Internet Engineering Task Force (IETF) A. Kobayashi
Request for Comments: 6183 NTT
Updates: 5470 B. Claise
Category: Informational Cisco Systems, Inc.
ISSN: 2070-1721 G. Muenz
TU Muenchen
K. Ishibashi
NTT
April 2011
Internet Engineering Task Force (IETF) A. Kobayashi
Request for Comments: 6183 NTT
Updates: 5470 B. Claise
Category: Informational Cisco Systems, Inc.
ISSN: 2070-1721 G. Muenz
TU Muenchen
K. Ishibashi
NTT
April 2011
IP Flow Information Export (IPFIX) Mediation: Framework
IP流信息导出（IPFIX）中介：框架
Abstract
摘要
This document describes a framework for IP Flow Information Export (IPFIX) Mediation. This framework extends the IPFIX reference model specified in RFC 5470 by defining the IPFIX Mediator components.
本文档描述了IP流信息导出（IPFIX）中介的框架。该框架通过定义IPFIX中介组件来扩展RFC 5470中指定的IPFIX参考模型。
Status of This Memo
关于下段备忘
This document is not an Internet Standards Track specification; it is published for informational purposes.
本文件不是互联网标准跟踪规范；它是为了提供信息而发布的。
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are a candidate for any level of Internet Standard; see Section 2 of RFC 5741.
本文件是互联网工程任务组（IETF）的产品。它代表了IETF社区的共识。它已经接受了公众审查，并已被互联网工程指导小组（IESG）批准出版。并非IESG批准的所有文件都适用于任何级别的互联网标准；见RFC 5741第2节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6183.
有关本文件当前状态、任何勘误表以及如何提供反馈的信息，请访问http://www.rfc-editor.org/info/rfc6183.
Copyright Notice
版权公告
Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有（c）2011 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must
本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(http://trustee.ietf.org/license-info)自本文件出版之日起生效。请仔细阅读这些文件，因为它们描述了您对本文件的权利和限制。从该文档中提取的代码组件必须
include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
包括信托法律条款第4.e节中所述的简化BSD许可证文本，且不提供简化BSD许可证中所述的担保。
Table of Contents
目录
1. Introduction ....................................................3
2. Terminology and Definitions .....................................3
3. IPFIX/PSAMP Documents Overview ..................................6
3.1. IPFIX Documents Overview ...................................6
3.2. PSAMP Documents Overview ...................................6
4. IPFIX Mediation Reference Model .................................7
5. IPFIX Mediation Functional Blocks ..............................12
5.1. Collecting Process ........................................12
5.2. Exporting Process .........................................13
5.3. Intermediate Process ......................................13
5.3.1. Data Record Expiration .............................14
5.3.2. Specific Intermediate Processes ....................14
6. Component Combination ..........................................20
6.1. Data-Based Collector Selection ............................20
6.2. Flow Selection and Aggregation ............................21
6.3. IPFIX File Writer/Reader ..................................22
7. Encoding for IPFIX Message Header ..............................22
8. Information Model ..............................................24
9. Security Considerations ........................................24
9.1. Avoiding Security Level Downgrade .........................25
9.2. Avoiding Security Level Upgrade ...........................25
9.3. Approximating End-to-End Assertions for IPFIX Mediators ...26
9.4. Multiple Tenancy ..........................................26
10. References ....................................................27
10.1. Normative References .....................................27
10.2. Informative References ...................................27
11. Acknowledgements ..............................................29
1. Introduction ....................................................3
2. Terminology and Definitions .....................................3
3. IPFIX/PSAMP Documents Overview ..................................6
3.1. IPFIX Documents Overview ...................................6
3.2. PSAMP Documents Overview ...................................6
4. IPFIX Mediation Reference Model .................................7
5. IPFIX Mediation Functional Blocks ..............................12
5.1. Collecting Process ........................................12
5.2. Exporting Process .........................................13
5.3. Intermediate Process ......................................13
5.3.1. Data Record Expiration .............................14
5.3.2. Specific Intermediate Processes ....................14
6. Component Combination ..........................................20
6.1. Data-Based Collector Selection ............................20
6.2. Flow Selection and Aggregation ............................21
6.3. IPFIX File Writer/Reader ..................................22
7. Encoding for IPFIX Message Header ..............................22
8. Information Model ..............................................24
9. Security Considerations ........................................24
9.1. Avoiding Security Level Downgrade .........................25
9.2. Avoiding Security Level Upgrade ...........................25
9.3. Approximating End-to-End Assertions for IPFIX Mediators ...26
9.4. Multiple Tenancy ..........................................26
10. References ....................................................27
10.1. Normative References .....................................27
10.2. Informative References ...................................27
11. Acknowledgements ..............................................29
The IP Flow Information Export (IPFIX) architectural components in [RFC5470] consist of IPFIX Devices and IPFIX Collectors communicating using the IPFIX protocol. Due to the sustained growth of IP traffic in heterogeneous network environments, this Exporter-Collector architecture may lead to scalability problems. In addition, it does not provide the flexibility required by a wide variety of measurement applications. A detailed descriptions of these problems is given in [RFC5982].
