RFC 5102
Information Model for IP Flow Information Export
4. Information Element Identifiers
All Information Elements defined in Section 5 of this document or in future extensions of the IPFIX information model have their identifiers assigned by IANA. Their identifiers can be retrieved at http://www.iana.org/assignments/ipfix. The value of these identifiers is in the range of 1-32767. Within this range, Information Element identifier values in the sub-range of 1-127 are compatible with field types used by NetFlow version 9 [RFC3954].
+---------------------------------+---------------------------------+ | Range of IANA-assigned | Description | | Information Element identifiers | | +---------------------------------+---------------------------------+ | 0 | Reserved. | | 1-127 | Information Element identifiers | | | compatible with NetFlow version | | | 9 field types [RFC3954]. | | 128-32767 | Further Information Element | | | identifiers. | +---------------------------------+---------------------------------+ Enterprise-specific Information Element identifiers have the same range of 1-32767, but they are coupled with an additional enterprise identifier. For enterprise-specific Information Elements, Information Element identifier 0 is also reserved. Enterprise-specific Information Element identifiers can be chosen by an enterprise arbitrarily within the range of 1-32767. The same identifier may be assigned by other enterprises for different purposes. Still, Collecting Processes can distinguish these Information Elements because the Information Element identifier is coupled with an enterprise identifier. Enterprise identifiers MUST be registered as SMI network management private enterprise code numbers with IANA. The registry can be found at http://www.iana.org/assignments/enterprise-numbers. The following list gives an overview of the Information Element identifiers that are specified in Section 5 and are compatible with field types used by NetFlow version 9 [RFC3954].
+----+----------------------------+-------+-------------------------+ | ID | Name | ID | Name | +----+----------------------------+-------+-------------------------+ | 1 | octetDeltaCount | 43 | RESERVED | | 2 | packetDeltaCount | 44 | sourceIPv4Prefix | | 3 | RESERVED | 45 | destinationIPv4Prefix | | 4 | protocolIdentifier | 46 | mplsTopLabelType | | 5 | ipClassOfService | 47 | mplsTopLabelIPv4Address | | 6 | tcpControlBits | 48-51 | RESERVED | | 7 | sourceTransportPort | 52 | minimumTTL | | 8 | sourceIPv4Address | 53 | maximumTTL | | 9 | sourceIPv4PrefixLength | 54 | fragmentIdentification | | 10 | ingressInterface | 55 | postIpClassOfService | | 11 | destinationTransportPort | 56 | sourceMacAddress | | 12 | destinationIPv4Address | 57 |postDestinationMacAddress| | 13 | destinationIPv4PrefixLength| 58 | vlanId | | 14 | egressInterface | 59 | postVlanId | | 15 | ipNextHopIPv4Address | 60 | ipVersion | | 16 | bgpSourceAsNumber | 61 | flowDirection | | 17 | bgpDestinationAsNumber | 62 | ipNextHopIPv6Address | | 18 | bgpNexthopIPv4Address | 63 | bgpNexthopIPv6Address | | 19 | postMCastPacketDeltaCount | 64 | ipv6ExtensionHeaders | | 20 | postMCastOctetDeltaCount | 65-69 | RESERVED | | 21 | flowEndSysUpTime | 70 | mplsTopLabelStackSection| | 22 | flowStartSysUpTime | 71 | mplsLabelStackSection2 | | 23 | postOctetDeltaCount | 72 | mplsLabelStackSection3 | | 24 | postPacketDeltaCount | 73 | mplsLabelStackSection4 | | 25 | minimumIpTotalLength | 74 | mplsLabelStackSection5 | | 26 | maximumIpTotalLength | 75 | mplsLabelStackSection6 | | 27 | sourceIPv6Address | 76 | mplsLabelStackSection7 | | 28 | destinationIPv6Address | 77 | mplsLabelStackSection8 | | 29 | sourceIPv6PrefixLength | 78 | mplsLabelStackSection9 | | 30 | destinationIPv6PrefixLength| 79 | mplsLabelStackSection10 | | 31 | flowLabelIPv6 | 80 | destinationMacAddress | | 32 | icmpTypeCodeIPv4 | 81 | postSourceMacAddress | | 33 | igmpType | 82-84 | RESERVED | | 34 | RESERVED | 85 | octetTotalCount | | 35 | RESERVED | 86 | packetTotalCount | | 36 | flowActiveTimeout | 87 | RESERVED | | 37 | flowIdleTimeout | 88 | fragmentOffset | | 38 | RESERVED | 89 | RESERVED | | 39 | RESERVED | 90 |mplsVpnRouteDistinguisher| | 40 | exportedOctetTotalCount |91-127 | RESERVED | | 41 | exportedMessageTotalCount | | | | 42 |exportedFlowRecordTotalCount| | | +----+----------------------------+-------+-------------------------+
