| Network Working Group | A. Yourtchenko |
| Internet-Draft | P. Aitken |
| Intended status: Informational | B. Claise |
| Expires: July 19, 2014 | Cisco Systems, Inc. |
| January 15, 2014 |
Cisco Specific Information Elements reused in IPFIX
draft-yourtchenko-cisco-ies-09
This document describes some additional Information Elements of Cisco Systems, Inc. that are not listed in RFC3954.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on July 19, 2014.
Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
The section 4 of [RFC7012] defines the IPFIX Information Elements in the range of 1-127 to be compatible with the NetFlow version 9 fields, as specified in the "Cisco Systems NetFlow Services Export Version 9" [RFC3954]. As [RFC3954] was specified in 2004, it does not contain all NetFlow version 9 specific fields in the range 1-127. The question was asked whether IPFIX Devices should exclusively report the IPFIX IANA IEs [IPFIX-IANA] ? In other words, when upgrading from a NetFlow metering process to an IPFIX Metering Process, should the IPFIX Devices stop reporting NetFlow version 9 specific IEs that were not registered in IANA [IPFIX-IANA] ?
This document is intended to fill the gap in this IE range. That way, IPFIX implementations could export all the IEs specified in IANA, regardless of the range.
IPFIX-specific terminology used in this document is defined in Section 2 of [RFC7011]. As in [RFC7011], these IPFIX-specific terms have the first letter of a word capitalized when used in this document.
The following Information Elements are discussed in the sections below:
| ID | Name | ID | Name |
|---|---|---|---|
| 84 | samplerName | ||
| 34 | samplingInterval | 87 | flagsAndSamplerId |
| 35 | samplingAlgorithm | 89 | forwardingStatus |
| 38 | engineType | 92 | srcTrafficIndex |
| 39 | engineId | 93 | dstTrafficIndex |
| 43 | ipv4RouterSc | 100 | className |
| 48 | samplerId | 102 | layer2packetSectionOffset |
| 49 | samplerMode | 103 | layer2packetSectionSize |
| 50 | samplerRandomInterval | 104 | layer2packetSectionData |
| 51 | classId |
The values are not compatible with the selectorAlgorithm IE, where "Deterministic" has been replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion is required, see
PSAMP parameters [PSAMP-IANA].
Reserved for internal use on the collector.
The basic encoding is 8 bits. The future extensions
could add one or three bytes. The layout of the basic
encoding is as follows:
MSB - 0 1 2 3 4 5 6 7 - LSB
+---+---+---+---+---+---+---+---+
| Status| Reason code or flags |
+---+---+---+---+---+---+---+---+
Status:
00b = Unknown
01b = Forwarded
10b = Dropped
11b = Consumed
Reason Code (status = 01b, Forwarded)
01 000000b = 64 = Unknown
01 000001b = 65 = Fragmented
01 000010b = 66 = Not Fragmented
Reason Code (status = 10b, Dropped)
10 000000b = 128 = Unknown
10 000001b = 129 = ACL deny
10 000010b = 130 = ACL drop
10 000011b = 131 = Unroutable
10 000100b = 132 = Adjacency
10 000101b = 133 = Fragmentation and DF set
10 000110b = 134 = Bad header checksum
10 000111b = 135 = Bad total Length
10 001000b = 136 = Bad header length
10 001001b = 137 = bad TTL
10 001010b = 138 = Policer
10 001011b = 139 = WRED
10 001100b = 140 = RPF
10 001101b = 141 = For us
10 001110b = 142 = Bad output interface
10 001111b = 143 = Hardware
Reason Code (status = 11b, Consumed)
11 000000b = 192 = Unknown
11 000001b = 193 = Punt Adjacency
11 000010b = 194 = Incomplete Adjacency
11 000011b = 195 = For us
Examples:
value : 0x40 = 64
binary: 01000000
decode: 01 -> Forward
000000 -> No further information
value : 0x89 = 137
binary: 10001001
decode: 10 -> Drop
001001 -> Fragmentation and DF set
ElementId: 65 .. 69
Performance metrics will need a consolidation in the industry, based on RFC6390. Once this consolidation happens, via a separate document the IEs 65-69 will either be assigned in the IANA registry or their status will be deprecated.
