Internet Assigned Numbers Authority • Domains • Protocols • Numbers • About IP Flow Information Export (IPFIX) Entities Created 2007-05-10 Last Updated 2026-09-11 Note [RFC 7012] has obsoleted [RFC 5102]. However, references to [RFC 5102] remain as part of the historical record. Available Formats [IMG] XML [IMG] HTML [IMG] TXT Registries Included Below • IPFIX Information Elements • IPFIX MPLS label type (Value 46) • Forwarding Status (Value 89) • Status 00b: Unknown • Status 01b: Forwarded • Status 10b: Dropped • Status 11b: Consumed • Classification Engine IDs (Value 101) • flowEndReason (Value 136) • natOriginatingAddressRealm (Value 229) • NAT Event Type (Value 230) • firewallEvent (Value 233) • biflowDirection (Value 239) • observationPointType (Value 277) • anonymizationTechnique (Value 286) • natType (Value 297) • valueDistributionMethod (Value 384) • flowSelectorAlgorithm (Value 390) • dataLinkFrameType (Value 408) • mibCaptureTimeSemantics (Value 448) • NAT Quota Exceeded Event Type (Value 466) • NAT Threshold Event Type (Value 467) • IPFIX IPv6 SRH Segment Type (Value 500) • IPFIX Version Numbers • IPFIX Set IDs • IPFIX Information Element Data Types • IPFIX Information Element Semantics • IPFIX Information Element Units • IPFIX Structured Data Types Semantics • IPFIX ipv6ExtensionHeaders Bits IPFIX Information Elements Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 7012][RFC 9710] Note Values 0-127: NFv9-compatible Note The columns previously titled "References" and "Requester" have been renamed "Additional Information" and "Reference", respectively. The initial values for this registry were provided in [RFC 5102]. [RFC 7012] has obsoleted [RFC 5102] and specifies that the current registry is the normative reference for these Information Elements. Available Formats [IMG] CSV ElementID Name Abstract Data Type Data Type Status Description Units Range Additional Information Reference Revision Date Semantics 0 Reserved [RFC 5102] 2013-02-18 The number of octets since the previous report (if any) in incoming 1 octetDeltaCount unsigned64 deltaCounter current packets for this Flow at the Observation Point. The number of octets octets [RFC 5102] 0 2013-02-18 includes IP header(s) and IP payload. 2 packetDeltaCount unsigned64 deltaCounter current The number of incoming packets since the previous report (if any) for packets [RFC 5102] 0 2013-02-18 this Flow at the Observation Point. The conservative count of Original Flows contributing to this 3 deltaFlowCount unsigned64 deltaCounter current Aggregated Flow; may be distributed via any of the methods expressed flows [RFC 7015] 1 2013-06-25 by the valueDistributionMethod Information Element. The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry. See [RFC 791] for the specification of the IPv4 4 protocolIdentifier unsigned8 identifier current protocol field. See [RFC 8200] for the specification [RFC 5102] 0 2013-02-18 In Internet Protocol version 4 (IPv4), this is carried in the of the IPv6 protocol field. See the list of protocol Protocol field. In Internet Protocol version 6 (IPv6), this is numbers assigned by IANA at [Protocol Numbers]. carried in the Next Header field in the last extension header of the packet. For IPv4 packets, this is the value of the TOS field in the IPv4 See [RFC 1812 (Section 5.3.2)] and [RFC 791] for the 5 ipClassOfService unsigned8 identifier current packet header. For IPv6 packets, this is the value of the Traffic definition of the IPv4 TOS field. See [RFC 8200] for [RFC 5102] 0 2013-02-18 Class field in the IPv6 packet header. the definition of the IPv6 Traffic Class field. TCP control bits observed for the packets of this Flow. This information is encoded as a bit field; each TCP control bit has a corresponding bit in that field. A bit is set to 1 if any observed packet of this Flow has the corresponding TCP control bit set to 1. The bit is cleared to 0 otherwise. Per [RFC 9293], the assignment of TCP control bits is managed by IANA via the "TCP Header Flags" registry [TCP Header Flags]. Implementers can retrieve the current TCP control bits from that registry, which is authoritative for them. As the most significant 4 bits of octets 12 and 13 (counting from zero) of the TCP header [RFC 9293] are used to encode the TCP data offset (header length), the corresponding bits in this Information Element MUST be reported by the Exporter with a value of zero and MUST be ignored by the Collector. Use the tcpHeaderLength Information Element to encode this value. All TCP control bits (including those unassigned) MUST be exported as observed in the TCP headers of the packets of this Flow. If exported as a single octet with reduced-size encoding ([Section 6 tcpControlBits unsigned16 flags current 6.2 of RFC 7011]), this Information Element covers the low-order See the assigned TCP control bits in the "TCP Header [RFC 9293]; [RFC 9565] 2 2024-01-29 octet of this field (i.e., bit offset positions 8 to 15) [TCP Header Flags" registry [TCP Header Flags]. Flags]. A Collector receiving this Information Element with reduced-size encoding must not assume anything about the content of the four bits with bit offset positions 4 to 7. Exporting Processes exporting this Information Element on behalf of a Metering Process that is not capable of observing any of the flags with bit offset positions 4 to 7 SHOULD use reduced-size encoding, and only export the least significant 8 bits of this Information Element. Note that previous revisions of this Information Element's definition specified that flags with bit offset positions 8 and 9 must be exported as zero, even if observed. Collectors should therefore not assume that a value of zero for these bits in this Information Element indicates the bits were never set in the observed traffic, especially if these bits are zero in every Flow Record sent by a given Exporter. Note also that the "TCP Header Flags" registry [TCP Header Flags] indexes the bit offset from the most significant bit of octet 12 to the least significant bit of octet 13 in the TCP header, but the tcpControlBits is encoded as a regular unsigned 16-bit integer. See [RFC 768] for the definition of the UDP source port field. See [RFC 9293] for the definition of the The source port identifier in the transport protocol header. For TCP source port field. See [RFC 9260] for the transport protocols such as UDP, TCP, SCTP, and DCCP, this is the definition of the SCTP source port number field. See 7 sourceTransportPort unsigned16 identifier current source port number given in the respective header. This field MAY [RFC 4340] for the definition of the DCCP source port [RFC 5102]; [RFC 9710] 0 2013-02-18 also be used for future transport protocols that have 16-bit source field. port identifiers. See the assigned transport protocol (e.g., UDP, TCP, SCTP, and DCCP) port numbers [Service Name and Transport Protocol Port Number Registry]. 8 sourceIPv4Address ipv4Address default current The IPv4 source address in the IP packet header. See [RFC 791] for the definition of the IPv4 source [RFC 5102] 1 2014-02-03 address field. 9 sourceIPv4PrefixLength unsigned8 current The number of contiguous bits that are relevant in the bits 0-32 [RFC 5102] 0 2013-02-18 sourceIPv4Prefix Information Element. The index of the IP interface where packets of this Flow are being received. The value matches the value of managed object 'ifIndex' as 10 ingressInterface unsigned32 identifier current defined in [RFC 2863]. Note that ifIndex values are not assigned See [RFC 2863] for the definition of the ifIndex [RFC 5102] 0 2013-02-18 statically to an interface and that the interfaces may be renumbered object. every time the device's management system is re-initialized, as specified in [RFC 2863]. See [RFC 768] for the definition of the UDP destination port field. See [RFC 9293] for the The destination port identifier in the transport protocol header. For definition of the TCP destination port field. See transport protocols such as UDP, TCP, SCTP, and DCCP, this is the [RFC 9260] for the definition of the SCTP destination 11 destinationTransportPort unsigned16 identifier current destination port number given in the respective header. This field port number field. See [RFC 4340] for the definition [RFC 5102]; [RFC 9710] 0 2013-02-18 MAY also be used for future transport protocols that have 16-bit of the DCCP destination port field. destination port identifiers. See the assigned transport protocol (e.g., UDP, TCP, SCTP, and DCCP) port numbers [Service Name and Transport Protocol Port Number Registry]. 12 destinationIPv4Address ipv4Address default current The IPv4 destination address in the IP packet header. See [RFC 791] for the definition of the IPv4 [RFC 5102] 1 2014-02-03 destination address field. 13 destinationIPv4PrefixLength unsigned8 current The number of contiguous bits that are relevant in the bits 0-32 [RFC 5102] 0 2013-02-18 destinationIPv4Prefix Information Element. The index of the IP interface where packets of this Flow are being sent. The value matches the value of managed object 'ifIndex' as 14 egressInterface unsigned32 identifier current defined in [RFC 2863]. Note that ifIndex values are not assigned See [RFC 2863] for the definition of the ifIndex [RFC 5102] 0 2013-02-18 statically to an interface and that the interfaces may be renumbered object. every time the device's management system is re-initialized, as specified in [RFC 2863]. 15 ipNextHopIPv4Address ipv4Address default current The IPv4 address of the next IPv4 hop. [RFC 5102] 1 2014-02-03 The autonomous system (AS) number of the source IP address. If AS 16 bgpSourceAsNumber unsigned32 identifier current path information for this Flow is only available as an unordered AS See [RFC 4271] for a description of BGP-4, and see [RFC 5102] 0 2013-02-18 set (and not as an ordered AS sequence), then the value of this [RFC 1930] for the definition of the AS number. Information Element is 0. The autonomous system (AS) number of the destination IP address. If 17 bgpDestinationAsNumber unsigned32 identifier current AS path information for this Flow is only available as an unordered See [RFC 4271] for a description of BGP-4, and see [RFC 5102] 0 2013-02-18 AS set (and not as an ordered AS sequence), then the value of this [RFC 1930] for the definition of the AS number. Information Element is 0. 18 bgpNextHopIPv4Address ipv4Address default current The IPv4 address of the next (adjacent) BGP hop. See [RFC 4271] for a description of BGP-4. [RFC 5102] 1 2014-02-03 The number of outgoing multicast packets since the previous report 19 postMCastPacketDeltaCount unsigned64 deltaCounter current (if any) sent for packets of this Flow by a multicast daemon within packets [RFC 5102] 0 2013-02-18 the Observation Domain. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means. The number of octets since the previous report (if any) in outgoing multicast packets sent for packets of this Flow by a multicast daemon 20 postMCastOctetDeltaCount unsigned64 deltaCounter current within the Observation Domain. This property cannot necessarily be octets [RFC 5102] 0 2013-02-18 observed at the Observation Point, but may be retrieved by other means. The number of octets includes IP header(s) and IP payload. The relative timestamp of the last packet of this Flow. It indicates 21 flowEndSysUpTime unsigned32 current the number of milliseconds since the last (re-)initialization of the milliseconds [RFC 5102] 1 2014-01-11 IPFIX Device (sysUpTime). sysUpTime can be calculated from systemInitTimeMilliseconds. The relative timestamp of the first packet of this Flow. It indicates 22 flowStartSysUpTime unsigned32 current the number of milliseconds since the last (re-)initialization of the milliseconds [RFC 5102] 1 2014-01-11 IPFIX Device (sysUpTime). sysUpTime can be calculated from systemInitTimeMilliseconds. The definition of this Information Element is identical to the 23 postOctetDeltaCount unsigned64 deltaCounter current definition of Information Element 'octetDeltaCount', except that it octets [RFC 5102] 0 2013-02-18 reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. The definition of this Information Element is identical to the 24 postPacketDeltaCount unsigned64 deltaCounter current definition of Information Element 'packetDeltaCount', except that it packets [RFC 5102] 0 2013-02-18 reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. See [RFC 791] for the specification of the IPv4 total 25 minimumIpTotalLength unsigned64 current Length of the smallest packet observed for this Flow. The packet octets length. See [RFC 8200] for the specification of the [RFC 5102] 0 2013-02-18 length includes the IP header(s) length and the IP payload length. IPv6 payload length. See [RFC 2675] for the specification of the IPv6 jumbo payload length. See [RFC 791] for the specification of the IPv4 total 26 maximumIpTotalLength unsigned64 current Length of the largest packet observed for this Flow. The packet octets length. See [RFC 8200] for the specification of the [RFC 5102] 0 2013-02-18 length includes the IP header(s) length and the IP payload length. IPv6 payload length. See [RFC 2675] for the specification of the IPv6 jumbo payload length. 27 sourceIPv6Address ipv6Address default current The IPv6 source address in the IP packet header. See [RFC 8200] for the definition of the Source [RFC 5102] 1 2014-02-03 Address field in the IPv6 header. 28 destinationIPv6Address ipv6Address default current The IPv6 destination address in the IP packet header. See [RFC 8200] for the definition of the Destination [RFC 5102] 1 2014-02-03 Address field in the IPv6 header. 29 sourceIPv6PrefixLength unsigned8 current The number of contiguous bits that are relevant in the bits 0-128 [RFC 5102] 0 2013-02-18 sourceIPv6Prefix Information Element. 30 destinationIPv6PrefixLength unsigned8 current The number of contiguous bits that are relevant in the bits 0-128 [RFC 5102] 0 2013-02-18 destinationIPv6Prefix Information Element. 31 flowLabelIPv6 unsigned32 identifier current The value of the IPv6 Flow Label field in the IP packet header. 0-0xFFFFF See [RFC 8200] for the definition of the Flow Label [RFC 5102] 1 2014-08-13 field in the IPv6 packet header. 32 icmpTypeCodeIPv4 unsigned16 identifier current Type and Code of the IPv4 ICMP message. The combination of both See the "ICMP Type Numbers" registry [Internet [RFC 5102]; [RFC 9710] 0 2013-02-18 values is reported as (ICMP type * 256) + ICMP code. Control Message Protocol (ICMP) Parameters] 33 igmpType unsigned8 identifier current The type field of the IGMP message. See the "IGMP Type Numbers" registry [Internet Group [RFC 5102]; [RFC 9710] 0 2013-02-18 Management Protocol (IGMP) Type Numbers] Deprecated in favor of 305 samplingPacketInterval. When using sampled 34 samplingInterval unsigned32 quantity deprecated NetFlow, the rate at which packets are sampled -- e.g., a value of packets [RFC 7270] 0 2014-04-04 100 indicates that one of every 100 packets is sampled. Deprecated in favor of 304 selectorAlgorithm. The type of algorithm used for sampled NetFlow: 1 - Deterministic Sampling, 35 samplingAlgorithm unsigned8 identifier deprecated 2 - Random Sampling. [RFC 7270] 0 2014-04-04 The values are not compatible with the selectorAlgorithm IE, where "Deterministic" has been replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion is required; see [Packet Sampling (PSAMP) Parameters.] 36 flowActiveTimeout unsigned16 current The number of seconds after which an active Flow is timed out anyway, seconds [RFC 5102] 0 2013-02-18 even if there is still a continuous flow of packets. A Flow is considered to be timed out if no packets belonging to the 37 flowIdleTimeout unsigned16 current Flow have been observed for the number of seconds specified by this seconds [RFC 5102] 0 2013-02-18 field. Type of flow switching engine in a router/switch: RP = 0, 38 engineType unsigned8 identifier deprecated VIP/Line card = 1, [RFC 7270] 0 2014-04-04 PFC/DFC = 2. Reserved for internal use on the Collector. Versatile Interface Processor (VIP) or line card slot number of the 39 engineId unsigned8 identifier deprecated flow switching engine in a router/switch. Reserved for internal use [RFC 7270] 0 2014-04-04 on the Collector. The total number of octets that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process. The value of this Information Element is calculated by summing up the IPFIX Message Header length values of all IPFIX 40 exportedOctetTotalCount unsigned64 totalCounter current Messages that were successfully sent to the Collecting Process. The octets [RFC 5102] 0 2013-02-18 reported number excludes octets in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of octets sent to this Collecting Process. The total number of IPFIX Messages that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular 41 exportedMessageTotalCount unsigned64 totalCounter current Collecting Process. The reported number excludes the IPFIX Message messages [RFC 5102] 0 2013-02-18 that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of IPFIX Messages sent to this Collecting Process. The total number of Flow Records that the Exporting Process has sent as Data Records since the Exporting Process (re-)initialization to a particular Collecting Process. The reported number excludes Flow 42 exportedFlowRecordTotalCount unsigned64 totalCounter current Records in the IPFIX Message that carries the counter value. If this flows [RFC 5102] 0 2013-02-18 Information Element is sent to a particular Collecting Process, then by default it specifies the number of Flow Records sent to this process. This is a platform-specific field for the Catalyst 5000/Catalyst 6000 43 ipv4RouterSc ipv4Address default deprecated family. It is used to store the address of a router that is being [CCO-MLS] describes MultiLayer Switching. [RFC 7270] 0 2014-04-04 shortcut when performing MultiLayer Switching. 44 sourceIPv4Prefix ipv4Address default current IPv4 source address prefix. [RFC 5102] 0 2013-02-18 45 destinationIPv4Prefix ipv4Address default current IPv4 destination address prefix. [RFC 5102] 0 2013-02-18 This field identifies the control protocol that allocated the See the IPFIX MPLS label type (Value 46) [IP Flow 46 mplsTopLabelType unsigned8 identifier current top-of-stack label. Values for this field are listed in the MPLS Information Export (IPFIX) Entities]. See [RFC 3031] [RFC 5102]; [RFC 9710] 0 2013-02-18 label type registry. for the MPLS label structure. 47 mplsTopLabelIPv4Address ipv4Address default current The IPv4 address of the system that the MPLS top label will cause See [RFC 3031] for the association between MPLS [RFC 5102] 1 2014-02-03 this Flow to be forwarded to. labels and IP addresses. 48 samplerId unsigned8 identifier deprecated Deprecated in favor of 302 selectorId. The unique identifier [RFC 7270] 0 2014-04-04 associated with samplerName. Deprecated in favor of 304 selectorAlgorithm. The values are not 49 samplerMode unsigned8 identifier deprecated compatible: selectorAlgorithm=3 is random sampling. The type of [RFC 7270] 0 2014-04-04 algorithm used for sampling data: 1 - Deterministic, 2 - Random Sampling. Use with samplerRandomInterval. Deprecated in favor of 305 samplingPacketInterval. Packet interval at 50 samplerRandomInterval unsigned32 quantity deprecated which to sample -- in case of random sampling. Used in connection [RFC 7270] 0 2014-04-04 with the samplerMode 0x02 (random sampling) value. 51 classId unsigned8 identifier deprecated Deprecated in favor of 302 selectorId. Characterizes the traffic [RFC 7270] 0 2014-04-04 class, i.e., QoS treatment. See [RFC 791] for the definition of the IPv4 Time to 52 minimumTTL unsigned8 current Minimum TTL value observed for any packet in this Flow. hops Live field. See [RFC 8200] for the definition of the [RFC 5102] 0 2013-02-18 IPv6 Hop Limit field. See [RFC 791] for the definition of the IPv4 Time to 53 maximumTTL unsigned8 current Maximum TTL value observed for any packet in this Flow. hops Live field. See [RFC 8200] for the definition of the [RFC 5102] 0 2013-02-18 IPv6 Hop Limit field. The value of the Identification field in the IPv4 packet header or in See [RFC 791] for the definition of the IPv4 54 fragmentIdentification unsigned32 identifier current the IPv6 Fragment header, respectively. The value is 0 for IPv6 if Identification field. See [RFC 8200] for the [RFC 5102] 0 2013-02-18 there is no fragment header. definition of the Identification field in the IPv6 Fragment header. The definition of this Information Element is identical to the See [RFC 791] for the definition of the IPv4 TOS 55 postIpClassOfService unsigned8 identifier current definition of Information Element 'ipClassOfService', except that it field. See [RFC 8200] for the definition of the IPv6 [RFC 5102] 0 2013-02-18 reports a potentially modified value caused by a middlebox function Traffic Class field. See [RFC 3234] for the after the packet passed the Observation Point. definition of middleboxes. 56 sourceMacAddress macAddress default current The IEEE 802 source MAC address field. See IEEE.802-3.2002. [RFC 5102] 1 2014-02-03 The definition of this Information Element is identical to the 57 postDestinationMacAddress macAddress default current definition of Information Element 'destinationMacAddress', except See IEEE.802-3.2002. [RFC 5102] 1 2014-02-03 that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. 58 vlanId unsigned16 identifier current Virtual LAN identifier associated with ingress interface. For dot1q See IEEE.802-1Q.2003. [RFC 5102] 0 2013-02-18 vlans, see 243 dot1qVlanId. 59 postVlanId unsigned16 identifier current Virtual LAN identifier associated with egress interface. For See IEEE.802-1Q.2003. [RFC 5102] 0 2013-02-18 postdot1q vlans, see 254, postDot1qVlanId. See [RFC 791] for the definition of the version field in the IPv4 packet header. See [RFC 8200] for the 60 ipVersion unsigned8 identifier current The IP version field in the IP packet header. definition of the version field in the IPv6 packet [RFC 5102] 0 2013-02-18 header. Additional information on defined version numbers can be found at [IP Version Numbers]. The direction of the Flow observed at the Observation Point. There are only two values defined. 61 flowDirection unsigned8 identifier current [RFC 5102] 0 2013-02-18 0x00: ingress flow 0x01: egress flow 62 ipNextHopIPv6Address ipv6Address default current The IPv6 address of the next IPv6 hop. [RFC 5102] 1 2014-02-03 63 bgpNextHopIPv6Address ipv6Address default current The IPv6 address of the next (adjacent) BGP hop. See [RFC 4271] for a description of BGP-4. [RFC 5102] 1 2014-02-03 This Information Element was initially specified in [RFC 5102]. [RFC 7012] has obsoleted [RFC 5102] and 64 ipv6ExtensionHeaders unsigned32 flags deprecated Deprecated in favor of the ipv6ExtensionHeadersFull IE. specifies that [IANA-IPFIX] is the normative [RFC 9740] 0 2013-02-18 reference for this Information Element. The diagram provided in [RFC 5102] is incorrect; see [RFC Errata 1738]. 65-69 Assigned for NetFlow v9 compatibility [RFC 3954] [RFC 5102] 0 2013-02-18 The Label, Exp, and S fields from the top MPLS label stack entry, i.e., from the last label that was pushed. The size of this Information Element is 3 octets. 0 1 2 70 mplsTopLabelStackSection octetArray default current 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 See [RFC 3032]. [RFC 5102] 1 2014-02-03 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Label | Exp |S| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Label: Label Value, 20 bits Exp: Experimental Use, 3 bits S: Bottom of Stack, 1 bit The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be 71 mplsLabelStackSection2 octetArray default current reported by mplsTopLabelStackSection. See the definition of See [RFC 3032]. [RFC 5102] 1 2014-02-03 mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be 72 mplsLabelStackSection3 octetArray default current reported by mplsLabelStackSection2. See the definition of See [RFC 3032]. [RFC 5102] 1 2014-02-03 mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be 73 mplsLabelStackSection4 octetArray default current reported by mplsLabelStackSection3. See the definition of See [RFC 3032]. [RFC 5102] 1 2014-02-03 mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be 74 mplsLabelStackSection5 octetArray default current reported by mplsLabelStackSection4. See the definition of See [RFC 3032]. [RFC 5102] 1 2014-02-03 mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be 75 mplsLabelStackSection6 octetArray default current reported by mplsLabelStackSection5. See the definition of See [RFC 3032]. [RFC 5102] 1 2014-02-03 mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be 76 mplsLabelStackSection7 octetArray default current reported by mplsLabelStackSection6. See the definition of See [RFC 3032]. [RFC 5102] 1 2014-02-03 mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be 77 mplsLabelStackSection8 octetArray default current reported by mplsLabelStackSection7. See the definition of See [RFC 3032]. [RFC 5102] 1 2014-02-03 mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be 78 mplsLabelStackSection9 octetArray default current reported by mplsLabelStackSection8. See the definition of See [RFC 3032]. [RFC 5102] 1 2014-02-03 mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be 79 mplsLabelStackSection10 octetArray default current reported by mplsLabelStackSection9. See the definition of See [RFC 3032]. [RFC 5102] 1 2014-02-03 mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. 80 destinationMacAddress macAddress default current The IEEE 802 destination MAC address field. See IEEE.802-3.2002. [RFC 5102] 1 2014-02-03 The definition of this Information Element is identical to the 81 postSourceMacAddress macAddress default current definition of Information Element 'sourceMacAddress', except that it See IEEE.802-3.2002. [RFC 5102] 1 2014-02-03 reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. 82 interfaceName string default current A short name uniquely describing an interface, eg "Eth1/0". See [RFC 2863] for the definition of the ifName [ipfix-iana_at_cisco.com] 0 2013-02-18 object. 83 interfaceDescription string default current The description of an interface, eg "FastEthernet 1/0" or "ISP See [RFC 2863] for the definition of the ifDescr [ipfix-iana_at_cisco.com] 0 2013-02-18 connection". object. 84 samplerName string deprecated Deprecated in favor of 335 selectorName. Name of the flow sampler. [RFC 7270] 0 2014-04-04 The total number of octets in incoming packets for this Flow at the 85 octetTotalCount unsigned64 totalCounter current Observation Point since the Metering Process (re-)initialization for octets [RFC 5102] 0 2013-02-18 this Observation Point. The number of octets includes IP header(s) and IP payload. The total number of incoming packets for this Flow at the Observation 86 packetTotalCount unsigned64 totalCounter current Point since the Metering Process (re-)initialization for this packets [RFC 5102] 0 2013-02-18 Observation Point. 