The following list gives an overview of the Information Element identifiers that are specified in Section 5 and extends the list of Information Element identifiers specified already in [RFC3954]. +-----+---------------------------+-----+---------------------------+ | ID | Name | ID | Name | +-----+---------------------------+-----+---------------------------+ | 128 | bgpNextAdjacentAsNumber | 169 | destinationIPv6Prefix | | 129 | bgpPrevAdjacentAsNumber | 170 | sourceIPv6Prefix | | 130 | exporterIPv4Address | 171 | postOctetTotalCount | | 131 | exporterIPv6Address | 172 | postPacketTotalCount | | 132 | droppedOctetDeltaCount | 173 | flowKeyIndicator | | 133 | droppedPacketDeltaCount | 174 | postMCastPacketTotalCount | | 134 | droppedOctetTotalCount | 175 | postMCastOctetTotalCount | | 135 | droppedPacketTotalCount | 176 | icmpTypeIPv4 | | 136 | flowEndReason | 177 | icmpCodeIPv4 | | 137 | commonPropertiesId | 178 | icmpTypeIPv6 | | 138 | observationPointId | 179 | icmpCodeIPv6 | | 139 | icmpTypeCodeIPv6 | 180 | udpSourcePort | | 140 | mplsTopLabelIPv6Address | 181 | udpDestinationPort | | 141 | lineCardId | 182 | tcpSourcePort | | 142 | portId | 183 | tcpDestinationPort | | 143 | meteringProcessId | 184 | tcpSequenceNumber | | 144 | exportingProcessId | 185 | tcpAcknowledgementNumber | | 145 | templateId | 186 | tcpWindowSize | | 146 | wlanChannelId | 187 | tcpUrgentPointer | | 147 | wlanSSID | 188 | tcpHeaderLength | | 148 | flowId | 189 | ipHeaderLength | | 149 | observationDomainId | 190 | totalLengthIPv4 | | 150 | flowStartSeconds | 191 | payloadLengthIPv6 | | 151 | flowEndSeconds | 192 | ipTTL | | 152 | flowStartMilliseconds | 193 | nextHeaderIPv6 | | 153 | flowEndMilliseconds | 194 | mplsPayloadLength | | 154 | flowStartMicroseconds | 195 | ipDiffServCodePoint | | 155 | flowEndMicroseconds | 196 | ipPrecedence | | 156 | flowStartNanoseconds | 197 | fragmentFlags | | 157 | flowEndNanoseconds | 198 | octetDeltaSumOfSquares | | 158 | flowStartDeltaMicroseconds| 199 | octetTotalSumOfSquares | | 159 | flowEndDeltaMicroseconds | 200 | mplsTopLabelTTL | | 160 | systemInitTimeMilliseconds| 201 | mplsLabelStackLength | | 161 | flowDurationMilliseconds | 202 | mplsLabelStackDepth | | 162 | flowDurationMicroseconds | 203 | mplsTopLabelExp | | 163 | observedFlowTotalCount | 204 | ipPayloadLength | | 164 | ignoredPacketTotalCount | 205 | udpMessageLength | | 165 | ignoredOctetTotalCount | 206 | isMulticast | | 166 | notSentFlowTotalCount | 207 | ipv4IHL | | 167 | notSentPacketTotalCount | 208 | ipv4Options | | 168 | notSentOctetTotalCount | 209 | tcpOptions |
+-----+---------------------------+-----+---------------------------+ | ID | Name | ID | Name | +-----+---------------------------+-----+---------------------------+ | 210 | paddingOctets | 218 | tcpSynTotalCount | | 211 | collectorIPv4Address | 219 | tcpFinTotalCount | | 212 | collectorIPv6Address | 220 | tcpRstTotalCount | | 213 | exportInterface | 221 | tcpPshTotalCount | | 214 | exportProtocolVersion | 222 | tcpAckTotalCount | | 215 | exportTransportProtocol | 223 | tcpUrgTotalCount | | 216 | collectorTransportPort | 224 | ipTotalLength | | 217 | exporterTransportPort | 237 | postMplsTopLabelExp | | | | 238 | tcpWindowScale | +-----+---------------------------+-----+---------------------------+5. Information Elements
