfc5610"/>
7045 <name>informationElementDescription
</name>
7046 <dataType>string
</dataType>
7047 <elementId>340</elementId>
7048 <status>current
</status>
7051 A UTF-
8 [RFC3629] encoded Unicode string containing a
7052 human-readable description of an Information Element. The content
7053 of the informationElementDescription MAY be annotated with one or
7054 more language tags [RFC4646], encoded in-line [RFC2482] within the
7055 UTF-
8 string, in order to specify the language in which the
7056 description is written. Description text in multiple languages
7057 MAY tag each section with its own language tag; in this case, the
7058 description information in each language SHOULD have equivalent
7059 meaning. In the absence of any language tag, the
"i-default"
7060 [RFC2277] language SHOULD be assumed. See the Security
7061 Considerations section for notes on string handling for
7062 Information Element type records.
7065 <xref type=
"rfc" data=
"rfc5610"/>
7069 <name>informationElementName
</name>
7070 <dataType>string
</dataType>
7071 <elementId>341</elementId>
7072 <status>current
</status>
7075 A UTF-
8 [RFC3629] encoded Unicode string containing
7076 the name of an Information Element, intended as a simple
7077 identifier. See the Security Considerations section for notes on
7078 string handling for Information Element type records
7081 <xref type=
"rfc" data=
"rfc5610"/>
7085 <name>informationElementRangeBegin
</name>
7086 <dataType>unsigned64
</dataType>
7087 <dataTypeSemantics>quantity
</dataTypeSemantics>
7088 <elementId>342</elementId>
7089 <status>current
</status>
7092 Contains the inclusive low end of the range of
7093 acceptable values for an Information Element.
7096 <xref type=
"rfc" data=
"rfc5610"/>
7100 <name>informationElementRangeEnd
</name>
7101 <dataType>unsigned64
</dataType>
7102 <dataTypeSemantics>quantity
</dataTypeSemantics>
7103 <elementId>343</elementId>
7104 <status>current
</status>
7107 Contains the inclusive high end of the range of
7108 acceptable values for an Information Element.
7111 <xref type=
"rfc" data=
"rfc5610"/>
7115 <name>informationElementSemantics
</name>
7116 <dataType>unsigned8
</dataType>
7117 <elementId>344</elementId>
7118 <status>current
</status>
7121 A description of the semantics of an IPFIX Information
7122 Element. These are taken from the data type semantics defined in
7123 section
3.2 of the IPFIX Information Model [RFC5102]; see that
7124 section for more information on the types defined in the informationElementSemantics sub-registry. This
7125 field may take the values in Table ; the special value
0x00
7126 (default) is used to note that no semantics apply to the field; it
7127 cannot be manipulated by a Collecting Process or File Reader that
7128 does not understand it a priori.
7130 These semantics are registered in the IANA IPFIX Information
7131 Element Semantics subregistry. This subregistry is intended to
7132 assign numbers for semantics names, not to provide a mechanism for
7133 adding semantics to the IPFIX Protocol, and as such requires a
7134 Standards Action [RFC5226] to modify.
7137 <xref type=
"rfc" data=
"rfc5610"/>
7141 <name>informationElementUnits
</name>
7142 <dataType>unsigned16
</dataType>
7143 <elementId>345</elementId>
7144 <status>current
</status>
7147 A description of the units of an IPFIX Information
7148 Element. These correspond to the units implicitly defined in the
7149 Information Element definitions in section
5 of the IPFIX
7150 Information Model [RFC5102]; see that section for more information
7151 on the types described in the informationElementsUnits sub-registry. This field may take the values in
7152 Table
3 below; the special value
0x00 (none) is used to note that
7153 the field is unitless.
7155 These types are registered in the IANA IPFIX Information Element
7156 Units subregistry; new types may be added on a First Come First
7157 Served [RFC5226] basis.
7160 <xref type=
"rfc" data=
"rfc5610"/>
7164 <name>privateEnterpriseNumber
</name>
7165 <dataType>unsigned32
</dataType>
7166 <dataTypeSemantics>identifier
</dataTypeSemantics>
7167 <elementId>346</elementId>
7168 <status>current
</status>
7171 A private enterprise number, as assigned by IANA.
7172 Within the context of an Information Element Type record, this
7173 element can be used along with the informationElementId element to
7174 scope properties to a specific Information Element. To export
7175 type information about an IANA-assigned Information Element, set
7176 the privateEnterpriseNumber to
0, or do not export the
7177 privateEnterpriseNumber in the type record. To export type
7178 information about an enterprise-specific Information Element,
7179 export the enterprise number in privateEnterpriseNumber, and
7180 export the Information Element number with the Enterprise bit
7181 cleared in informationElementId. The Enterprise bit in the
7182 associated informationElementId Information Element MUST be
7183 ignored by the Collecting Process.
7186 <xref type=
"rfc" data=
"rfc5610"/>
7190 <name>virtualStationInterfaceId
</name>
7191 <dataType>octetArray
</dataType>
7192 <dataTypeSemantics>identifier
</dataTypeSemantics>
7193 <elementId>347</elementId>
7194 <status>current
</status>
7197 Instance Identifier of the interface to a Virtual Station. A Virtual
7198 Station is an end station instance: it can be a virtual machine or a
7204 See IEEE
802.1Qbg for the definition of Virtual Station Interface ID.
