Cisco Specific Information Elements reused in IPFIXCisco Systems, Inc.De Kleetlaan, 7BrusselsDiegemB-1831Belgium+32 2 704 5494ayourtch@cisco.comCisco Systems, Inc.96 Commercial QuayEdinburghEH6 6LXScotland+44 131 561 3616paitken@cisco.comCisco Systems, Inc.De Kleetlaan, 6a b1DiegemB-1831Belgium+32 2 704 5622bclaise@cisco.com
Applications
IPFIXThis document describes some additional Information Elements of Cisco Systems, Inc. that are not listed in RFC3954.The section 4 of defines the IPFIX Information Elements in the range of 1-127 to be compatible with the NetFlow version 9 fields, as specified in the "Cisco Systems NetFlow Services Export Version 9". As was specified in 2004, it does not contain all NetFlow version 9 specific fields in the range 1-127. The question was asked whether IPFIX Devices should exclusively report the IPFIX IANA IEs ? In other words, when upgrading from a NetFlow metering process to an IPFIX Metering Process, should the IPFIX Devices stop reporting NetFlow version 9 specific IEs that were not registered in IANA ?This document is intended to fill the gap in this IE range. That way, IPFIX implementations could export all the IEs specified in IANA, regardless of the range.IPFIX-specific terminology used in this document is defined in Section 2 of . As in , these IPFIX-specific terms have the first letter of a word capitalized when used in this document.The following Information Elements are discussed in the sections below:IDNameIDName34samplingInterval87flagsAndSamplerId35samplingAlgorithm89forwardingStatus38engineType92srcTrafficIndex39engineId93dstTrafficIndex43ipv4RouterSc100className48samplerId102layer2packetSectionOffset49samplerMode103layer2packetSectionSize50samplerRandomInterval104layer2packetSectionData51classIdDeprecated in favor of 305 samplingPacketInterval. When using sampled NetFlow, the rate at which packets are sampled - e.g. a value of 100 indicates that one of every 100 packets is sampled. unsigned3234quantitydeprecatedpacketsDeprecated in favor of 304 selectorAlgorithm. The type of algorithm used for sampled NetFlow: 1 - Deterministic Sampling; 2 - Random Sampling. The values are not compatible with the selectorAlgorithm IE, where "Deterministic" has been replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion is required, see PSAMP parameters.unsigned835identifierdeprecatedType of flow switching engine in a router/switch: RP = 0, VIP/Line card = 1, PFC/DFC = 2. Reserved for internal use on the collector.unsigned838identifierdeprecatedVIP or line card slot number of the flow switching engine in a router/switch. Reserved for internal use on the collector.unsigned839identifierdeprecatedThis is a platform-specific field for Catalyst 5000/Catalyst 6000 family. It is used to store the address of a router that is being shortcut when performing MultiLayer Switching. ipv4Address43identifierdeprecated describes the MultiLayer Switching.Deprecated in favor of 302 selectorId. The unique identifier associated with samplerName.unsigned848identifierdeprecatedDeprecated in favor of 304 selectorAlgorithm. The values are not compatible: selectorAlgorithm=3 is random sampling. The type of algorithm used for sampling data: 1 - deterministic, 2 - random sampling. Use with samplerRandomInterval.unsigned849identifierdeprecatedDeprecated in favour of 305 samplingPacketInterval. Packet interval at which to sample - in case of random sampling. Used in connection with samplerMode 0x02 (random sampling) value.unsigned3250quantitydeprecatedDeprecated in favour of 302 selectorId. Characterizes the traffic class, i.e. QoS treatment.unsigned851identifierdeprecatedDeprecated in favor of 335 selectorName. Name of the flow sampler.string84deprecatedFlow flags and the value of the sampler ID (samplerId) combined in one bitmapped field. Reserved for internal use on the collector.unsigned3287identifierdeprecatedThis Information Element describes the forwarding status of the flow and any attached reasons. The Reduced Size Encoding rules as per apply.