This section describes the Information Elements of the IPFIX information model. The elements are grouped into 12 groups according to their semantics and their applicability: 1. Identifiers 2. Metering and Exporting Process Configuration 3. Metering and Exporting Process Statistics 4. IP Header Fields 5. Transport Header Fields 6. Sub-IP Header Fields 7. Derived Packet Properties 8. Min/Max Flow Properties 9. Flow Timestamps 10. Per-Flow Counters 11. Miscellaneous Flow Properties 12. Padding The Information Elements that are derived from fields of packets or from packet treatment, such as the Information Elements in groups 4-7, can typically serve as Flow Keys used for mapping packets to Flows. If they do not serve as Flow Keys, their value may change from packet to packet within a single Flow. For Information Elements with values that are derived from fields of packets or from packet treatment and for which the value may change from packet to packet within a single Flow, the IPFIX information model defines that their value is determined by the first packet observed for the corresponding Flow, unless the description of the Information Element explicitly specifies a different semantics. This simple rule allows writing all
Information Elements related to header fields once when the first packet of the Flow is observed. For further observed packets of the same Flow, only Flow properties that depend on more than one packet, such as the Information Elements in groups 8-11, need to be updated. Information Elements with a name having the "post" prefix, for example, "postClassOfServiceIPv4", do not report properties that were actually observed at the Observation Point, but retrieved by other means within the Observation Domain. These Information Elements can be used if there are middlebox functions within the Observation Domain changing Flow properties after packets passed the Observation Point. Information Elements in this section use the reference property to reference [RFC0768], [RFC0791], [RFC0792], [RFC0793], [RFC1108], [RFC1112], [RFC1191], [RFC1323], [RFC1385], [RFC1812], [RFC1930], [RFC2113], [RFC2119], [RFC2460], [RFC2675], [RFC2863], [RFC3031], [RFC3032], [RFC3193], [RFC3234], [RFC3260], [RFC3270], [RFC3376], [RFC3954], [RFC4271], [RFC4291], [RFC4302], [RFC4303], [RFC4364], [RFC4382], [RFC4443], [RFC4960], [RFC5036], [IEEE.802-11.1999], [IEEE.802-1Q.2003], and [IEEE.802-3.2002].5.1. Identifiers
Information Elements grouped in the table below are identifying components of the IPFIX architecture, of an IPFIX Device, or of the IPFIX protocol. All of them have an integral abstract data type and data type semantics "identifier" as described in Section 3.2.4. Typically, some of them are used for limiting scopes of other Information Elements. However, other Information Elements MAY be used for limiting scopes. Note also that all Information Elements listed below MAY be used for other purposes than limiting scopes. +-----+---------------------------+-----+---------------------------+ | ID | Name | ID | Name | +-----+---------------------------+-----+---------------------------+ | 141 | lineCardId | 148 | flowId | | 142 | portId | 145 | templateId | | 10 | ingressInterface | 149 | observationDomainId | | 14 | egressInterface | 138 | observationPointId | | 143 | meteringProcessId | 137 | commonPropertiesId | | 144 | exportingProcessId | | | +-----+---------------------------+-----+---------------------------+
5.1.1. lineCardId
Description: An identifier of a line card that is unique per IPFIX Device hosting an Observation Point. Typically, this Information Element is used for limiting the scope of other Information Elements. Abstract Data Type: unsigned32 Data Type Semantics: identifier ElementId: 141 Status: current5.1.2. portId
Description: An identifier of a line port that is unique per IPFIX Device hosting an Observation Point. Typically, this Information Element is used for limiting the scope of other Information Elements. Abstract Data Type: unsigned32 Data Type Semantics: identifier ElementId: 142 Status: current5.1.3. ingressInterface
Description: The index of the IP interface where packets of this Flow are being received. The value matches the value of managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. Abstract Data Type: unsigned32 Data Type Semantics: identifier ElementId: 10 Status: current Reference: See RFC 2863 for the definition of the ifIndex object.