7207 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7211 <name>virtualStationInterfaceName
</name>
7212 <dataType>string
</dataType>
7213 <elementId>348</elementId>
7214 <status>current
</status>
7217 Name of the interface to a Virtual Station. A Virtual Station is an end station
7218 instance: it can be a virtual machine or a physical host.
7223 See IEEE
802.1Qbg for the definition of Virtual Station Interface.
7226 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7230 <name>virtualStationUUID
</name>
7231 <dataType>octetArray
</dataType>
7232 <dataTypeSemantics>identifier
</dataTypeSemantics>
7233 <elementId>349</elementId>
7234 <status>current
</status>
7237 Unique Identifier of a Virtual Station. A Virtual Station is an end station
7238 instance: it can be a virtual machine or a physical host.
7243 See IEEE
802.1Qbg for the definition of Virtual Station.
7246 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7250 <name>virtualStationName
</name>
7251 <dataType>string
</dataType>
7252 <elementId>350</elementId>
7253 <status>current
</status>
7256 Name of a Virtual Station. A Virtual Station is an end station
7257 instance: it can be a virtual machine or a physical host.
7262 See IEEE
802.1Qbg for the definition of Virtual Station.
7265 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7269 <name>layer2SegmentId
</name>
7270 <dataType>unsigned64
</dataType>
7271 <dataTypeSemantics>identifier
</dataTypeSemantics>
7272 <elementId>351</elementId>
7273 <status>current
</status>
7276 Identifier of a layer
2 network segment in an overlay network.
7277 The most significant byte identifies the layer
2 network
7278 overlay network encapsulation type:
7290 The three lowest significant bytes
7291 hold the value of the layer
2
7292 overlay network segment identifier.
7298 - a
24 bit segment ID VXLAN Network
7302 - a
24 bit Tenant Network Identifier
7308 See VxLAN RFC at http://tools.ietf.org/html/draft-mahalingam-dutt-dcops-vxlan-
00
7311 See NVGRE RFC at http://tools.ietf.org/html/draft-sridharan-virtualization-nvgre-
00
7314 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7317 <name>layer2OctetDeltaCount
</name>
7318 <dataType>unsigned64
</dataType>
7319 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
7320 <elementId>352</elementId>
7321 <status>current
</status>
7324 The number of layer
2 octets since the previous report (if any) in
7325 incoming packets for this Flow at the Observation Point. The
7326 number of octets includes layer
2 header(s) and layer
2 payload.
7327 # memo: layer
2 version of octetDeltaCount (field #
1)
7330 <units>octets
</units>
7333 <xref type=
"draft" data=
"draft-kashima-ipfix-data-link-layer-monitoring"/>
7336 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7340 <name>layer2OctetTotalCount
</name>
7341 <dataType>unsigned64
</dataType>
7342 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
7343 <elementId>353</elementId>
7344 <status>current
</status>
7347 The total number of layer
2 octets in incoming packets for this
7348 Flow at the Observation Point since the Metering Process
7349 (re-)initialization for this Observation Point. The number of
7350 octets includes layer
2 header(s) and layer
2 payload.
7351 # memo: layer
2 version of octetTotalCount (field #
85)
7354 <units>octets
</units>
7357 <xref type=
"draft" data=
"draft-kashima-ipfix-data-link-layer-monitoring"/>
7360 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7364 <name>ingressUnicastPacketTotalCount
</name>
7365 <dataType>unsigned64
</dataType>
7366 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
7367 <elementId>354</elementId>
7368 <status>current
</status>
7371 The total number of incoming unicast packets metered at the
7372 Observation Point since the Metering Process (re-)initialization
7373 for this Observation Point.
7376 <units>packets
</units>
7377 <references><paragraph/></references>
7378 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7382 <name>ingressMulticastPacketTotalCount
</name>
7383 <dataType>unsigned64
</dataType>
7384 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
7385 <elementId>355</elementId>
7386 <status>current
</status>
7389 The total number of incoming multicast packets metered at the
7390 Observation Point since the Metering Process (re-)initialization
7391 for this Observation Point.
7394 <units>packets
</units>
7395 <references><paragraph/></references>
7396 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7400 <name>ingressBroadcastPacketTotalCount
</name>
7401 <dataType>unsigned64
</dataType>
7402 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
7403 <elementId>356</elementId>
7404 <status>current
</status>
7407 The total number of incoming broadcast packets metered at the
7408 Observation Point since the Metering Process (re-)initialization
7409 for this Observation Point.
7412 <units>packets
</units>
7413 <references><paragraph/></references>
7414 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7418 <name>egressUnicastPacketTotalCount
</name>
7419 <dataType>unsigned64
</dataType>
7420 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
7421 <elementId>357</elementId>
7422 <status>current
</status>
7425 The total number of incoming unicast packets metered at the
7426 Observation Point since the Metering Process (re-)initialization
7427 for this Observation Point.
7430 <units>packets
</units>
7431 <references><paragraph/></references>
7432 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7436 <name>egressBroadcastPacketTotalCount
</name>
7437 <dataType>unsigned64
</dataType>
7438 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
7439 <elementId>358</elementId>
7440 <status>current
</status>
7443 The total number of incoming broadcast packets metered at the
7444 Observation Point since the Metering Process (re-)initialization
7445 for this Observation Point.