ElementId: 101
ElementId: 94 .. 97
Please refer to the RFC 6759 [RFC6759]
ElementId: 105..126
These element IDs are not covered by this draft and left "as is", i.e. for Netflow v9 compatibility.
This document specifies several new IPFIX Information Elements in the IPFIX Information Element registry as defined in Section 3 above. The following Information Elements must be assigned:
This document specifies the definitions of several Information Elements and does not alter the security considerations of the base protocol. Please refer to the security considerations sections of RFC 3954 [RFC3954] and RFC 7012 [RFC7012].
However, the export of the sections of the packet payload may unintentionally change the security assumptions of other protocols.
| [RFC7011] | Claise, B., Trammell, B. and P. Aitken, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information", STD 77, RFC 7011, September 2013. |
| [RFC3954] | Claise, B., "Cisco Systems NetFlow Services Export Version 9", RFC 3954, October 2004. |
| [RFC6759] | Claise, B., Aitken, P. and N. Ben-Dvora, "Cisco Systems Export of Application Information in IP Flow Information Export (IPFIX)", RFC 6759, November 2012. |
| [RFC7012] | Claise, B. and B. Trammell, "Information Model for IP Flow Information Export (IPFIX)", RFC 7012, September 2013. |
| [PSAMP-IANA] | IANA, "Packet Sampling (PSAMP) Parameters", 2013. |
| [IPFIX-IANA] | IANA, "IP Flow Information Export (IPFIX) Entities", 2013. |
| [CCO-NF9FMT] | Cisco, "NetFlow version 9 Flow-Record format", 2011. |
| [CCO-BGPPOL] | Cisco, "BGP Policy Accounting and BGP Policy Accounting Output Interface Accounting Features", 2005. |
| [CCO-MLS] | Cisco, "IP MultiLayer Switching Sample Configuration", 2007. |
<?xml version="1.0" encoding="UTF-8"?>
<fieldDefinitions xmlns="urn:ietf:params:xml:ns:ipfix-info"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:ietf:params:xml:ns:ipfix-info
ipfix-info.xsd">
<field name="samplingInterval" dataType="unsigned32"
group=""
dataTypeSemantics="quantity"
elementId="34" applicability="flow" status="deprecated">
<description>
<paragraph>
Deprecated in favor of 305 samplingPacketInterval. When using
sampled NetFlow, the rate at which packets are sampled - e.g. a
value of 100 indicates that one of every 100 packets is sampled.
</paragraph>
</description>
</field>
<field name="samplingAlgorithm" dataType="unsigned8"
group=""
dataTypeSemantics="identifier"
elementId="35" applicability="flow" status="deprecated">
<description>
<paragraph>
Deprecated in favor of 304 selectorAlgorithm. The type of
algorithm used for sampled NetFlow: 1 - Deterministic Sampling;
2 - Random Sampling. The values are not compatible with the
selectorAlgorithm IE, where "Deterministic" has been replaced by
"Systematic count-based" (1) or "Systematic time-based" (2), and
"Random" is (3). Conversion is required, see
<REF:PSAMP-IANA>PSAMP parameters.
</paragraph>
</description>
</field>
<field name="engineType" dataType="unsigned8"
group=""
dataTypeSemantics="identifier"
elementId="38" applicability="flow" status="deprecated">
<description>
<paragraph>
Type of flow switching engine in a router/switch: RP = 0,
VIP/Line card = 1, PFC/DFC = 2. Reserved for internal use on the
collector.
</paragraph>
</description>
</field>
<field name="engineId" dataType="unsigned8"
group=""
dataTypeSemantics="identifier"
elementId="39" applicability="flow" status="deprecated">
<description>
<paragraph>
VIP or line card slot number of the flow switching engine in a
router/switch. Reserved for internal use on the collector.
</paragraph>
</description>
</field>
<field name="ipv4RouterSc" dataType="ipv4Address"
group=""
dataTypeSemantics="identifier"
elementId="43" applicability="flow" status="deprecated">
<description>
<paragraph>
This is a platform-specific field for Catalyst 5000/Catalyst
6000 family. It is used to store the address of a router that is
being shortcut when performing MultiLayer Switching.
</paragraph>
</description>
<reference>
http://www
.cisco.com
/en/US/pro
ducts/hw/s
witches/ps
700/products_configuration_example09186a00800ab513.shtml
describes the MultiLayer Switching.