[RFC5470]中的IP流信息导出（IPFIX）体系结构组件由使用IPFIX协议进行通信的IPFIX设备和IPFIX收集器组成。由于异构网络环境中IP流量的持续增长，这种导出器-收集器体系结构可能会导致可伸缩性问题。此外，它不能提供多种测量应用所需的灵活性。[RFC5982]中给出了这些问题的详细描述。
To fulfill application requirements with limited system resources, the IPFIX architecture needs to introduce an intermediate entity between Exporters and Collectors. From a data manipulation point of view, this intermediate entity may provide the aggregation, correlation, filtering, and modification of Flow Records and/or Packet Sampling (PSAMP) Packet Reports to save measurement system resources and to perform preprocessing tasks for the Collector. From a protocol conversion point of view, this intermediate entity may provide conversion into IPFIX, or conversion of IPFIX transport protocols (e.g., from UDP to the Stream Control Transmission Protocol (SCTP)) to improve the export reliability.
为了用有限的系统资源满足应用程序需求，IPFIX体系结构需要在导出器和收集器之间引入一个中间实体。从数据操作的角度来看，该中间实体可以提供流记录和/或数据包采样（PSAMP）数据包报告的聚合、关联、过滤和修改，以节省测量系统资源并为收集器执行预处理任务。从协议转换的角度来看，该中间实体可提供到IPFIX的转换，或IPFIX传输协议的转换（例如，从UDP到流控制传输协议（SCTP））以提高导出可靠性。
This document introduces a generalized concept for such intermediate entities and describes the high-level architecture of IPFIX Mediation, key IPFIX Mediation architectural components, and characteristics of IPFIX Mediation.
本文档介绍了此类中间实体的一般概念，并描述了IPFIX中介的高级体系结构、关键IPFIX中介体系结构组件以及IPFIX中介的特征。
This document is structured as follows: Section 2 describes the terminology used in this document, Section 3 gives an IPFIX/PSAMP document overview, Section 4 describes a high-level reference model, Section 5 describes functional features related to IPFIX Mediation, Section 6 describes combinations of components along with some application examples, Section 7 describes consideration points of the encoding for IPFIX Message Headers, Section 8 describes the Information Elements used in an IPFIX Mediator, and Section 9 describes the security issues raised by IPFIX Mediation.
本文档的结构如下：第2节描述了本文档中使用的术语，第3节给出了IPFIX/PSAMP文档概述，第4节描述了高级参考模型，第5节描述了与IPFIX中介相关的功能特性，第6节描述了组件的组合以及一些应用程序示例，第7节描述了IPFIX消息头编码的考虑点，第8节描述了IPFIX中介中使用的信息元素，第9节描述了IPFIX中介引起的安全问题。
The IPFIX-specific and PSAMP-specific terminology used in this document is defined in [RFC5101] and [RFC5476], respectively. The IPFIX-Mediation-specific terminology used in this document is defined in [RFC5982]. However, as reading the problem statements document is not a prerequisite to reading this framework document, the definitions have been reproduced here along with additional definitions. In this document, as in [RFC5101] and [RFC5476], the first letter of each IPFIX-specific and PSAMP-specific term is
本文件中使用的特定于IPFIX和特定于PSAMP的术语分别在[RFC5101]和[RFC5476]中定义。[RFC5982]中定义了本文档中使用的IPFIX中介特定术语。但是，由于阅读问题陈述文件不是阅读本框架文件的先决条件，因此，此处已将这些定义与其他定义一起复制。在本文件中，与[RFC5101]和[RFC5476]一样，每个特定于IPFIX和PSAMP的术语的第一个字母为
capitalized along with the IPFIX-Mediation-specific terms defined here. The use of the terms "must", "should", and "may" in this document is informational only.