7448 <units>packets
</units>
7449 <references><paragraph/></references>
7450 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7454 <name>monitoringIntervalStartMilliSeconds
</name>
7455 <dataType>dateTimeMilliseconds
</dataType>
7456 <elementId>359</elementId>
7457 <status>current
</status>
7460 The absolute timestamp at which the monitoring interval
7462 A Monitoring interval is the period of time during which the Metering
7466 <units>milliseconds
</units>
7467 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7471 <name>monitoringIntervalEndMilliSeconds
</name>
7472 <dataType>dateTimeMilliseconds
</dataType>
7473 <elementId>360</elementId>
7474 <status>current
</status>
7477 The absolute timestamp at which the monitoring interval ended.
7478 A Monitoring interval is the period of time during which the Metering
7482 <units>milliseconds
</units>
7483 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7487 <name>portRangeStart
</name>
7488 <dataType>unsigned16
</dataType>
7489 <dataTypeSemantics>identifier
</dataTypeSemantics>
7490 <elementId>361</elementId>
7491 <status>current
</status>
7494 The port number identifying the start of a range of ports. A value
7495 of zero indicates that the range start is not specified, ie the
7496 range is defined in some other way.
7499 Additional information on defined TCP port numbers can be found at
7500 http://www.iana.org/assignments/service-names-port-numbers.
7503 <references><paragraph/></references>
7504 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7508 <name>portRangeEnd
</name>
7509 <dataType>unsigned16
</dataType>
7510 <dataTypeSemantics>identifier
</dataTypeSemantics>
7511 <elementId>362</elementId>
7512 <status>current
</status>
7515 The port number identifying the end of a range of ports. A value
7516 of zero indicates that the range end is not specified, ie the
7517 range is defined in some other way.
7520 Additional information on defined TCP port numbers can be found at
7521 http://www.iana.org/assignments/service-names-port-numbers.
7524 <references><paragraph/></references>
7525 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7529 <name>portRangeStepSize
</name>
7530 <dataType>unsigned16
</dataType>
7531 <dataTypeSemantics>identifier
</dataTypeSemantics>
7532 <elementId>363</elementId>
7533 <status>current
</status>
7536 The step size in a port range. The default step size is
1,
7537 which indicates contiguous ports. A value of zero indicates
7538 that the step size is not specified, ie the range is defined
7542 <references><paragraph/></references>
7543 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7547 <name>portRangeNumPorts
</name>
7548 <dataType>unsigned16
</dataType>
7549 <dataTypeSemantics>identifier
</dataTypeSemantics>
7550 <elementId>364</elementId>
7551 <status>current
</status>
7554 The number of ports in a port range. A value of zero indicates
7555 that the number of ports is not specified, ie the range is defined
7559 <references><paragraph/></references>
7560 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7564 <name>staMacAddress
</name>
7565 <dataType>macAddress
</dataType>
7566 <dataTypeSemantics>identifier
</dataTypeSemantics>
7567 <elementId>365</elementId>
7568 <status>current
</status>
7571 The IEEE
802 MAC address of a wireless station (STA).
7575 <paragraph>See section
1.4 of RFC5415 for the definition of STA.
</paragraph>
7577 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7581 <name>staIPv4Address
</name>
7582 <dataType>ipv4Address
</dataType>
7583 <dataTypeSemantics>identifier
</dataTypeSemantics>
7584 <elementId>366</elementId>
7585 <status>current
</status>
7588 The IPv4 address of a wireless station (STA).
7592 <paragraph>See section
1.4 of RFC5415 for the definition of STA.
</paragraph>
7594 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7598 <name>wtpMacAddress
</name>
7599 <dataType>macAddress
</dataType>
7600 <dataTypeSemantics>identifier
</dataTypeSemantics>
7601 <elementId>367</elementId>
7602 <status>current
</status>
7605 The IEEE
802 MAC address of a wireless access point (WTP).
7609 <paragraph>See section
1.4 of RFC5415 for the definition of WTP.
</paragraph>
7611 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7615 <name>ingressInterfaceType
</name>
7616 <dataType>unsigned32
</dataType>
7617 <dataTypeSemantics>identifier
</dataTypeSemantics>
7618 <elementId>368</elementId>
7619 <status>current
</status>
7622 The type of interface where packets of this Flow are being received.
7623 The value matches the value of managed object 'ifType' as defined in
7624 http://www.iana.org/assignments/ianaiftype-mib/ianaiftype-mib
7628 <paragraph>http://www.iana.org/assignments/ianaiftype-mib/ianaiftype-mib
</paragraph>
7630 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7634 <name>egressInterfaceType
</name>
7635 <dataType>unsigned32
</dataType>
7636 <dataTypeSemantics>identifier
</dataTypeSemantics>
7637 <elementId>369</elementId>
7638 <status>current
</status>
7641 The type of interface where packets of this Flow are being sent.
7642 The value matches the value of managed object 'ifType' as defined in
7643 http://www.iana.org/assignments/ianaiftype-mib/ianaiftype-mib
7647 <paragraph>http://www.iana.org/assignments/ianaiftype-mib/ianaiftype-mib
</paragraph>
7649 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7653 <name>rtpSequenceNumber
</name>
7654 <dataType>unsigned16
</dataType>
7655 <elementId>370</elementId>
7656 <status>current
</status>
7659 The RTP sequence number per RFC3550.
7662 <xref type=
"rfc" data=
"rfc3550"/>
7663 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7667 <name>userName
</name>
7668 <dataType>string
</dataType>
7669 <elementId>371</elementId>
7670 <status>current
</status>
7673 User name associated with the flow.
7676 <xref type=
"person" data=
"ipfix-iana_at_cisco.com"/>
7680 <name>applicationCategoryName
</name>
7681 <dataType>string
</dataType>
7682 <elementId>372</elementId>
7683 <status>current
</status>
7686 An attribute that provides a first level categorization for
7687 each Application ID.