87 flagsAndSamplerId unsigned32 identifier deprecated Flow flags and the value of the sampler ID (samplerId) combined in [RFC 7270] 0 2014-04-04 one bitmapped field. Reserved for internal use on the Collector. The value of the IP fragment offset field in the IPv4 packet header See [RFC 791] for the specification of the fragment 88 fragmentOffset unsigned16 quantity current or the IPv6 Fragment header, respectively. The value is 0 for IPv6 if 0-0x1FFF offset in the IPv4 header. See [RFC 8200] for the [RFC 5102] 1 2014-08-13 there is no fragment header. specification of the fragment offset in the IPv6 Fragment header. This Information Element describes the forwarding status of the flow and any attached reasons. IPFIX reduced-size encoding is used as required. A structure is currently associated with the least-significant byte. Future versions may be defined to associate meanings with the remaining bits. The current version of the Information Element should be exported as unsigned8. The layout of the encoding is as follows: See "NetFlow Version 9 Flow-Record Format" MSB - 0 1 2 3 4 5 6 7 - LSB [CCO-NF9FMT]. See the "Forwarding Status (Value 89)" [RFC Errata 5262]; [RFC 7270]; [RFC 89 forwardingStatus unsigned32 identifier current +---+---+---+---+---+---+---+---+ registry [IP Flow Information Export (IPFIX) 9710] 2 2018-02-21 | Status| Reason code or flags | Entities]. +---+---+---+---+---+---+---+---+ Examples: value : 0x40 = 64 binary: 01000000 decode: 01 -> Forward 000000 -> No further information value : 0x89 = 137 binary: 10001001 decode: 10 -> Drop 001001 -> Bad TTL The value of the VPN route distinguisher of a corresponding entry in a VPN routing and forwarding table. Route distinguisher ensures that the same address can be used in several different MPLS VPNs and that it is possible for BGP to carry several completely different routes to that address, one for each VPN. According to [RFC 4364], the size See [RFC 4364] for the specification of the route 90 mplsVpnRouteDistinguisher octetArray default current of mplsVpnRouteDistinguisher is 8 octets. However, in [RFC 4382] an distinguisher. See [RFC 4382] for the specification [RFC 5102] 1 2014-02-03 octet string with flexible length was chosen for representing a VPN of the MPLS/BGP Layer 3 Virtual Private Network (VPN) route distinguisher by object MplsL3VpnRouteDistinguisher. This Management Information Base. choice was made in order to be open to future changes of the size. This idea was adopted when choosing octetArray as abstract data type for this Information Element. The maximum length of this Information Element is 256 octets. The prefix length of the subnet of the mplsTopLabelIPv4Address or See [RFC 3031] for the association between MPLS 91 mplsTopLabelPrefixLength unsigned8 quantity current mplsTopLabelIPv6Address that the MPLS top label will cause the Flow bits 0-128 labels and prefix lengths. [ipfix-iana_at_cisco.com] 2 2014-08-13 to be forwarded to. 92 srcTrafficIndex unsigned32 identifier current BGP Policy Accounting Source Traffic Index. BGP policy accounting as described in [CCO-BGPPOL]. [RFC 7270] 0 2014-04-04 93 dstTrafficIndex unsigned32 identifier current BGP Policy Accounting Destination Traffic Index. BGP policy accounting as described in [CCO-BGPPOL]. [RFC 7270] 0 2014-04-04 94 applicationDescription string default current Specifies the description of an application. [RFC 6759] 1 2014-02-03 95 applicationId octetArray default current Specifies an Application ID per [RFC 6759]. See [Section 4 of RFC 6759] for the applicationId [RFC 6759] 1 2014-02-03 Information Element Specification. 96 applicationName string default current Specifies the name of an application. [RFC 6759] 0 2013-02-18 97 Assigned for NetFlow v9 compatibility [RFC 3954] [RFC 5102] 0 2013-02-18 See [RFC 3260] for the definition of the The definition of this Information Element is identical to the Differentiated Services Field. See [Section 5.3.2 of definition of Information Element 'ipDiffServCodePoint', except that RFC 1812] and [RFC 791] for the definition of the 98 postIpDiffServCodePoint unsigned8 identifier current it reports a potentially modified value caused by a middlebox 0-63 IPv4 TOS field. See [RFC 8200] for the definition of [ipfix-iana_at_cisco.com] 0 2013-02-18 function after the packet passed the Observation Point. the IPv6 Traffic Class field. See the IPFIX Information Model [RFC 5102] for the 'ipDiffServCodePoint' specification. The amount of multicast replication that's applied to a traffic See [RFC 1112] for the specification of reserved IPv4 99 multicastReplicationFactor unsigned32 quantity current stream. multicast addresses. See [RFC 4291] for the [ipfix-iana_at_cisco.com] 0 2013-02-18 specification of reserved IPv6 multicast addresses. 100 className string deprecated Deprecated in favor of 335 selectorName. Traffic Class Name, [RFC 7270] 0 2014-04-04 associated with the classId Information Element. A unique identifier for the engine that determined the Selector ID. Thus, the Classification Engine ID defines the context for the Selector ID. The Classification Engine can be considered a specific See the "Classification Engine IDs (Value 101)" 101 classificationEngineId unsigned8 identifier current registry for application assignments. registry [IP Flow Information Export (IPFIX) [RFC 6759]; [RFC 9710] 0 2013-02-18 Entities] Values for this field are listed in the Classification Engine IDs registry. 102 layer2packetSectionOffset unsigned16 quantity deprecated Deprecated in favor of 409 sectionOffset. Layer 2 packet section [RFC 7270] 0 2014-04-04 offset. Potentially a generic packet section offset. 103 layer2packetSectionSize unsigned16 quantity deprecated Deprecated in favor of 312 dataLinkFrameSize. Layer 2 packet section [RFC 7270] 0 2014-04-04 size. Potentially a generic packet section size. 104 layer2packetSectionData octetArray deprecated Deprecated in favor of 315 dataLinkFrameSection. Layer 2 packet [RFC 7270] 0 2014-04-04 section data. 105-127 Assigned for NetFlow v9 compatibility [RFC 3954] [RFC 5102] 0 2013-02-18 The autonomous system (AS) number of the first AS in the AS path to the destination IP address. The path is deduced by looking up the 128 bgpNextAdjacentAsNumber unsigned32 identifier current destination IP address of the Flow in the BGP routing information See [RFC 4271] for a description of BGP-4, and see [RFC 5102] 0 2013-02-18 base. If AS path information for this Flow is only available as an [RFC 1930] for the definition of the AS number. unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. The autonomous system (AS) number of the last AS in the AS path from the source IP address. The path is deduced by looking up the source IP address of the Flow in the BGP routing information base. If AS 129 bgpPrevAdjacentAsNumber unsigned32 identifier current path information for this Flow is only available as an unordered AS See [RFC 4271] for a description of BGP-4, and see [RFC 5102] 0 2013-02-18 set (and not as an ordered AS sequence), then the value of this [RFC 1930] for the definition of the AS number. Information Element is 0. In case of BGP asymmetry, the bgpPrevAdjacentAsNumber might not be able to report the correct value. The IPv4 address used by the Exporting Process. This is used by the 130 exporterIPv4Address ipv4Address default current Collector to identify the Exporter in cases where the identity of the [RFC 5102] 1 2014-02-03 Exporter may have been obscured by the use of a proxy. The IPv6 address used by the Exporting Process. This is used by the 131 exporterIPv6Address ipv6Address default current Collector to identify the Exporter in cases where the identity of the [RFC 5102] 1 2014-02-03 Exporter may have been obscured by the use of a proxy. The number of octets since the previous report (if any) in packets of 132 droppedOctetDeltaCount unsigned64 deltaCounter current this Flow dropped by packet treatment. The number of octets includes octets [RFC 5102] 0 2013-02-18 IP header(s) and IP payload. 133 droppedPacketDeltaCount unsigned64 deltaCounter current The number of packets since the previous report (if any) of this Flow packets [RFC 5102] 0 2013-02-18 dropped by packet treatment. The total number of octets in packets of this Flow dropped by packet 134 droppedOctetTotalCount unsigned64 totalCounter current treatment since the Metering Process (re-)initialization for this octets [RFC 5102] 0 2013-02-18 Observation Point. The number of octets includes IP header(s) and IP payload. 135 droppedPacketTotalCount unsigned64 totalCounter current The number of packets of this Flow dropped by packet treatment since packets [RFC 5102] 0 2013-02-18 the Metering Process (re-)initialization for this Observation Point. 136 flowEndReason unsigned8 identifier current The reason for Flow termination. Values are listed in the See the "flowEndReason (Value 136)" registry [IP Flow [RFC 5102]; [RFC 9710] 0 2013-02-18 flowEndReason registry. Information Export (IPFIX) Entities]. An identifier of a set of common properties that is unique per 137 commonPropertiesId unsigned64 identifier current Observation Domain and Transport Session. Typically, this Information [RFC 5102] 0 2013-02-18 Element is used to link to information reported in separate Data Records. An identifier of an Observation Point that is unique per Observation 138 observationPointId unsigned64 identifier current Domain. It is RECOMMENDED that this identifier is also unique per [RFC 5102]; [ipfix-iana_at_cisco.com] 1 2013-04-11 IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Type and Code of the IPv6 ICMP message. The combination of both See the "ICMPv6 'type' Numbers" and "ICMPv6 'Code' 139 icmpTypeCodeIPv6 unsigned16 identifier current values is reported as (ICMP type * 256) + ICMP code. Fields" registries [Internet Control Message Protocol [RFC 5102]; [RFC 9710] 0 2013-02-18 version 6 (ICMPv6) Parameters] 140 mplsTopLabelIPv6Address ipv6Address default current The IPv6 address of the system that the MPLS top label will cause See [RFC 3031] for the association between MPLS [RFC 5102] 1 2014-02-03 this Flow to be forwarded to. labels and IP addresses. An identifier of a line card that is unique per IPFIX Device hosting 141 lineCardId unsigned32 identifier current an Observation Point. Typically, this Information Element is used for [RFC 5102] 0 2013-02-18 limiting the scope of other Information Elements. An identifier of a line port that is unique per IPFIX Device hosting 142 portId unsigned32 identifier current an Observation Point. Typically, this Information Element is used for [RFC 5102] 0 2013-02-18 limiting the scope of other Information Elements. An identifier of a Metering Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of 143 meteringProcessId unsigned32 identifier current other Information Elements. Note that process identifiers are [RFC 5102] 0 2013-02-18 typically assigned dynamically. The Metering Process may be re-started with a different ID. An identifier of an Exporting Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the 144 exportingProcessId unsigned32 identifier current scope of other Information Elements. Note that process identifiers [RFC 5102] 0 2013-02-18 are typically assigned dynamically. The Exporting Process may be re-started with a different ID. An identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain. Template IDs 0-255 are reserved for Template Sets, Options Template 145 templateId unsigned16 identifier current Sets, and other reserved Sets yet to be created. Template IDs of Data [RFC 5102] 0 2013-02-18 Sets are numbered from 256 to 65535. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that after a re-start of the Exporting Process Template identifiers may be re-assigned. 146 wlanChannelId unsigned8 identifier current The identifier of the 802.11 (Wi-Fi) channel used. See IEEE.802-11.1999. [RFC 5102] 0 2013-02-18 The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi) 147 wlanSSID string default current network used. According to IEEE.802-11.1999, the SSID is encoded into See IEEE.802-11.1999. [RFC 5102] 0 2013-02-18 a string of up to 32 characters. An identifier of a Flow that is unique within an Observation Domain. 148 flowId unsigned64 identifier current This Information Element can be used to distinguish between different [RFC 5102] 0 2013-02-18 Flows if Flow Keys such as IP addresses and port numbers are not reported or are reported in separate records. An identifier of an Observation Domain that is locally unique to an Exporting Process. The Exporting Process uses the Observation Domain ID to uniquely identify to the Collecting Process the Observation Domain where Flows were metered. It is RECOMMENDED that this identifier is also unique per IPFIX Device. 149 observationDomainId unsigned32 identifier current [RFC 5102] 0 2013-02-18 A value of 0 indicates that no specific Observation Domain is identified by this Information Element. Typically, this Information Element is used for limiting the scope of other Information Elements. 150 flowStartSeconds dateTimeSeconds default current The absolute timestamp of the first packet of this Flow. seconds [RFC 5102] 0 2013-02-18 151 flowEndSeconds dateTimeSeconds default current The absolute timestamp of the last packet of this Flow. seconds [RFC 5102] 0 2013-02-18 152 flowStartMilliseconds dateTimeMilliseconds default current The absolute timestamp of the first packet of this Flow. milliseconds [RFC 5102] 0 2013-02-18 153 flowEndMilliseconds dateTimeMilliseconds default current The absolute timestamp of the last packet of this Flow. milliseconds [RFC 5102] 0 2013-02-18 154 flowStartMicroseconds dateTimeMicroseconds default current The absolute timestamp of the first packet of this Flow. microseconds [RFC 5102] 0 2013-02-18 155 flowEndMicroseconds dateTimeMicroseconds default current The absolute timestamp of the last packet of this Flow. microseconds [RFC 5102] 0 2013-02-18 156 flowStartNanoseconds dateTimeNanoseconds default current The absolute timestamp of the first packet of this Flow. nanoseconds [RFC 5102] 0 2013-02-18 157 flowEndNanoseconds dateTimeNanoseconds default current The absolute timestamp of the last packet of this Flow. nanoseconds [RFC 5102] 0 2013-02-18 This is a relative timestamp only valid within the scope of a single 158 flowStartDeltaMicroseconds unsigned32 current IPFIX Message. It contains the negative time offset of the first microseconds See the [IPFIX protocol specification] for the [RFC 5102] 0 2013-02-18 observed packet of this Flow relative to the export time specified in definition of the IPFIX Message Header. the IPFIX Message Header. This is a relative timestamp only valid within the scope of a single 159 flowEndDeltaMicroseconds unsigned32 current IPFIX Message. It contains the negative time offset of the last microseconds See the [IPFIX protocol specification] for the [RFC 5102] 0 2013-02-18 observed packet of this Flow relative to the export time specified in definition of the IPFIX Message Header. the IPFIX Message Header. 160 systemInitTimeMilliseconds dateTimeMilliseconds default current The absolute timestamp of the last (re-)initialization of the IPFIX milliseconds [RFC 5102] 0 2013-02-18 Device. 161 flowDurationMilliseconds unsigned32 current The difference in time between the first observed packet of this Flow milliseconds [RFC 5102] 0 2013-02-18 and the last observed packet of this Flow. 162 flowDurationMicroseconds unsigned32 current The difference in time between the first observed packet of this Flow microseconds [RFC 5102] 0 2013-02-18 and the last observed packet of this Flow. 163 observedFlowTotalCount unsigned64 totalCounter current The total number of Flows observed in the Observation Domain since flows [RFC 5102] 0 2013-02-18 the Metering Process (re-)initialization for this Observation Point. 164 ignoredPacketTotalCount unsigned64 totalCounter current The total number of observed IP packets that the Metering Process did packets [RFC 5102] 0 2013-02-18 not process since the (re-)initialization of the Metering Process. The total number of octets in observed IP packets (including the IP 165 ignoredOctetTotalCount unsigned64 totalCounter current header) that the Metering Process did not process since the octets [RFC 5102] 0 2013-02-18 (re-)initialization of the Metering Process. The total number of Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting 166 notSentFlowTotalCount unsigned64 totalCounter current Process instead of being sent to the Collecting Process. There are flows [RFC 5102] 0 2013-02-18 several potential reasons for this including resource shortage and special Flow export policies. The total number of packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the 167 notSentPacketTotalCount unsigned64 totalCounter current Exporting Process instead of being sent to the Collecting Process. packets [RFC 5102] 0 2013-02-18 There are several potential reasons for this including resource shortage and special Flow export policies. The total number of octets in packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process 168 notSentOctetTotalCount unsigned64 totalCounter current or by the Exporting Process instead of being sent to the Collecting octets [RFC 5102] 0 2013-02-18 Process. There are several potential reasons for this including resource shortage and special Flow export policies. 169 destinationIPv6Prefix ipv6Address default current IPv6 destination address prefix. [RFC 5102] 0 2013-02-18 170 sourceIPv6Prefix ipv6Address default current IPv6 source address prefix. [RFC 5102] 0 2013-02-18 The definition of this Information Element is identical to the 171 postOctetTotalCount unsigned64 totalCounter current definition of Information Element 'octetTotalCount', except that it octets [RFC 5102] 0 2013-02-18 reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. The definition of this Information Element is identical to the 172 postPacketTotalCount unsigned64 totalCounter current definition of Information Element 'packetTotalCount', except that it packets [RFC 5102] 0 2013-02-18 reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. This set of bit fields is used for marking the Information Elements of a Data Record that serve as Flow Key. Each bit represents an Information Element in the Data Record, with the n-th least significant bit representing the n-th Information Element. A bit set to value 1 indicates that the corresponding Information Element is a Flow Key of the reported Flow. A bit set to value 0 indicates that 173 flowKeyIndicator unsigned64 flags current this is not the case. [RFC 5102]; [RFC Errata 4984] 1 2017-08-01 If the Data Record contains more than 64 Information Elements, the corresponding Template SHOULD be designed such that all Flow Keys are among the first 64 Information Elements, because the flowKeyIndicator only contains 64 bits. If the Data Record contains less than 64 Information Elements, then the bits in the flowKeyIndicator for which no corresponding Information Element exists MUST have the value 0. The total number of outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain since 174 postMCastPacketTotalCount unsigned64 totalCounter current the Metering Process (re-)initialization. This property cannot packets [RFC 5102] 0 2013-02-18 necessarily be observed at the Observation Point, but may be retrieved by other means. The total number of octets in outgoing multicast packets sent for packets of this Flow by a multicast daemon in the Observation Domain 175 postMCastOctetTotalCount unsigned64 totalCounter current since the Metering Process (re-)initialization. This property cannot octets [RFC 5102] 0 2013-02-18 necessarily be observed at the Observation Point, but may be retrieved by other means. The number of octets includes IP header(s) and IP payload. 176 icmpTypeIPv4 unsigned8 identifier current Type of the IPv4 ICMP message. See the "ICMP Type Numbers" registry [Internet [RFC 5102]; [RFC 9710] 0 2013-02-18 Control Message Protocol (ICMP) Parameters] 177 icmpCodeIPv4 unsigned8 identifier current Code of the IPv4 ICMP message. See the "ICMP Type Numbers" registry [Internet [RFC 5102]; [RFC 9710] 0 2013-02-18 Control Message Protocol (ICMP) Parameters] See the "ICMPv6 'type' Numbers" registry [Internet 178 icmpTypeIPv6 unsigned8 identifier current Type of the IPv6 ICMP message. Control Message Protocol version 6 (ICMPv6) [RFC 5102]; [RFC 9710] 0 2013-02-18 Parameters] See the "ICMPv6 'Code' Fields" registry [Internet 179 icmpCodeIPv6 unsigned8 identifier current Code of the IPv6 ICMP message. Control Message Protocol version 6 (ICMPv6) [RFC 5102]; [RFC 9710] 0 2013-02-18 Parameters] See [RFC 768] for the definition of the UDP source 180 udpSourcePort unsigned16 identifier current The source port identifier in the UDP header. port field. Additional information on defined UDP [RFC 5102] 0 2013-02-18 port numbers can be found at [Service Name and Transport Protocol Port Number Registry]. See [RFC 768] for the definition of the UDP 181 udpDestinationPort unsigned16 identifier current The destination port identifier in the UDP header. destination port field. Additional information on [RFC 5102] 0 2013-02-18 defined UDP port numbers can be found at [Service Name and Transport Protocol Port Number Registry]. See [RFC 9293] for the definition of the TCP source 182 tcpSourcePort unsigned16 identifier current The source port identifier in the TCP header. port field. Additional information on defined TCP [RFC 5102] 0 2013-02-18 port numbers can be found at [Service Name and Transport Protocol Port Number Registry]. See [RFC 9293] for the definition of the TCP 183 tcpDestinationPort unsigned16 identifier current The destination port identifier in the TCP header. destination port field. Additional information on [RFC 5102] 0 2013-02-18 defined TCP port numbers can be found at [Service Name and Transport Protocol Port Number Registry]. 184 tcpSequenceNumber unsigned32 current The sequence number in the TCP header. See [RFC 9293] for the definition of the TCP sequence [RFC 5102] 0 2013-02-18 number. 185 tcpAcknowledgementNumber unsigned32 current The acknowledgement number in the TCP header. See [RFC 9293] for the definition of the TCP [RFC 5102] 0 2013-02-18 acknowledgement number. The window field in the TCP header. If the TCP window scale is See [RFC 9293] for the definition of the TCP window 186 tcpWindowSize unsigned16 current supported, then TCP window scale must be known to fully interpret the field. See [RFC 1323] for the definition of the TCP [RFC 5102] 0 2013-02-18 value of this information. window scale. 187 tcpUrgentPointer unsigned16 current The urgent pointer in the TCP header. See [RFC 9293] for the definition of the TCP urgent [RFC 5102] 0 2013-02-18 pointer. The length of the TCP header. Note that the value of this Information Element is different from the value of the Data Offset field in the 188 tcpHeaderLength unsigned8 current TCP header. The Data Offset field indicates the length of the TCP octets See [RFC 9293] for the definition of the TCP header. [RFC 5102] 0 2013-02-18 header in units of 4 octets. This Information Elements specifies the length of the TCP header in units of octets. 189 ipHeaderLength unsigned8 current The length of the IP header. For IPv6, the value of this Information octets See [RFC 791] for the definition of the IPv4 header. [RFC 5102] 0 2013-02-18 Element is 40. See [RFC 8200] for the definition of the IPv6 header. 190 totalLengthIPv4 unsigned16 current The total length of the IPv4 packet. octets See [RFC 791] for the specification of the IPv4 total [RFC 5102] 0 2013-02-18 length. This Information Element reports the value of the Payload Length field in the IPv6 header. Note that IPv6 extension headers belong to See [RFC 8200] for the specification of the IPv6 191 payloadLengthIPv6 unsigned16 current the payload. Also note that in case of a jumbo payload option the octets payload length. See [RFC 2675] for the specification [RFC 5102] 0 2013-02-18 value of the Payload Length field in the IPv6 header is zero and so of the IPv6 jumbo payload option. will be the value reported by this Information Element. For IPv4, the value of the Information Element matches the value of See [RFC 791] for the definition of the IPv4 Time to 192 ipTTL unsigned8 current the Time to Live (TTL) field in the IPv4 packet header. For IPv6, the hops Live field. See [RFC 2675] for the definition of the [RFC 5102] 0 2013-02-18 value of the Information Element matches the value of the Hop Limit IPv6 Hop Limit field. field in the IPv6 packet header. The value of the Next Header field of the IPv6 header. The value See [RFC 8200] for the definition of the IPv6 Next 193 nextHeaderIPv6 unsigned8 current identifies the type of the following IPv6 extension header or of the Header field. See the list of protocol numbers [RFC 5102] 0 2013-02-18 following IP payload. Valid values are defined in the IANA Protocol assigned by IANA at [Protocol Numbers]. Numbers registry. See [RFC 3031] for the specification of MPLS packets. 194 mplsPayloadLength unsigned32 current The size of the MPLS packet without the label stack. octets See [RFC 3032] for the specification of the MPLS [RFC 5102] 0 2013-02-18 label stack. The value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services field. The Differentiated Services field See [RFC 3260] for the definition of the spans the most significant 6 bits of the IPv4 TOS field or the IPv6 Differentiated Services field. See [RFC 1812 (Section 195 ipDiffServCodePoint unsigned8 identifier current Traffic Class field, respectively. 0-63 5.3.2)] and [RFC 791] for the definition of the IPv4 [RFC 5102] 0 2013-02-18 TOS field. See [RFC 8200] for the definition of the This Information Element encodes only the 6 bits of the IPv6 Traffic Class field. Differentiated Services field. Therefore, its value may range from 0 to 63. The value of the IP Precedence. The IP Precedence value is encoded in See [RFC 1812 (Section 5.3.3)] and [RFC 791] for the the first 3 bits of the IPv4 TOS field or the IPv6 Traffic Class definition of the IP Precedence. See [RFC 1812 196 ipPrecedence unsigned8 identifier current field, respectively. 0-7 (Section 5.3.2)] and [RFC 791] for the definition of [RFC 5102] 0 2013-02-18 the IPv4 TOS field. See [RFC 8200] for the definition This Information Element encodes only these 3 bits. Therefore, its of the IPv6 Traffic Class field. value may range from 0 to 7. Fragmentation properties indicated by flags in the IPv4 packet header or the IPv6 Fragment header, respectively. Bit 0: (RS) Reserved. The value of this bit MUST be 0 until specified otherwise. Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment. Corresponds to the value of the DF flag in the IPv4 header. Will always be 0 for IPv6 unless a "don't fragment" feature is introduced to IPv6. See [RFC 791] for the specification of the IPv4 197 fragmentFlags unsigned8 flags current Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments. fragment flags. See [RFC 8200] for the specification [RFC 5102] 0 2013-02-18 Corresponds to the MF flag in the IPv4 header of the IPv6 Fragment header. or to the M flag in the IPv6 Fragment header, respectively. The value is 0 for IPv6 if there is no fragment header. Bits 3-7: (DC) Don't Care. The values of these bits are irrelevant. 0 1 2 3 4 5 6 7 +---+---+---+---+---+---+---+---+ | R | D | M | D | D | D | D | D | | S | F | F | C | C | C | C | C | +---+---+---+---+---+---+---+---+ The sum of the squared numbers of octets per incoming packet since 198 octetDeltaSumOfSquares unsigned64 current the previous report (if any) for this Flow at the Observation Point. [RFC 5102] 0 2013-02-18 The number of octets includes IP header(s) and IP payload. The total sum of the squared numbers of octets in incoming packets 199 octetTotalSumOfSquares unsigned64 current for this Flow at the Observation Point since the Metering Process octets [RFC 5102] 0 2013-02-18 (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload. 200 mplsTopLabelTTL unsigned8 current The TTL field from the top MPLS label stack entry, i.e., the last hops See [RFC 3032] for the specification of the TTL [RFC 5102] 0 2013-02-18 label that was pushed. field. 