Subject: [ipfix] Re: Information Model

From: Benoit Claise <[email-masked]>
Date: Wed, 6 Feb 2002 11:31:12 +0100 (CET)

Hi,

These are the information fields that Ganesh and I were thinking of in our document, which BTW has been sent to the editor (we're still waiting for an answer).

Note: as I understood from Dave Plonka, all discussions must be moved to the generic ipfix mailing list.

Regards, Benoit.

   Field Type                 Value   Length  Description

   IN_BYTES_32                  1       4     32-bit counter for bytes
                                              associated with an IP Flow

   IN_PKTS_32                   2       4     32-bit counter for packets
                                              associated with an IP Flow

   FLOWS                        3       4     Number of main cache flows
                                              that were aggregated

   PROT                         4       1     IP protocol byte.

   TOS                          5       1     Type of service byte

   TCP_FLAGS                    6       1     TCP Flags (cumulative OR
                                              of TCP flags)

                                              TCP/UDP source port
   L4_SRC_PORT                  7       2     number (.e.g, FTP, Telnet,
                                              etc...)

   IPV4_SRC_ADDR                8       4     Source IPv4 Address

   SRC_MASK                     9       1     source route's mask bits

   INPUT_SNMP                   10      2     Input interface index

                                              TCP/UDP destination port
   L4_DST_PORT                  11      2     number (.e.g, FTP, Telnet,
                                              etc...)

   IPV4_DST_ADDR                12      4     Destination IPv4 Address

   DST_MASK                     13      1     destination route's mask
                                              Bits

   OUTPUT_SNMP                  14      2     Output interface index

   IPV4_NEXT_HOP                15      4     Next hop router's IPv4
                                              Address

   SRC_AS                       16      4     Source BGP Autonomous
                                              System Number

   DST_AS                       17      4     Destination BGP Autonomous
                                              System Number

   BGP_NEXT_HOP                 18      4     Next-hop router in the BGP
                                              domain

   IPM_DPKTS                    19      4     Packet count for IP
                                              Multicast

   IPM_DOCTETS                  20      4     Octet (byte) count for IP
                                              Multicast

                                              SysUptime at which the
   LAST_SWITCHED                21      4     last packet of this flow
                                              was switched

                                              SysUptime at which the
   FIRST_SWITCHED               22      4     first packet of this flow
                                              was switched

   IN_BYTES_64                  23      8     64-bit counter for bytes
                                              associated with an IP Flow

   IN_PKTS_64                   24      8     64-bit counter for packets
                                              associated with an IP Flow

   MAC_ADDR                     25      6     Layer 2 Media Access
                                              Control address associated
                                              with a flow

   VLAN_ID                      26      2     Virtual LAN identifier
                                              associated with a flow

   IPV6_SRC_ADDR                27      16    IPv6 Source Address

   IPV6_DST_ADDR                28      16    IPv6 Destination Address

   IPV6_SRC_MASK                29      1     IPv6 Source Mask

   IPV6_DST_MASK                30      1     IPv6 Destination Mask

   FLOW_LABEL                   31      2     IPV6 Flow Label

                                              ICMP Packet Type. This is
   ICMP_TYPE                    32      1     reported as (ICMP Type *
                                              256) + ICMP code

   IGMP_TYPE                    33      1     IGMP Packet Type

                                              When using Sampling,
                                              the rate at which
                                              packets are sampled. For
   SAMPLING_INTERVAL            34      1     example, a value of 100
                                              indicates that one of
                                              every hundred packets is
                                              sampled.

                                              The type of algorithm used
                                              for sampling data.
                                              Currently, the only
                                              sampling algorithm defined
   SAMPLING_ALGO                35      1     is:
                                              0x02 packet-sampling

                                              Timeout value for active
   FLOW_ACTIVE_TIMEOUT          36      2     flow entries in the
                                              cache.

                                              Timeout value for inactive
   FLOW_INACTIVE_TIMEOUT        37      2     flow entries in the
                                              cache.