7690 <xref type=
"rfc" data=
"rfc6759"/>
7694 <name>applicationSubCategoryName
</name>
7695 <dataType>string
</dataType>
7696 <elementId>373</elementId>
7697 <status>current
</status>
7700 An attribute that provides a second level categorization
7701 for each Application ID.
7704 <xref type=
"rfc" data=
"rfc6759"/>
7708 <name>applicationGroupName
</name>
7709 <dataType>string
</dataType>
7710 <elementId>374</elementId>
7711 <status>current
</status>
7714 An attribute that groups multiple Application IDs that
7715 belong to the same networking application.
7718 <xref type=
"rfc" data=
"rfc6759"/>
7722 <name>originalFlowsPresent
</name>
7723 <dataType>unsigned64
</dataType>
7724 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
7725 <elementId>375</elementId>
7726 <status>current
</status>
7729 The non-conservative count of Original Flows
7730 contributing to this Aggregated Flow. Non-conservative counts
7731 need not sum to the original count on re-aggregation.
7734 <xref type=
"draft" data=
"RFC-ietf-ipfix-a9n-08"/>
7738 <name>originalFlowsInitiated
</name>
7739 <dataType>unsigned64
</dataType>
7740 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
7741 <elementId>376</elementId>
7742 <status>current
</status>
7745 The conservative count of Original Flows whose first
7746 packet is represented within this Aggregated Flow. Conservative
7747 counts must sum to the original count on re-aggregation.
7750 <xref type=
"draft" data=
"RFC-ietf-ipfix-a9n-08"/>
7754 <name>originalFlowsCompleted
</name>
7755 <dataType>unsigned64
</dataType>
7756 <dataTypeSemantics>deltaCounter
</dataTypeSemantics>
7757 <elementId>377</elementId>
7758 <status>current
</status>
7761 The conservative count of Original Flows whose last
7762 packet is represented within this Aggregated Flow. Conservative
7763 counts must sum to the original count on re-aggregation.
7766 <xref type=
"draft" data=
"RFC-ietf-ipfix-a9n-08"/>
7770 <name>distinctCountOfSourceIPAddress
</name>
7771 <dataType>unsigned64
</dataType>
7772 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
7773 <elementId>378</elementId>
7774 <status>current
</status>
7777 The count of distinct source IP address values for
7778 Original Flows contributing to this Aggregated Flow, without
7779 regard to IP version. This Information Element is preferred to
7780 the IP-version-specific counters, unless it is important to
7781 separate the counts by version.
7784 <xref type=
"draft" data=
"RFC-ietf-ipfix-a9n-08"/>
7788 <name>distinctCountOfDestinationIPAddress
</name>
7789 <dataType>unsigned64
</dataType>
7790 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
7791 <elementId>379</elementId>
7792 <status>current
</status>
7795 The count of distinct destination IP address values
7796 for Original Flows contributing to this Aggregated Flow, without
7797 regard to IP version. This Information Element is preferred to
7798 the version-specific counters below, unless it is important to
7799 separate the counts by version.
7802 <xref type=
"draft" data=
"RFC-ietf-ipfix-a9n-08"/>
7806 <name>distinctCountOfSourceIPv4Address
</name>
7807 <dataType>unsigned32
</dataType>
7808 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
7809 <elementId>380</elementId>
7810 <status>current
</status>
7813 The count of distinct source IPv4 address values for
7814 Original Flows contributing to this Aggregated Flow.
7817 <xref type=
"draft" data=
"RFC-ietf-ipfix-a9n-08"/>
7821 <name>distinctCountOfDestinationIPv4Address
</name>
7822 <dataType>unsigned32
</dataType>
7823 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
7824 <elementId>381</elementId>
7825 <status>current
</status>
7828 The count of distinct destination IPv4 address values
7829 for Original Flows contributing to this Aggregated Flow.
7832 <xref type=
"draft" data=
"RFC-ietf-ipfix-a9n-08"/>
7836 <name>distinctCountOfSourceIPv6Address
</name>
7837 <dataType>unsigned64
</dataType>
7838 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
7839 <elementId>382</elementId>
7840 <status>current
</status>
7843 The count of distinct source IPv6 address values for
7844 Original Flows contributing to this Aggregated Flow.
7847 <xref type=
"draft" data=
"RFC-ietf-ipfix-a9n-08"/>
7851 <name>distinctCountOfDestinationIPv6Address
</name>
7852 <dataType>unsigned64
</dataType>
7853 <dataTypeSemantics>totalCounter
</dataTypeSemantics>
7854 <elementId>383</elementId>
7855 <status>current
</status>
7858 The count of distinct destination IPv6 address values
7859 for Original Flows contributing to this Aggregated Flow.