201 mplsLabelStackLength unsigned32 current The length of the MPLS label stack in units of octets. octets See [RFC 3032] for the specification of the MPLS [RFC 5102] 0 2013-02-18 label stack. 202 mplsLabelStackDepth unsigned32 current The number of labels in the MPLS label stack. entries See [RFC 3032] for the specification of the MPLS [RFC 5102] 0 2013-02-18 label stack. The Exp field from the top MPLS label stack entry, i.e., the last label that was pushed. Bits 0-4: Don't Care, value is irrelevant. 203 mplsTopLabelExp unsigned8 flags current Bits 5-7: MPLS Exp field. See [RFC 3032] for the specification of the Exp [RFC 5102] 0 2013-02-18 field. See [RFC 3270] for usage of the Exp field. 0 1 2 3 4 5 6 7 +---+---+---+---+---+---+---+---+ | don't care | Exp | +---+---+---+---+---+---+---+---+ The effective length of the IP payload. For IPv4 packets, the value of this Information Element is the difference between the total length of the IPv4 packet (as reported by Information Element totalLengthIPv4) and the length of the IPv4 See [RFC 791] for the specification of IPv4 packets. 204 ipPayloadLength unsigned32 current header (as reported by Information Element headerLengthIPv4). octets See [RFC 8200] for the specification of the IPv6 [RFC 5102] 0 2013-02-18 payload length. See [RFC 2675] for the specification For IPv6, the value of the Payload Length field in the IPv6 header is of the IPv6 jumbo payload length. reported except in the case that the value of this field is zero and that there is a valid jumbo payload option. In this case, the value of the Jumbo Payload Length field in the jumbo payload option is reported. 205 udpMessageLength unsigned16 current The value of the Length field in the UDP header. octets See [RFC 768] for the specification of the UDP [RFC 5102] 0 2013-02-18 header. If the IP destination address is not a reserved multicast address, then the value of all bits of the octet (including the reserved ones) is zero. The first bit of this octet is set to 1 if the Version field of the IP header has the value 4 and if the Destination Address field contains a reserved multicast address in the range from 224.0.0.0 to 239.255.255.255. Otherwise, this bit is set to 0. The second and third bits of this octet are reserved for future use. See [RFC 1112] for the specification of reserved IPv4 multicast addresses. See [RFC 4291] for the The remaining bits of the octet are only set to values other than specification of reserved IPv6 multicast addresses 206 isMulticast unsigned8 flags current zero if the IP Destination Address is a reserved IPv6 multicast and the definition of the T flag and the IPv6 [RFC 5102] 0 2013-02-18 address. Then the fourth bit of the octet is set to the value of the multicast scope. The diagram provided in [RFC 5102] T flag in the IPv6 multicast address and the remaining four bits are is incorrect. The diagram in this registry is taken set to the value of the scope field in the IPv6 multicast address. from Errata 1736. See [RFC Errata 1736]. 0 1 2 3 4 5 6 7 +------+------+------+------+------+------+------+------+ | IPv6 multicast scope | T | RES. | RES. | MCv4 | +------+------+------+------+------+------+------+------+ Bits 0-3: set to value of multicast scope if IPv6 multicast Bit 4: set to value of T flag, if IPv6 multicast Bits 5-6: reserved for future use Bit 7: set to 1 if IPv4 multicast The value of the Internet Header Length (IHL) field in the IPv4 207 ipv4IHL unsigned8 current header. It specifies the length of the header in units of 4 octets. 4-octet See [RFC 791] for the specification of the IPv4 [RFC 5102] 0 2013-02-18 Please note that its unit is different from most of the other words header. Information Elements reporting length values. IPv4 options in packets of this Flow. The information is encoded in a set of bit fields. For each valid IPv4 option type, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv4 option type. Otherwise, if no observed packet of this Flow contained the respective IPv4 option type, the value of the corresponding bit is 0. The list of valid IPv4 options is maintained by IANA. Note that for identifying an option not just the 5-bit Option Number, but all 8 bits of the Option Type need to match one of the IPv4 options specified at http://www.iana.org/assignments/ip-parameters. Options are mapped to bits according to their option numbers. Option number X is mapped to bit X. The mapping is illustrated by the figure below. 0 1 2 3 4 5 6 7 +------+------+------+------+------+------+------+------+ ... | RR |CIPSO |E-SEC | TS | LSR | SEC | NOP | EOOL | +------+------+------+------+------+------+------+------+ 8 9 10 11 12 13 14 15 +------+------+------+------+------+------+------+------+ ... |ENCODE| VISA | FINN | MTUR | MTUP | ZSU | SSR | SID | ... +------+------+------+------+------+------+------+------+ 16 17 18 19 20 21 22 23 +------+------+------+------+------+------+------+------+ ... | DPS |NSAPA | SDB |RTRALT|ADDEXT| TR | EIP |IMITD | ... +------+------+------+------+------+------+------+------+ 24 25 26 27 28 29 30 31 +------+------+------+------+------+------+------+------+ See [RFC 791] for the definition of IPv4 options. See ... | | EXP | to be assigned by IANA | QS | UMP | the list of IPv4 option numbers assigned by IANA at +------+------+------+------+------+------+------+------+ [Internet Protocol Version 4 (IPv4) Parameters]. The 208 ipv4Options unsigned32 flags current diagram provided in [RFC 5102] is incorrect. The [RFC 5102] 0 2013-02-18 Type Option diagram in this registry is taken from Errata 1737. Bit Value Name Reference See [RFC Errata 1737] . ---+-----+-------+------------------------------------ 0 7 RR Record Route, RFC 791 1 134 CIPSO Commercial Security 2 133 E-SEC Extended Security, RFC 1108 3 68 TS Time Stamp, RFC 791 4 131 LSR Loose Source Route, RFC791 5 130 SEC Security, RFC 1108 6 1 NOP No Operation, RFC 791 7 0 EOOL End of Options List, RFC 791 8 15 ENCODE 9 142 VISA Experimental Access Control 10 205 FINN Experimental Flow Control 11 12 MTUR (obsoleted) MTU Reply, RFC 1191 12 11 MTUP (obsoleted) MTU Probe, RFC 1191 13 10 ZSU Experimental Measurement 14 137 SSR Strict Source Route, RFC 791 15 136 SID Stream ID, RFC 791 16 151 DPS Dynamic Packet State 17 150 NSAPA NSAP Address 18 149 SDB Selective Directed Broadcast 19 147 ADDEXT Address Extension 20 148 RTRALT Router Alert, RFC 2113 21 82 TR Traceroute, RFC 3193 22 145 EIP Extended Internet Protocol, RFC 1385 23 144 IMITD IMI Traffic Descriptor 25 30 EXP RFC3692-style Experiment 25 94 EXP RFC3692-style Experiment 25 158 EXP RFC3692-style Experiment 25 222 EXP RFC3692-style Experiment 30 25 QS Quick-Start 31 152 UMP Upstream Multicast Pkt. ... ... ... Further options numbers may be assigned by IANA This Information Element was initially specified in [RFC 5102]. [RFC 7012] has obsoleted [RFC 5102] and 209 tcpOptions unsigned64 flags deprecated Deprecated in favor of the tcpOptionsFull IE. specifies that [IANA-IPFIX] is the normative [RFC 9740] 0 2013-02-18 reference for this Information Element. The diagram provided in [RFC 5102] is incorrect; see [RFC Errata 1739]. 210 paddingOctets octetArray default current The value of this Information Element is always a sequence of 0x00 [RFC 5102] 0 2013-02-18 values. 211 collectorIPv4Address ipv4Address default current An IPv4 address to which the Exporting Process sends Flow [RFC 5102] 1 2014-02-03 information. 212 collectorIPv6Address ipv6Address default current An IPv6 address to which the Exporting Process sends Flow [RFC 5102] 1 2014-02-03 information. The index of the interface from which IPFIX Messages sent by the Exporting Process to a Collector leave the IPFIX Device. The value matches the value of managed object 'ifIndex' as defined in [RFC See [RFC 2863] for the definition of the ifIndex 213 exportInterface unsigned32 identifier current 2863]. Note that ifIndex values are not assigned statically to an object. [RFC 5102] 0 2013-02-18 interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in [RFC 2863]. The protocol version used by the Exporting Process for sending Flow information. The protocol version is given by the value of the See the [IPFIX protocol specification] for the 214 exportProtocolVersion unsigned8 identifier current Version Number field in the Message Header. definition of the IPFIX Message Header. See [RFC [RFC 5102] 0 2013-02-18 3954] for the definition of the NetFlow version 9 The protocol version is 10 for IPFIX and 9 for NetFlow version 9. A message header. value of 0 indicates that no export protocol is in use. The value of the protocol number used by the Exporting Process for sending Flow information. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA See [RFC 791] for the specification of the IPv4 Protocol Numbers registry. protocol field. See [RFC 8200] for the specification 215 exportTransportProtocol unsigned8 identifier current of the IPv6 protocol field. See the list of protocol [RFC 5102] 0 2013-02-18 In Internet Protocol version 4 (IPv4), this is carried in the numbers assigned by IANA at [Protocol Numbers]. Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet. See [RFC 768] for the definition of the UDP destination port field. See [RFC 9293] for the The destination port identifier to which the Exporting Process sends definition of the TCP destination port field. See Flow information. For transport protocols such as UDP, TCP, and SCTP, [RFC 9260] for the definition of the SCTP destination 216 collectorTransportPort unsigned16 identifier current this is the destination port number. This field MAY also be used for port number field. [RFC 5102]; [RFC 9710] 0 2013-02-18 future transport protocols that have 16-bit source port identifiers. See the assigned transport protocol (e.g., UDP, TCP, and SCTP) port numbers [Service Name and Transport Protocol Port Number Registry]. See [RFC 768] for the definition of the UDP source port field. See [RFC 9293] for the definition of the The source port identifier from which the Exporting Process sends TCP source port field. See [RFC 9260] for the 217 exporterTransportPort unsigned16 identifier current Flow information. For transport protocols such as UDP, TCP, and SCTP, definition of the SCTP source port number field. [RFC 5102]; [RFC 9710] 0 2013-02-18 this is the source port number. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. See the assigned transport protocol (e.g., UDP, TCP, and SCTP) port numbers [Service Name and Transport Protocol Port Number Registry]. 218 tcpSynTotalCount unsigned64 totalCounter current The total number of packets of this Flow with TCP "Synchronize packets See [RFC 9293] for the definition of the TCP SYN [RFC 5102] 0 2013-02-18 sequence numbers" (SYN) flag set. flag. 219 tcpFinTotalCount unsigned64 totalCounter current The total number of packets of this Flow with TCP "No more data from packets See [RFC 9293] for the definition of the TCP FIN [RFC 5102] 0 2013-02-18 sender" (FIN) flag set. flag. 220 tcpRstTotalCount unsigned64 totalCounter current The total number of packets of this Flow with TCP "Reset the packets See [RFC 9293] for the definition of the TCP RST [RFC 5102] 0 2013-02-18 connection" (RST) flag set. flag. 221 tcpPshTotalCount unsigned64 totalCounter current The total number of packets of this Flow with TCP "Push Function" packets See [RFC 9293] for the definition of the TCP PSH [RFC 5102] 0 2013-02-18 (PSH) flag set. flag. 222 tcpAckTotalCount unsigned64 totalCounter current The total number of packets of this Flow with TCP "Acknowledgment packets See [RFC 9293] for the definition of the TCP ACK [RFC 5102] 0 2013-02-18 field significant" (ACK) flag set. flag. 223 tcpUrgTotalCount unsigned64 totalCounter current The total number of packets of this Flow with TCP "Urgent Pointer packets See [RFC 9293] for the definition of the TCP URG [RFC 5102] 0 2013-02-18 field significant" (URG) flag set. flag. See [RFC 791] for the specification of the IPv4 total 224 ipTotalLength unsigned64 current The total length of the IP packet. octets length. See [RFC 8200] for the specification of the [RFC 5102] 0 2013-02-18 IPv6 payload length. See [RFC 2675] for the specification of the IPv6 jumbo payload length. The definition of this Information Element is identical to the See [RFC 791] for the definition of the IPv4 source 225 postNATSourceIPv4Address ipv4Address default current definition of Information Element 'sourceIPv4Address', except that it address field. See [RFC 3022] for the definition of [ipfix-iana_at_cisco.com] 1 2014-02-03 reports a modified value caused by a NAT middlebox function after the NAT. See [RFC 3234] for the definition of packet passed the Observation Point. middleboxes. The definition of this Information Element is identical to the See [RFC 791] for the definition of the IPv4 226 postNATDestinationIPv4Address ipv4Address default current definition of Information Element 'destinationIPv4Address', except destination address field. See [RFC 3022] for the [ipfix-iana_at_cisco.com] 1 2014-02-03 that it reports a modified value caused by a NAT middlebox function definition of NAT. See [RFC 3234] for the definition after the packet passed the Observation Point. of middleboxes. See [RFC 768] for the definition of the UDP source port field. See [RFC 9293] for the definition of the The definition of this Information Element is identical to the TCP source port field. See [RFC 9260] for the definition of Information Element 'sourceTransportPort', except that definition of SCTP. See [RFC 3022] for the definition 227 postNAPTSourceTransportPort unsigned16 identifier current it reports a modified value caused by a Network Address Port of NAPT. See [RFC 3234] for the definition of [ipfix-iana_at_cisco.com] 0 2013-02-18 Translation (NAPT) middlebox function after the packet passed the middleboxes. See the assigned transport protocol Observation Point. (e.g., UDP, TCP, SCTP, and DCCP) port numbers [Service Name and Transport Protocol Port Number Registry]. See [RFC 768] for the definition of the UDP source port field. See [RFC 9293] for the definition of the The definition of this Information Element is identical to the TCP source port field. See [RFC 9260] for the definition of Information Element 'destinationTransportPort', except definition of SCTP. See [RFC 3022] for the definition 228 postNAPTDestinationTransportPort unsigned16 identifier current that it reports a modified value caused by a Network Address Port of NAPT. See [RFC 3234] for the definition of [ipfix-iana_at_cisco.com] 0 2013-02-18 Translation (NAPT) middlebox function after the packet passed the middleboxes. See the assigned transport protocol Observation Point. (e.g., UDP, TCP, SCTP, and DCCP) port numbers [Service Name and Transport Protocol Port Number Registry]. Indicates whether the session was created because traffic originated in the private or public address realm. postNATSourceIPv4Address, postNATDestinationIPv4Address, postNAPTSourceTransportPort, and See the "natOriginatingAddressRealm (Value 229)" 229 natOriginatingAddressRealm unsigned8 identifier current postNAPTDestinationTransportPort are qualified with the address realm 1-2 registry [IP Flow Information Export (IPFIX) [ipfix-iana_at_cisco.com]; [RFC 9710] 1 2014-08-13 in perspective. Entities]. See [RFC 3022] for the definition of NAT. Values are listed in the natOriginatingAddressRealm registry. This Information Element identifies a NAT event. This IE identifies See the "NAT Event Type (Value 230)" registry [IP the type of a NAT event. Examples of NAT events include, but are not Flow Information Export (IPFIX) Entities]. See [RFC 230 natEvent unsigned8 identifier current limited to, NAT translation create, NAT translation delete, Threshold 3022] for the definition of NAT. See [RFC 8158] for [RFC 8158]; [RFC 9710] 2 2017-03-15 Reached, or Threshold Exceeded, etc. Values for this Information the definitions of values 4-16. Element are listed in the "NAT Event Type" registry. The total number of layer 4 payload bytes in a flow from the 231 initiatorOctets unsigned64 deltaCounter current initiator since the previous report. The initiator is the device octets See #298, initiatorPackets. [ipfix-iana_at_cisco.com] 1 2014-08-13 which triggered the session creation, and remains the same for the life of the session. The total number of layer 4 payload bytes in a flow from the 232 responderOctets unsigned64 deltaCounter current responder since the previous report. The responder is the device octets See #299, responderPackets. [ipfix-iana_at_cisco.com] 1 2014-08-13 which replies to the initiator, and remains the same for the life of the session. 233 firewallEvent unsigned8 current Indicates a firewall event. Allowed values are listed in the See the "firewallEvent (Value 233)" registry [IP Flow [ipfix-iana_at_cisco.com]; [RFC 9710] 0 2013-02-18 firewallEvent registry. Information Export (IPFIX) Entities]. 234 ingressVRFID unsigned32 current An unique identifier of the VRFname where the packets of this flow [ipfix-iana_at_cisco.com] 0 2013-02-18 are being received. This identifier is unique per Metering Process 235 egressVRFID unsigned32 current An unique identifier of the VRFname where the packets of this flow [ipfix-iana_at_cisco.com] 0 2013-02-18 are being sent. This identifier is unique per Metering Process 236 VRFname string default current The name of a VPN Routing and Forwarding table (VRF). See [RFC 4364] for the definition of VRF. [ipfix-iana_at_cisco.com] 0 2013-02-18 The definition of this Information Element is identical to the 237 postMplsTopLabelExp unsigned8 flags current definition of Information Element 'mplsTopLabelExp', except that it See [RFC 3032] for the specification of the Exp [RFC 5102] 0 2013-02-18 reports a potentially modified value caused by a middlebox function field. See [RFC 3270] for usage of the Exp field. after the packet passed the Observation Point. 238 tcpWindowScale unsigned16 current The scale of the window field in the TCP header. See [RFC 1323] for the definition of the TCP window [RFC 5102] 0 2013-02-18 scale. A description of the direction assignment method used to assign the Biflow Source and Destination. This Information Element MAY be present in a Flow Data Record, or applied to all flows exported from an Exporting Process or Observation Domain using IPFIX Options. If this Information Element is not present in a Flow Record or associated with a Biflow via scope, it is assumed that the See the "biflowDirection (Value 239)" registry [IP 239 biflowDirection unsigned8 identifier current configuration of the direction assignment method is done out-of-band. Flow Information Export (IPFIX) Entities]. [RFC 5103]; [RFC 9710] 0 2013-02-18 Note that when using IPFIX Options to apply this Information Element to all flows within an Observation Domain or from an Exporting Process, the Option SHOULD be sent reliably. If reliable transport is not available (i.e., when using UDP), this Information Element SHOULD appear in each Flow Record. Values are listed in the biflowDirection registry. The difference between the length of an Ethernet frame (minus the 240 ethernetHeaderLength unsigned8 quantity current FCS) and the length of its MAC Client Data section (including any octets [IEEE.802-3.2005] [ipfix-iana_at_cisco.com] 1 2014-08-13 padding) as defined in section 3.1 of [IEEE.802-3.2005]. It does not include the Preamble, SFD and Extension field lengths. 241 ethernetPayloadLength unsigned16 quantity current The length of the MAC Client Data section (including any padding) of octets [IEEE.802-3.2005] [ipfix-iana_at_cisco.com] 1 2014-08-13 a frame as defined in section 3.1 of [IEEE.802-3.2005]. The total length of the Ethernet frame (excluding the Preamble, SFD, 242 ethernetTotalLength unsigned16 quantity current Extension and FCS fields) as described in section 3.1 of octets [IEEE.802-3.2005] [ipfix-iana_at_cisco.com] 1 2014-08-13 [IEEE.802-3.2005]. The value of the 12-bit VLAN Identifier portion of the Tag Control Information field of an Ethernet frame. The structure and semantics within the Tag Control Information field are defined in [IEEE802.1Q]. In Provider Bridged Networks, it represents the Service VLAN identifier in the Service VLAN Tag (S-TAG) Tag Control Information (TCI) field or the Customer VLAN identifier in the Customer VLAN Tag (C-TAG) Tag Control Information (TCI) field as described in 243 dot1qVlanId unsigned16 identifier current [IEEE802.1Q]. In Provider Backbone Bridged Networks, it represents [IEEE802.1Q][IEEE802.1Qbg] [ipfix-iana_at_cisco.com]; [RFC 7133] 2 2014-01-11 the Backbone VLAN identifier in the Backbone VLAN Tag (B-TAG) Tag Control Information (TCI) field as described in [IEEE802.1Q]. In a virtual link between a host system and EVB bridge, it represents the Service VLAN identifier indicating S-channel as described in [IEEE802.1Qbg]. In the case of a multi-tagged frame, it represents the outer tag's VLAN identifier, except for I-TAG. The value of the 3-bit User Priority portion of the Tag Control Information field of an Ethernet frame. The structure and semantics 244 dot1qPriority unsigned8 identifier current within the Tag Control Information field are defined in [IEEE802.1Q]. [IEEE802.1Q] [ipfix-iana_at_cisco.com]; [RFC 7133] 1 2014-01-11 In the case of multi-tagged frame, it represents the 3-bit Priority Code Point (PCP) portion of the outer tag's Tag Control Information (TCI) field as described in [IEEE802.1Q], except for I-TAG. The value represents the Customer VLAN identifier in the Customer 245 dot1qCustomerVlanId unsigned16 identifier current VLAN Tag (C-TAG) Tag Control Information (TCI) field as described in [IEEE802.1Q] [ipfix-iana_at_cisco.com]; [RFC 7133] 1 2014-01-11 [IEEE802.1Q]. The value represents the 3-bit Priority Code Point (PCP) portion of 246 dot1qCustomerPriority unsigned8 identifier current the Customer VLAN Tag (C-TAG) Tag Control Information (TCI) field as [IEEE802.1Q] [ipfix-iana_at_cisco.com]; [RFC 7133] 1 2014-01-11 described in [IEEE802.1Q]. The EVC Service Attribute which uniquely identifies the Ethernet 247 metroEvcId string default current Virtual Connection (EVC) within a Metro Ethernet Network, as defined MEF 10.1 (Ethernet Services Attributes Phase 2) MEF16 [ipfix-iana_at_cisco.com] 1 2014-02-03 in section 6.2 of MEF 10.1. The MetroEVCID is encoded in a string of (Ethernet Local Management Interface) up to 100 characters. 248 metroEvcType unsigned8 identifier current The 3-bit EVC Service Attribute which identifies the type of service MEF 10.1 (Ethernet Services Attributes Phase 2) MEF16 [ipfix-iana_at_cisco.com] 0 2013-02-18 provided by an EVC. (Ethernet Local Management Interface) A 32-bit non-zero connection identifier, which together with the 249 pseudoWireId unsigned32 identifier current pseudoWireType, identifies the Pseudo Wire (PW) as defined in [RFC See [RFC 8077] for pseudowire definitions. [ipfix-iana_at_cisco.com] 0 2013-02-18 8077]. The value of this information element identifies the type of MPLS See [RFC 4446] for the pseudowire type definition, 250 pseudoWireType unsigned16 identifier current Pseudo Wire (PW) as defined in [RFC 4446]. and [Pseudowire Name Spaces (PWE3)] for the IANA [ipfix-iana_at_cisco.com] 0 2013-02-18 Pseudowire Types registry. 251 pseudoWireControlWord unsigned32 identifier current The 32-bit Preferred Pseudo Wire (PW) MPLS Control Word as defined in See [RFC 4385] for the Pseudo Wire Control Word [ipfix-iana_at_cisco.com] 0 2013-02-18 [Section 3 of RFC 4385]. definition. 252 ingressPhysicalInterface unsigned32 identifier current The index of a networking device's physical interface (example, a See [RFC 2863] for the definition of the ifIndex [ipfix-iana_at_cisco.com] 0 2013-02-18 switch port) where packets of this flow are being received. object. 