5.1.4. egressInterface
Description: The index of the IP interface where packets of this Flow are being sent. The value matches the value of managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. Abstract Data Type: unsigned32 Data Type Semantics: identifier ElementId: 14 Status: current Reference: See RFC 2863 for the definition of the ifIndex object.5.1.5. meteringProcessId
Description: An identifier of a Metering Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that process identifiers are typically assigned dynamically. The Metering Process may be re-started with a different ID. Abstract Data Type: unsigned32 Data Type Semantics: identifier ElementId: 143 Status: current5.1.6. exportingProcessId
Description: An identifier of an Exporting Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that process identifiers are typically assigned dynamically. The Exporting Process may be re-started with a different ID. Abstract Data Type: unsigned32 Data Type Semantics: identifier ElementId: 144 Status: current
5.1.7. flowId
Description: An identifier of a Flow that is unique within an Observation Domain. This Information Element can be used to distinguish between different Flows if Flow Keys such as IP addresses and port numbers are not reported or are reported in separate records. Abstract Data Type: unsigned64 Data Type Semantics: identifier ElementId: 148 Status: current5.1.8. templateId
Description: An identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain. Template IDs 0-255 are reserved for Template Sets, Options Template Sets, and other reserved Sets yet to be created. Template IDs of Data Sets are numbered from 256 to 65535. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that after a re-start of the Exporting Process Template identifiers may be re-assigned. Abstract Data Type: unsigned16 Data Type Semantics: identifier ElementId: 145 Status: current5.1.9. observationDomainId
Description: An identifier of an Observation Domain that is locally unique to an Exporting Process. The Exporting Process uses the Observation Domain ID to uniquely identify to the Collecting Process the Observation Domain where Flows were metered. It is RECOMMENDED that this identifier is also unique per IPFIX Device. A value of 0 indicates that no specific Observation Domain is identified by this Information Element. Typically, this Information Element is used for limiting the scope of other Information Elements. Abstract Data Type: unsigned32 Data Type Semantics: identifier ElementId: 149 Status: current
5.1.10. observationPointId
Description: An identifier of an Observation Point that is unique per Observation Domain. It is RECOMMENDED that this identifier is also unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Abstract Data Type: unsigned32 Data Type Semantics: identifier ElementId: 138 Status: current5.1.11. commonPropertiesId
Description: An identifier of a set of common properties that is unique per Observation Domain and Transport Session. Typically, this Information Element is used to link to information reported in separate Data Records. Abstract Data Type: unsigned64 Data Type Semantics: identifier ElementId: 137 Status: current5.2. Metering and Exporting Process Configuration
Information Elements in this section describe the configuration of the Metering Process or the Exporting Process. The set of these Information Elements is listed in the table below. +-----+--------------------------+-----+----------------------------+ | ID | Name | ID | Name | +-----+--------------------------+-----+----------------------------+ | 130 | exporterIPv4Address | 213 | exportInterface | | 131 | exporterIPv6Address | 214 | exportProtocolVersion | | 217 | exporterTransportPort | 215 | exportTransportProtocol | | 211 | collectorIPv4Address | 216 | collectorTransportPort | | 212 | collectorIPv6Address | 173 | flowKeyIndicator | +-----+--------------------------+-----+----------------------------+
5.2.1. exporterIPv4Address
Description: The IPv4 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy. Abstract Data Type: ipv4Address Data Type Semantics: identifier ElementId: 130 Status: current5.2.2. exporterIPv6Address
Description: The IPv6 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy. Abstract Data Type: ipv6Address Data Type Semantics: identifier ElementId: 131 Status: current5.2.3. exporterTransportPort
Description: The source port identifier from which the Exporting Process sends Flow information. For the transport protocols UDP, TCP, and SCTP, this is the source port number. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. This field may be useful for distinguishing multiple Exporting Processes that use the same IP address. Abstract Data Type: unsigned16 Data Type Semantics: identifier ElementId: 217 Status: current Reference: See RFC 768 for the definition of the UDP source port field. See RFC 793 for the definition of the TCP source port field. See RFC 4960 for the definition of SCTP. Additional information on defined UDP and TCP port numbers can be found at http://www.iana.org/assignments/port-numbers.
5.2.4. collectorIPv4Address
Description: An IPv4 address to which the Exporting Process sends Flow information. Abstract Data Type: ipv4Address Data Type Semantics: identifier ElementId: 211 Status: current5.2.5. collectorIPv6Address
Description: An IPv6 address to which the Exporting Process sends Flow information. Abstract Data Type: ipv6Address Data Type Semantics: identifier ElementId: 212 Status: current5.2.6. exportInterface
Description: The index of the interface from which IPFIX Messages sent by the Exporting Process to a Collector leave the IPFIX Device. The value matches the value of managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. Abstract Data Type: unsigned32 Data Type Semantics: identifier ElementId: 213 Status: current Reference: See RFC 2863 for the definition of the ifIndex object.
5.2.7. exportProtocolVersion
Description: The protocol version used by the Exporting Process for sending Flow information. The protocol version is given by the value of the Version Number field in the Message Header. The protocol version is 10 for IPFIX and 9 for NetFlow version 9. A value of 0 indicates that no export protocol is in use. Abstract Data Type: unsigned8 Data Type Semantics: identifier ElementId: 214 Status: current Reference: See the IPFIX protocol specification [RFC5101] for the definition of the IPFIX Message Header. See RFC 3954 for the definition of the NetFlow version 9 message header.5.2.8. exportTransportProtocol
Description: The value of the protocol number used by the Exporting Process for sending Flow information. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry. In Internet Protocol version 4 (IPv4), this is carried in the Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet. Abstract Data Type: unsigned8 Data Type Semantics: identifier ElementId: 215 Status: current Reference: See RFC 791 for the specification of the IPv4 protocol field. See RFC 2460 for the specification of the IPv6 protocol field. See the list of protocol numbers assigned by IANA at http://www.iana.org/assignments/protocol-numbers.