7862 <xref type=
"draft" data=
"RFC-ietf-ipfix-a9n-08"/>
7866 <name>valueDistributionMethod
</name>
7867 <dataType>unsigned8
</dataType>
7868 <elementId>384</elementId>
7869 <status>current
</status>
7872 A description of the method used to distribute the
7873 counters from Contributing Flows into the Aggregated Flow records
7874 described by an associated scope, generally a Template. The
7875 method is deemed to apply to all the non-key Information Elements
7876 in the referenced scope for which value distribution is a valid
7877 operation; if the originalFlowsInitiated and/or
7878 originalFlowsCompleted Information Elements appear in the
7879 Template, they are not subject to this distribution method, as
7880 they each infer their own distribution method. This is intended
7881 to be a complete set of possible value distribution methods; it is
7885 +-------+-----------------------------------------------------------+
7886 | Value | Description |
7887 +-------+-----------------------------------------------------------+
7888 |
0 | Unspecified: The counters for an Original Flow are |
7889 | | explicitly not distributed according to any other method |
7890 | | defined for this Information Element; use for arbitrary |
7891 | | distribution, or distribution algorithms not described by |
7892 | | any other codepoint. |
7893 | | --------------------------------------------------------- |
7895 |
1 | Start Interval: The counters for an Original Flow are |
7896 | | added to the counters of the appropriate Aggregated Flow |
7897 | | containing the start time of the Original Flow. This |
7898 | | should be assumed the default if value distribution |
7899 | | information is not available at a Collecting Process for |
7900 | | an Aggregated Flow. |
7901 | | --------------------------------------------------------- |
7903 |
2 | End Interval: The counters for an Original Flow are added |
7904 | | to the counters of the appropriate Aggregated Flow |
7905 | | containing the end time of the Original Flow. |
7906 | | --------------------------------------------------------- |
7908 |
3 | Mid Interval: The counters for an Original Flow are added |
7909 | | to the counters of a single appropriate Aggregated Flow |
7910 | | containing some timestamp between start and end time of |
7911 | | the Original Flow. |
7912 | | --------------------------------------------------------- |
7914 |
4 | Simple Uniform Distribution: Each counter for an Original |
7915 | | Flow is divided by the number of time intervals the |
7916 | | Original Flow covers (i.e., of appropriate Aggregated |
7917 | | Flows sharing the same Flow Key), and this number is |
7918 | | added to each corresponding counter in each Aggregated |
7920 | | --------------------------------------------------------- |
7922 |
5 | Proportional Uniform Distribution: Each counter for an |
7923 | | Original Flow is divided by the number of time units the |
7924 | | Original Flow covers, to derive a mean count rate. This |
7925 | | mean count rate is then multiplied by the number of time |
7926 | | units in the intersection of the duration of the Original |
7927 | | Flow and the time interval of each Aggregated Flow. This |
7928 | | is like simple uniform distribution, but accounts for the |
7929 | | fractional portions of a time interval covered by an |
7930 | | Original Flow in the first and last time interval. |
7931 | | --------------------------------------------------------- |
7933 |
6 | Simulated Process: Each counter of the Original Flow is |
7934 | | distributed among the intervals of the Aggregated Flows |
7935 | | according to some function the Intermediate Aggregation |
7936 | | Process uses based upon properties of Flows presumed to |
7937 | | be like the Original Flow. This is essentially an |
7938 | | assertion that the Intermediate Aggregation Process has |
7939 | | no direct packet timing information but is nevertheless |
7940 | | not using one of the other simpler distribution methods. |
7941 | | The Intermediate Aggregation Process specifically makes |
7942 | | no assertion as to the correctness of the simulation. |
7943 | | --------------------------------------------------------- |
7945 |
7 | Direct: The Intermediate Aggregation Process has access |
7946 | | to the original packet timings from the packets making up |
7947 | | the Original Flow, and uses these to distribute or |
7948 | | recalculate the counters. |
7949 +-------+-----------------------------------------------------------+
7952 <xref type=
"draft" data=
"RFC-ietf-ipfix-a9n-08"/>
7956 <name>rfc3550JitterMeanMilliseconds
</name>
7957 <dataType>unsigned32
</dataType>
7958 <dataTypeSemantics>quantity
</dataTypeSemantics>
7959 <elementId>385</elementId>
7960 <status>current
</status>
7963 Interarrival jitter as defined in section
6.4.1 of
<xref type=
"rfc" data=
"rfc3550"/>,
7964 measured in milliseconds.
7967 <units>milliseconds
</units>
7968 <xref type=
"rfc" data=
"rfc3550"/>
7972 <name>rfc3550JitterMeanMicroseconds
</name>
7973 <dataType>unsigned32
</dataType>
7974 <dataTypeSemantics>quantity
</dataTypeSemantics>
7975 <elementId>386</elementId>
7976 <status>current
</status>
7979 Interarrival jitter as defined in section
6.4.1 of
<xref type=
"rfc" data=
"rfc3550"/>,
7980 measured in microseconds.
7983 <units>microseconds
</units>
7984 <xref type=
"rfc" data=
"rfc3550"/>
7988 <name>rfc3550JitterMeanNanoseconds
</name>
7989 <dataType>unsigned32
</dataType>
7990 <dataTypeSemantics>quantity
</dataTypeSemantics>
7991 <elementId>387</elementId>
7992 <status>current
</status>
7995 Interarrival jitter as defined in section
6.4.1 of
<xref type=
"rfc" data=
"rfc3550"/>,
7996 measured in nanoseconds.