253 egressPhysicalInterface unsigned32 identifier current The index of a networking device's physical interface (example, a See [RFC 2863] for the definition of the ifIndex [ipfix-iana_at_cisco.com] 0 2013-02-18 switch port) where packets of this flow are being sent. object. The definition of this Information Element is identical to the 254 postDot1qVlanId unsigned16 identifier current definition of Information Element 'dot1qVlanId', except that it [IEEE.802-3.2005] [IEEE.802-1ad.2005] [ipfix-iana_at_cisco.com] 0 2013-02-18 reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. The definition of this Information Element is identical to the 255 postDot1qCustomerVlanId unsigned16 identifier current definition of Information Element 'dot1qCustomerVlanId', except that [IEEE.802-1ad.2005] [IEEE.802-1Q.2003] [ipfix-iana_at_cisco.com] 0 2013-02-18 it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. The Ethernet type field of an Ethernet frame that identifies the MAC [IEEE.802-3.2005] Ethertype registry available at 256 ethernetType unsigned16 identifier current client protocol carried in the payload as defined in paragraph [http://standards.ieee.org/regauth/ethertype/eth.txt] [ipfix-iana_at_cisco.com] 0 2013-02-18 1.4.349 of [IEEE.802-3.2005]. The definition of this Information Element is identical to the See [RFC 1812 (Section 5.3.3)] and [RFC 791] for the definition of Information Element 'ipPrecedence', except that it definition of the IP Precedence. See [RFC 1812 257 postIpPrecedence unsigned8 identifier current reports a potentially modified value caused by a middlebox function 0-7 (Section 5.3.2)] and [RFC 791] for the definition of [ipfix-iana_at_cisco.com] 0 2013-02-18 after the packet passed the Observation Point. the IPv4 TOS field. See [RFC 8200] for the definition of the IPv6 Traffic Class field. The absolute timestamp at which the data within the scope containing 258 collectionTimeMilliseconds dateTimeMilliseconds default current this Information Element was received by a Collecting Process. This milliseconds [RFC 5655]; [RFC Errata 3559]; [RFC 1 2013-03-26 Information Element SHOULD be bound to its containing IPFIX Message 9710] via IPFIX Options and the messageScope Information Element. The value of the SCTP Stream Identifier used by the Exporting Process 259 exportSctpStreamId unsigned16 identifier current for exporting IPFIX Message data. This is carried in the Stream [RFC 5655] 0 2013-02-18 Identifier field of the header of the SCTP DATA chunk containing the IPFIX Message(s). The absolute Export Time of the latest IPFIX Message within the scope 260 maxExportSeconds dateTimeSeconds default current containing this Information Element. This Information Element SHOULD seconds [RFC 5655] 0 2013-02-18 be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to 261 maxFlowEndSeconds dateTimeSeconds default current the second if necessary. This Information Element SHOULD be bound to seconds [RFC 5655] 0 2013-02-18 its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. The MD5 checksum of the IPFIX Message containing this record. This Information Element SHOULD be bound to its containing IPFIX Message via an options record and the messageScope Information Element, and SHOULD appear only once in a given IPFIX Message. To calculate the value of this Information Element, first buffer the containing IPFIX 262 messageMD5Checksum octetArray default current Message, setting the value of this Information Element to all zeroes. [RFC 5655]; [RFC 1321]; [RFC 9710] 0 2013-02-18 Then calculate the MD5 checksum of the resulting buffer as defined in [RFC 1321], place the resulting value in this Information Element, and export the buffered message. This Information Element is intended as a simple checksum only; therefore collision resistance and algorithm agility are not required, and MD5 is an appropriate message digest. This Information Element has a fixed length of 16 octets. The presence of this Information Element as scope in an Options Template signifies that the options described by the Template apply to the IPFIX Message that contains them. It is defined for general 263 messageScope unsigned8 current purpose message scoping of options, and proposed specifically to 0-0 [RFC 5655] 0 2013-02-18 allow the attachment a checksum to a message via IPFIX Options. The value of this Information Element MUST be written as 0 by the File Writer or Exporting Process. The value of this Information Element MUST be ignored by the File Reader or the Collecting Process. The absolute Export Time of the earliest IPFIX Message within the 264 minExportSeconds dateTimeSeconds default current scope containing this Information Element. This Information Element seconds [RFC 5655] 0 2013-02-18 SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to 265 minFlowStartSeconds dateTimeSeconds default current the second if necessary. This Information Element SHOULD be bound to seconds [RFC 5655] 0 2013-02-18 its containing IPFIX Transport Session via an options record and the sessionScope Information Element. This Information Element is used to encapsulate non- IPFIX data into an IPFIX Message stream, for the purpose of allowing a non-IPFIX data processor to store a data stream inline within an IPFIX File. A 266 opaqueOctets octetArray default current Collecting Process or File Writer MUST NOT try to interpret this [RFC 5655] 0 2013-02-18 binary data. This Information Element differs from paddingOctets as its contents are meaningful in some non-IPFIX context, while the contents of paddingOctets MUST be 0x00 and are intended only for Information Element alignment. The presence of this Information Element as scope in an Options Template signifies that the options described by the Template apply to the IPFIX Transport Session that contains them. Note that as all options are implicitly scoped to Transport Session and Observation Domain, this Information Element is equivalent to a "null" scope. It 267 sessionScope unsigned8 current is defined for general purpose session scoping of options, and 0-0 [RFC 5655] 0 2013-02-18 proposed specifically to allow the attachment of time window to an IPFIX File via IPFIX Options. The value of this Information Element MUST be written as 0 by the File Writer or Exporting Process. The value of this Information Element MUST be ignored by the File Reader or the Collecting Process. The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the microsecond if necessary. This Information Element SHOULD be 268 maxFlowEndMicroseconds dateTimeMicroseconds default current bound to its containing IPFIX Transport Session via IPFIX Options and microseconds [RFC 5655] 0 2013-02-18 the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with microsecond- precision (or better) timestamp Information Elements. The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the millisecond if necessary. This Information Element SHOULD be 269 maxFlowEndMilliseconds dateTimeMilliseconds default current bound to its containing IPFIX Transport Session via IPFIX Options and milliseconds [RFC 5655] 0 2013-02-18 the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with millisecond- precision (or better) timestamp Information Elements. The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport 270 maxFlowEndNanoseconds dateTimeNanoseconds default current Session via IPFIX Options and the sessionScope Information Element. nanoseconds [RFC 5655] 0 2013-02-18 This Information Element SHOULD be used only in Transport Sessions containing Flow Records with nanosecond-precision timestamp Information Elements. The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the microsecond if necessary. This Information Element SHOULD be 271 minFlowStartMicroseconds dateTimeMicroseconds default current bound to its containing IPFIX Transport Session via an options record microseconds [RFC 5655] 0 2013-02-18 and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with microsecond- precision (or better) timestamp Information Elements. The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the millisecond if necessary. This Information Element SHOULD be 272 minFlowStartMilliseconds dateTimeMilliseconds default current bound to its containing IPFIX Transport Session via an options record milliseconds [RFC 5655] 0 2013-02-18 and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with millisecond- precision (or better) timestamp Information Elements. The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport 273 minFlowStartNanoseconds dateTimeNanoseconds default current Session via an options record and the sessionScope Information nanoseconds [RFC 5655] 0 2013-02-18 Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with nanosecond-precision timestamp Information Elements. The full X.509 certificate, encoded in ASN.1 DER format, used by the Collector when IPFIX Messages were transmitted using TLS or DTLS. 274 collectorCertificate octetArray default current This Information Element SHOULD be bound to its containing IPFIX [RFC 5655] 0 2013-02-18 Transport Session via an options record and the sessionScope Information Element, or to its containing IPFIX Message via an options record and the messageScope Information Element. The full X.509 certificate, encoded in ASN.1 DER format, used by the Collector when IPFIX Messages were transmitted using TLS or DTLS. 275 exporterCertificate octetArray default current This Information Element SHOULD be bound to its containing IPFIX [RFC 5655] 0 2013-02-18 Transport Session via an options record and the sessionScope Information Element, or to its containing IPFIX Message via an options record and the messageScope Information Element. The export reliability of Data Records, within this SCTP stream, for the element(s) in the Options Template scope. A typical example of an element for which the export reliability will be reported is the templateID, as specified in the Data Records Reliability Options 276 dataRecordsReliability boolean default current Template. A value of 'True' means that the Exporting Process MUST [RFC 6526] 1 2014-02-03 send any Data Records associated with the element(s) reliably within this SCTP stream. A value of 'False' means that the Exporting Process MAY send any Data Records associated with the element(s) unreliably within this SCTP stream. 277 observationPointType unsigned8 identifier current Type of observation point. Values are listed in the See the "observationPointType (Value 277)" registry [ipfix-iana_at_cisco.com]; [RFC 9710] 0 2013-02-18 observationPointType registry. [IP Flow Information Export (IPFIX) Entities]. This information element counts the number of TCP or UDP connections 278 newConnectionDeltaCount unsigned32 deltaCounter current which were opened during the observation period. The observation [ipfix-iana_at_cisco.com] 1 2014-08-13 period may be specified by the flow start and end timestamps. This information element aggregates the total time in seconds for all 279 connectionSumDurationSeconds unsigned64 current of the TCP or UDP connections which were in use during the seconds [ipfix-iana_at_cisco.com] 1 2013-06-25 observation period. For example if there are 5 concurrent connections each for 10 seconds, the value would be 50 s. This information element identifies a transaction within a connection. A transaction is a meaningful exchange of application data between two network devices or a client and server. A 280 connectionTransactionId unsigned64 identifier current transactionId is assigned the first time a flow is reported, so that [ipfix-iana_at_cisco.com] 0 2013-02-18 later reports for the same flow will have the same transactionId. A different transactionId is used for each transaction within a TCP or UDP connection. The identifiers need not be sequential. The definition of this Information Element is identical to the definition of Information Element 'sourceIPv6Address', except that it reports a modified value caused by a NAT64 middlebox function after 281 postNATSourceIPv6Address ipv6Address default current the packet passed the Observation Point. See [RFC 8200] for the [ipfix-iana_at_cisco.com] 0 2013-02-18 definition of the Source Address field in the IPv6 header. See [RFC 3234] for the definition of middleboxes. See [RFC-ietf-v6ops-rfc6146-bis-16] for NAT64 specification. The definition of this Information Element is identical to the definition of Information Element 'destinationIPv6Address', except that it reports a modified value caused by a NAT64 middlebox function 282 postNATDestinationIPv6Address ipv6Address default current after the packet passed the Observation Point. See [RFC 8200] for the [ipfix-iana_at_cisco.com] 0 2013-02-18 definition of the Destination Address field in the IPv6 header. See [RFC 3234] for the definition of middleboxes. See [RFC-ietf-v6ops-rfc6146-bis-16] for NAT64 specification. 283 natPoolId unsigned32 identifier current Locally unique identifier of a NAT pool. [ipfix-iana_at_cisco.com] 0 2013-02-18 284 natPoolName string default current The name of a NAT pool identified by a natPoolID. [ipfix-iana_at_cisco.com] 0 2013-02-18 A flag word describing specialized modifications to the anonymization policy in effect for the anonymization technique applied to a referenced Information Element within a referenced Template. When flags are clear (0), the normal policy (as described by anonymizationTechnique) applies without modification. MSB 14 13 12 11 10 9 8 7 6 5 4 3 2 1 LSB +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ | Reserved |LOR|PmA| SC | +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ anonymizationFlags IE +--------+----------+-----------------------------------------------+ | bit(s) | name | description | | (LSB = | | | | 0) | | | +--------+----------+-----------------------------------------------+ | 0-1 | SC | Stability Class: see the Stability Class | | | | table below, and Section 5.1 of [RFC6235]. | | 2 | PmA | Perimeter Anonymization: when set (1), | | | | source Information Elements as described in | | | | [RFC5103] are interpreted as external | | | | addresses, and destination Information | | | | Elements as described in [RFC5103] are | | | | interpreted as internal addresses, for the | | | | purposes of associating | | | | anonymizationTechnique to Information | | | | Elements only; see Section 7.2.2 of [RFC6235] | | | | for details. | | | | This bit MUST NOT be set when associated with | | | | a non-endpoint (i.e., source or | | | | destination) Information Element. SHOULD be | | | | consistent within a record (i.e., if a | | | | source Information Element has this flag | | | | set, the corresponding destination element | | | | SHOULD have this flag set, and vice versa.) | | 3 | LOR | Low-Order Unchanged: when set (1), the | | | | low-order bits of the anonymized Information | | | | Element contain real data. This modification | | | | is intended for the anonymization of | | | | network-level addresses while leaving | | | | host-level addresses intact in order to | | | | preserve host level-structure, which could | | | | otherwise be used to reverse anonymization. | | | | MUST NOT be set when associated with a | 285 anonymizationFlags unsigned16 flags current | | | truncation-based anonymizationTechnique. | [RFC 6235]; [RFC 9710] 0 2013-02-18 | 4-15 | Reserved | Reserved for future use: SHOULD be cleared | | | | (0) by the Exporting Process and MUST be | | | | ignored by the Collecting Process. | +--------+----------+-----------------------------------------------+ The Stability Class portion of this flags word describes the stability class of the anonymization technique applied to a referenced Information Element within a referenced Template. Stability classes refer to the stability of the parameters of the anonymization technique, and therefore the comparability of the mapping between the real and anonymized values over time. This determines which anonymized datasets may be compared with each other. Values are as follows: +-----+-----+-------------------------------------------------------+ | Bit | Bit | Description | | 1 | 0 | | +-----+-----+-------------------------------------------------------+ | 0 | 0 | Undefined: the Exporting Process makes no | | | | representation as to how stable the mapping is, or | | | | over what time period values of this field will | | | | remain comparable; while the Collecting Process MAY | | | | assume Session level stability, Session level | | | | stability is not guaranteed. Processes SHOULD assume | | | | this is the case in the absence of stability class | | | | information; this is the default stability class. | | 0 | 1 | Session: the Exporting Process will ensure that the | | | | parameters of the anonymization technique are stable | | | | during the Transport Session. All the values of the | | | | described Information Element for each Record | | | | described by the referenced Template within the | | | | Transport Session are comparable. The Exporting | | | | Process SHOULD endeavour to ensure at least this | | | | stability class. | | 1 | 0 | Exporter-Collector Pair: the Exporting Process will | | | | ensure that the parameters of the anonymization | | | | technique are stable across Transport Sessions over | | | | time with the given Collecting Process, but may use | | | | different parameters for different Collecting | | | | Processes. Data exported to different Collecting | | | | Processes are not comparable. | | 1 | 1 | Stable: the Exporting Process will ensure that the | | | | parameters of the anonymization technique are stable | | | | across Transport Sessions over time, regardless of | | | | the Collecting Process to which it is sent. | +-----+-----+-------------------------------------------------------+ A description of the anonymization technique applied to a referenced Information Element within a referenced Template. Each technique may See the "anonymizationTechnique (Value 286)" registry 286 anonymizationTechnique unsigned16 identifier current be applicable only to certain Information Elements and recommended [IP Flow Information Export (IPFIX) Entities]. [RFC 6235]; [RFC 9710] 0 2013-02-18 only for certain Information Elements. Values are listed in the anonymizationTechnique registry. A zero-based index of an Information Element referenced by 287 informationElementIndex unsigned16 identifier current informationElementId within a Template referenced by templateId; used [RFC 6235] 0 2013-02-18 to disambiguate scope for templates containing multiple identical Information Elements. Specifies if the Application ID is based on peer-to-peer technology. 288 p2pTechnology string default current [RFC 6759] 0 2013-02-18 Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and { "unassigned", "u", 0 }. Specifies if the Application ID is used as a tunnel technology. 289 tunnelTechnology string default current [RFC 6759] 0 2013-02-18 Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and { "unassigned", "u", 0 }. Specifies if the Application ID is an encrypted networking protocol. 290 encryptedTechnology string default current [RFC 6759] 0 2013-02-18 Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and { "unassigned", "u", 0 }. Specifies a generic Information Element with a basicList abstract 291 basicList basicList list current data type. For example, a list of port numbers, a list of interface [RFC 6313] 0 2013-02-18 indexes, etc. 292 subTemplateList subTemplateList list current Specifies a generic Information Element with a subTemplateList [RFC 6313] 0 2013-02-18 abstract data type. 293 subTemplateMultiList subTemplateMultiList list current Specifies a generic Information Element with a subTemplateMultiList [RFC 6313] 0 2013-02-18 abstract data type. This element describes the "validity state" of the BGP route See [RFC 4271] for a description of BGP-4, [RFC 6811] 294 bgpValidityState unsigned8 identifier current correspondent source or destination IP address. If the "validity for the definition of "validity states" and [RFC [ipfix-iana_at_cisco.com] 0 2013-02-18 state" for this Flow is only available, then the value of this 8097] for the encoding of those "validity states". Information Element is 255. 295 IPSecSPI unsigned32 identifier current IPSec Security Parameters Index (SPI). See [RFC 2401] for the definition of SPI. [ipfix-iana_at_cisco.com] 0 2013-02-18 296 greKey unsigned32 identifier current GRE key, which is used for identifying an individual traffic flow See [RFC 1701] for the definition of GRE and the GRE [ipfix-iana_at_cisco.com] 0 2013-02-18 within a tunnel. Key. See the "natType (Value 297)" registry [IP Flow Information Export (IPFIX) Entities]. See [RFC 3022] for the definition of NAT (commonly named NAT44). See 297 natType unsigned8 identifier current This Information Element identifies the NAT type applied to packets [RFC 6144] for the definition of NAT46. See [ipfix-iana_at_cisco.com]; [RFC 9710] 0 2013-02-18 of the Flow. Values are listed in the natType registry. [RFC-ietf-v6ops-rfc6146-bis-16] for the definition of NAT64. See [RFC 6296] for the definition of NPTv6. See [RFC 791] for the definition of IPv4. See [RFC 8200] for the definition of IPv6. The total number of layer 4 packets in a flow from the initiator 298 initiatorPackets unsigned64 deltaCounter current since the previous report. The initiator is the device which packets See #231, initiatorOctets. [ipfix-iana_at_cisco.com] 1 2014-08-13 triggered the session creation, and remains the same for the life of the session. The total number of layer 4 packets in a flow from the responder 299 responderPackets unsigned64 deltaCounter current since the previous report. The responder is the device which replies packets See #232, responderOctets. [ipfix-iana_at_cisco.com] 1 2014-08-13 to the initiator, and remains the same for the life of the session. 300 observationDomainName string default current The name of an observation domain identified by an See #149, observationDomainId. [ipfix-iana_at_cisco.com] 0 2013-02-18 observationDomainId. From all the packets observed at an Observation Point, a subset of the packets is selected by a sequence of one or more Selectors. The 301 selectionSequenceId unsigned64 identifier current selectionSequenceId is a unique value per Observation Domain, [RFC 5477] 0 2013-02-18 specifying the Observation Point and the sequence of Selectors through which the packets are selected. The Selector ID is the unique ID identifying a Primitive Selector. 302 selectorId unsigned64 identifier current Each Primitive Selector must have a unique ID in the Observation [RFC 5477]; [RFC Errata 2052] 0 2013-02-18 Domain. 303 informationElementId unsigned16 identifier current This Information Element contains the ID of another Information [RFC 5477] 0 2013-02-18 Element. This Information Element identifies the packet selection methods (e.g., Filtering, Sampling) that are applied by the Selection Process. Most of these methods have parameters. Further Information Elements are needed to fully specify packet selection with these methods and all of their parameters. For the methods parameters, Information Elements are defined in the IPFIX registry [IANA-IPFIX]. 304 selectorAlgorithm unsigned16 identifier current The names of these Information Elements are listed for each method See the "Packet Sampling (PSAMP) Parameters" registry [RFC 5477]; [RFC 9710] 0 2013-02-18 identifier. Further method identifiers may be added to the list. It [Packet Sampling (PSAMP) Parameters] might be necessary to define new Information Elements to specify their parameters. There is a broad variety of possible parameters that could be used for Property Match Filtering (5) but currently there are no agreed parameters specified. This Information Element specifies the number of packets that are consecutively sampled. A value of 100 means that 100 consecutive 305 samplingPacketInterval unsigned32 quantity current packets are sampled. packets [RFC 5477] 0 2013-02-18 For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector. This Information Element specifies the number of packets between two "samplingPacketInterval"s. A value of 100 means that the next interval starts 100 packets (which are not sampled) after the current 306 samplingPacketSpace unsigned32 quantity current "samplingPacketInterval" is over. packets [RFC 5477] 0 2013-02-18 For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector. This Information Element specifies the time interval in microseconds during which all arriving packets are sampled. 307 samplingTimeInterval unsigned32 quantity current microseconds [RFC 5477] 0 2013-02-18 For example, this Information Element may be used to describe the configuration of a systematic time-based Sampling Selector. This Information Element specifies the time interval in microseconds between two "samplingTimeInterval"s. A value of 100 means that the next interval starts 100 microseconds (during which no packets are 308 samplingTimeSpace unsigned32 quantity current sampled) after the current "samplingTimeInterval" is over. microseconds [RFC 5477] 0 2013-02-18 For example, this Information Element may used to describe the configuration of a systematic time-based Sampling Selector. This Information Element specifies the number of elements taken from the parent Population for random Sampling methods. 309 samplingSize unsigned32 quantity current packets [RFC 5477] 0 2013-02-18 For example, this Information Element may be used to describe the configuration of a random n-out-of-N Sampling Selector. This Information Element specifies the number of elements in the parent Population for random Sampling methods. 310 samplingPopulation unsigned32 quantity current packets [RFC 5477] 0 2013-02-18 For example, this Information Element may be used to describe the configuration of a random n-out-of-N Sampling Selector. This Information Element specifies the probability that a packet is sampled, expressed as a value between 0 and 1. The probability is equal for every packet. A value of 0 means no packet was sampled 311 samplingProbability float64 quantity current since the probability is 0. [RFC 5477] 0 2013-02-18 For example, this Information Element may be used to describe the configuration of a uniform probabilistic Sampling Selector. This Information Element specifies the length of the selected data 312 dataLinkFrameSize unsigned16 quantity current link frame. [ISO/IEC.7498-1:1994] [RFC 7133] 1 2014-01-11 The data link layer is defined in [ISO/IEC.7498-1:1994]. This Information Element carries a series of n octets from the IP header of a sampled packet, starting sectionOffset octets into the IP header. However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the IP header. With sufficient length, this element also reports octets from the IP payload. However, full packet capture of arbitrary packet streams is explicitly out of scope per the Security Considerations sections of [RFC 5477] and [RFC 2804]. 313 ipHeaderPacketSection octetArray default current [RFC 2804]; [RFC 5477] [RFC 5477]; [RFC 7133] 1 2014-01-11 The sectionExportedOctets expresses how much data was exported, while the remainder is padding. When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or it MAY have a variable length. When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol. This Information Element carries a series of n octets from the IP payload of a sampled packet, starting sectionOffset octets into the IP payload. However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the IP payload. The IPv4 payload is that part of the packet that follows the IPv4 header and any options, which [RFC 791] refers to as "data" or "data octets". For example, see the examples in [RFC 791, Appendix A]. The IPv6 payload is the rest of the packet following the 40-octet 314 ipPayloadPacketSection octetArray default current IPv6 header. Note that any extension headers present are considered [RFC 791]; [RFC 8200] [RFC 5477]; [RFC 7133] 1 2014-01-11 part of the payload. See [RFC 8200] for the IPv6 specification. The sectionExportedOctets expresses how much data was observed, while the remainder is padding. When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or MAY have a variable length. When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol. This Information Element carries n octets from the data link frame of a selected frame, starting sectionOffset octets into the frame. However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the data link frame. The sectionExportedOctets expresses how much data was observed, while the remainder is padding. When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or MAY have a variable length. 315 dataLinkFrameSection octetArray default current When the sectionExportedOctets field corresponding to this [RFC 6313]; [RFC 7133] [ISO/IEC.7498-1:1994] [RFC 7133] 1 2014-01-11 Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol. Further Information Elements, i.e., dataLinkFrameType and dataLinkFrameSize, are needed to specify the data link type and the size of the data link frame of this Information Element. A set of these Information Elements MAY be contained in a structured data type, as expressed in [RFC 6313]. Or a set of these Information Elements MAY be contained in one Flow Record as shown in [Appendix B of RFC 7133]. The data link layer is defined in [ISO/IEC.7498-1:1994]. This Information Element carries a series of n octets from the MPLS label stack of a sampled packet, starting sectionOffset octets into the MPLS label stack. However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the head of the MPLS label stack. With sufficient length, this element also reports octets from the MPLS payload. However, full packet capture of arbitrary packet streams is explicitly out of scope per the Security Considerations sections of [RFC 5477] and [RFC 2804]. See [RFC 3031] for the specification of MPLS packets. 316 mplsLabelStackSection octetArray default current [RFC 2804]; [RFC 3031]; [RFC 3032]; [RFC 5477] [RFC 5477]; [RFC 7133] 1 2014-01-11 See [RFC 3032] for the specification of the MPLS label stack. The sectionExportedOctets expresses how much data was observed, while the remainder is padding. When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or MAY have a variable length. When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol. The mplsPayloadPacketSection carries a series of n octets from the MPLS payload of a sampled packet, starting sectionOffset octets into the MPLS payload, as it is data that follows immediately after the MPLS label stack. However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the MPLS payload. See [RFC 3031] for the specification of MPLS packets. See [RFC 3032] for the specification of the MPLS label stack. 317 mplsPayloadPacketSection octetArray default current [RFC 3031]; [RFC 3032] [RFC 5477]; [RFC 7133] 1 2014-01-11 The sectionExportedOctets expresses how much data was observed, while the remainder is padding. When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or it MAY have a variable length. When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol. This Information Element specifies the total number of packets observed by a Selector, for a specific value of SelectorId. 318 selectorIdTotalPktsObserved unsigned64 totalCounter current packets [RFC 5477] 0 2013-02-18 This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC 7011]. This Information Element specifies the total number of packets selected by a Selector, for a specific value of SelectorId. 