5.2.9. collectorTransportPort
Description: The destination port identifier to which the Exporting Process sends Flow information. For the transport protocols UDP, TCP, and SCTP, this is the destination port number. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. Abstract Data Type: unsigned16 Data Type Semantics: identifier ElementId: 216 Status: current Reference: See RFC 768 for the definition of the UDP destination port field. See RFC 793 for the definition of the TCP destination port field. See RFC 4960 for the definition of SCTP. Additional information on defined UDP and TCP port numbers can be found at http://www.iana.org/assignments/port-numbers.5.2.10. flowKeyIndicator
Description: This set of bit fields is used for marking the Information Elements of a Data Record that serve as Flow Key. Each bit represents an Information Element in the Data Record with the n-th bit representing the n-th Information Element. A bit set to value 1 indicates that the corresponding Information Element is a Flow Key of the reported Flow. A bit set to value 0 indicates that this is not the case. If the Data Record contains more than 64 Information Elements, the corresponding Template SHOULD be designed such that all Flow Keys are among the first 64 Information Elements, because the flowKeyIndicator only contains 64 bits. If the Data Record contains less than 64 Information Elements, then the bits in the flowKeyIndicator for which no corresponding Information Element exists MUST have the value 0. Abstract Data Type: unsigned64 Data Type Semantics: flags ElementId: 173 Status: current
5.3. Metering and Exporting Process Statistics
Information Elements in this section describe statistics of the Metering Process and/or the Exporting Process. The set of these Information Elements is listed in the table below. +-----+-----------------------------+-----+-------------------------+ | ID | Name | ID | Name | +-----+-----------------------------+-----+-------------------------+ | 41 | exportedMessageTotalCount | 165 | ignoredOctetTotalCount | | 40 | exportedOctetTotalCount | 166 | notSentFlowTotalCount | | 42 | exportedFlowRecordTotalCount| 167 | notSentPacketTotalCount | | 163 | observedFlowTotalCount | 168 | notSentOctetTotalCount | | 164 | ignoredPacketTotalCount | | | +-----+-----------------------------+-----+-------------------------+5.3.1. exportedMessageTotalCount
Description: The total number of IPFIX Messages that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process. The reported number excludes the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of IPFIX Messages sent to this Collecting Process. Abstract Data Type: unsigned64 Data Type Semantics: totalCounter ElementId: 41 Status: current Units: messages5.3.2. exportedOctetTotalCount
Description: The total number of octets that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process. The value of this Information Element is calculated by summing up the IPFIX Message Header length values of all IPFIX Messages that were successfully sent to the Collecting Process. The reported number excludes octets in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of octets sent to this Collecting Process. Abstract Data Type: unsigned64 Data Type Semantics: totalCounter ElementId: 40 Status: current
Units: octets5.3.3. exportedFlowRecordTotalCount
Description: The total number of Flow Records that the Exporting Process has sent as Data Records since the Exporting Process (re-)initialization to a particular Collecting Process. The reported number excludes Flow Records in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of Flow Records sent to this process. Abstract Data Type: unsigned64 Data Type Semantics: totalCounter ElementId: 42 Status: current Units: flows5.3.4. observedFlowTotalCount
Description: The total number of Flows observed in the Observation Domain since the Metering Process (re-)initialization for this Observation Point. Abstract Data Type: unsigned64 Data Type Semantics: totalCounter ElementId: 163 Status: current Units: flows5.3.5. ignoredPacketTotalCount
Description: The total number of observed IP packets that the Metering Process did not process since the (re-)initialization of the Metering Process. Abstract Data Type: unsigned64 Data Type Semantics: totalCounter ElementId: 164 Status: current Units: packets
5.3.6. ignoredOctetTotalCount
Description: The total number of octets in observed IP packets (including the IP header) that the Metering Process did not process since the (re-)initialization of the Metering Process. Abstract Data Type: unsigned64 Data Type Semantics: totalCounter ElementId: 165 Status: current Units: octets5.3.7. notSentFlowTotalCount
Description: The total number of Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies. Abstract Data Type: unsigned64 Data Type Semantics: totalCounter ElementId: 166 Status: current Units: flows5.3.8. notSentPacketTotalCount
Description: The total number of packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies. Abstract Data Type: unsigned64 Data Type Semantics: totalCounter ElementId: 167 Status: current Units: packets
5.3.9. notSentOctetTotalCount
Description: The total number of octets in packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies. Abstract Data Type: unsigned64 Data Type Semantics: totalCounter ElementId: 168 Status: current Units: octets5.4. IP Header Fields