7999 <units>nanoseconds
</units>
8000 <xref type=
"rfc" data=
"rfc3550"/>
8005 <elementId>388-
32767</elementId>
8010 <registry id=
"ipfix-mpls-label-type">
8011 <title>IPFIX MPLS label type (Value
46)
</title>
8012 <registration_rule>Expert Review
</registration_rule>
8013 <expert>Primary expert - Nevil Brownlee and Secondary expert - Juergen Quittek
</expert>
8014 <xref type=
"rfc" data=
"rfc5102"/>
8018 <description>TE-MIDPT: Any TE tunnel mid-point or tail label
</description>
8019 <xref type=
"rfc" data=
"rfc5102"/>
8024 <description>Pseudowire: Any PWE3 or Cisco AToM based label
</description>
8025 <xref type=
"rfc" data=
"rfc5102"/>
8030 <description>VPN: Any label associated with VPN
</description>
8031 <xref type=
"rfc" data=
"rfc5102"/>
8036 <description>BGP: Any label associated with BGP or BGP routing
</description>
8037 <xref type=
"rfc" data=
"rfc5102"/>
8042 <description>LDP: Any label associated with dynamically assigned labels using LDP
</description>
8043 <xref type=
"rfc" data=
"rfc5102"/>
8047 <value>6-
255</value>
8048 <description>Unassigned
</description>
8049 <xref type=
"rfc" data=
"rfc5102"/>
8055 <registry id=
"classification-engine-ids">
8056 <title>Classification Engine IDs (Value
101)
</title>
8057 <registration_rule>Expert Review
</registration_rule>
8058 <expert>Primary expert - Nevil Brownlee and Secondary expert - Juergen Quittek
</expert>
8059 <xref type=
"rfc" data=
"rfc6759"/>
8063 <description>Invalid.
</description>
8065 <xref type=
"rfc" data=
"rfc6759"/>
8070 <description>IANA-L3: The Assigned Internet Protocol Number (layer
3 (L3)) is exported in the Selector ID. See http://www.iana.org/assignments/protocol-numbers.
8073 <xref type=
"rfc" data=
"rfc6759"/>
8078 <description>PANA-L3: Proprietary layer
3 definition. An enterprise can export its own layer
3 protocol numbers. The Selector ID has a global significance for all devices from the same enterprise.
8081 <xref type=
"rfc" data=
"rfc6759"/>
8086 <description>IANA-L4: The IANA layer
4 (L4) well-known port
8087 number is exported in the Selector ID. See [http://www.iana.org/assignments/service-names-port-numbers]. Note: as an IPFIX flow is unidirectional,
8088 it contains the destination port in a flow from
8089 the client to the server.
8092 <xref type=
"rfc" data=
"rfc6759"/>
8097 <description>PANA-L4: Proprietary layer
4 definition. An
8098 enterprise can export its own layer
4 port
8099 numbers. The Selector ID has global significance
8100 for devices from the same enterprise. Example:
8101 IPFIX had the port
4739 pre-assigned in the IETF
8102 draft for years. While waiting for the RFC and its
8103 associated IANA registration, the Selector ID
4739
8104 was used with this PANA-L4.
8107 <xref type=
"rfc" data=
"rfc6759"/>
8112 <description>Reserved
</description>
8114 <xref type=
"rfc" data=
"rfc6759"/>
8119 <description>USER-Defined: The Selector ID represents
8120 applications defined by the user (using CLI, GUI,
8121 etc.) based on the methods described in section
2.
8122 The Selector ID has a local significance per
8126 <xref type=
"rfc" data=
"rfc6759"/>
8131 <description>Reserved
</description>
8133 <xref type=
"rfc" data=
"rfc6759"/>
8138 <description>Reserved
</description>
8140 <xref type=
"rfc" data=
"rfc6759"/>
8145 <description>Reserved
</description>
8147 <xref type=
"rfc" data=
"rfc6759"/>
8152 <description>Reserved
</description>
8154 <xref type=
"rfc" data=
"rfc6759"/>
8159 <description>Reserved
</description>
8161 <xref type=
"rfc" data=
"rfc6759"/>
8166 <description>PANA-L2: Proprietary layer
2 (L2) definition. An
8167 enterprise can export its own layer
2 identifiers.
8168 The Selector ID represents the enterprise's unique
8169 global layer
2 applications. The Selector ID has a
8170 global significance for all devices from the same
8171 enterprise. Examples include Cisco Subnetwork
8172 Access Protocol (SNAP).
8175 <xref type=
"rfc" data=
"rfc6759"/>
8180 <description>PANA-L7: Proprietary layer
7 definition. The
8181 Selector ID represents the enterprise's unique
8182 global ID for the layer
7 applications. The
8183 Selector ID has a global significance for all
8184 devices from the same enterprise. This
8185 Classification Engine Id is used when the
8186 application registry is owned by the Exporter
8187 manufacturer (referred to as the
"enterprise" in
8191 <xref type=
"rfc" data=
"rfc6759"/>
8196 <description>Reserved
</description>
8198 <xref type=
"rfc" data=
"rfc6759"/>
8203 <description>Reserved
</description>
8205 <xref type=
"rfc" data=
"rfc6759"/>
8210 <description>Reserved
</description>
8212 <xref type=
"rfc" data=
"rfc6759"/>
8217 <description>Reserved
</description>
8219 <xref type=
"rfc" data=
"rfc6759"/>
8224 <description>ETHERTYPE: The Selector ID represents the well-
8225 known Ethertype. See http://standards.ieee.org/develop/regauth/ethertype/eth.txt.