319 selectorIdTotalPktsSelected unsigned64 totalCounter current packets [RFC 5477] 0 2013-02-18 This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC 7011]. This Information Element specifies the maximum possible measurement error of the reported value for a given Information Element. The absoluteError has the same unit as the Information Element with which it is associated. The real value of the metric can differ by absoluteError (positive or negative) from the measured value. This Information Element provides only the error for measured values. 320 absoluteError float64 quantity current If an Information Element contains an estimated value (from inferred [RFC 5477] 1 2018-06-13 Sampling), the confidence boundaries and confidence level have to be provided instead, using the upperCILimit, lowerCILimit, and confidenceLevel Information Elements. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC 7011]. This Information Element specifies the maximum possible positive or negative error ratio for the reported value for a given Information Element as percentage of the measured value. The real value of the metric can differ by relativeError percent (positive or negative) from the measured value. This Information Element provides only the error for measured values. 321 relativeError float64 quantity current If an Information Element contains an estimated value (from [RFC 5477] 0 2013-02-18 Sampling), the confidence boundaries and confidence level have to be provided instead, using the upperCILimit, lowerCILimit, and confidenceLevel Information Elements. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC 7011]. 322 observationTimeSeconds dateTimeSeconds default current This Information Element specifies the absolute time in seconds of an seconds [RFC 5477] 1 2014-02-03 observation. 323 observationTimeMilliseconds dateTimeMilliseconds default current This Information Element specifies the absolute time in milliseconds milliseconds [RFC 5477] 1 2014-02-03 of an observation. 324 observationTimeMicroseconds dateTimeMicroseconds default current This Information Element specifies the absolute time in microseconds microseconds [RFC 5477] 1 2014-02-03 of an observation. 325 observationTimeNanoseconds dateTimeNanoseconds default current This Information Element specifies the absolute time in nanoseconds nanoseconds [RFC 5477] 1 2014-02-03 of an observation. 326 digestHashValue unsigned64 quantity current This Information Element specifies the value from the digest hash [RFC 5477] 0 2013-02-18 function. See also [Sections 6.2, 3.8, 7.1 of RFC 5475]. This Information Element specifies the IP payload offset used by a 327 hashIPPayloadOffset unsigned64 quantity current Hash-based Selection Selector. See also [Sections 6.2, 3.8, 7.1 of [RFC 5477] 0 2013-02-18 RFC 5475]. This Information Element specifies the IP payload size used by a 328 hashIPPayloadSize unsigned64 quantity current Hash-based Selection Selector. See also [Sections 6.2, 3.8, 7.1 of [RFC 5477] 0 2013-02-18 RFC 5475]. This Information Element specifies the value for the beginning of a 329 hashOutputRangeMin unsigned64 quantity current hash function's potential output range. [RFC 5477] 0 2013-02-18 See also [Sections 6.2, 3.8, 7.1 of RFC 5475]. This Information Element specifies the value for the end of a hash 330 hashOutputRangeMax unsigned64 quantity current function's potential output range. [RFC 5477] 0 2013-02-18 See also [Sections 6.2, 3.8, 7.1 of RFC 5475]. This Information Element specifies the value for the beginning of a 331 hashSelectedRangeMin unsigned64 quantity current hash function's selected range. [RFC 5477] 0 2013-02-18 See also [Sections 6.2, 3.8, 7.1 of RFC 5475]. This Information Element specifies the value for the end of a hash 332 hashSelectedRangeMax unsigned64 quantity current function's selected range. [RFC 5477] 0 2013-02-18 See also [Sections 6.2, 3.8, 7.1 of RFC 5475]. This Information Element contains a boolean value that is TRUE if the output from this hash Selector has been configured to be included in 333 hashDigestOutput boolean default current the packet report as a packet digest, else FALSE. [RFC 5477] 1 2014-02-03 See also [Sections 6.2, 3.8, 7.1 of RFC 5475]. This Information Element specifies the initialiser value to the hash 334 hashInitialiserValue unsigned64 quantity current function. [RFC 5477] 0 2013-02-18 See also [Sections 6.2, 3.8, 7.1 of RFC 5475]. 335 selectorName string default current The name of a selector identified by a selectorID. Globally unique [ipfix-iana_at_cisco.com] 0 2013-02-18 per Metering Process. This Information Element specifies the upper limit of a confidence interval. It is used to provide an accuracy statement for an estimated value. The confidence limits define the range in which the real value is assumed to be with a certain probability p. Confidence limits always need to be associated with a confidence level that defines this probability p. Please note that a confidence interval only provides a probability that the real value lies within the limits. That means the real value can lie outside the confidence 336 upperCILimit float64 quantity current limits. [RFC 5477] 0 2013-02-18 The upperCILimit, lowerCILimit, and confidenceLevel Information Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC 7011]. Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together. This Information Element specifies the lower limit of a confidence interval. For further information, see the description of upperCILimit. The upperCILimit, lowerCILimit, and confidenceLevel Information 337 lowerCILimit float64 quantity current Elements should all be used in an Options Template scoped to the [RFC 5477] 0 2013-02-18 observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC 7011]. Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together. This Information Element specifies the confidence level. It is used to provide an accuracy statement for estimated values. The confidence level provides the probability p with which the real value lies within a given range. A confidence level always needs to be associated with confidence limits that define the range in which the real value is assumed to be. 338 confidenceLevel float64 quantity current The upperCILimit, lowerCILimit, and confidenceLevel Information [RFC 5477] 0 2013-02-18 Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC 7011]. Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together. A description of the abstract data type of an IPFIX information element. These are taken from the abstract data types defined in Section 3.1 of the IPFIX Information Model [RFC 5102]; see that section for more information on the types described in the "IPFIX Information Element Data Types" registry. These types are registered See the "IPFIX Information Element Data Types" 339 informationElementDataType unsigned8 current in the "IPFIX Information Element Data Types" registry. registry [IP Flow Information Export (IPFIX) [RFC 5610]; [RFC 9710] 0 2013-02-18 Entities] The "IPFIX Information Element Data Types" registry is intended to assign numbers for type names, not to provide a mechanism for adding data types to the IPFIX Protocol; as such, modifications require Standards Action [RFC 8126]. A UTF-8 [RFC 3629] encoded Unicode string containing a human-readable description of an Information Element. The content of the informationElementDescription MAY be annotated with one or more language tags [RFC 4646], encoded in-line [RFC 2482] within the UTF-8 string, in order to specify the language in which the description is 340 informationElementDescription string default current written. Description text in multiple languages MAY tag each section [RFC 5610]; [RFC 9710] 0 2013-02-18 with its own language tag; in this case, the description information in each language SHOULD have equivalent meaning. In the absence of any language tag, the "i-default" [RFC 2277] language SHOULD be assumed. See [Section 4 of RFC 5610] (Security Considerations) for notes on string handling for Information Element type records. A UTF-8 [RFC 3629] encoded Unicode string containing the name of an 341 informationElementName string default current Information Element, intended as a simple identifier. See the [RFC 5610] 0 2013-02-18 Security Considerations section for notes on string handling for Information Element type records 342 informationElementRangeBegin unsigned64 quantity current Contains the inclusive low end of the range of acceptable values for [RFC 5610] 0 2013-02-18 an Information Element. 343 informationElementRangeEnd unsigned64 quantity current Contains the inclusive high end of the range of acceptable values for [RFC 5610] 0 2013-02-18 an Information Element. A description of the semantics of an IPFIX Information Element. These are taken from the data type semantics defined in Section 3.2 of the IPFIX Information Model [RFC 5102]; see that section for more information on the types defined in the "IPFIX Information Element Semantics" registry. This field may take the values in the "IPFIX Information Element Semantics" registry. The special value 0x00 See the "IPFIX Information Element Semantics" 344 informationElementSemantics unsigned8 current (default) is used to note that no semantics apply to the field; it registry [IP Flow Information Export (IPFIX) [RFC 5610]; [RFC 9710] 0 2013-02-18 cannot be manipulated by a Collecting Process or File Reader that Entities] does not understand it a priori. The "IPFIX Information Element Semantics" registry is intended to assign numbers for semantics names, not to provide a mechanism for adding semantics to the IPFIX Protocol; as such, modifications require Standards Action [RFC 8126]. A description of the units of an IPFIX Information Element. These correspond to the units implicitly defined in the Information Element definitions in Section 5 of the IPFIX Information Model [RFC 5102]; See the "IPFIX Information Element Units" registry [RFC 5610]; [RFC Errata 1822]; [RFC 345 informationElementUnits unsigned16 current see that section for more information on the types described in the [IP Flow Information Export (IPFIX) Entities] 9710] 1 2020-10-01 "IPFIX Information Element Units" registry. These types can take the values in the "IPFIX Information Element Units" registry. The special value 0x00 (none) is used to note that the field is unitless. A private enterprise number, as assigned by IANA. Within the context of an Information Element Type record, this element can be used along with the informationElementId element to scope properties to a specific Information Element. To export type information about an IANA-assigned Information Element, set the privateEnterpriseNumber to 346 privateEnterpriseNumber unsigned32 identifier current 0, or do not export the privateEnterpriseNumber in the type record. See the "Private Enterprise Numbers (PENs)" registry [RFC 5610]; [RFC 9710] 0 2013-02-18 To export type information about an enterprise-specific Information [Private Enterprise Numbers (PENs)] Element, export the enterprise number in privateEnterpriseNumber, and export the Information Element number with the Enterprise bit cleared in informationElementId. The Enterprise bit in the associated informationElementId Information Element MUST be ignored by the Collecting Process. Instance Identifier of the interface to a Virtual Station. A Virtual See IEEE 802.1Qbg for the definition of Virtual 347 virtualStationInterfaceId octetArray default current Station is an end station instance: it can be a virtual machine or a Station Interface ID. [ipfix-iana_at_cisco.com] 1 2014-02-03 physical host. 348 virtualStationInterfaceName string default current Name of the interface to a Virtual Station. A Virtual Station is an See IEEE 802.1Qbg for the definition of Virtual [ipfix-iana_at_cisco.com] 1 2014-02-03 end station instance: it can be a virtual machine or a physical host. Station Interface. 349 virtualStationUUID octetArray default current Unique Identifier of a Virtual Station. A Virtual Station is an end See IEEE 802.1Qbg for the definition of Virtual [ipfix-iana_at_cisco.com] 1 2014-02-03 station instance: it can be a virtual machine or a physical host. Station. 350 virtualStationName string default current Name of a Virtual Station. A Virtual Station is an end station See IEEE 802.1Qbg for the definition of Virtual [ipfix-iana_at_cisco.com] 0 2013-02-18 instance: it can be a virtual machine or a physical host. Station. Identifier of a layer 2 network segment in an overlay network. The most significant byte identifies the layer 2 network overlay network encapsulation type: 0x00 reserved 0x01 VxLAN See VxLAN RFC at [RFC 7348] 351 layer2SegmentId unsigned64 identifier current 0x02 NVGRE [ipfix-iana_at_cisco.com] 0 2013-02-18 See NVGRE RFC at [RFC 7637] The three lowest significant bytes hold the value of the layer 2 overlay network segment identifier. For example: - a 24 bit segment ID VXLAN Network Identifier (VNI) - a 24 bit Tenant Network Identifier (TNI) for NVGRE The number of layer 2 octets since the previous report (if any) in 352 layer2OctetDeltaCount unsigned64 deltaCounter current incoming packets for this Flow at the Observation Point. The number octets [ipfix-iana_at_cisco.com] 1 2014-05-02 of octets includes layer 2 header(s) and layer 2 payload. # memo: layer 2 version of octetDeltaCount (field #1) The total number of layer 2 octets in incoming packets for this Flow at the Observation Point since the Metering Process 353 layer2OctetTotalCount unsigned64 totalCounter current (re-)initialization for this Observation Point. The number of octets octets [ipfix-iana_at_cisco.com] 1 2014-05-02 includes layer 2 header(s) and layer 2 payload. # memo: layer 2 version of octetTotalCount (field #85) The total number of incoming unicast packets metered at the 354 ingressUnicastPacketTotalCount unsigned64 totalCounter current Observation Point since the Metering Process (re-)initialization for packets [ipfix-iana_at_cisco.com] 0 2013-02-18 this Observation Point. The total number of incoming multicast packets metered at the 355 ingressMulticastPacketTotalCount unsigned64 totalCounter current Observation Point since the Metering Process (re-)initialization for packets [ipfix-iana_at_cisco.com] 0 2013-02-18 this Observation Point. The total number of incoming broadcast packets metered at the 356 ingressBroadcastPacketTotalCount unsigned64 totalCounter current Observation Point since the Metering Process (re-)initialization for packets [ipfix-iana_at_cisco.com] 0 2013-02-18 this Observation Point. The total number of incoming unicast packets metered at the 357 egressUnicastPacketTotalCount unsigned64 totalCounter current Observation Point since the Metering Process (re-)initialization for packets [ipfix-iana_at_cisco.com] 0 2013-02-18 this Observation Point. The total number of incoming broadcast packets metered at the 358 egressBroadcastPacketTotalCount unsigned64 totalCounter current Observation Point since the Metering Process (re-)initialization for packets [ipfix-iana_at_cisco.com] 0 2013-02-18 this Observation Point. The absolute timestamp at which the monitoring interval started. A 359 monitoringIntervalStartMilliSeconds dateTimeMilliseconds default current Monitoring interval is the period of time during which the Metering milliseconds [ipfix-iana_at_cisco.com] 0 2013-02-18 Process is running. The absolute timestamp at which the monitoring interval ended. A 360 monitoringIntervalEndMilliSeconds dateTimeMilliseconds default current Monitoring interval is the period of time during which the Metering milliseconds [ipfix-iana_at_cisco.com] 0 2013-02-18 Process is running. The port number identifying the start of a range of port numbers. A See the assigned transport protocol (e.g., UDP, TCP, 361 portRangeStart unsigned16 identifier current value of zero indicates that the range start is not specified, i.e., SCTP, and DCCP) port numbers [Service Name and [ipfix-iana_at_cisco.com]; [RFC 9710] 0 2013-02-18 the range is defined in some other way. Transport Protocol Port Number Registry]. The port number identifying the end of a range of port numbers. A See the assigned transport protocol (e.g., UDP, TCP, 362 portRangeEnd unsigned16 identifier current value of zero indicates that the range end is not specified, i.e., SCTP, and DCCP) port numbers [Service Name and [ipfix-iana_at_cisco.com]; [RFC 9710] 0 2013-02-18 the range is defined in some other way. Transport Protocol Port Number Registry]. The step size in a port range. The default step size is 1, which 363 portRangeStepSize unsigned16 identifier current indicates contiguous ports. A value of zero indicates that the step [ipfix-iana_at_cisco.com] 0 2013-02-18 size is not specified, ie the range is defined in some other way. The number of ports in a port range. A value of zero indicates that 364 portRangeNumPorts unsigned16 identifier current the number of ports is not specified, ie the range is defined in some [ipfix-iana_at_cisco.com] 0 2013-02-18 other way. 365 staMacAddress macAddress default current The IEEE 802 MAC address of a wireless station (STA). See [Section 1.4 of RFC 5415] for the definition of [ipfix-iana_at_cisco.com] 1 2014-02-03 STA. 366 staIPv4Address ipv4Address default current The IPv4 address of a wireless station (STA). See [Section 1.4 of RFC 5415] for the definition of [ipfix-iana_at_cisco.com] 1 2014-02-03 STA. 367 wtpMacAddress macAddress default current The IEEE 802 MAC address of a wireless access point (WTP). See [Section 1.4 of RFC 5415] for the definition of [ipfix-iana_at_cisco.com] 1 2014-02-03 WTP. 368 ingressInterfaceType unsigned32 identifier current The type of interface where packets of this Flow are being received. See the "IANAifType-MIB" registry [IANAifType-MIB]. [ipfix-iana_at_cisco.com]; [RFC 9710] 0 2013-02-18 The value matches the value of managed object 'ifType'. 369 egressInterfaceType unsigned32 identifier current The type of interface where packets of this Flow are being sent. The See the "IANAifType-MIB" registry [IANAifType-MIB]. [ipfix-iana_at_cisco.com]; [RFC 9710] 0 2013-02-18 value matches the value of managed object 'ifType'. 370 rtpSequenceNumber unsigned16 current The RTP sequence number per [RFC 3550]. [RFC 3550] [ipfix-iana_at_cisco.com] 0 2013-02-18 371 userName string default current User name associated with the flow. [ipfix-iana_at_cisco.com] 0 2013-02-18 372 applicationCategoryName string default current An attribute that provides a first level categorization for each [RFC 6759] 0 2013-02-18 Application ID. 373 applicationSubCategoryName string default current An attribute that provides a second level categorization for each [RFC 6759] 0 2013-02-18 Application ID. 374 applicationGroupName string default current An attribute that groups multiple Application IDs that belong to the [RFC 6759] 0 2013-02-18 same networking application. The non-conservative count of Original Flows contributing to this 375 originalFlowsPresent unsigned64 deltaCounter current Aggregated Flow. Non-conservative counts need not sum to the original flows [RFC 7015] 1 2013-06-25 count on re-aggregation. The conservative count of Original Flows whose first packet is 376 originalFlowsInitiated unsigned64 deltaCounter current represented within this Aggregated Flow. Conservative counts must sum flows [RFC 7015] 1 2013-06-25 to the original count on re-aggregation. The conservative count of Original Flows whose last packet is 377 originalFlowsCompleted unsigned64 deltaCounter current represented within this Aggregated Flow. Conservative counts must sum flows [RFC 7015] 1 2013-06-25 to the original count on re-aggregation. The count of distinct source IP address values for Original Flows 378 distinctCountOfSourceIPAddress unsigned64 totalCounter current contributing to this Aggregated Flow, without regard to IP version. [RFC 7015] 0 2013-02-18 This Information Element is preferred to the IP-version-specific counters, unless it is important to separate the counts by version. The count of distinct destination IP address values for Original Flows contributing to this Aggregated Flow, without regard to IP 379 distinctCountOfDestinationIPAddress unsigned64 totalCounter current version. This Information Element is preferred to the [RFC 7015]; [RFC 9710] 0 2013-02-18 version-specific counters, unless it is important to separate the counts by version. 380 distinctCountOfSourceIPv4Address unsigned32 totalCounter current The count of distinct source IPv4 address values for Original Flows [RFC 7015] 0 2013-02-18 contributing to this Aggregated Flow. 381 distinctCountOfDestinationIPv4Address unsigned32 totalCounter current The count of distinct destination IPv4 address values for Original [RFC 7015] 0 2013-02-18 Flows contributing to this Aggregated Flow. 382 distinctCountOfSourceIPv6Address unsigned64 totalCounter current The count of distinct source IPv6 address values for Original Flows [RFC 7015] 0 2013-02-18 contributing to this Aggregated Flow. 383 distinctCountOfDestinationIPv6Address unsigned64 totalCounter current The count of distinct destination IPv6 address values for Original [RFC 7015] 0 2013-02-18 Flows contributing to this Aggregated Flow. A description of the method used to distribute the counters from Contributing Flows into the Aggregated Flow records described by an associated scope, generally a Template. The method is deemed to apply to all the non-key Information Elements in the referenced scope for which value distribution is a valid operation; if the See the "valueDistributionMethod (Value 384)" 384 valueDistributionMethod unsigned8 current originalFlowsInitiated and/or originalFlowsCompleted Information registry [IP Flow Information Export (IPFIX) [RFC 7015]; [RFC 9710] 0 2013-02-18 Elements appear in the Template, they are not subject to this Entities]. distribution method, as they each infer their own distribution method. The "valueDistributionMethod (Value 384)" registry is intended to list a complete set of possible value distribution methods. 385 rfc3550JitterMilliseconds unsigned32 quantity current Interarrival jitter as defined in [Section 6.4.1 of RFC 3550], milliseconds [RFC 3550] [ipfix-iana_at_cisco.com] 0 2013-02-18 measured in milliseconds. 386 rfc3550JitterMicroseconds unsigned32 quantity current Interarrival jitter as defined in [Section 6.4.1 of RFC 3550], microseconds [RFC 3550] [ipfix-iana_at_cisco.com] 0 2013-02-18 measured in microseconds. 387 rfc3550JitterNanoseconds unsigned32 quantity current Interarrival jitter as defined in [Section 6.4.1 of RFC 3550], nanoseconds [RFC 3550] [ipfix-iana_at_cisco.com] 0 2013-02-18 measured in nanoseconds. The value of the 1-bit Drop Eligible Indicator (DEI) field of the VLAN tag as described in 802.1Q-2011 subclause 9.6. In case of a QinQ frame, it represents the outer tag's DEI field and in case of an IEEE 388 dot1qDEI boolean default current 802.1ad frame it represents the DEI field of the S-TAG. Note: in [802.1Q-2011 subclause 9.6] [Yaakov_J_Stein] 1 2014-02-03 earlier versions of 802.1Q the same bit field in the incoming packet is occupied by the Canonical Format Indicator (CFI) field, except for S-TAGs. In case of a QinQ frame, it represents the inner tag's Drop Eligible 389 dot1qCustomerDEI boolean default current Indicator (DEI) field and in case of an IEEE 802.1ad frame it [802.1Q-2011 subclause 9.6] [Yaakov_J_Stein] 1 2014-02-03 represents the DEI field of the C-TAG. This Information Element identifies the Intermediate Flow Selection Process technique (e.g., Filtering, Sampling) that is applied by the Intermediate Flow Selection Process. Most of these techniques have parameters. Its configuration parameter(s) MUST be clearly specified. See the "flowSelectorAlgorithm (Value 390)" registry 390 flowSelectorAlgorithm unsigned16 identifier current Additional Information Elements are needed to fully specify packet [IP Flow Information Export (IPFIX) Entities]. [RFC 7014]; [RFC 9710] 0 2013-06-07 selection with these methods and all of their parameters. Additional method identifiers may be added to the "flowSelectorAlgorithm (Value 390)" registry. It might be necessary to define new Information Elements to specify their parameters. This Information Element specifies the volume in octets of all Flows 391 flowSelectedOctetDeltaCount unsigned64 deltaCounter current that are selected in the Intermediate Flow Selection Process since octets [RFC 7014] 1 2014-08-13 the previous report. This Information Element specifies the volume in packets of all Flows 392 flowSelectedPacketDeltaCount unsigned64 deltaCounter current that were selected in the Intermediate Flow Selection Process since packets [RFC 7014] 1 2014-08-13 the previous report. This Information Element specifies the number of Flows that were 393 flowSelectedFlowDeltaCount unsigned64 deltaCounter current selected in the Intermediate Flow Selection Process since the last flows [RFC 7014] 1 2014-08-13 report. This Information Element specifies the total number of Flows observed by a Selector, for a specific value of SelectorId. This Information 394 selectorIDTotalFlowsObserved unsigned64 current Element should be used in an Options Template scoped to the flows [RFC 7014] 0 2013-06-07 observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC 7011]. This Information Element specifies the total number of Flows selected by a Selector, for a specific value of SelectorId. This Information 395 selectorIDTotalFlowsSelected unsigned64 current Element should be used in an Options Template scoped to the flows [RFC 7014] 0 2013-06-07 observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC 7011]. This Information Element specifies the number of Flows that are consecutively sampled. A value of 100 means that 100 consecutive 396 samplingFlowInterval unsigned64 current Flows are sampled. For example, this Information Element may be used flows [RFC 7014] 0 2013-06-07 to describe the configuration of a systematic count-based Sampling Selector. This Information Element specifies the number of Flows between two "samplingFlowInterval"s. A value of 100 means that the next interval 397 samplingFlowSpacing unsigned64 current starts 100 Flows (which are not sampled) after the current flows [RFC 7014] 0 2013-06-07 "samplingFlowInterval" is over. For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector. This Information Element specifies the time interval in microseconds 398 flowSamplingTimeInterval unsigned64 current during which all arriving Flows are sampled. For example, this microseconds [RFC 7014] 0 2013-06-07 Information Element may be used to describe the configuration of a systematic time-based Sampling Selector. This Information Element specifies the time interval in microseconds between two "flowSamplingTimeInterval"s. A value of 100 means that 399 flowSamplingTimeSpacing unsigned64 current the next interval starts 100 microseconds (during which no Flows are microseconds [RFC 7014] 0 2013-06-07 sampled) after the current "flowsamplingTimeInterval" is over. For example, this Information Element may used to describe the configuration of a systematic time-based Sampling Selector. 