Information Elements in this section indicate values of IP header fields or are derived from IP header field values in combination with further information. +-----+----------------------------+-----+--------------------------+ | ID | Name | ID | Name | +-----+----------------------------+-----+--------------------------+ | 60 | ipVersion | 193 | nextHeaderIPv6 | | 8 | sourceIPv4Address | 195 | ipDiffServCodePoint | | 27 | sourceIPv6Address | 196 | ipPrecedence | | 9 | sourceIPv4PrefixLength | 5 | ipClassOfService | | 29 | sourceIPv6PrefixLength | 55 | postIpClassOfService | | 44 | sourceIPv4Prefix | 31 | flowLabelIPv6 | | 170 | sourceIPv6Prefix | 206 | isMulticast | | 12 | destinationIPv4Address | 54 | fragmentIdentification | | 28 | destinationIPv6Address | 88 | fragmentOffset | | 13 | destinationIPv4PrefixLength| 197 | fragmentFlags | | 30 | destinationIPv6PrefixLength| 189 | ipHeaderLength | | 45 | destinationIPv4Prefix | 207 | ipv4IHL | | 169 | destinationIPv6Prefix | 190 | totalLengthIPv4 | | 192 | ipTTL | 224 | ipTotalLength | | 4 | protocolIdentifier | 191 | payloadLengthIPv6 | +-----+----------------------------+-----+--------------------------+5.4.1. ipVersion
Description: The IP version field in the IP packet header. Abstract Data Type: unsigned8 Data Type Semantics: identifier ElementId: 60 Status: current
Reference:
See RFC 791 for the definition of the version field in the IPv4
packet header. See RFC 2460 for the definition of the version
field in the IPv6 packet header. Additional information on
defined version numbers can be found at
http://www.iana.org/assignments/version-numbers.
5.4.2. sourceIPv4Address
Description:
The IPv4 source address in the IP packet header.
Abstract Data Type: ipv4Address
Data Type Semantics: identifier
ElementId: 8
Status: current
Reference:
See RFC 791 for the definition of the IPv4 source address field.
5.4.3. sourceIPv6Address
Description:
The IPv6 source address in the IP packet header.
Abstract Data Type: ipv6Address
Data Type Semantics: identifier
ElementId: 27
Status: current
Reference:
See RFC 2460 for the definition of the Source Address field in the
IPv6 header.
5.4.4. sourceIPv4PrefixLength
Description:
The number of contiguous bits that are relevant in the
sourceIPv4Prefix Information Element.
Abstract Data Type: unsigned8
ElementId: 9
Status: current
Units: bits
Range: The valid range is 0-32.
5.4.5. sourceIPv6PrefixLength
Description: The number of contiguous bits that are relevant in the sourceIPv6Prefix Information Element. Abstract Data Type: unsigned8 ElementId: 29 Status: current Units: bits Range: The valid range is 0-128.5.4.6. sourceIPv4Prefix
Description: IPv4 source address prefix. Abstract Data Type: ipv4Address ElementId: 44 Status: current5.4.7. sourceIPv6Prefix
Description: IPv6 source address prefix. Abstract Data Type: ipv6Address ElementId: 170 Status: current5.4.8. destinationIPv4Address
Description: The IPv4 destination address in the IP packet header. Abstract Data Type: ipv4Address Data Type Semantics: identifier ElementId: 12 Status: current Reference: See RFC 791 for the definition of the IPv4 destination address field.
5.4.9. destinationIPv6Address
Description: The IPv6 destination address in the IP packet header. Abstract Data Type: ipv6Address Data Type Semantics: identifier ElementId: 28 Status: current Reference: See RFC 2460 for the definition of the Destination Address field in the IPv6 header.5.4.10. destinationIPv4PrefixLength
Description: The number of contiguous bits that are relevant in the destinationIPv4Prefix Information Element. Abstract Data Type: unsigned8 ElementId: 13 Status: current Units: bits Range: The valid range is 0-32.5.4.11. destinationIPv6PrefixLength
Description: The number of contiguous bits that are relevant in the destinationIPv6Prefix Information Element. Abstract Data Type: unsigned8 ElementId: 30 Status: current Units: bits Range: The valid range is 0-128.5.4.12. destinationIPv4Prefix
Description: IPv4 destination address prefix. Abstract Data Type: ipv4Address ElementId: 45 Status: current
5.4.13. destinationIPv6Prefix
Description: IPv6 destination address prefix. Abstract Data Type: ipv6Address ElementId: 169 Status: current5.4.14. ipTTL
Description: For IPv4, the value of the Information Element matches the value of the Time to Live (TTL) field in the IPv4 packet header. For IPv6, the value of the Information Element matches the value of the Hop Limit field in the IPv6 packet header. Abstract Data Type: unsigned8 ElementId: 192 Status: current Units: hops Reference: See RFC 791 for the definition of the IPv4 Time to Live field. See RFC 2460 for the definition of the IPv6 Hop Limit field.5.4.15. protocolIdentifier
Description: The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry. In Internet Protocol version 4 (IPv4), this is carried in the Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet. Abstract Data Type: unsigned8 Data Type Semantics: identifier ElementId: 4 Status: current Reference: See RFC 791 for the specification of the IPv4 protocol field. See RFC 2460 for the specification of the IPv6 protocol field. See the list of protocol numbers assigned by IANA at http://www.iana.org/assignments/protocol-numbers.