8226 Note that the Ethertype is usually expressed in
8227 hexadecimal. However, the corresponding decimal
8228 value is used in this Selector ID.
8231 <xref type=
"rfc" data=
"rfc6759"/>
8236 <description>LLC: The Selector ID represents the well-known
8237 IEEE
802.2 Link Layer Control (LLC) Destination
8238 Service Access Point (DSAP).
8239 See http://standards.ieee.org/develop/regauth/llc/public.html.
8240 Note that LLC DSAP is usually expressed in
8241 hexadecimal. However, the corresponding decimal
8242 value is used in this Selector ID.
8245 <xref type=
"rfc" data=
"rfc6759"/>
8250 <description>PANA-L7-PEN: Proprietary layer
7 definition,
8251 including a Private Enterprise Number (PEN)
8252 [http://www.iana.org/assignments/enterprise-numbers]
8253 to identify that the application registry being
8254 used is not owned by the Exporter manufacturer or to identify the
8255 original enterprise in the case of a mediator or
8256 3rd party device. The Selector ID represents the
8257 enterprise unique global ID for the layer
7
8258 applications. The Selector ID has a global
8259 significance for all devices from the same
8263 <xref type=
"rfc" data=
"rfc6759"/>
8272 <registry id=
"ipfix-version-numbers">
8273 <title>IPFIX Version Numbers
</title>
8274 <xref type=
"rfc" data=
"rfc5101"/>
8275 <registration_rule>Standards Action
</registration_rule>
8279 <description>Reserved
</description>
8284 <description>Reserved (historic)
</description>
8289 <description>Cisco Systems NetFlow Version
9 (historic)
</description>
8290 <xref type=
"rfc" data=
"rfc3954"/>
8295 <description>IPFIX as documented in RFC5101
</description>
8296 <xref type=
"rfc" data=
"rfc5101"/>
8300 <value>11-
65535</value>
8301 <description>Unassigned
</description>
8308 <registry id=
"ipfix-set-ids">
8309 <title>IPFIX Set IDs
</title>
8310 <xref type=
"rfc" data=
"rfc5101"/>
8311 <registration_rule>Standards Action
</registration_rule>
8315 <description>Not used (historic)
</description>
8316 <xref type=
"rfc" data=
"rfc3954"/>
8321 <description>Template Set
</description>
8322 <xref type=
"rfc" data=
"rfc5101"/>
8327 <description>Option Template Set
</description>
8328 <xref type=
"rfc" data=
"rfc5101"/>
8332 <value>4-
255</value>
8333 <description>Unassigned
</description>
8334 <xref type=
"rfc" data=
"rfc5101"/>
8338 <value>256-
65535</value>
8339 <description>Reserved for Data Sets
</description>
8340 <xref type=
"rfc" data=
"rfc5101"/>
8347 <registry id=
"ipfix-information-element-data-types">
8348 <title>IPFIX Information Element Data Types
</title>
8349 <xref type=
"rfc" data=
"rfc5610"/>
8350 <registration_rule>Standards Action
</registration_rule>
8356 <description>octetArray
</description>
8357 <xref type=
"rfc" data=
"rfc5102"/>
8362 <description>unsigned8
</description>
8363 <xref type=
"rfc" data=
"rfc5102"/>
8368 <description>unsigned16
</description>
8369 <xref type=
"rfc" data=
"rfc5102"/>
8374 <description>unsigned32
</description>
8375 <xref type=
"rfc" data=
"rfc5102"/>
8380 <description>unsigned64
</description>
8381 <xref type=
"rfc" data=
"rfc5102"/>
8386 <description>signed8
</description>
8387 <xref type=
"rfc" data=
"rfc5102"/>
8392 <description>signed16
</description>
8393 <xref type=
"rfc" data=
"rfc5102"/>
8398 <description>signed32
</description>
8399 <xref type=
"rfc" data=
"rfc5102"/>
8404 <description>signed64
</description>
8405 <xref type=
"rfc" data=
"rfc5102"/>
8410 <description>float32
</description>
8411 <xref type=
"rfc" data=
"rfc5102"/>
8416 <description>float64
</description>
8417 <xref type=
"rfc" data=
"rfc5102"/>
8422 <description>boolean
</description>
8423 <xref type=
"rfc" data=
"rfc5102"/>
8428 <description>macAddress
</description>
8429 <xref type=
"rfc" data=
"rfc5102"/>
8434 <description>string
</description>
8435 <xref type=
"rfc" data=
"rfc5102"/>
8440 <description>dateTimeSeconds
</description>
8441 <xref type=
"rfc" data=
"rfc5102"/>
8446 <description>dateTimeMilliseconds
</description>
8447 <xref type=
"rfc" data=
"rfc5102"/>
8452 <description>dateTimeMicroseconds
</description>
8453 <xref type=
"rfc" data=
"rfc5102"/>
8458 <description>dateTimeNanoseconds
</description>
8459 <xref type=
"rfc" data=
"rfc5102"/>
8464 <description>ipv4Address
</description>
8465 <xref type=
"rfc" data=
"rfc5102"/>
8470 <description>ipv6Address
</description>
8471 <xref type=
"rfc" data=
"rfc5102"/>
8476 <description>basicList
</description>
8477 <xref type=
"rfc" data=
"rfc6313"/>
8482 <description>subTemplateList
</description>
8483 <xref type=
"rfc" data=
"rfc6313"/>
8488 <description>subTemplateMultiList
</description>
8489 <xref type=
"rfc" data=
"rfc6313"/>