与此处定义的IPFIX中介特定术语一起大写。本文件中使用的术语“必须”、“应该”和“可能”仅供参考。
In this document, we use the term "record stream" to mean a stream of records carrying flow-based or packet-based information. The records may be encoded as IPFIX Data Records or in any other format.
在本文档中，我们使用术语“记录流”来表示承载基于流或基于包的信息的记录流。这些记录可以编码为IPFIX数据记录或任何其他格式。
Transport Session Information
传输会话信息
The Transport Session Information contains information that allows the identification of an individual Transport Session as defined in [RFC5101]. If SCTP is used as transport protocol, the Transport Session Information identifies the SCTP association. If TCP or UDP is used as transport protocol, the Transport Session Information corresponds to the 5-tuple {Exporter IP address, Collector IP address, Exporter transport port, Collector transport port, transport protocol}. The Transport Session Information may include further details about how Transport Layer Security (TLS) [RFC5246] or Datagram Transport Layer Security (DTLS) [RFC4347] is used for encryption and authentication.
传输会话信息包含允许识别[RFC5101]中定义的单个传输会话的信息。如果将SCTP用作传输协议，则传输会话信息将标识SCTP关联。如果TCP或UDP用作传输协议，则传输会话信息对应于5元组{导出器IP地址、收集器IP地址、导出器传输端口、收集器传输端口、传输协议}。传输会话信息可以包括关于如何将传输层安全性（TLS）[RFC5246]或数据报传输层安全性（DTLS）[RFC4347]用于加密和认证的进一步细节。
Original Exporter
原始出口商
An Original Exporter is an IPFIX Device that hosts the Observation Points where the metered IP packets are observed.
原始导出器是一个IPFIX设备，它承载观测点，在观测点上观测经过计量的IP数据包。
IPFIX Mediation
IPFIX调解
IPFIX Mediation is the manipulation and conversion of a record stream for subsequent export using the IPFIX protocol.
IPFIX中介是使用IPFIX协议操纵和转换记录流以进行后续导出。
The following terms are used in this document to describe the architectural entities used by IPFIX Mediation.
本文档中使用以下术语来描述IPFIX中介使用的体系结构实体。
Intermediate Process
中间过程
An Intermediate Process takes a record stream as its input from Collecting Processes, Metering Processes, IPFIX File Readers, other Intermediate Processes, or other record sources; performs some transformations on this stream based upon the content of each record, states maintained across multiple records, or other data sources; and passes the transformed record stream as its output to Exporting Processes, IPFIX File Writers, or other Intermediate Processes in order to perform IPFIX Mediation. Typically, an Intermediate Process is hosted by an IPFIX Mediator. Alternatively, an Intermediate Process may be hosted by an Original Exporter.
中间进程从收集进程、计量进程、IPFIX文件读取器、其他中间进程或其他记录源获取记录流作为其输入；根据每个记录的内容、跨多个记录维护的状态或其他数据源对此流执行一些转换；并将转换后的记录流作为其输出传递给导出进程、IPFIX文件编写器或其他中间进程，以执行IPFIX中介。通常，中间进程由IPFIX中介托管。或者，中间过程可以由原始导出器托管。
Specific Intermediate Processes are described below. However, this is not an exhaustive list.
具体的中间过程如下所述。然而，这并不是一份详尽的清单。
Intermediate Conversion Process
中间转化过程
An Intermediate Conversion Process is an Intermediate Process that transforms non-IPFIX into IPFIX or manages the relation among Templates and states of incoming/outgoing transport sessions in the case of transport protocol conversion (e.g., from UDP to SCTP).