400 hashFlowDomain unsigned16 identifier current This Information Element specifies the Information Elements that are [RFC 7014] 0 2013-06-07 used by the Hash-based Flow Selector as the Hash Domain. The number of octets, excluding IP header(s) and Layer 4 transport 401 transportOctetDeltaCount unsigned64 deltaCounter current protocol header(s), observed for this Flow at the Observation Point octets [Brian_Trammell] 0 2013-08-01 since the previous report (if any). The number of packets containing at least one octet beyond the IP 402 transportPacketDeltaCount unsigned64 deltaCounter current header(s) and Layer 4 transport protocol header(s), observed for this packets [Brian_Trammell] 0 2013-08-01 Flow at the Observation Point since the previous report (if any). The IPv4 address used by the Exporting Process on an Original 403 originalExporterIPv4Address ipv4Address current Exporter, as seen by the Collecting Process on an IPFIX Mediator. [RFC 7119] 0 2013-12-24 Used to provide information about the Original Observation Points to a downstream Collector. The IPv6 address used by the Exporting Process on an Original 404 originalExporterIPv6Address ipv6Address current Exporter, as seen by the Collecting Process on an IPFIX Mediator. [RFC 7119] 0 2013-12-24 Used to provide information about the Original Observation Points to a downstream Collector. The Observation Domain ID reported by the Exporting Process on an Original Exporter, as seen by the Collecting Process on an IPFIX 405 originalObservationDomainId unsigned32 identifier current Mediator. Used to provide information about the Original Observation [RFC 7119] 0 2013-12-24 Domain to a downstream Collector. When cascading through multiple Mediators, this identifies the initial Observation Domain in the cascade. Description: An identifier of an Intermediate Process that is unique per IPFIX Device. Typically, this Information Element is used for 406 intermediateProcessId unsigned32 identifier current limiting the scope of other Information Elements. Note that process [RFC 7119] 0 2013-12-24 identifiers may be assigned dynamically; that is, an Intermediate Process may be restarted with a different ID. Description: The total number of received Data Records that the Intermediate Process did not process since the (re-)initialization of the Intermediate Process; includes only Data Records not examined or 407 ignoredDataRecordTotalCount unsigned64 totalCounter current otherwise handled by the Intermediate Process due to resource [RFC 7119] 0 2013-12-24 constraints, not Data Records that were examined or otherwise handled by the Intermediate Process but those that merely do not contribute to any exported Data Record due to the operations performed by the Intermediate Process. This Information Element specifies the type of the selected data link See the "dataLinkFrameType (Value 408)" registry [IP frame. Data link types are defined in the "dataLinkFrameType (Value Flow Information Export (IPFIX) Entities]. 408 dataLinkFrameType unsigned16 flags current 408)" registry. [RFC 7133]; [RFC 9710] 0 2014-01-11 More information about the data link layer can be Additional values may be assigned by IANA. Note that the assigned found in values are bits so that multiple observations can be OR'd together. (IEEE802.3)(IEEE802.11)(ISO/IEC.7498-1:1994). This Information Element specifies the offset of the packet section (e.g., dataLinkFrameSection, ipHeaderPacketSection, ipPayloadPacketSection, mplsLabelStackSection, and mplsPayloadPacketSection). If this Information Element is omitted, it defaults to zero (i.e., no offset). If multiple sectionOffset Information Elements are specified within a single Template, then they apply to the packet section Information Elements in order: the first sectionOffset applies to the first 409 sectionOffset unsigned16 quantity current packet section, the second to the second, and so on. Note that the [RFC 7133] 0 2014-01-11 "closest" sectionOffset and packet section Information Elements within a given Template are not necessarily related. If there are fewer sectionOffset Information Elements than packet section Information Elements, then subsequent packet section Information Elements have no offset, i.e., a sectionOffset of zero applies to those packet section Information Elements. If there are more sectionOffset Information Elements than the number of packet section Information Elements, then the additional sectionOffset Information Elements are meaningless. This Information Element specifies the observed length of the packet section (e.g., dataLinkFrameSection, ipHeaderPacketSection, ipPayloadPacketSection, mplsLabelStackSection, and mplsPayloadPacketSection) when padding is used. 410 sectionExportedOctets unsigned16 quantity current [RFC 7011] [RFC 7133] 0 2014-01-11 The packet section may be of a fixed size larger than the sectionExportedOctets. In this case, octets in the packet section beyond the sectionExportedOctets MUST follow the [RFC 7011] rules for padding (i.e., be composed of zero (0) valued octets). This Information Element, which is 16 octets long, represents the Backbone Service Instance Tag (I-TAG) Tag Control Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q]. It encodes the Backbone Service Instance Priority Code Point (I-PCP), Backbone 411 dot1qServiceInstanceTag octetArray default current Service Instance Drop Eligible Indicator (I-DEI), Use Customer [IEEE802.1Q] [RFC 7133] 1 2014-05-02 Addresses (UCAs), Backbone Service Instance Identifier (I-SID), Encapsulated Customer Destination Address (C-DA), Encapsulated Customer Source Address (C-SA), and reserved fields. The structure and semantics within the Tag Control Information field are defined in [IEEE802.1Q]. The value of the 24-bit Backbone Service Instance Identifier (I-SID) 412 dot1qServiceInstanceId unsigned32 identifier current portion of the Backbone Service Instance Tag (I-TAG) Tag Control 0-0xFFFFFF [IEEE802.1Q] [RFC 7133] 1 2014-05-02 Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q]. The value of the 3-bit Backbone Service Instance Priority Code Point 413 dot1qServiceInstancePriority unsigned8 identifier current (I-PCP) portion of the Backbone Service Instance Tag (I-TAG) Tag 0-7 [IEEE802.1Q] [RFC 7133] 1 2014-05-02 Control Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q]. The value of the Encapsulated Customer Source Address (C-SA) portion 414 dot1qCustomerSourceMacAddress macAddress default current of the Backbone Service Instance Tag (I-TAG) Tag Control Information [IEEE802.1Q] [RFC 7133] 1 2014-05-02 (TCI) field of an Ethernet frame as described in [IEEE802.1Q]. The value of the Encapsulated Customer Destination Address (C-DA) 415 dot1qCustomerDestinationMacAddress macAddress default current portion of the Backbone Service Instance Tag (I-TAG) Tag Control [IEEE802.1Q] [RFC 7133] 1 2014-05-02 Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q]. 416 deprecated Duplicate of Information Element ID 352, layer2OctetDeltaCount. [RFC 5477] 2 2014-05-13 The definition of this Information Element is identical to the definition of the layer2OctetDeltaCount Information Element, except that it reports a potentially modified value caused by a middlebox 417 postLayer2OctetDeltaCount unsigned64 deltaCounter current function after the packet passed the Observation Point. octets [RFC 5477] [RFC 7133] 1 2014-05-02 This Information Element is the layer 2 version of postOctetDeltaCount (ElementId #23). The number of layer 2 octets since the previous report (if any) in outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain. This property cannot necessarily be observed at the Observation Point but may be retrieved 418 postMCastLayer2OctetDeltaCount unsigned64 deltaCounter current by other means. The number of octets includes layer 2 header(s) and octets [RFC 5477] [RFC 7133] 1 2014-05-02 layer 2 payload. This Information Element is the layer 2 version of postMCastOctetDeltaCount (ElementId #20). 419 deprecated Duplicate of Information Element ID 353, layer2OctetTotalCount. [RFC 5477] 2 2014-05-13 The definition of this Information Element is identical to the definition of the layer2OctetTotalCount Information Element, except that it reports a potentially modified value caused by a middlebox 420 postLayer2OctetTotalCount unsigned64 totalCounter current function after the packet passed the Observation Point. octets [RFC 5477] [RFC 7133] 1 2014-05-02 This Information Element is the layer 2 version of postOctetTotalCount (ElementId #171). The total number of layer 2 octets in outgoing multicast packets sent for packets of this Flow by a multicast daemon in the Observation Domain since the Metering Process (re-)initialization. This property cannot necessarily be observed at the Observation Point but may be 421 postMCastLayer2OctetTotalCount unsigned64 totalCounter current retrieved by other means. The number of octets includes layer 2 octets [RFC 5477] [RFC 7133] 1 2014-05-02 header(s) and layer 2 payload. This Information Element is the layer 2 version of postMCastOctetTotalCount (ElementId #175). Layer 2 length of the smallest packet observed for this Flow. The packet length includes the length of the layer 2 header(s) and the 422 minimumLayer2TotalLength unsigned64 current length of the layer 2 payload. octets [RFC 5477] [RFC 7133] 1 2014-05-02 This Information Element is the layer 2 version of minimumIpTotalLength (ElementId #25). Layer 2 length of the largest packet observed for this Flow. The packet length includes the length of the layer 2 header(s) and the 423 maximumLayer2TotalLength unsigned64 current length of the layer 2 payload. octets [RFC 5477] [RFC 7133] 1 2014-05-02 This Information Element is the layer 2 version of maximumIpTotalLength (ElementId #26). The number of layer 2 octets since the previous report (if any) in packets of this Flow dropped by packet treatment. The number of 424 droppedLayer2OctetDeltaCount unsigned64 deltaCounter current octets includes layer 2 header(s) and layer 2 payload. octets [RFC 5477] [RFC 7133] 1 2014-05-02 This Information Element is the layer 2 version of droppedOctetDeltaCount (ElementId #132). The total number of octets in observed layer 2 packets (including the layer 2 header) that were dropped by packet treatment since the 425 droppedLayer2OctetTotalCount unsigned64 totalCounter current (re-)initialization of the Metering Process. octets [RFC 5477] [RFC 7133] 1 2014-05-02 This Information Element is the layer 2 version of droppedOctetTotalCount (ElementId #134). The total number of octets in observed layer 2 packets (including the layer 2 header) that the Metering Process did not process since the 426 ignoredLayer2OctetTotalCount unsigned64 totalCounter current (re-)initialization of the Metering Process. octets [RFC 5477] [RFC 7133] 1 2014-05-02 This Information Element is the layer 2 version of ignoredOctetTotalCount (ElementId #165). The total number of octets in observed layer 2 packets (including the layer 2 header) that the Metering Process did not process since the 427 notSentLayer2OctetTotalCount unsigned64 totalCounter current (re-)initialization of the Metering Process. octets [RFC 5477] [RFC 7133] 1 2014-05-02 This Information Element is the layer 2 version of notSentOctetTotalCount (ElementId #168). The sum of the squared numbers of layer 2 octets per incoming packet since the previous report (if any) for this Flow at the Observation Point. The number of octets includes layer 2 header(s) and layer 2 428 layer2OctetDeltaSumOfSquares unsigned64 deltaCounter current payload. octets [RFC 5477] [RFC 7133] 1 2014-05-02 This Information Element is the layer 2 version of octetDeltaSumOfSquares (ElementId #198). The total sum of the squared numbers of layer 2 octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of 429 layer2OctetTotalSumOfSquares unsigned64 totalCounter current octets includes layer 2 header(s) and layer 2 payload. octets [RFC 5477] [RFC 7133] 1 2014-05-02 This Information Element is the layer 2 version of octetTotalSumOfSquares (ElementId #199). 430 layer2FrameDeltaCount unsigned64 deltaCounter current The number of incoming layer 2 frames since the previous report (if frames [ipfix-iana_at_cisco.com] 0 2014-05-02 any) for this Flow at the Observation Point. The total number of incoming layer 2 frames for this Flow at the 431 layer2FrameTotalCount unsigned64 totalCounter current Observation Point since the Metering Process (re-)initialization for frames [ipfix-iana_at_cisco.com] 0 2014-05-02 this Observation Point. 432 pseudoWireDestinationIPv4Address ipv4Address default current The destination IPv4 address of the PSN tunnel carrying the [RFC 3985] [ipfix-iana_at_cisco.com] 0 2014-05-28 pseudowire. The total number of observed layer 2 frames that the Metering Process 433 ignoredLayer2FrameTotalCount unsigned64 totalCounter current did not process since the (re-)initialization of the Metering frames [ipfix-iana_at_cisco.com] 0 2014-06-27 Process. This Information Element is the layer 2 version of ignoredPacketTotalCount (ElementId #164). An IPFIX Information Element that denotes that the integer value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB 434 mibObjectValueInteger signed32 quantity current Field Option or via another means. This Information Element is used [RFC 8038] 1 2017-04-30 for MIB objects with the Base syntax of Integer32 and INTEGER with IPFIX reduced-size encoding used as required. The value is encoded as per the standard IPFIX Abstract Data Type of signed32. An IPFIX Information Element that denotes that an Octet String or Opaque value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in 435 mibObjectValueOctetString octetArray default current a MIB Field Option or via another means. This Information Element is [RFC 8038] 0 2015-12-13 used for MIB objects with the Base syntax of OCTET STRING and Opaque. The value is encoded as per the standard IPFIX Abstract Data Type of octetArray. An IPFIX Information Element that denotes that an Object Identifier or OID value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is 436 mibObjectValueOID octetArray default current used for MIB objects with the Base syntax of OBJECT IDENTIFIER. Note: [RFC 8038] 0 2015-12-13 In this case, the "mibObjectIdentifier" defines which MIB object is being exported, and the "mibObjectValueOID" field will contain the OID value of that MIB object. The mibObjectValueOID Information Element is encoded as ASN.1/BER [X.690] in an octetArray. An IPFIX Information Element that denotes that a set of Enumerated flags or bits from a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is 437 mibObjectValueBits octetArray flags current used for MIB objects with the Base syntax of BITS. The flags or bits [RFC 8038] 0 2015-12-13 are encoded as per the standard IPFIX Abstract Data Type of octetArray, with sufficient length to accommodate the required number of bits. If the number of bits is not an integer multiple of octets, then the most significant bits at the end of the octetArray MUST be set to 0. An IPFIX Information Element that denotes that the IPv4 address value of a MIB object will be exported. The MIB Object Identifier 438 mibObjectValueIPAddress ipv4Address default current ("mibObjectIdentifier") for this field MUST be exported in a MIB [RFC 8038] 0 2015-12-13 Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of IpAddress. The value is encoded as per the standard IPFIX Abstract Data Type of ipv4Address. An IPFIX Information Element that denotes that the counter value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB 439 mibObjectValueCounter unsigned64 snmpCounter current Field Option or via another means. This Information Element is used [RFC 8038] 0 2015-12-13 for MIB objects with the Base syntax of Counter32 or Counter64 with IPFIX reduced-size encoding used as required. The value is encoded as per the standard IPFIX Abstract Data Type of unsigned64. An IPFIX Information Element that denotes that the Gauge value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used 440 mibObjectValueGauge unsigned32 snmpGauge current for MIB objects with the Base syntax of Gauge32. The value is encoded [RFC 8038] 0 2015-12-13 as per the standard IPFIX Abstract Data Type of unsigned32. This value represents a non-negative integer that may increase or decrease but that shall never exceed a maximum value or fall below a minimum value. An IPFIX Information Element that denotes that the TimeTicks value of a MIB object will be exported. The MIB Object Identifier 441 mibObjectValueTimeTicks unsigned32 quantity current ("mibObjectIdentifier") for this field MUST be exported in a MIB [RFC 8038] 1 2017-04-30 Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of TimeTicks. The value is encoded as per the standard IPFIX Abstract Data Type of unsigned32. An IPFIX Information Element that denotes that an unsigned integer value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB 442 mibObjectValueUnsigned unsigned32 quantity current Field Option or via another means. This Information Element is used [RFC 8038] 1 2017-04-30 for MIB objects with the Base syntax of unsigned32 with IPFIX reduced-size encoding used as required. The value is encoded as per the standard IPFIX Abstract Data Type of unsigned32. An IPFIX Information Element that denotes that a complete or partial conceptual table will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB 443 mibObjectValueTable subTemplateList list current Field Option or via another means. This Information Element is used [RFC 8038] 1 2017-04-30 for MIB objects with a syntax of SEQUENCE OF. This is encoded as a subTemplateList of mibObjectValue Information Elements. The Template specified in the subTemplateList MUST be an Options Template and MUST include all the objects listed in the INDEX clause as Scope Fields. An IPFIX Information Element that denotes that a single row of a conceptual table will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used 444 mibObjectValueRow subTemplateList list current for MIB objects with a syntax of SEQUENCE. This is encoded as a [RFC 8038] 0 2015-12-13 subTemplateList of mibObjectValue Information Elements. The subTemplateList exported MUST contain exactly one row (i.e., one instance of the subTemplate). The Template specified in the subTemplateList MUST be an Options Template and MUST include all the objects listed in the INDEX clause as Scope Fields. An IPFIX Information Element that denotes that a MIB Object 445 mibObjectIdentifier octetArray default current Identifier (MIB OID) is exported in the (Options) Template Record. [RFC 8038] 0 2015-12-13 The mibObjectIdentifier Information Element contains the OID assigned to the MIB object type definition encoded as ASN.1/BER [X.690]. 446 mibSubIdentifier unsigned32 identifier current A non-negative sub-identifier of an Object Identifier (OID). [RFC 8038] 0 2015-12-13 A set of bit fields that is used for marking the Information Elements of a Data Record that serve as INDEX MIB objects for an indexed columnar MIB object. Each bit represents an Information Element in the Data Record, with the n-th least significant bit representing the n-th Information Element. A bit set to 1 indicates that the corresponding Information Element is an index of the columnar object represented by the mibObjectValue. A bit set to 0 indicates that this is not the case. 447 mibIndexIndicator unsigned64 flags current [RFC 8038] 0 2015-12-13 If the Data Record contains more than 64 Information Elements, the corresponding Template SHOULD be designed such that all index fields are among the first 64 Information Elements, because the mibIndexIndicator only contains 64 bits. If the Data Record contains less than 64 Information Elements, then the extra bits in the mibIndexIndicator for which no corresponding Information Element exists MUST have the value 0 and must be disregarded by the Collector. This Information Element may be exported with IPFIX reduced-size encoding. Indicates when in the lifetime of the Flow the MIB value was retrieved from the MIB for a mibObjectIdentifier. This is used to indicate if the value exported was collected from the MIB closer to Flow creation or Flow export time and refers to the Timestamp fields included in the same Data Record. This field SHOULD be used when exporting a mibObjectValue that specifies counters or statistics. If the MIB value was sampled by SNMP prior to the IPFIX Metering Process or Exporting Process See the "mibCaptureTimeSemantics (Value registry 448 mibCaptureTimeSemantics unsigned8 identifier current retrieving the value (i.e., the data is already stale) and it is 448)" [IP Flow Information Export (IPFIX) Entities]. [RFC 8038]; [RFC 9710] 0 2015-12-13 important to know the exact sampling time, then an additional observationTime* element should be paired with the OID using IPFIX Structured Data [RFC 6313]. Similarly, if different MIB capture times apply to different mibObjectValue elements within the Data Record, then individual mibCaptureTimeSemantics Information Elements should be paired with each OID using IPFIX Structured Data. Values are listed in the "mibCaptureTimeSemantics (Value 448)" registry. A mibContextEngineID that specifies the SNMP engine ID for a MIB 449 mibContextEngineID octetArray default current field being exported over IPFIX. Definition as per [RFC 3411, Section [RFC 8038] 0 2015-12-13 3.3]. An Information Element that denotes that a MIB context name is 450 mibContextName string default current specified for a MIB field being exported over IPFIX. Reference [RFC [RFC 8038] 0 2015-12-13 3411, Section 3.3]. 451 mibObjectName string default current The name (called a descriptor in [RFC 2578] of an object type [RFC 8038] 0 2015-12-13 definition. 452 mibObjectDescription string default current The value of the DESCRIPTION clause of a MIB object type definition. [RFC 8038] 0 2015-12-13 453 mibObjectSyntax string default current The value of the SYNTAX clause of a MIB object type definition, which [RFC 8038] 0 2015-12-13 may include a textual convention or sub-typing. See [RFC 2578]. 454 mibModuleName string default current The textual name of the MIB module that defines a MIB object. [RFC 8038] 0 2015-12-13 The International Mobile Subscription Identity (IMSI). The IMSI is a 455 mobileIMSI string default current decimal digit string with up to a maximum of 15 ASCII/UTF-8 encoded [3GPP TS 23.003] Section 3 and [ITU-T E.164]. [ipfix-iana_at_cisco.com] 0 2015-12-15 digits (0x30 - 0x39). The Mobile Station International Subscriber Directory Number 456 mobileMSISDN string default current (MSISDN). The MSISDN is a decimal digit string with up to a maximum [3GPP TS 23.003] Section 3 and [ITU-T E.164]. [ipfix-iana_at_cisco.com] 0 2015-12-15 of 15 ASCII/UTF-8 encoded digits (0x30 - 0x39). The HTTP Response Status Code, as defined in [Section 6 of RFC 7231], 457 httpStatusCode unsigned16 identifier current associated with a flow. Implies that the flow record represents a 0-999 [RFC 7231] [Andrew_Feren] 0 2016-04-28 flow containing an HTTP Response. This Information Element contains the maximum number of IP source transport ports that can be used by an end user when sending IP packets; each user is associated with one or more (source) IPv4 or IPv6 addresses. This Information Element is particularly useful in 458 sourceTransportPortsLimit unsigned16 quantity current address-sharing deployments that adhere to REQ-4 of [RFC 6888]. ports 1-65535 [RFC 8045]; [RFC Errata 5009] 1 2017-08-01 Limiting the number of ports assigned to each user ensures fairness among users and mitigates the denial-of-service attack that a user could launch against other users through the address-sharing device in order to grab more ports. 459 httpRequestMethod string current The HTTP request method, as defined in [Section 4 of RFC 7231], [Felix_Erlacher] 0 2016-11-15 associated with a flow. String with up to 8 UTF-8 characters. The HTTP request host, as defined in [Section 5.4 of RFC 7230] or, in 460 httpRequestHost string current the case of HTTP/2, the content of the :authority pseudo-header field [Felix_Erlacher] 0 2016-11-15 as defined in [Section 8.1.2.3 of RFC 7240]. Encoded in UTF-8. The HTTP request target, as defined in [Section 2 of RFC 7231] and in 461 httpRequestTarget string current [Section 5.3 of RFC 7230], associated with a flow. Or the HTTP/2 [Felix_Erlacher] 0 2016-11-15 ":path" pseudo-header field as defined in [Section 8.1.2.3 of RFC 7240]. Encoded in UTF-8. The version of an HTTP/1.1 message as indicated by the HTTP-version field, defined in [Section 2.6 of RFC 7230], or the version 462 httpMessageVersion string current identification of an HTTP/2 frame as defined in [RFC 7240, Section [Felix_Erlacher] 0 2016-11-15 3.1]. The length of this field is limited to 10 characters, UTF-8 encoded. This Information Element uniquely identifies an Instance of the NAT See [RFC 791] for the definition of the IPv4 source 463 natInstanceID unsigned32 identifier current that runs on a NAT middlebox function after the packet passes the address field. See [RFC 3022] for the definition of [RFC 8158] 0 2017-03-15 Observation Point. natInstanceID is defined in [RFC 7659]. NAT. See [RFC 3234] for the definition of middleboxes. This Information Element represents the internal address realm where the packet is originated from or destined to. By definition, a NAT mapping can be created from two address realms, one from internal and See [RFC 791] for the definition of the IPv4 source 464 internalAddressRealm octetArray identifier current one from external. Realms are implementation dependent and can address field. See [RFC 3022] for the definition of [RFC 8158] 0 2017-03-15 represent a Virtual Routing and Forwarding (VRF) ID, a VLAN ID, or NAT. See [RFC 3234] for the definition of some unique identifier. Realms are optional and, when left middleboxes. unspecified, would mean that the external and internal realms are the same. This Information Element represents the external address realm where See [RFC 791] for the definition of the IPv4 source 465 externalAddressRealm octetArray identifier current the packet is originated from or destined to. See the address field. See [RFC 3022] for the definition of [RFC 8158]; [RFC 9710] 0 2017-03-15 internalAddressRealm IE for the detailed definition. NAT. See [RFC 3234] for the definition of middleboxes. This Information Element identifies the type of a NAT Quota Exceeded See the "NAT Quota Exceeded Event Type (Value 466)" 466 natQuotaExceededEvent unsigned32 identifier current event. Values for this Information Element are listed in the "NAT registry [IP Flow Information Export (IPFIX) [RFC 8158]; [RFC 9710] 0 2017-03-15 Quota Exceeded Event Type (Value 466)" registry. Entities]. See [RFC 3022] for the definition of NAT. This Information Element identifies a type of a NAT Threshold event. See the "NAT Threshold Event Type (Value 467)" 467 natThresholdEvent unsigned32 identifier current Values for this Information Element are listed in the "NAT Threshold registry [IP Flow Information Export (IPFIX) [RFC 8158]; [RFC 9710] 0 2017-03-15 Event Type (Value 467)" registry. Entities]. See [RFC 3022] for the definition of NAT. 468 httpUserAgent string default current The HTTP User-Agent header field as defined in [Section 5.5.3 of RFC [RFC 7231] [Andrew_Feren] 0 2017-04-19 7231]. Encoded in UTF-8. 469 httpContentType string default current The HTTP Content-Type header field as defined in [Section 3.1.1.5 of [RFC 7231] [Andrew_Feren] 0 2017-04-19 RFC 7231]. Encoded in UTF-8. 470 httpReasonPhrase string default current The HTTP reason phrase as defined in [Section 6.1 of RFC 7231]. [RFC 7231] [Felix_Erlacher] 0 2017-06-19 471 maxSessionEntries unsigned32 identifier current This element represents the maximum session entries that can be See [RFC 3022] for the definition of NAT. See [RFC [RFC 8158] 0 2017-12-01 created by the NAT device. 3234] for the definition of middleboxes. 472 maxBIBEntries unsigned32 identifier current This element represents the maximum BIB entries that can be created See [RFC 3022] for the definition of NAT. See [RFC [RFC 8158] 0 2017-12-01 by the NAT device. 3234] for the definition of middleboxes. 