</reference>
</field>
<field name="samplerId" dataType="unsigned8"
group=""
dataTypeSemantics="identifier"
elementId="48" applicability="flow" status="deprecated">
<description>
<paragraph>
Deprecated in favor of 302 selectorId. The unique identifier
associated with samplerName.
</paragraph>
</description>
</field>
<field name="samplerMode" dataType="unsigned8"
group=""
dataTypeSemantics="identifier"
elementId="49" applicability="flow" status="deprecated">
<description>
<paragraph>
Deprecated in favor of 304 selectorAlgorithm. The values are not
compatible: selectorAlgorithm=3 is random sampling. The type of
algorithm used for sampling data: 1 - deterministic, 2 - random
sampling. Use with samplerRandomInterval.
</paragraph>
</description>
</field>
<field name="samplerRandomInterval" dataType="unsigned32"
group=""
dataTypeSemantics="quantity"
elementId="50" applicability="flow" status="deprecated">
<description>
<paragraph>
Deprecated in favour of 305 samplingPacketInterval. Packet
interval at which to sample - in case of random sampling. Used
in connection with samplerMode 0x02 (random sampling) value.
</paragraph>
</description>
</field>
<field name="classId" dataType="unsigned8"
group=""
dataTypeSemantics="identifier"
elementId="51" applicability="flow" status="deprecated">
<description>
<paragraph>
Deprecated in favour of 302 selectorId. Characterizes the
traffic class, i.e. QoS treatment.
</paragraph>
</description>
</field>
<field name="samplerName" dataType="string"
group=""
dataTypeSemantics=""
elementId="84" applicability="flow" status="deprecated">
<description>
<paragraph>
Deprecated in favor of 335 selectorName. Name of the flow
sampler.
</paragraph>
</description>
</field>
<field name="flagsAndSamplerId" dataType="unsigned32"
group=""
dataTypeSemantics="identifier"
elementId="87" applicability="flow" status="deprecated">
<description>
<paragraph>
Flow flags and the value of the sampler ID (samplerId) combined
in one bitmapped field. Reserved for internal use on the
collector.
</paragraph>
</description>
</field>
<field name="forwardingStatus" dataType="unsigned32"
group=""
dataTypeSemantics="identifier"
elementId="89" applicability="flow" status="current">
<description>
<paragraph>
This Information Element describes the forwarding status of the
flow and any attached reasons. The Reduced Size Encoding rules
as per <REF:RFC7011> apply.
</paragraph>
<artwork>
The basic encoding is 8 bits. The future extensions
could add one or three bytes. The layout of the basic
encoding is as follows:
MSB - 0 1 2 3 4 5 6 7 - LSB
+---+---+---+---+---+---+---+---+
| Status| Reason code or flags |
+---+---+---+---+---+---+---+---+
Status:
00b = Unknown
01b = Forwarded
10b = Dropped
11b = Consumed
Reason Code (status = 01b, Forwarded)
01 000000b = 64 = Unknown
01 000001b = 65 = Fragmented
01 000010b = 66 = Not Fragmented
Reason Code (status = 10b, Dropped)
10 000000b = 128 = Unknown
10 000001b = 129 = ACL deny
10 000010b = 130 = ACL drop
10 000011b = 131 = Unroutable
10 000100b = 132 = Adjacency
10 000101b = 133 = Fragmentation and DF set
10 000110b = 134 = Bad header checksum
10 000111b = 135 = Bad total Length
10 001000b = 136 = Bad header length
10 001001b = 137 = bad TTL
10 001010b = 138 = Policer
10 001011b = 139 = WRED
10 001100b = 140 = RPF
10 001101b = 141 = For us
10 001110b = 142 = Bad output interface
10 001111b = 143 = Hardware
Reason Code (status = 11b, Consumed)
11 000000b = 192 = Unknown
11 000001b = 193 = Punt Adjacency
11 000010b = 194 = Incomplete Adjacency
11 000011b = 195 = For us
Examples:
value : 0x40 = 64
binary: 01000000
decode: 01 -> Forward
000000 -> No further information
value : 0x89 = 137
binary: 10001001
decode: 10 -> Drop
001001 -> Fragmentation and DF set
</artwork>
</description>
<reference>
See http:/
/www.cisco
.com/en/US
/technolog
ies/tk648/tk362/technologies_white_paper09186a00800a3db9.html -
NetFlow Version 9 Record Format.