中间转换过程是在传输协议转换（例如，从UDP到SCTP）的情况下，将非IPFIX转换为IPFIX或管理传入/传出传输会话的模板和状态之间的关系的中间过程。
Intermediate Aggregation Process
中间聚合过程
An Intermediate Aggregation Process is an Intermediate Process that aggregates records based upon a set of Flow Keys or functions applied to fields from the record (e.g., data binning and subnet aggregation).
中间聚合过程是一个中间过程，它根据应用于记录字段的一组流键或函数（例如，数据装箱和子网聚合）聚合记录。
Intermediate Correlation Process
中间相关过程
An Intermediate Correlation Process is an Intermediate Process that adds information to records, noting correlations among them, or generates new records with correlated data from multiple records (e.g., the production of bidirectional flow records from unidirectional flow records).
中间关联过程是一种中间过程，它向记录中添加信息，注意记录之间的关联，或使用多个记录中的相关数据生成新记录（例如，从单向流记录生成双向流记录）。
Intermediate Selection Process
中间选择过程
An Intermediate Selection Process is an Intermediate Process that selects records from a sequence based upon criteria-evaluated record values and passes only those records that match the criteria (e.g., filtering only records from a given network to a given Collector).
中间选择过程是一个中间过程，它根据标准评估的记录值从序列中选择记录，并仅传递与标准匹配的记录（例如，仅过滤从给定网络到给定收集器的记录）。
Intermediate Anonymization Process
中间匿名过程
An Intermediate Anonymization Process is an Intermediate Process that transforms records in order to anonymize them, to protect the identity of the entities described by the records (e.g., by applying prefix-preserving pseudonymization of IP addresses).
中间匿名化过程是转换记录以使其匿名化的中间过程，以保护记录所描述的实体的身份（例如，通过应用保留前缀的IP地址假名化）。
IPFIX Mediator
IPFIX中介
An IPFIX Mediator is an IPFIX Device that provides IPFIX Mediation by receiving a record stream from some data sources, hosting one or more Intermediate Processes to transform that stream, and exporting the transformed record stream into IPFIX Messages via an Exporting Process. In the common case, an IPFIX Mediator receives
IPFIX中介器是一种IPFIX设备，它通过从某些数据源接收记录流、承载一个或多个中间进程来转换该流，并通过导出进程将转换后的记录流导出为IPFIX消息来提供IPFIX中介。在常见情况下，IPFIX中介接收
a record stream from a Collecting Process, but it could also receive a record stream from data sources not encoded using IPFIX, e.g., in the case of conversion from the NetFlow V9 protocol [RFC3954] to the IPFIX protocol.
来自收集进程的记录流，但它也可以从未使用IPFIX编码的数据源接收记录流，例如，在从NetFlow V9协议[RFC3954]转换为IPFIX协议的情况下。
Note that the IPFIX Mediator is a generalization of the concentrator and proxy elements envisioned in the IPFIX requirements [RFC3917]. IPFIX Mediators running appropriate Intermediate Processes provide the functionality specified therein.
请注意，IPFIX中介是IPFIX需求[RFC3917]中设想的集中器和代理元素的概括。运行适当中间进程的IPFIX中介提供其中指定的功能。
IPFIX Mediation can be applied to flow-based or packet-based information. The flow-based information is encoded as IPFIX Flow Records by the IPFIX protocol, and the packet-based information is extracted by some packet selection techniques and then encoded as PSAMP Packet Reports by the PSAMP protocol. Thus, this section describes relevant documents for both protocols.
IPFIX中介可以应用于基于流或基于包的信息。基于流的信息通过IPFIX协议编码为IPFIX流记录，基于包的信息通过一些包选择技术提取，然后通过PSAMP协议编码为PSAMP包报告。因此，本节描述了两个协议的相关文档。
The IPFIX protocol [RFC5101] provides network administrators with access to IP Flow information. The architecture for the export of measured IP Flow information from an IPFIX Exporting Process to a Collecting Process is defined in [RFC5470], per the requirements defined in [RFC3917]. The IPFIX protocol [RFC5101] specifies how IPFIX Data Records and Templates are carried via a number of transport protocols from IPFIX Exporting Processes to IPFIX Collecting Processes. IPFIX has a formal description of IPFIX Information Elements, their names, types, and additional semantic information, as specified in [RFC5102]. The IPFIX Management Information Base is defined in [RFC5815]. Finally, [RFC5472] describes what types of applications can use the IPFIX protocol and how they can use the information provided. Furthermore, it shows how the IPFIX framework relates to other architectures and frameworks. The storage of IPFIX Messages in a file is specified in [RFC5655].