473 maxEntriesPerUser unsigned32 identifier current This element represents the maximum NAT entries that can be created See [RFC 3022] for the definition of NAT. See [RFC [RFC 8158] 0 2017-12-01 per user by the NAT device. 3234] for the definition of middleboxes. 474 maxSubscribers unsigned32 identifier current This element represents the maximum subscribers or maximum hosts that See [RFC 3022] for the definition of NAT. See [RFC [RFC 8158] 0 2017-12-01 are allowed by the NAT device. 3234] for the definition of middleboxes. 475 maxFragmentsPendingReassembly unsigned32 identifier current This element represents the maximum fragments that the NAT device can See [RFC 3022] for the definition of NAT. See [RFC [RFC 8158] 0 2017-12-01 store for reassembling the packet. 3234] for the definition of middleboxes. 476 addressPoolHighThreshold unsigned32 identifier current This element represents the high threshold value of the number of See [RFC 3022] for the definition of NAT. See [RFC [RFC 8158] 0 2017-12-01 public IP addresses in the address pool. 3234] for the definition of middleboxes. 477 addressPoolLowThreshold unsigned32 identifier current This element represents the low threshold value of the number of See [RFC 3022] for the definition of NAT. See [RFC [RFC 8158] 0 2017-12-01 public IP addresses in the address pool. 3234] for the definition of middleboxes. 478 addressPortMappingHighThreshold unsigned32 identifier current This element represents the high threshold value of the number of See [RFC 3022] for the definition of NAT. See [RFC [RFC 8158] 0 2017-12-01 address and port mappings. 3234] for the definition of middleboxes. 479 addressPortMappingLowThreshold unsigned32 identifier current This element represents the low threshold value of the number of See [RFC 3022] for the definition of NAT. See [RFC [RFC 8158] 0 2017-12-01 address and port mappings. 3234] for the definition of middleboxes. This element represents the high threshold value of the number of See [RFC 3022] for the definition of NAT. See [RFC 480 addressPortMappingPerUserHighThreshold unsigned32 identifier current address and port mappings that a single user is allowed to create on 3234] for the definition of middleboxes. [RFC 8158] 0 2017-12-01 a NAT device. This element represents the high threshold value of the number of See [RFC 3022] for the definition of NAT. See [RFC 481 globalAddressMappingHighThreshold unsigned32 identifier current address and port mappings that a single user is allowed to create on 3234] for the definition of middleboxes. See [RFC [RFC 8158] 0 2017-12-01 a NAT device in a paired address pooling behavior. 4787] for the definition of paired address pooling behavior. 482 vpnIdentifier octetArray default current VPN ID in the format specified by [RFC 2685]. The size of this [RFC 2685] [ipfix-iana_at_cisco.com] 0 2018-07-10 Information Element is 7 octets. 483 bgpCommunity unsigned32 identifier current BGP community as defined in [RFC 1997] [RFC 1997] [RFC 8549] 0 2019-01-18 484 bgpSourceCommunityList basicList list current basicList of zero or more bgpCommunity IEs, containing the BGP [RFC 6313]; [RFC 1997] [RFC 8549] 0 2019-01-18 communities corresponding with source IP address of a specific flow basicList of zero or more bgpCommunity IEs, containing the BGP 485 bgpDestinationCommunityList basicList list current communities corresponding with destination IP address of a specific [RFC 6313]; [RFC 1997] [RFC 8549] 0 2019-01-18 flow 486 bgpExtendedCommunity octetArray default current BGP Extended Community as defined in [RFC-ietf-idr-rfc4360-bis-09]; [RFC-ietf-idr-rfc4360-bis-09] [RFC 8549] 0 2019-01-18 the size of this IE MUST be 8 octets basicList of zero or more bgpExtendedCommunity IEs, containing the 487 bgpSourceExtendedCommunityList basicList list current BGP Extended Communities corresponding with source IP address of a [RFC 6313]; [RFC-ietf-idr-rfc4360-bis-09] [RFC 8549] 0 2019-01-18 specific flow basicList of zero or more bgpExtendedCommunity IEs, containing the 488 bgpDestinationExtendedCommunityList basicList list current BGP Extended Communities corresponding with destination IP address of [RFC 6313]; [RFC-ietf-idr-rfc4360-bis-09] [RFC 8549] 0 2019-01-18 a specific flow 489 bgpLargeCommunity octetArray default current BGP Large Community as defined in [RFC 8092]; the size of this IE [RFC 8092] [RFC 8549] 0 2019-01-18 MUST be 12 octets. basicList of zero or more bgpLargeCommunity IEs, containing the BGP 490 bgpSourceLargeCommunityList basicList list current Large Communities corresponding with source IP address of a specific [RFC 6313]; [RFC 8092] [RFC 8549] 0 2019-01-18 flow basicList of zero or more bgpLargeCommunity IEs, containing the BGP 491 bgpDestinationLargeCommunityList basicList list current Large Communities corresponding with destination IP address of a [RFC 6313]; [RFC 8092] [RFC 8549] 0 2019-01-18 specific flow The 8-bit Flags field defined in the SRH ([Section 2 of RFC 8754]). See the assignments in the "Segment Routing Header 492 srhFlagsIPv6 unsigned8 flags current Assigned flags and their meanings are provided in the ["Segment Flags" registry at [Segment Routing Header Flags]. [RFC 9487] 0 2023-06-08 Routing Header Flags"] IANA registry. See also [RFC 8754] for the SRH specification. The 16-bit Tag field defined in the SRH ([Section 2 of RFC 8754]). A See [Section 2 of RFC 8754] for more details about 493 srhTagIPv6 unsigned16 identifier current tag is used to mark a packet as part of a class or group of packets the Tag. [RFC 9487] 0 2023-06-08 sharing the same set of properties. 494 srhSegmentIPv6 ipv6Address default current The 128-bit IPv6 address that represents an SRv6 segment. Specified in [Section 1 of RFC 8402] and mentioned in [RFC 9487] 0 2023-06-08 "Segment List" in [Section 2 of RFC 8754]. 495 srhActiveSegmentIPv6 ipv6Address default current The 128-bit IPv6 address that represents the active SRv6 segment. See [Section 2 of RFC 8402] for the definition of [RFC 9487] 0 2023-06-08 "active segment". The ordered basicList [RFC 6313] of zero or more 128-bit IPv6 addresses in the SRH that represents the SRv6 Segment List. As specified in [Section 2 of RFC 8754], the Segment List is encoded See [Section 2 of RFC 8754] for more details about 496 srhSegmentIPv6BasicList basicList list current starting from the last segment of the SR Policy. That is, the first the SRv6 Segment List. [RFC 9487] 0 2023-06-08 element of the Segment List (Segment List[0]) contains the last segment of the SR Policy, the second element contains the penultimate segment of the SR Policy, and so on. 497 srhSegmentIPv6ListSection octetArray default current The SRv6 Segment List as defined in [Section 2 of RFC 8754] as a See [Section 2 of RFC 8754] for more details about [RFC 9487] 0 2023-06-08 series of octets in IPFIX. the SRv6 Segment List. The 8-bit unsigned integer defining the number of segments remaining Specified by the "Segments Left" field in [Section 498 srhSegmentsIPv6Left unsigned8 quantity current to reach the end of the Segment List from the SRH. 4.4 of RFC 8200] and mentioned in [Section 2 of RFC [RFC 9487] 0 2023-06-08 8754]. 499 srhIPv6Section octetArray default current The SRH and its TLVs as defined in [Section 2 of RFC 8754] as a See [Section 2 of RFC 8754] for more details about [RFC 9487] 0 2023-06-08 series of octets in IPFIX. the structure of an SRH. The designator of the routing protocol or PCEP extension where the active SRv6 segment has been learned from. Values for this See the assigned types in the "IPFIX IPv6 SRH Segment 500 srhIPv6ActiveSegmentType unsigned8 identifier current Information Element are listed in the "IPFIX IPv6 SRH Segment Type (Value 500)" registry at [IPFIX IPv6 SRH Segment Type [RFC 9487] 0 2023-06-08 (Value 500)” subregistry; see [IPFIX IPv6 SRH Segment Type (Value (Value 500)]. 500)]. The length of the SRH segment IPv6 locator specified as the number of See [Section 3.1 of RFC 8986] for more details about 501 srhSegmentIPv6LocatorLength unsigned8 default current significant bits. Together with srhSegmentIPv6, it enables the the SID format. [RFC 9487]; [RFC Errata 7728] 1 2024-01-22 calculation of the SRv6 Locator. The 16-bit unsigned integer that represents an SRv6 Endpoint behavior See the assigned behaviors in the "SRv6 Endpoint 502 srhSegmentIPv6EndpointBehavior unsigned16 identifier current as per [Section 4 of RFC 8986]. Assigned values and their meanings Behaviors" registry at [SRv6 Endpoint Behaviors]. See [RFC 9487] 0 2023-06-08 are provided in the ["SRV6 Endpoint Behaviors"] registry. [Section 4 of RFC 8986] for more details about the processing of endpoint behaviors. The checksum in the transport header. For the transport protocols UDP See [RFC 768] for the definition of the UDP checksum 503 transportChecksum unsigned16 default current and TCP, this is the checksum given in the respective header. This field. See [RFC 9293] for the definition of the TCP [ipfix-iana_at_cisco.com] 0 2024-03-27 field MAY also be used for future transport protocols that have checksum field. 16-bit checksum values. This Information Element carries a series of n octets from the ICMP header of a sampled packet, starting sectionOffset octets into the ICMP header. However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the ICMP header. With sufficient length, this element also reports octets from the ICMP payload. However, full packet capture of arbitrary packet streams is explicitly out of scope per the Security Considerations sections of [RFC 5477] and [RFC 2804]. See [RFC 792] for the definition of the IPv4 ICMP 504 icmpHeaderPacketSection octetArray default current header. See [RFC 4443] for the definition of the IPv6 [ipfix-iana_at_cisco.com] 0 2024-03-27 The sectionExportedOctets expresses how much data was exported, while ICMP header. the remainder is padding. When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or it MAY have a variable length. When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol. 8-bit flags field indicating the version of GTP-U protocol, protocol Refer to section 5.1 of the 3GPP specification 505 gtpuFlags unsigned8 flags current type and presence of extension header, sequence number and N-PDU [TS.29281]. [draft-voyersriram-opsawg-ipfix-gtpu-05] 0 2024-04-12 number defined in Section 5.1 of the 3GPP specification [TS.29281]. 506 gtpuMsgType unsigned8 identifier current 8-bit Message type field indicating the type of GTP-U message defined Refer to section 5.1 of the 3GPP specification [draft-voyersriram-opsawg-ipfix-gtpu-05] 0 2024-04-12 in section 5.1 of the 3GPP specification [TS.29281]. [TS.29281]. 32-bit tunnel endpoint identifier field defined in section 5.1 of the 3GPP specification [TS.29281]. This field unambiguously identifies a 507 gtpuTEid unsigned32 identifier current tunnel endpoint in the receiving GTP-U protocol entity for a given Refer to section 5.1 of the 3GPP specification [draft-voyersriram-opsawg-ipfix-gtpu-05] 0 2024-04-12 UDP/IP endpoint. The receiving side of a GTP tunnel locally assigns [TS.29281]. the TEID value the transmitting side has to use. The TEID values are exchanged between tunnel endpoints using control plane messages. 508 gtpuSequenceNum unsigned16 identifier current 16-bit sequence number field defined in section 5.1 (Optional Fields) Refer to section 5.1 of the 3GPP specification [draft-voyersriram-opsawg-ipfix-gtpu-05] 0 2024-04-12 of the 3GPP specification [TS.29281]. [TS.29281]. 6-bit QoS flow identifier field defined in PDU Session Container extension header of GTP-U. This is defined in section 5.5.3.3 of the 3GPP specification [TS.38415]. This is used to determine the QoS flow and QoS profile which are associated with the received packet. The basic encoding is 8 bits. The layout of basic encoding is as follows: MSB - 0 1 2 3 4 5 6 7 - LSB +----+----+----+----+----+----+----+----+ Refer to section 5.5.3.3 of the 3GPP specification 509 gtpuQFI unsigned8 identifier current |Reserved | 6 bit QFI value | [TS.38415] and section 5.7.1.1 from 3GPP [draft-voyersriram-opsawg-ipfix-gtpu-05] 0 2024-04-12 +----+----+----+----+----+----+----+----+ specification [TS.23501] for additional details. Examples: value : 0x08 binary: 00001000 decode: 001000 - QFI value value : 0x3e binary: 00111110 decode: 111110 - QFI value 4-bit PDU type field defined in PDU Session Container extension header of GTP-U. This is defined in section 5.5.3 of the 3GPP specification [TS.38415]. This field indicates the structure of the PDU session user plane frame. The basic encoding is 8 bits. The layout of basic encoding is as follows: Refer to section 5.5.3 of the 3GPP specification 510 gtpuPduType unsigned8 identifier current MSB - 0 1 2 3 4 5 6 7 - LSB [TS.38415]. [draft-voyersriram-opsawg-ipfix-gtpu-05] 0 2024-04-12 +----+----+----+----+----+----+----+----+ | Reserved | 4 bit PDU Type | +----+----+----+----+----+----+----+----+ Examples: value : 0x01 binary: 00000001 decode: 0001 - PDU Type value Ordered basicList [RFC 6313] of zero or more bgpSourceAsNumber See [RFC 4271] for a description of BGP-4, and see 511 bgpSourceAsPathList basicList list current elements, containing the BGP as-path corresponding with the source IP [RFC 1930] for the definition of the AS number. [ipfix-iana_at_cisco.com] 0 2024-05-24 address of a specific flow. Ordered basicList [RFC 6313] of zero or more bgpDestinationAsNumber See [RFC 4271] for a description of BGP-4, and see 512 bgpDestinationAsPathList basicList list current elements, containing the BGP as-path corresponding with the [RFC 1930] for the definition of the AS number. [ipfix-iana_at_cisco.com] 0 2024-05-24 destination IP address of a specific flow. Type of an IPv6 extension header observed in at least one packet of See the "IPv6 Extension Header Types" registry at 513 ipv6ExtensionHeaderType unsigned8 identifier current this Flow. [IANA-EH]. See [Section 4 of RFC 8200] for the [RFC 9740] 0 2024-10-07 general definition of IPv6 extension headers. The number of consecutive occurrences of the same extension header See the "IPv6 Extension Header Types" registry at 514 ipv6ExtensionHeaderCount unsigned8 totalCounter current type in a Flow. This IE is reported, e.g., in the [IANA-EH]. See [Section 4 of RFC 8200] for the [RFC 9740] 0 2024-10-07 ipv6ExtensionHeaderTypeCountList IE. The type of the extension header general definition of IPv6 extension headers. is provided in the ipv6ExtensionHeaderType IE. IPv6 extension headers observed in packets of this Flow. The information is encoded in a set of bit fields. For each IPv6 extension header, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv6 extension header. Otherwise, if no observed packet of this Flow contains the respective IPv6 extension header, the value of the corresponding bit is 0. The IPv6 extension header associated with each bit is provided in [IANA-IPFIX-IPv6EH]. Bit 0 corresponds to the least significant bit (LSB) in the ipv6ExtensionHeadersFull IE, while bit 255 corresponds to the most significant bit (MSB) of the IE. In doing so, few octets will be needed to encode common IPv6 extension headers when observed in a Flow. See the "IPFIX ipv6ExtensionHeaders Bits" registry at [IANA-IPFIX-IPv6EH]. See the "IPv6 Extension Header The "No Next Header" (bit 2) value ([Section 4.7 of RFC 8200]) is Types" registry at [IANA-EH]. See [Section 4 of RFC used if there is no upper-layer header in an IPv6 packet. Even if the 8200] for the general definition of IPv6 extension value is not considered as an extension header as such, the headers. The ipv6ExtensionHeadersFull IE deprecates 515 ipv6ExtensionHeadersFull unsigned256 flags current corresponding bit is set in the ipv6ExtensionHeadersFull IE whenever the ipv6ExtensionHeaders IE (64) that was initially [RFC 9740] 0 2024-10-07 that value is encountered in the Flow. defined in [RFC 5102]. [RFC 7012] obsoletes [RFC 5102] and specifies that [IANA-IPFIX] is the Extension headers observed in a Flow with varying extension header normative reference for the ipv6ExtensionHeaders IE chains MUST NOT be grouped in the ipv6ExtensionHeadersFull IE if the (64). ipv6ExtensionHeaderChainLengthList IE is also present. If the ipv6ExtensionHeaderChainLengthList IE is not present, then extension headers observed in a Flow with varying extension header chains MAY be grouped in one single ipv6ExtensionHeadersFull IE or be exported in separate ipv6ExtensionHeadersFull IEs, one for each extension header chain. The ipv6ExtensionHeadersFull IE MUST NOT be exported if ipv6ExtensionHeaderTypeCountList IE is also present because of the overlapping scopes of these two IEs. The value of ipv6ExtensionHeadersFull IE may be encoded in fewer octets per the guidelines in [Section 6.2 of RFC 7011] As per [Section 4.1 of RFC 8200], IPv6 nodes must accept and attempt to process extension headers occurring any number of times in the same packet. This IE echoes the order of extension headers and number of onsecutive occurrences of the same extension header type in a Flow. This IE is a subTemplateList of ipv6ExtensionHeaderType and ipv6ExtensionHeaderCount IEs. Each header chain in a Flow with varying extension header chains MUST be exported in a separate IE. The same extension header type may appear several times in an ipv6ExtensionHeaderTypeCountList IE. For example, if an IPv6 packet of a Flow includes a Hop-by-Hop Options header, a Destination Options header, a Fragment header, and a Destination Options header, the ipv6ExtensionHeaderTypeCountList IE will report: See the "IPv6 Extension Header Types" registry at 516 ipv6ExtensionHeaderTypeCountList subTemplateList list current [IANA-EH]. See [Section 4 of RFC 8200] for the [RFC 9740] 0 2024-10-07 * the count of Hop-by-Hop Options headers, general definition of IPv6 extension headers. * the occurrences of the Destination Options headers that are observed before a Fragment header, * the occurrences of the Fragment headers, and * the occurrences of the Destination Options headers that are observed right after a Fragment header. If an implementation determines that an observed packet of a Flow includes an extension header (including an extension header that it does not support), then the exact observed code of that extension header MUST be echoed in the ipv6ExtensionHeaderTypeCountList IE. How an implementation disambiguates between unknown upper-layer protocols vs. extension headers is not IPFIX-specific. Refer, for example, to [Section 2.2 of RFC 8883] for a behavior of an intermediate node that encounters an unknown Next Header type. When set to "false", this IE indicates that the exported extension header information (e.g., ipv6ExtensionHeadersFull or ipv6ExtensionHeaderTypeCountList) does not match the full enclosed See [Section 4 of RFC 8200] for the general 517 ipv6ExtensionHeadersLimit boolean default current extension headers, but only up to a limit that is typically set by definition of IPv6 extension headers. See [RFC 8883] [RFC 9740] 0 2024-10-07 hardware or software. for an example of IPv6 packet processing due to limits on extension headers. When set to "true", this IE indicates that the exported extension header information matches the full enclosed extension headers. In theory, there are no limits on the number of IPv6 extension headers that may be present in a packet other than the path MTU. However, it was regularly reported that IPv6 packets with extension headers were often dropped in the Internet (e.g., [RFC 7872]). As discussed in [Section 1.2 of RFC 8883], some hardware devices implement a parsing buffer of a fixed size to process packets, including all the headers. When the aggregate length of headers of an IPv6 packet exceeds that size, the packet will be discarded or See [Section 4 of RFC 8200] for the general 518 ipv6ExtensionHeadersChainLength unsigned32 identifier current deferred to a slow path. definition of IPv6 extension headers. See [RFC 9098] [RFC 9740] 0 2024-10-07 for an overview of operational implications of IPv6 The ipv6ExtensionHeadersChainLength IE is used to report, in octets, packets with extension headers. the length of an extension header chain observed in a Flow. The length is the sum of the lengths of all extension headers of the chain. Exporting such information might help identifying root causes of performance degradation, including packet drops. Each header chain length of a Flow with varying extension header chains MUST be exported in a separate ipv6ExtensionHeadersChainLength IE. This IE is used to report the chains and their lengths as observed in a Flow with varying extension header chains. This IE is a subTemplateList of ipv6ExtensionHeadersFull and See the "IPv6 Extension Header Types" registry at 519 ipv6ExtensionHeaderChainLengthList subTemplateList list current ipv6ExtensionHeadersChainLength IEs. [IANA-EH]. See [Section 4 of RFC 8200] for the [RFC 9740] 0 2024-10-07 general definition of IPv6 extension headers. If several extension header chains are observed in a Flow, each header chain MUST be exported in a separate ipv6ExtensionHeaderChainLengthList IE. TCP options in packets of this Flow. The information is encoded in a set of bit fields. For each TCP option, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding TCP option. Otherwise, if no observed packet of this Flow contains the respective TCP option, the value of the corresponding bit is 0. Options are mapped to bits according to their option numbers. TCP option Kind 0 corresponds to the least significant bit in the tcpOptionsFull IE, while Kind 255 corresponds to the most significant bit of the IE. This approach allows an observer to export any See the "TCP Option Kind Numbers" registry at observed TCP option even if it does not support that option and [IANA-TCP]. See [RFC 9293] for the general definition without requiring updating a mapping table. of TCP options. The tcpOptionsFull IE deprecates the 520 tcpOptionsFull unsigned256 flags current tcpOptions IE (209) that was initially defined in [RFC 9740] 0 2024-10-07 The value of tcpOptionsFull IE may be encoded in fewer octets per the [RFC 5102]. [RFC 7012] obsoletes [RFC 5102] and guidelines in [Section 6.2 of RFC 7011]. specifies that [IANA-IPFIX] is the normative reference for the tcpOptions IE (209). The presence of tcpSharedOptionExID16List or tcpSharedOptionExID32List IEs is an indication that a shared TCP option (Kind=253 or 254) is observed in a Flow. The presence of tcpSharedOptionExID16List or tcpSharedOptionExID32List IEs takes precedence over setting the corresponding bits in the tcpOptionsFull IE for the same Flow. In order to optimize the use of the reduced-size encoding in the presence of tcpSharedOptionExID16List or tcpSharedOptionExID32List IEs, the Exporter MUST NOT set to 1 the shared TCP options (Kind=253 or 254) flags of the tcpOptionsFull IE that is reported for the same Flow. Reports an observed 2-byte ExID in a shared TCP option (Kind=253 or See the "TCP/UDP Experimental Option Experiment 254) in a Flow. Identifiers (TCP/UDP ExIDs)" registry at 521 tcpSharedOptionExID16 unsigned16 identifier current [IANA_TCP-UDP_ExIDs]. See [RFC 9293] for the general [RFC 9740] 0 2024-10-07 A basicList of tcpSharedOptionExID16 is used to report definition of TCP options. See [RFC 6994] for the tcpSharedOptionExID16List values. shared use of experimental TCP Options. Reports an observed 4-byte ExID in a shared TCP option (Kind=253 or See the "TCP/UDP Experimental Option Experiment 254) in a Flow. Identifiers (TCP/UDP ExIDs)" registry at 522 tcpSharedOptionExID32 unsigned32 identifier current [IANA_TCP-UDP_ExIDs]. See [RFC 9293] for the general [RFC 9740] 0 2024-10-07 A basicList of tcpSharedOptionExID32 is used to report definition of TCP options. See [RFC 6994] for the tcpSharedOptionExID32List values. shared use of experimental TCP Options. Reports observed 2-byte ExIDs in shared TCP options (Kind=253 or 254) See the "TCP/UDP Experimental Option Experiment in a Flow. Identifiers (TCP/UDP ExIDs)" registry at 523 tcpSharedOptionExID16List basicList list current [IANA_TCP-UDP_ExIDs]. See [RFC 9293] for the general [RFC 9740] 0 2024-10-07 A basicList of tcpSharedOptionExID16 IEs in which each definition of TCP options. See [RFC 6994] for the tcpSharedOptionExID16 IE carries an observed 2-byte ExID in a shared shared use of experimental TCP Options. option. Reports observed 4-byte ExIDs in shared TCP options (Kind=253 or 254) See the "TCP/UDP Experimental Option Experiment in a Flow. Identifiers (TCP/UDP ExIDs)" registry at 524 tcpSharedOptionExID32List basicList list current [IANA_TCP-UDP_ExIDs]. See [RFC 9293] for the general [RFC 9740] 0 2024-10-07 A basicList of tcpSharedOptionExID32 IEs in which each definition of TCP options. See [RFC 6994] for the tcpSharedOptionExID32 IE carries an observed 4-byte ExID in a shared shared use of experimental TCP Options. option. Observed SAFE UDP options in a Flow. The information is encoded in a set of bit fields. Options are mapped to bits according to their option numbers. UDP option Kind 0 corresponds to the least significant bit in the udpSafeOptions IE, while Kind 191 corresponds to the 65th most significant bit of the IE. The bit is set to 1 if the corresponding SAFE UDP option is observed at least once in the Flow. The bit is set to 0 if the option is never observed in the Flow. The 64 most significant bits MUST be set to 0. See the "UDP Option Kind Numbers" registry at The reduced-size encoding per [Section 6.2 of RFC 7011] is followed [UDP_OPTIONS]. 525 udpSafeOptions unsigned256 flags current whenever fewer octets are needed to report observed SAFE UDP options. [RFC 9870] 0 2024-10-23 For example, if only option Kinds <= 31 are observed, then the value See [RFC 9868] for more details about UDP options. of the udpSafeOptions IE can be encoded as unsigned32, or if only option Kinds <= 63 are observed, then the value of the udpSafeOptions IE can be encoded as unsigned64. The presence of udpSafeExIDList is an indication that the SAFE Experimental Option is observed in a Flow. The presence of udpSafeExIDList takes precedence over setting the corresponding bit in the udpSafeOptions IE for the same Flow. In order to optimize the use of the reduced-size encoding in the presence of udpSafeExIDList IE, the Exporter MUST NOT set the EXP flag of the udpSafeOptions IE that is reported for the same Flow to 1. Observed UNSAFE UDP options in a Flow. The information is encoded in a set of bit fields. Options are mapped to bits according to their option numbers. UDP option Kind 192 corresponds to the least significant bit in the udpUnsafeOptions IE, while Kind 255 corresponds to the most significant bit of the IE. The bit is set to 1 if the corresponding UNSAFE UDP option is observed at least once in the Flow. The bit is set to 0 if the option is never observed in the Flow. See the "UDP Option Kind Numbers" registry at [UDP_OPTIONS]. 526 udpUnsafeOptions unsigned64 flags current The reduced-size encoding per [Section 6.2 of RFC 7011] is followed [RFC 9870] 0 2024-10-23 whenever fewer octets are needed to report observed UNSAFE UDP See [RFC 9868] for more details about UDP options. options. The presence of udpUnsafeExIDList is an indication that the UNSAFE Experimental Option is observed in a Flow. The presence of udpUnsafeExIDList takes precedence over setting the corresponding bit in the udpUnsafeOptions IE for the same Flow. In order to optimize the use of the reduced-size encoding in the presence of udpUnsafeExIDList IE, the Exporter MUST NOT set the UEXP flag of the udpUnsafeOptions IE that is reported for the same Flow to 1. Observed ExID in an Experimental (EXP, Kind=127) Option or an UNSAFE See the "TCP/UDP Experimental Option Experiment Experimental (UEXP, Kind=254) Option. Identifiers (TCP/UDP ExIDs)" registry at [UDP_ExIDs]. 