5.4.16. nextHeaderIPv6
Description: The value of the Next Header field of the IPv6 header. The value identifies the type of the following IPv6 extension header or of the following IP payload. Valid values are defined in the IANA Protocol Numbers registry. Abstract Data Type: unsigned8 ElementId: 193 Status: current Reference: See RFC 2460 for the definition of the IPv6 Next Header field. See the list of protocol numbers assigned by IANA at http://www.iana.org/assignments/protocol-numbers.5.4.17. ipDiffServCodePoint
Description: The value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services field. The Differentiated Services field spans the most significant 6 bits of the IPv4 TOS field or the IPv6 Traffic Class field, respectively. This Information Element encodes only the 6 bits of the Differentiated Services field. Therefore, its value may range from 0 to 63. Abstract Data Type: unsigned8 Data Type Semantics: identifier ElementId: 195 Status: current Range: The valid range is 0-63. Reference: See RFC 3260 for the definition of the Differentiated Services field. See RFC 1812 (Section 5.3.2) and RFC 791 for the definition of the IPv4 TOS field. See RFC 2460 for the definition of the IPv6 Traffic Class field.5.4.18. ipPrecedence
Description: The value of the IP Precedence. The IP Precedence value is encoded in the first 3 bits of the IPv4 TOS field or the IPv6 Traffic Class field, respectively. This Information Element encodes only these 3 bits. Therefore, its value may range from 0 to 7. Abstract Data Type: unsigned8 Data Type Semantics: identifier ElementId: 196 Status: current
Range: The valid range is 0-7.
Reference:
See RFC 1812 (Section 5.3.3) and RFC 791 for the definition of the
IP Precedence. See RFC 1812 (Section 5.3.2) and RFC 791 for the
definition of the IPv4 TOS field. See RFC 2460 for the definition
of the IPv6 Traffic Class field.
5.4.19. ipClassOfService
Description:
For IPv4 packets, this is the value of the TOS field in the IPv4
packet header. For IPv6 packets, this is the value of the Traffic
Class field in the IPv6 packet header.
Abstract Data Type: unsigned8
Data Type Semantics: identifier
ElementId: 5
Status: current
Reference:
See RFC 1812 (Section 5.3.2) and RFC 791 for the definition of the
IPv4 TOS field. See RFC 2460 for the definition of the IPv6
Traffic Class field.
5.4.20. postIpClassOfService
Description:
The definition of this Information Element is identical to the
definition of Information Element 'ipClassOfService', except that
it reports a potentially modified value caused by a middlebox
function after the packet passed the Observation Point.
Abstract Data Type: unsigned8
Data Type Semantics: identifier
ElementId: 55
Status: current
Reference:
See RFC 791 for the definition of the IPv4 TOS field. See RFC
2460 for the definition of the IPv6 Traffic Class field. See RFC
3234 for the definition of middleboxes.
5.4.21. flowLabelIPv6
Description: The value of the IPv6 Flow Label field in the IP packet header. Abstract Data Type: unsigned32 Data Type Semantics: identifier ElementId: 31 Status: current Reference: See RFC 2460 for the definition of the Flow Label field in the IPv6 packet header.5.4.22. isMulticast
Description: If the IP destination address is not a reserved multicast address, then the value of all bits of the octet (including the reserved ones) is zero. The first bit of this octet is set to 1 if the Version field of the IP header has the value 4 and if the Destination Address field contains a reserved multicast address in the range from 224.0.0.0 to 239.255.255.255. Otherwise, this bit is set to 0. The second and third bits of this octet are reserved for future use. The remaining bits of the octet are only set to values other than zero if the IP Destination Address is a reserved IPv6 multicast address. Then the fourth bit of the octet is set to the value of the T flag in the IPv6 multicast address and the remaining four bits are set to the value of the scope field in the IPv6 multicast address. 0 1 2 3 4 5 6 7 +------+------+------+------+------+------+------+------+ | MCv4 | RES. | RES. | T | IPv6 multicast scope | +------+------+------+------+------+------+------+------+ Bit 0: set to 1 if IPv4 multicast Bits 1-2: reserved for future use Bit 4: set to value of T flag, if IPv6 multicast Bits 4-7: set to value of multicast scope if IPv6 multicast Abstract Data Type: unsigned8 Data Type Semantics: flags ElementId: 206 Status: current
Reference:
See RFC 1112 for the specification of reserved IPv4 multicast
addresses. See RFC 4291 for the specification of reserved IPv6
multicast addresses and the definition of the T flag and the IPv6
multicast scope.