unsigned3289identifiercurrentSee - NetFlow Version 9 Record Format.BGP Policy Accounting Source Traffic Indexunsigned3292identifiercurrentBGP policy accounting as described in BGP Policy Accounting Destination Traffic Indexunsigned3293identifiercurrentBGP policy accounting as described in Deprecated in favor of 335 selectorName. Traffic Class Name, associated with the classId Information Element.string100deprecatedLayer 2 packet section offset. Potentially a generic packet section offset.unsigned16102quantitycurrent contains a corresponding field 'sectionOffset' with a better description. One solution is to assign the value 102 for the 'sectionOffset' in .Layer 2 packet section size. Potentially a generic packet section size.unsigned16103quantitycurrent contains a corresponding field 'sectionObservedOctets' with a better description. One solution is to assign the value 103 to 'sectionObservedOctets' in .Layer 2 packet section data.octetArray104current contains a corresponding field 'dataLinkFrameSection' with a better description. One solution is to assign the value 104 to 'dataLinkFrameSection' in .ElementId: 65 .. 69Performance metrics will need a consolidation in the industry, based on RFC6390. Once this consolidation happens, via a separate document the IEs 65-69 will either be assigned in the IANA registry or their status will be deprecated.ElementId: 101ElementId: 94 .. 97Please refer to the RFC 6759This document specifies several new IPFIX Information Elements in the
IPFIX Information Element registry as defined in Section 3 above. The following Information Elements must be assigned:IE Number 34 for the samplingInterval IEIE Number 35 for the samplingAlgorithm IEIE Number 38 for the engineType IEIE Number 39 for the engineId IEIE Number 43 for the ipv4RouterSc IEIE Number 48 for the samplerId IEIE Number 49 for the samplerMode IEIE Number 50 for the samplerRandomInterval IEIE Number 51 for the classId IEIE Number 84 for the samplerName IEIE Number 87 for the flagsAndSamplerId IEIE Number 89 for the forwardingStatus IEIE Number 92 for the srcTrafficIndex IEIE Number 93 for the dstTrafficIndex IEIE Number 100 for the className IEIE Number 102 for the layer2packetSectionOffset IEIE Number 103 for the layer2packetSectionSize IEIE Number 104 for the layer2packetSectionData IEThis document specifies the definitions of several Information Elements and does not alter the security considerations of the base protocol. Please refer to the security considerations sections of RFC 3954 and RFC 7012.However, the export of the sections of the packet payload may unintentionally change the security assumptions of other protocols.Packet Sampling (PSAMP) ParametersIANAIP Flow Information Export (IPFIX) EntitiesIANANetFlow version 9 Flow-Record formatCiscoBGP Policy Accounting and BGP Policy Accounting Output Interface Accounting FeaturesCiscoIP MultiLayer Switching Sample ConfigurationCiscoTo be removed by RFC Editor before publication01: initial revision presented at the IETF meeting.02: removed "flow" from flowSamplerId, flowSamplerMode, and
flowSamplerRandomInterval; updated the related drafts in references; added the "reference" column to the XML definitions; renamed fsFlowEntryTotalCount into deltaFlowCount to keep the naming in sync with draft-trammell-ipfix-a9n. Also minor changes to formatting and added the IE overview table.03: updated the references to draft-claise-export-application-info-in-ipfix, slightly tweaked the title and removed the unused reference to draft-ietf-ipfix-flow-selection-tech.04: sync the references.05: update references to draft-claise-export-application-info-in-ipfix with reference to rfc6759, draft-trammell-ipfix-a9n to draft-ietf-ipfix-a9n, draft-kashima-ipfix-data-link-layer-monitoring to draft-ietf-ipfix-data-link-layer-monitoring.06: sync the references.07: Update per comment from Andrew Feren - change semantics of ipv4RouterSc to "identifier" and remove deltaFlowCount
as it made it to IANA. Update references RFC5101 to RFC7011, draft-ietf-ipfix-data-link-layer-monitoring from -03 to -04.