527 udpExID unsigned16 identifier current [RFC 9870] 0 2024-10-23 A basicList of udpExID is used to report udpSafeExIDList and See [RFC 9868] for more details about ExIDs. udpUnsafeExIDList values. Observed ExIDs in the Experimental (EXP, Kind=127) Option. See the "TCP/UDP Experimental Option Experiment 528 udpSafeExIDList basicList list current Identifiers (TCP/UDP ExIDs)" registry at [UDP_ExIDs]. [RFC 9870] 0 2024-10-23 A basicList of udpExID Information Elements in which each udpExID Information Element carries the ExID observed in an EXP Option. See [RFC 9868] for more details about ExIDs. Observed ExIDs in the UNSAFE Experimental (UEXP, Kind=254) Option. See the "TCP/UDP Experimental Option Experiment 529 udpUnsafeExIDList basicList list current Identifiers (TCP/UDP ExIDs)" registry at [UDP_ExIDs]. [RFC 9870] 0 2024-10-23 A basicList of udpExID Information Elements in which each udpExID Information Element carries the ExID observed in an UEXP Option. See [RFC 9868] for more details about ExIDs. This Information Element identifies the mean path delay of all packets in the Flow, in microseconds, between an OAM header 530 pathDelayMeanDeltaMicroseconds unsigned32 deltaCounter current encapsulating node and the local node with the OAM domain (either an OWDelay_HybridType1_IP_RFC9951_Seconds_Mean in the [RFC 9951] 0 2026-04-02 OAM header transit node or an OAM header decapsulating node), IANA [Performance Metric] registry. according to OWDelay_HybridType1_IP_RFC9951_Seconds_Mean in the IANA [Performance Metric] Registry. This Information Element identifies the lowest path delay of all packets in the Flow, in microseconds, between an OAM header 531 pathDelayMinDeltaMicroseconds unsigned32 deltaCounter current encapsulating node and the local node with the OAM domain (either an OWDelay_HybridType1_IP_RFC9951_Seconds_Min in the [RFC 9951] 0 2026-04-02 OAM header transit node or an OAM header decapsulating node), IANA [Performance Metric] registry. according to the OWDelay_HybridType1_IP_RFC9951_Seconds_Min in the IANA [Performance Metric] Registry. This Information Element identifies the highest path delay of all packets in the Flow, in microseconds, between an OAM header 532 pathDelayMaxDeltaMicroseconds unsigned32 deltaCounter current encapsulating node and the local node with the OAM domain (either an OWDelay_HybridType1_IP_RFC9951_Seconds_Max in the [RFC 9951] 0 2026-04-02 OAM header transit node or an OAM header decapsulating node), IANA [Performance Metric] registry. according to OWDelay_HybridType1_IP_RFC9951_Seconds_Max in the IANA [Performance Metric] Registry. This Information Element identifies the sum of the path delay of all packets in the Flow, in microseconds, between an OAM header 533 pathDelaySumDeltaMicroseconds unsigned64 deltaCounter current encapsulating node and the local node with the OAM domain (either an OWDelay_HybridType1_IP_RFC9951_Seconds_Sum in the [RFC 9951] 0 2026-04-02 OAM header transit node or an OAM header decapsulating node), IANA [Performance Metric] registry. according to OWDelay_HybridType1_IP_RFC9951_Seconds_Sum in the IANA [Performance Metric] Registry. 534-32767 Unassigned IPFIX MPLS label type (Value 46) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 7012] Available Formats [IMG] CSV Value Description Reference 0 Unknown: The MPLS label type is not known. [RFC 3954]; [ipfix-iana_at_cisco.com] 1 TE-MIDPT: Any TE tunnel mid-point or tail label [RFC 5102] 2 Pseudowire: Any PWE3 or Cisco AToM based label [RFC 5102] 3 VPN: Any label associated with VPN [RFC 5102]; [RFC 4364] 4 BGP: Any label associated with BGP or BGP routing [RFC 5102]; [RFC 4271] 5 LDP: Any label associated with dynamically assigned labels using LDP [RFC 5102]; [RFC 5036] 6 Path Computation Element [RFC 9160]; [RFC 8664] 7 OSPFv2 Segment Routing [RFC 9160]; [RFC 8665] 8 OSPFv3 Segment Routing [RFC 9160]; [RFC 8666] 9 IS-IS Segment Routing [RFC 9160]; [RFC 8667] 10 BGP Segment Routing Prefix-SID [RFC 9160]; [RFC 8669] 11-255 Unassigned Forwarding Status (Value 89) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 7270] Available Formats [IMG] CSV Value Description Reference 00b Unknown [RFC 7270] 01b Forwarded [RFC 7270] 10b Dropped [RFC 7270] 11b Consumed [RFC 7270] Status 00b: Unknown Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 7270] Available Formats [IMG] CSV Binary Hex Description Reference 0x00-0x3F Unassigned Status 01b: Forwarded Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 7270] Available Formats [IMG] CSV Binary Hex Description Reference 01 000000b 0x40 Unknown [RFC 7270] 01 000001b 0x41 Fragmented [RFC 7270] 01 000010b 0x42 Not Fragmented [RFC 7270] 01 000011b 0x43 Tunneled [Alfred_Nothaft] 01 000100b 0x44 ACL Redirect [Sriram_Gopalakrishnan] 0x45-0x7F Unassigned Status 10b: Dropped Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 7270] Available Formats [IMG] CSV Binary Hex Description Reference 10 000000b 0x80 Unknown [RFC 7270] 10 000001b 0x81 ACL deny [RFC 7270] 10 000010b 0x82 ACL drop [RFC 7270] 10 000011b 0x83 Unroutable [RFC 7270] 10 000100b 0x84 Adjacency [RFC 7270] 10 000101b 0x85 Fragmentation and DF set [RFC 7270] 10 000110b 0x86 Bad header checksum [RFC 7270] 10 000111b 0x87 Bad total Length [RFC 7270] 10 001000b 0x88 Bad header length [RFC 7270] 10 001001b 0x89 bad TTL [RFC 7270] 10 001010b 0x8A Policer [RFC 7270] 10 001011b 0x8B WRED [RFC 7270] 10 001100b 0x8C RPF [RFC 7270] 10 001101b 0x8D For us [RFC 7270] 10 001110b 0x8E Bad output interface [RFC 7270] 10 001111b 0x8F Hardware [RFC 7270] 0x90-0xBF Unassigned Status 11b: Consumed Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 7270] Available Formats [IMG] CSV Binary Hex Description Reference 11 000000b 0xC0 Unknown [RFC 7270] 11 000001b 0xC1 Punt Adjacency [RFC 7270] 11 000010b 0xC2 Incomplete Adjacency [RFC 7270] 11 000011b 0xC3 For us [RFC 7270] 0xC4-0xFF Unassigned Classification Engine IDs (Value 101) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 6759] Available Formats [IMG] CSV Value Description Default Reference Length 0 Invalid. [RFC 6759] 1 IANA-L3: The Assigned Internet Protocol Number (layer 3 (L3)) 1 [RFC 6759] is exported in the Selector ID. See [Protocol Numbers]. PANA-L3: Proprietary layer 3 definition. An enterprise can 2 export its own layer 3 protocol numbers. The Selector ID has a 1 [RFC 6759] global significance for all devices from the same enterprise. IANA-L4: The IANA layer 4 (L4) well-known port number is exported in the Selector ID. See [Service Name and Transport 3 Protocol Port Number Registry]. Note: as an IPFIX flow is 2 [RFC 6759] unidirectional, it contains the destination port in a flow from the client to the server. PANA-L4: Proprietary layer 4 definition. An enterprise can export its own layer 4 port numbers. The Selector ID has global significance for devices from the same enterprise. 4 Example: IPFIX had the port 4739 pre-assigned in the IETF 2 [RFC 6759] draft for years. While waiting for the RFC and its associated IANA registration, the Selector ID 4739 was used with this PANA-L4. 5 Reserved [RFC 6759] USER-Defined: The Selector ID represents applications defined 6 by the user (using CLI, GUI, etc.) based on the methods 3 [RFC 6759] described in section 2. The Selector ID has a local significance per device. 7 Reserved [RFC 6759] 8 Reserved [RFC 6759] 9 Reserved [RFC 6759] 10 Reserved [RFC 6759] 11 Reserved [RFC 6759] PANA-L2: Proprietary layer 2 (L2) definition. An enterprise can export its own layer 2 identifiers. The Selector ID 12 represents the enterprise's unique global layer 2 5 [RFC 6759] applications. The Selector ID has a global significance for all devices from the same enterprise. Examples include Cisco Subnetwork Access Protocol (SNAP). PANA-L7: Proprietary layer 7 definition. The Selector ID represents the enterprise's unique global ID for the layer 7 applications. The Selector ID has a global significance for 13 all devices from the same enterprise. This Classification 3 [RFC 6759] Engine Id is used when the application registry is owned by the Exporter manufacturer (referred to as the "enterprise" in [RFC 6759]). 14 Reserved [RFC 6759] 15 Reserved [RFC 6759] 16 Reserved [RFC 6759] 17 Reserved [RFC 6759] ETHERTYPE: The Selector ID represents the well- known Ethertype. See 18 [http://standards.ieee.org/develop/regauth/ethertype/eth.txt]. 2 [RFC 6759] Note that the Ethertype is usually expressed in hexadecimal. However, the corresponding decimal value is used in this Selector ID. LLC: The Selector ID represents the well-known IEEE 802.2 Link Layer Control (LLC) Destination Service Access Point (DSAP). See 19 [http://standards.ieee.org/develop/regauth/llc/public.html]. 1 [RFC 6759] Note that LLC DSAP is usually expressed in hexadecimal. However, the corresponding decimal value is used in this Selector ID. PANA-L7-PEN: Proprietary layer 7 definition, including a Private Enterprise Number (PEN) [Private Enterprise Numbers (PENs)] to identify that the application registry being used 20 is not owned by the Exporter manufacturer or to identify the 3 [RFC 6759] original enterprise in the case of a mediator or 3rd party device. The Selector ID represents the enterprise unique global ID for the layer 7 applications. The Selector ID has a global significance for all devices from the same enterprise. 21 The Selector ID contains an application ID from the Qosmos 4 [Paul_Aitken]; [Qosmos] ixEngine. 22 The Selector ID contains a protocol from the ntop nDPI engine. 2 [Paul_Aitken]; [https://www.ntop.org/products/deep-packet-inspection/ndpi] 23 R&S ipoque DPI PACE2 engine 2 [Tim_Kittel]; [https://www.ipoque.com/products/dpi-engine-rs-pace-2-for-application-awareness] 24 R&S ipoque DPI vPACE engine 2 [Tim_Kittel]; [https://www.ipoque.com/products/dpi-engine-rs-pace-2-for-application-awareness] flowEndReason (Value 136) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 5102] Available Formats [IMG] CSV Value Name Description Reference 0x00 Reserved [RFC 5102] 0x01 idle timeout The Flow was terminated because it was considered to be idle. [RFC 5102] 0x02 active timeout The Flow was terminated for reporting purposes while it was still active, for example, after the maximum [RFC 5102] lifetime of unreported Flows was reached. 0x03 end of Flow detected The Flow was terminated because the Metering Process detected signals indicating the end of the Flow, for [RFC 5102] example, the TCP FIN flag. 0x04 forced end The Flow was terminated because of some external event, for example, a shutdown of the Metering Process [RFC 5102] initiated by a network management application. 0x05 lack of resources The Flow was terminated because of lack of resources available to the Metering Process and/or the Exporting [RFC 5102] Process. 0x06-0xFF Unassigned natOriginatingAddressRealm (Value 229) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [ipfix-iana_at_cisco.com] Available Formats [IMG] CSV Value Description Reference 1 Private [ipfix-iana_at_cisco.com] 2 Private [ipfix-iana_at_cisco.com] 3-255 Unassigned NAT Event Type (Value 230) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 8158] Available Formats [IMG] CSV Value Event Name Reference 0 Reserved [RFC 8158] 1 NAT translation create (Historic) [RFC 8158] 2 NAT translation delete (Historic) [RFC 8158] 3 NAT Addresses exhausted [RFC 8158] 4 NAT44 session create [RFC 8158] 5 NAT44 session delete [RFC 8158] 6 NAT64 session create [RFC 8158] 7 NAT64 session delete [RFC 8158] 8 NAT44 BIB create [RFC 8158] 9 NAT44 BIB delete [RFC 8158] 10 NAT64 BIB create [RFC 8158] 11 NAT64 BIB delete [RFC 8158] 12 NAT ports exhausted [RFC 8158] 13 Quota Exceeded [RFC 8158] 14 Address binding create [RFC 8158] 15 Address binding delete [RFC 8158] 16 Port block allocation [RFC 8158] 17 Port block de-allocation [RFC 8158] 18 Threshold Reached [RFC 8158] firewallEvent (Value 233) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [ipfix-iana_at_cisco.com] Available Formats [IMG] CSV Value Description Reference 0 Ignore (invalid) [ipfix-iana_at_cisco.com] 1 Flow Created [ipfix-iana_at_cisco.com] 2 Flow Deleted [ipfix-iana_at_cisco.com] 3 Flow Denied [ipfix-iana_at_cisco.com] 4 Flow Alert [ipfix-iana_at_cisco.com] 5 Flow Update [ipfix-iana_at_cisco.com] 6-255 Unassigned biflowDirection (Value 239) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 5103] Available Formats [IMG] CSV Value Name Description Reference 0x00 arbitrary Direction was assigned arbitrarily. [RFC 5103] 0x01 initiator The Biflow Source is the flow initiator, as determined by the Metering Process' best effort to detect the [RFC 5103] initiator. The Biflow Destination is the flow initiator, as determined by the Metering Process' best effort to detect the 0x02 reverseInitiator initiator. This value is provided for the convenience of Exporting Processes to revise an initiator estimate [RFC 5103] without re-encoding the Biflow Record. 0x03 perimeter The Biflow Source is the endpoint outside of a defined perimeter. The perimeter's definition is implicit in the [RFC 5103] set of Biflow Source and Biflow Destination addresses exported in the Biflow Records. 0x04-0xFF Unassigned observationPointType (Value 277) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [ipfix-iana_at_cisco.com] Available Formats [IMG] CSV Value Description Reference 1 Physical port [ipfix-iana_at_cisco.com] 2 Port channel [ipfix-iana_at_cisco.com] 3 Vlan [ipfix-iana_at_cisco.com] 4-255 Unassigned anonymizationTechnique (Value 286) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 6235] Available Formats [IMG] CSV Value Name Description Applicable to Recommended for Reference The Exporting Process makes no representation as to whether the 0 Undefined defined field is anonymized or not. While the Collecting Process all all [RFC 6235] MAY assume that the field is not anonymized, it is not guaranteed not to be. This is the default anonymization technique. 1 None The values exported are real. all all [RFC 6235] The values exported are anonymized using simple precision 2 Precision Degradation/Truncation degradation or truncation. The new precision or number of all all [RFC 6235] truncated bits is implicit in the exported data, and can be deduced by the Collecting Process. 3 Binning The values exported are anonymized into bins. all all [RFC 6235] 4 Enumeration The values exported are anonymized by enumeration. all timestamps [RFC 6235] 5 Permutation The values exported are anonymized by permutation. all identifiers [RFC 6235] The values exported are anonymized by permutation, preserving 6 Structured Permutation bit-level structure as appropriate; this represents all [RFC 6235] prefix-preserving IP address anonymization or structured MAC address anonymization. The values exported are anonymized using reverse truncation. The 7 Reverse Truncation number of truncated bits is implicit in the exported data, and all [RFC 6235] can be deduced by the Collecting Process. 8 Noise The values exported are anonymized by adding random noise to each non-identifiers counters [RFC 6235] value. 9 Offset The values exported are anonymized by adding a single offset to all timestamps [RFC 6235] all values. 10-65535 Unassigned natType (Value 297) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [ipfix-iana_at_cisco.com] Available Formats [IMG] CSV Value Description Reference 0 unknown [ipfix-iana_at_cisco.com] 1 NAT44 translated [ipfix-iana_at_cisco.com] 2 NAT64 translated [ipfix-iana_at_cisco.com] 3 NAT46 translated [ipfix-iana_at_cisco.com] 4 IPv4-->IPv4 (no NAT) [ipfix-iana_at_cisco.com] 5 NAT66 translated [ipfix-iana_at_cisco.com] 6 IPv6-->IPv6 (no NAT) [ipfix-iana_at_cisco.com] 7-255 Unassigned valueDistributionMethod (Value 384) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 7015] Available Formats [IMG] CSV Value Name Description Reference The counters for an Original Flow are explicitly not distributed according to any other method 0 Unspecified defined for this Information Element; use for arbitrary distribution, or distribution algorithms [RFC 7015] not described by any other codepoint. The counters for an Original Flow are added to the counters of the appropriate Aggregated Flow 1 Start Interval containing the start time of the Original Flow. This should be assumed the default if value [RFC 7015] distribution information is not available at a Collecting Process for an Aggregated Flow. 2 End Interval The counters for an Original Flow are added to the counters of the appropriate Aggregated Flow [RFC 7015] containing the end time of the Original Flow. 3 Mid Interval The counters for an Original Flow are added to the counters of a single appropriate Aggregated Flow [RFC 7015] containing some timestamp between start and end time of the Original Flow. Each counter for an Original Flow is divided by the number of time intervals the Original Flow 4 Simple Uniform Distribution covers (i.e., of appropriate Aggregated Flows sharing the same Flow Key), and this number is added [RFC 7015] to each corresponding counter in each Aggregated Flow. Each counter for an Original Flow is divided by the number of time units the Original Flow covers, to derive a mean count rate. This mean count rate is then multiplied by the number of time units in 5 Proportional Uniform Distribution the intersection of the duration of the Original Flow and the time interval of each Aggregated [RFC 7015] Flow. This is like simple uniform distribution, but accounts for the fractional portions of a time interval covered by an Original Flow in the first and last time interval. Each counter of the Original Flow is distributed among the intervals of the Aggregated Flows according to some function the Intermediate Aggregation Process uses based upon properties of Flows 6 Simulated Process presumed to be like the Original Flow. This is essentially an assertion that the Intermediate [RFC 7015] Aggregation Process has no direct packet timing information but is nevertheless not using one of the other simpler distribution methods. The Intermediate Aggregation Process specifically makes no assertion as to the correctness of the simulation. 7 Direct The Intermediate Aggregation Process has access to the original packet timings from the packets [RFC 7015] making up the Original Flow, and uses these to distribute or recalculate the counters. 8-255 Unassigned flowSelectorAlgorithm (Value 390) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 7014] Available Formats [IMG] CSV ID Technique Parameters Reference 0 Unassigned 1 Systematic count-based Sampling flowSamplingInterval, flowSamplingSpacing [RFC 7014] 2 Systematic time-based Sampling flowSamplingTimeInterval, flowSamplingTimeSpacing [RFC 7014] 3 Random n-out-of-N Sampling samplingSize, samplingPopulation [RFC 7014] 4 Uniform probabilistic Sampling samplingProbability [RFC 7014] 5 Property Match Filtering Information Element Value Range [RFC 7014] 6 Hash-based Filtering using BOB hashInitialiserValue, hashFlowDomain, hashSelectedRangeMin, hashSelectedRangeMax, [RFC 7014] hashOutputRangeMin, hashOutputRangeMax 7 Hash-based Filtering using IPSX hashInitialiserValue, hashFlowDomain, hashSelectedRangeMin, hashSelectedRangeMax, [RFC 7014] hashOutputRangeMin, hashOutputRangeMax 8 Hash-based Filtering using CRC hashInitialiserValue, hashFlowDomain, hashSelectedRangeMin, hashSelectedRangeMax, [RFC 7014] hashOutputRangeMin, hashOutputRangeMax 9 Flow-state Dependent Intermediate Flow Selection No agreed Parameters [RFC 7014] Process dataLinkFrameType (Value 408) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 7133] Available Formats [IMG] CSV Value Description Reference 0x0001 IEEE802.3 ETHERNET [IEEE Std 802.3-2012] 0x0002 IEEE802.11 MAC Frame format [IEEE Std 802.11-2012] 0x0003-0xFFFF Unassigned mibCaptureTimeSemantics (Value 448) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 8038] Available Formats [IMG] CSV Value Name Description Reference 0 undefined [RFC 8038] 1 begin The value for the MIB object is captured from the MIB when the Flow is first observed [RFC 8038] 2 end The value for the MIB object is captured from the MIB when the Flow ends [RFC 8038] 3 export The value for the MIB object is captured from the MIB at export time [RFC 8038] 4 average The value for the MIB object is an average of multiple captures from the MIB over the observed life of the Flow [RFC 8038] 5-255 Unassigned NAT Quota Exceeded Event Type (Value 466) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 8158] Available Formats [IMG] CSV Value Quota Exceeded Event Name Reference 0 Reserved [RFC 8158] 1 Maximum session entries [RFC 8158] 2 Maximum BIB entries [RFC 8158] 3 Maximum entries per user [RFC 8158] 4 Maximum active hosts or subscribers [RFC 8158] 5 Maximum fragments pending reassembly [RFC 8158] NAT Threshold Event Type (Value 467) Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 8158] Available Formats [IMG] CSV Value Threshold Exceeded Event Name Reference 0 Reserved [RFC 8158] 1 Address pool high threshold event [RFC 8158] 2 Address pool low threshold event [RFC 8158] 3 Address and port mapping high threshold event [RFC 8158] 4 Address and port mapping per user high threshold event [RFC 8158] 5 Global Address mapping high threshold event [RFC 8158] IPFIX IPv6 SRH Segment Type (Value 500) Registration Procedure(s) Expert Review Expert(s) Thomas Graf, Pierre Francois, IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 9487] Available Formats [IMG] CSV Value Description Reference 0 Unknown [RFC 9487] 1 Segment Routing Policy [RFC 9487]; [RFC 9256] 2 Path Computation Element [RFC 9487]; [RFC 9603] 3 OSPFv3 Segment Routing [RFC 9487]; [RFC 9513] 4 IS-IS Segment Routing [RFC 9487]; [RFC 9352] 5 BGP Segment Routing Prefix-SID [RFC 9487]; [RFC 8669] 6-255 Unassigned IPFIX Version Numbers Registration Procedure(s) Standards Action Reference [RFC 7011] Available Formats [IMG] CSV Value Version Reference 0 Reserved 1-8 Reserved (historic) 9 Cisco Systems NetFlow Version 9 (historic) [RFC 3954] 10 IPFIX [RFC 7011] 11-65535 Unassigned IPFIX Set IDs Registration Procedure(s) Standards Action Reference [RFC 7011] Available Formats [IMG] CSV Value Set Identifier Reference 0-1 Not used (historic) [RFC 3954] 2 Template Set [RFC 7011] 3 Options Template Set [RFC 7011]; [RFC Errata 1818] 4-255 Unassigned 256-65535 Reserved for Data Sets [RFC 7011] IPFIX Information Element Data Types Registration Procedure(s) Standards Action Reference [RFC 5610] Available Formats [IMG] CSV Value Description Reference 0 octetArray [RFC 5102]; [RFC 7011] 1 unsigned8 [RFC 5102]; [RFC 7011] 2 unsigned16 [RFC 5102]; [RFC 7011] 3 unsigned32 [RFC 5102]; [RFC 7011] 4 unsigned64 [RFC 5102]; [RFC 7011] 5 signed8 [RFC 5102]; [RFC 7011] 6 signed16 [RFC 5102]; [RFC 7011] 7 signed32 [RFC 5102]; [RFC 7011] 8 signed64 [RFC 5102]; [RFC 7011] 9 float32 [RFC 5102]; [RFC 7011] 10 float64 [RFC 5102]; [RFC 7011] 11 boolean [RFC 5102]; [RFC 7011] 12 macAddress [RFC 5102]; [RFC 7011] 13 string [RFC 5102]; [RFC 7011] 14 dateTimeSeconds [RFC 5102]; [RFC 7011] 15 dateTimeMilliseconds [RFC 5102]; [RFC 7011] 16 dateTimeMicroseconds [RFC 5102]; [RFC 7011] 17 dateTimeNanoseconds [RFC 5102]; [RFC 7011] 18 ipv4Address [RFC 5102]; [RFC 7011] 19 ipv6Address [RFC 5102]; [RFC 7011] 20 basicList [RFC 6313]; [RFC 7011] 21 subTemplateList [RFC 6313]; [RFC 7011] 22 subTemplateMultiList [RFC 6313]; [RFC 7011] 23 unsigned256 [RFC 9740] 24-255 Unassigned IPFIX Information Element Semantics Registration Procedure(s) Standards Action Reference [RFC 5610] Available Formats [IMG] CSV Value Description Reference 0 default [RFC 5610] 1 quantity [RFC 5610] 2 totalCounter [RFC 5610] 3 deltaCounter [RFC 5610] 4 identifier [RFC 5610] 5 flags [RFC 5610] 6 list [RFC 6313] 7 snmpCounter [RFC 8038] 8 snmpGauge [RFC 8038] 9-255 Unassigned IPFIX Information Element Units Registration Procedure(s) Expert Review Expert(s) IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken) Reference [RFC 5610][RFC Errata 1822] Available Formats [IMG] CSV Value Name Notes Reference 0 none [RFC 5610] 1 bits [RFC 5610] 2 octets [RFC 5610] 3 packets [RFC 5610] 4 flows [RFC 5610] 5 seconds [RFC 5610] 6 milliseconds [RFC 5610] 7 microseconds [RFC 5610] 8 nanoseconds [RFC 5610] 9 4-octet words For example, for IPv4 header length [RFC 5610] 10 messages For example, for reliability reporting [RFC 5610] 11 hops For example, for TTL [RFC 5610] 12 entries For example, for MPLS label stack [RFC 5610] 13 frames For example, Layer 2 frames [ipfix-iana_at_cisco.com] 14 ports [RFC 8045] 15 inferred The units of the inferred Information Element [RFC 5477] 16-65535 Unassigned IPFIX Structured Data Types Semantics Registration Procedure(s) Standards Action Reference [RFC 6313] Available Formats [IMG] CSV Value Name Description Reference 0x00 noneOf The "noneOf" structured data type semantic specifies that none of the elements are actual properties of the Data [RFC 6313] Record. 0x01 exactlyOneOf The "exactlyOneOf" structured data type semantic specifies that only a single element from the structured data is an [RFC 6313] actual property of the Data Record. This is equivalent to a logical XOR operation. 0x02 oneOrMoreOf The "oneOrMoreOf" structured data type semantic specifies that one or more elements from the list in the structured [RFC 6313] data are actual properties of the Data Record. This is equivalent to a logical OR operation. 0x03 allOf The "allOf" structured data type semantic specifies that all of the list elements from the structured data are [RFC 6313] actual properties of the Data Record. 0x04 ordered The "ordered" structured data type semantic specifies that elements from the list in the structured data are [RFC 6313] ordered. 0x05-0xFE unassigned The "undefined" structured data type semantic specifies that the semantic of the list elements is not specified and 0xFF undefined that, if a semantic exists, then it is up to the Collecting Process to draw its own conclusions. The "undefined" [RFC 6313] structured data type semantic is the default structured data type semantic. IPFIX ipv6ExtensionHeaders Bits Registration Procedure(s) Expert Review Expert(s) Paul Aitken, Jen Linkova Reference [RFC 9740] Available Formats [IMG] CSV Bit Label Protocol Number Description Reference 0 DST 60 Destination Options for IPv6 [RFC 9740] 1 HOP 0 IPv6 Hop-by-Hop Options [RFC 9740] 2 NoNxt 59 No Next Header for IPv6 [RFC 9740] 3 UNK Unknown extension or transport header [RFC 9740] 4 FRA0 44 Fragment header - first fragment [RFC 9740] 5 RH 43 Routing header [RFC 9740] 6 FRA1 44 Fragmentation header - not first fragment [RFC 9740] 7 MOB 135 Mobility Header [RFC 9740] 8 ESP 50 Encapsulating Security Payload [RFC 9740] 9 AH 51 Authentication Header [RFC 9740] 10 HIP 139 Host Identity Protocol [RFC 9740] 11 SHIM6 140 Shim6 Protocol [RFC 9740] 12 253 Use for experimentation and testing [RFC 9740] 13 254 Use for experimentation and testing [RFC 9740] 14-255 Unassigned Contact Information ID Name Contact URI Last Updated [Alfred_Nothaft] Alfred Nothaft mailto:alfred.nothaft&nokia.com 2018-02-12 [Andrew_Feren] Andrew Feren mailto:andrew.feren&plixer.com 2017-04-19 [Brian_Trammell] Brian Trammell mailto:brian&trammell.ch 2013-08-01 [Felix_Erlacher] Felix Erlacher mailto:felix.erlacher&ccs-labs.org 2017-06-19 [ipfix-iana_at_cisco.com] ipfix-iana at cisco.com mailto:ipfix-iana&cisco.com 2013-04-11 [Paul_Aitken] Paul Aitken mailto:paul.aitken&att.com 2018-02-12 [Qosmos] Qosmos http://www.qosmos.com 2017-02-21 [Sriram_Gopalakrishnan] Sriram Gopalakrishnan mailto:sriragop&cisco.com 2024-07-02 [Tim_Kittel] Tim Kittel mailto:tim.kittel&rohde-schwarz.com 2022-02-04 [Yaakov_J_Stein] Yaakov (J) Stein mailto:yaakov_s&rad.com 2013-04-11 Licensing Terms