IPFIX协议[RFC5101]为网络管理员提供了访问IP流信息的权限。[RFC5470]根据[RFC3917]中定义的要求，定义了将测量的IP流信息从IPFIX导出过程导出到收集过程的体系结构。IPFIX协议[RFC5101]指定如何通过多个传输协议将IPFIX数据记录和模板从IPFIX导出进程传送到IPFIX收集进程。IPFIX对IPFIX信息元素、它们的名称、类型和附加语义信息进行了正式描述，如[RFC5102]中所述。[RFC5815]中定义了IPFIX管理信息库。最后，[RFC5472]描述了什么类型的应用程序可以使用IPFIX协议，以及它们如何使用提供的信息。此外，它还展示了IPFIX框架与其他体系结构和框架的关系。[RFC5655]中规定了文件中IPFIX消息的存储。
The framework for packet selection and reporting [RFC5474] enables network elements to select subsets of packets by statistical and other methods and to export a stream of reports on the selected packets to a Collector. The set of packet selection techniques (Sampling and Filtering) standardized by PSAMP is described in [RFC5475]. The PSAMP protocol [RFC5476] specifies the export of packet information from a PSAMP Exporting Process to a Collector. Like IPFIX, PSAMP has a formal description of its Information
分组选择和报告框架[RFC5474]使网络元件能够通过统计和其他方法选择分组子集，并将所选分组的报告流导出到收集器。[RFC5475]中描述了PSAMP标准化的数据包选择技术（采样和过滤）。PSAMP协议[RFC5476]指定从PSAMP导出进程向收集器导出数据包信息。与IPFIX一样，PSAMP对其信息也有正式的描述
Elements, their names, types, and additional semantic information. The PSAMP information model is defined in [RFC5477]. The PSAMP Management Information Base is described in [PSAMP-MIB].
元素、它们的名称、类型和附加语义信息。PSAMP信息模型在[RFC5477]中定义。[PSAMP-MIB]中描述了PSAMP管理信息库。
Figure A shows the high-level IPFIX Mediation reference model as an extension of the IPFIX reference model presented in [RFC5470]. This figure covers the various possible scenarios that can exist in an IPFIX measurement system.
图A显示了作为[RFC5470]中介绍的IPFIX参考模型的扩展的高级IPFIX中介参考模型。此图涵盖了IPFIX测量系统中可能存在的各种场景。
+----------------+ +---------------+ +---------------+
| Collector 1 | | Collector 2 | | Collector N |
|[Collecting | |[Collecting | |[Collecting |
| Process(es)] | | Process(es)] |... | Process(es)] |
+----^-----------+ +---^--------^--+ +--------^------+
| / \ |
| / \ |
Flow Records Flow Records Flow Records Flow Records
| / \ |
+------+-------------+------+ +------+-----------+--------+
|IPFIX Mediator N+1 | |IPFIX Mediator Z |
|[Exporting Process(es)] | |[Exporting Process(es)] |
|[Intermediate Process(es)] | |[Intermediate Process(es)] |
|[Collecting Process(es)] |... |[Collecting Process(es)] |
+----^----------------^-----+ +------^----------------^---+
| | | |
Flow Records Flow Records Packet Reports record stream
| | | |
+------+------+ +------+-------+ +------+-------+ +-----+-----+
|IPFIX | |IPFIX Original| |PSAMP Original| |Other |
| Mediator 1 | | Exporter 1 | | Exporter 1 | | Source 1 |
|+-------------+ |+--------------+ |+--------------+ |+-----------+
+|IPFIX | +|IPFIX Original| +|PSAMP Original| +|Other |
| Mediator N | | Exporter N | | Exporter N | | Source N |
|[Exporting | |[Exporting | |[Exporting | | |
| Process(es)]| | Process(es)]| | Process(es)]| | |
|[Intermediate| |[Metering | |[Metering | | |
| Process(es)]| | Process(es)]| | Process(es)]| | |
|[Collecting | |[Observation | |[Observation | | |
| Process(es)]| | Point(s)]| | Point(s)]| | |
+------^------+ +-----^-^------+ +-----^-^------+ +-----------+
| | | | |
Flow Records Packets coming Packets coming
into Observation into Observation
Points Points
+----------------+ +---------------+ +---------------+
| Collector 1 | | Collector 2 | | Collector N |