5.4.23. fragmentIdentification
Description:
The value of the Identification field in the IPv4 packet header or
in the IPv6 Fragment header, respectively. The value is 0 for
IPv6 if there is no fragment header.
Abstract Data Type: unsigned32
Data Type Semantics: identifier
ElementId: 54
Status: current
Reference:
See RFC 791 for the definition of the IPv4 Identification field.
See RFC 2460 for the definition of the Identification field in the
IPv6 Fragment header.
5.4.24. fragmentOffset
Description:
The value of the IP fragment offset field in the IPv4 packet
header or the IPv6 Fragment header, respectively. The value is 0
for IPv6 if there is no fragment header.
Abstract Data Type: unsigned16
Data Type Semantics: identifier
ElementId: 88
Status: current
Reference:
See RFC 791 for the specification of the fragment offset in the
IPv4 header. See RFC 2460 for the specification of the fragment
offset in the IPv6 Fragment header.
5.4.25. fragmentFlags
Description:
Fragmentation properties indicated by flags in the IPv4 packet
header or the IPv6 Fragment header, respectively.
Bit 0: (RS) Reserved.
The value of this bit MUST be 0 until specified
otherwise.
Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment.
Corresponds to the value of the DF flag in the
IPv4 header. Will always be 0 for IPv6 unless
a "don't fragment" feature is introduced to IPv6.
Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments.
Corresponds to the MF flag in the IPv4 header
or to the M flag in the IPv6 Fragment header,
respectively. The value is 0 for IPv6 if there
is no fragment header.
Bits 3-7: (DC) Don't Care.
The values of these bits are irrelevant.
0 1 2 3 4 5 6 7
+---+---+---+---+---+---+---+---+
| R | D | M | D | D | D | D | D |
| S | F | F | C | C | C | C | C |
+---+---+---+---+---+---+---+---+
Abstract Data Type: unsigned8
Data Type Semantics: flags
ElementId: 197
Status: current
Reference:
See RFC 791 for the specification of the IPv4 fragment flags. See
RFC 2460 for the specification of the IPv6 Fragment header.
5.4.26. ipHeaderLength
Description:
The length of the IP header. For IPv6, the value of this
Information Element is 40.
Abstract Data Type: unsigned8
ElementId: 189
Status: current
Units: octets
Reference:
See RFC 791 for the specification of the IPv4 header. See RFC
2460 for the specification of the IPv6 header.
5.4.27. ipv4IHL
Description:
The value of the Internet Header Length (IHL) field in the IPv4
header. It specifies the length of the header in units of 4
octets. Please note that its unit is different from most of the
other Information Elements reporting length values.
Abstract Data Type: unsigned8
ElementId: 207
Status: current
Units: 4 octets
Reference:
See RFC 791 for the specification of the IPv4 header.
5.4.28. totalLengthIPv4
Description:
The total length of the IPv4 packet.
Abstract Data Type: unsigned16
ElementId: 190
Status: current
Units: octets
Reference:
See RFC 791 for the specification of the IPv4 total length.
5.4.29. ipTotalLength
Description:
The total length of the IP packet.
Abstract Data Type: unsigned64
ElementId: 224
Status: current
Units: octets
Reference:
See RFC 791 for the specification of the IPv4 total length. See
RFC 2460 for the specification of the IPv6 payload length. See
RFC 2675 for the specification of the IPv6 jumbo payload length.
5.4.30. payloadLengthIPv6
Description:
This Information Element reports the value of the Payload Length
field in the IPv6 header. Note that IPv6 extension headers belong
to the payload. Also note that in case of a jumbo payload option
the value of the Payload Length field in the IPv6 header is zero
and so will be the value reported by this Information Element.
Abstract Data Type: unsigned16
ElementId: 191
Status: current
Units: octets
Reference:
See RFC 2460 for the specification of the IPv6 payload length.
See RFC 2675 for the specification of the IPv6 jumbo payload
option.
(next page on part 3)