8493 <value>23-
255</value>
8494 <description>Unassigned
</description>
8501 <registry id=
"ipfix-information-element-semantics">
8502 <title>IPFIX Information Element Semantics
</title>
8503 <xref type=
"rfc" data=
"rfc5610"/>
8504 <registration_rule>Standards Action
</registration_rule>
8510 <description>default
</description>
8511 <xref type=
"rfc" data=
"rfc5610"/>
8516 <description>quantity
</description>
8517 <xref type=
"rfc" data=
"rfc5610"/>
8522 <description>totalCounter
</description>
8523 <xref type=
"rfc" data=
"rfc5610"/>
8528 <description>deltaCounter
</description>
8529 <xref type=
"rfc" data=
"rfc5610"/>
8534 <description>identifier
</description>
8535 <xref type=
"rfc" data=
"rfc5610"/>
8540 <description>flags
</description>
8541 <xref type=
"rfc" data=
"rfc5610"/>
8546 <description>list
</description>
8547 <xref type=
"rfc" data=
"rfc6313"/>
8551 <value>7-
255</value>
8552 <description>Unassigned
</description>
8553 <xref type=
"rfc" data=
"rfc5610"/>
8560 <registry id=
"ipfix-information-element-units">
8561 <title>IPFIX Information Element Units
</title>
8562 <xref type=
"rfc" data=
"rfc5610"/>
8563 <registration_rule>Expert Review
</registration_rule>
8567 <description>none
</description>
8569 <xref type=
"rfc" data=
"rfc5610"/>
8574 <description>bits
</description>
8576 <xref type=
"rfc" data=
"rfc5610"/>
8581 <description>octets
</description>
8583 <xref type=
"rfc" data=
"rfc5610"/>
8588 <description>packets
</description>
8590 <xref type=
"rfc" data=
"rfc5610"/>
8595 <description>flows
</description>
8597 <xref type=
"rfc" data=
"rfc5610"/>
8602 <description>seconds
</description>
8604 <xref type=
"rfc" data=
"rfc5610"/>
8609 <description>milliseconds
</description>
8611 <xref type=
"rfc" data=
"rfc5610"/>
8616 <description>microseconds
</description>
8618 <xref type=
"rfc" data=
"rfc5610"/>
8623 <description>nanoseconds
</description>
8625 <xref type=
"rfc" data=
"rfc5610"/>
8630 <description>4-octet words
</description>
8631 <comments>for IPv4 header length
</comments>
8632 <xref type=
"rfc" data=
"rfc5610"/>
8637 <description>messages
</description>
8638 <comments>for reliability reporting
</comments>
8639 <xref type=
"rfc" data=
"rfc5610"/>
8644 <description>hops
</description>
8645 <comments>for TTL
</comments>
8646 <xref type=
"rfc" data=
"rfc5610"/>
8651 <description>entries
</description>
8652 <comments>for MPLS label stack
</comments>
8653 <xref type=
"rfc" data=
"rfc5610"/>
8657 <value>13-
65535</value>
8658 <description>Unassigned
</description>
8660 <xref type=
"rfc" data=
"rfc5610"/>
8667 <registry id=
"ipfix-structured-data-types-semantics">
8668 <title>IPFIX Structured Data Types Semantics
</title>
8669 <xref type=
"rfc" data=
"rfc6313"/>
8670 <registration_rule>Standards Action
</registration_rule>
8675 <description>The
"noneOf" structured data type semantic specifies
8676 that none of the elements are actual properties of the Data
8679 <xref type=
"rfc" data=
"rfc6313"/>
8684 <name>exactlyOneOf
</name>
8685 <description>The
"exactlyOneOf" structured data type semantic
8686 specifies that only a single element from the structured data is
8687 an actual property of the Data Record. This is equivalent to a
8688 logical XOR operation.
8690 <xref type=
"rfc" data=
"rfc6313"/>
8695 <name>oneOrMoreOf
</name>
8696 <description>The
"oneOrMoreOf" structured data type semantic
8697 specifies that one or more elements from the list in the
8698 structured data are actual properties of the Data Record. This is
8699 equivalent to a logical OR operation.
8701 <xref type=
"rfc" data=
"rfc6313"/>
8707 <description>The
"allOf" structured data type semantic specifies
8708 that all of the list elements from the structured data are actual
8709 properties of the Data Record.
8711 <xref type=
"rfc" data=
"rfc6313"/>
8716 <name>ordered
</name>
8717 <description>The
"ordered" structured data type semantic specifies
8718 that elements from the list in the structured data are ordered.
8720 <xref type=
"rfc" data=
"rfc6313"/>
8724 <value>0x05-
0xFE</value>
8726 <description>unassigned
8732 <name>undefined
</name>
8733 <description>The
"undefined" structured data type semantic
8734 specifies that the semantic of the list elements is not specified and
8735 that, if a semantic exists, then it is up to the Collecting
8736 Process to draw its own conclusions. The
"undefined" structured
8737 data type semantic is the default structured data type semantic.
8739 <xref type=
"rfc" data=
"rfc6313"/>
8745 <person id=
"ipfix-iana_at_cisco.com">
8746 <name>ipfix-iana at cisco.com
</name>
8747 <uri>mailto:ipfix-iana
&cisco.com
</uri>
8748 <updated>2012-
09-
20</updated>