</reference>
</field>
<field name="srcTrafficIndex" dataType="unsigned32"
group=""
dataTypeSemantics="identifier"
elementId="92" applicability="flow" status="current">
<description>
<paragraph>
BGP Policy Accounting Source Traffic Index
</paragraph>
</description>
<reference>
BGP policy accounting as described in
http://www
.cisco.com
/en/US/tech/tk365/technologies_tech_note09186a0080094e88.shtml
</reference>
</field>
<field name="dstTrafficIndex" dataType="unsigned32"
group=""
dataTypeSemantics="identifier"
elementId="93" applicability="flow" status="current">
<description>
<paragraph>
BGP Policy Accounting Destination Traffic Index
</paragraph>
</description>
<reference>
BGP policy accounting as described in
http://www
.cisco.com
/en/US/tech/tk365/technologies_tech_note09186a0080094e88.shtml
</reference>
</field>
<field name="className" dataType="string"
group=""
dataTypeSemantics=""
elementId="100" applicability="flow" status="deprecated">
<description>
<paragraph>
Deprecated in favor of 335 selectorName. Traffic Class Name,
associated with the classId Information Element.
</paragraph>
</description>
</field>
<field name="layer2packetSectionOffset" dataType="unsigned16"
group=""
dataTypeSemantics="quantity"
elementId="102" applicability="flow" status="deprecated">
<description>
<paragraph>
Deprecated in favor of 409 sectionOffset.
Layer 2 packet section offset. Potentially a generic packet
section offset.
</paragraph>
</description>
</field>
<field name="layer2packetSectionSize" dataType="unsigned16"
group=""
dataTypeSemantics="quantity"
elementId="103" applicability="flow" status="deprecated">
<description>
<paragraph>
Deprecated in favor of 312 dataLinkFrameSize.
Layer 2 packet section size. Potentially a generic packet
section size.
</paragraph>
</description>
</field>
<field name="layer2packetSectionData" dataType="octetArray"
group=""
dataTypeSemantics=""
elementId="104" applicability="flow" status="deprecated">
<description>
<paragraph>
Deprecated in favor of 315 dataLinkFrameSection.
Layer 2 packet section data.
</paragraph>
</description>
</field>
</fieldDefinitions>
To be removed by RFC Editor before publication
01: initial revision presented at the IETF meeting.
02: removed "flow" from flowSamplerId, flowSamplerMode, and flowSamplerRandomInterval; updated the related drafts in references; added the "reference" column to the XML definitions; renamed fsFlowEntryTotalCount into deltaFlowCount to keep the naming in sync with draft-trammell-ipfix-a9n. Also minor changes to formatting and added the IE overview table.
03: updated the references to draft-claise-export-application-info-in-ipfix, slightly tweaked the title and removed the unused reference to draft-ietf-ipfix-flow-selection-tech.
04: sync the references.
05: update references to draft-claise-export-application-info-in-ipfix with reference to rfc6759, draft-trammell-ipfix-a9n to draft-ietf-ipfix-a9n, draft-kashima-ipfix-data-link-layer-monitoring to draft-ietf-ipfix-data-link-layer-monitoring.
06: sync the references.
07: Update per comment from Andrew Feren - change semantics of ipv4RouterSc to "identifier" and remove deltaFlowCount as it made it to IANA. Update references RFC5101 to RFC7011, draft-ietf-ipfix-data-link-layer-monitoring from -03 to -04.
08: restore the 84 samplerName after its accidental deletion from table 1 in -07; mark 101-103 IEs as deprecated, include the paragraph on IE 105..126 that are not discussed in this draft.
09: now that IANA assigned the IPFIX Information Elements in draft-ietf-ipfix-data-link-layer-monitoring, this draft is updated to simplify IANA's/editor's work, with changes as follows. TBD02 became 409 as sectionOffset is now assigned by IANA. Removed "EDITOR's NOTE" for layer2packetSectionOffset, layer2packetSectionSize, layer2packetSectionData, ietf-ipfix-data-link-layer-monitoring.