   OUT_BYTES_32                 38      4     32-bit counter for bytes
                                              associated with an IP Flow

   OUT_PKTS_32                  39      4     32-bit counter for packets
                                              associated with an IP Flow

   OUT_BYTES_64                 40      8     64-bit counter for bytes
                                              associated with an IP Flow

   OUT_PKTS_64                  41      8     64-bit counter for packets
                                              associated with an IP Flow
                                              inside TCP/UDP destination

   INSIDE_L4_SRC                42      2     port number (.e.g, FTP,
                                              Telnet, etc...)
                                              only applicable with NAT

   INSIDE_IPV4_SRC_ADDR         43      4     Source IPv4 Address
                                              only applicable with NAT

                                              TCP/UDP destination port
   INSIDE_L4_DST_PORT           44      2     number (.e.g, FTP, telnet
                                              etc...)
                                              only applicable with NAT

   INSIDE_IPV4_DST_ADDR         45      4     Destination IPv4 Address
                                              only applicable with NAT

   INSIDE_IPV6_SRC_ADDR         46      16    IPv6 Source Address
                                              only applicable with NAT

   INSIDE_IPV6_DST_ADDR         47      16    IPv6 Destination Address
                                              only applicable with NAT

                                              TCP/UDP destination port
   OUTSIDE_L4_SRC_PORT          48       2    number (.e.g, FTP, Telnet,
                                              etc...)
                                              only applicable with NAT

   OUTSIDE_IPV4_SRC_ADDR        49       4    Source IPv4 Address

                                              only applicable with NAT
                                              TCP/UDP destination port
   OUTSIDE_L4_DST_PORT          50       2    number (.e.g, FTP, Telnet,
                                              etc...)
                                              only applicable with NAT

   OUTSIDE_IPV4_DST_ADDR        51       4    Destination IPv4 Address
                                              only applicable with NAT

   OUTSIDE_IPV6_SRC_ADDR        52       16   IPv6 Source Address
                                              only applicable with NAT

   OUTSIDE_IPV6_DST_ADDR        53       16   IPv6 Destination Address
                                              only applicable with NAT

   Flow Direction               54       1    The direction of the flow
                                              observed at the
                                              observation point. If the
                                              observation point is a set
                                              of interface(s) the
                                              direction is w.r.t the
                                              wire.

   The "Value" column in the above table is a numeric identifier for the
   field type.

   When extensibility is needed (when new technologies are defined or
   when some new field types are needed), the newly added field types
   MUST be added to the list. They MUST be defined by the exporter and
   understood by the collector.

Regards, Benoit.

> 
> >>>>> "k" == kcn  <[email-masked]> writes:
> > That is the document.  As I clarified myself earlier, I think this
> > document is overkill for what we need but it has great information
> > we can work from and extract.
> 
> Agree - it's a good document to start from.
> 
> I'd suggest sticking to the flow attributes/IEs that are mentioned in
> the requirements draft (draft-ietf-ipfix-reqs-00.txt) for now, and try
> to define as clearly as possible what each attribute's value should
> represent.
> 
> I expect that as we do this, we will understand some fundamental
> categorizations of flow attributes, for example
> 
> * attributes that can be derived directly from packet fields
> * attributes that can be derived from other observables, such as the
>   time of observation, or the input interface ("observation point")
> * attributes that can be derived from other state (e.g. routing
>   tables), such as the output interface or "AS" information.
> 
> or
> 
> * attributes that form a part of the flow "key"
> * attributes that are combined from multiple packets (e.g. "bitwise
>   inclusive OR of the TCP flags of all TCP segments in a flow")
> * attributes that are only computed when the flow is created, or when
>   the flow is exported
> 
> Hopefully we can turn such categorizations (where deemed useful) into
> re-usable terminology that could go into an introductory section of
> this document, or into an architecture/terminology document.
> 
> In the description of the specific flow aggregates, we should try to
> talk in terms of data types such as "an unsigned integer between 0 and
> 255" (e.g. for an "IP protocol" attribute), but avoid anything that is
> related to a specific encoding.
> -- 
> Simon Leinen				       [email-masked]
> SWITCH				   http://www.switch.ch/misc/leinen/
> 
> 	       Computers hate being anthropomorphized.
> 

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/