|[Collecting | |[Collecting | |[Collecting |
| Process(es)] | | Process(es)] |... | Process(es)] |
+----^-----------+ +---^--------^--+ +--------^------+
| / \ |
| / \ |
Flow Records Flow Records Flow Records Flow Records
| / \ |
+------+-------------+------+ +------+-----------+--------+
|IPFIX Mediator N+1 | |IPFIX Mediator Z |
|[Exporting Process(es)] | |[Exporting Process(es)] |
|[Intermediate Process(es)] | |[Intermediate Process(es)] |
|[Collecting Process(es)] |... |[Collecting Process(es)] |
+----^----------------^-----+ +------^----------------^---+
| | | |
Flow Records Flow Records Packet Reports record stream
| | | |
+------+------+ +------+-------+ +------+-------+ +-----+-----+
|IPFIX | |IPFIX Original| |PSAMP Original| |Other |
| Mediator 1 | | Exporter 1 | | Exporter 1 | | Source 1 |
|+-------------+ |+--------------+ |+--------------+ |+-----------+
+|IPFIX | +|IPFIX Original| +|PSAMP Original| +|Other |
| Mediator N | | Exporter N | | Exporter N | | Source N |
|[Exporting | |[Exporting | |[Exporting | | |
| Process(es)]| | Process(es)]| | Process(es)]| | |
|[Intermediate| |[Metering | |[Metering | | |
| Process(es)]| | Process(es)]| | Process(es)]| | |
|[Collecting | |[Observation | |[Observation | | |
| Process(es)]| | Point(s)]| | Point(s)]| | |
+------^------+ +-----^-^------+ +-----^-^------+ +-----------+
| | | | |
Flow Records Packets coming Packets coming
into Observation into Observation
Points Points
Figure A: IPFIX Mediation Reference Model Overview
图A:IPFIX中介参考模型概述
The functional components within each entity are indicated within brackets []. An IPFIX Mediator receives IPFIX Flow Records or PSAMP Packet Reports from other IPFIX Mediators, IPFIX Flow Records from IPFIX Original Exporters, PSAMP Packet Reports from PSAMP Original Exporters, and/or a record stream from other sources. The IPFIX Mediator then exports IPFIX Flow Records and/or PSAMP Packet Reports to one or multiple Collectors and/or other IPFIX Mediators.
每个实体内的功能组件在括号[]内表示。IPFIX中介接收来自其他IPFIX中介的IPFIX流记录或PSAMP数据包报告、来自IPFIX原始导出器的IPFIX流记录、来自PSAMP原始导出器的PSAMP数据包报告和/或来自其他来源的记录流。然后，IPFIX中介将IPFIX流记录和/或PSAMP数据包报告导出到一个或多个收集器和/或其他IPFIX中介。
Figure B shows the basic IPFIX Mediator component model. An IPFIX Mediator contains one or more Intermediate Processes and one or more Exporting Processes. Typically, it also contains a Collecting Process but might contain several Collecting Processes, as described in Figure B.
图B显示了基本的IPFIX中介器组件模型。IPFIX中介包含一个或多个中间进程和一个或多个导出进程。通常，它还包含一个收集过程，但可能包含多个收集过程，如图B所示。
IPFIX (Data Records)
^
^ |
+------------------------|-|---------------------+
| IPFIX Mediator | | |
| | | |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Exporting Process(es) |' |
| '----------------------^--------------------' |
| | | |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Intermediate Process(es) |' |
| '----------------------^--------------------' |
| | | |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Collecting Process(es) |' |
| '----------------------^--------------------' |
+------------------------|-|---------------------+
|
IPFIX (Data Records)
IPFIX (Data Records)
^
^ |
+------------------------|-|---------------------+
| IPFIX Mediator | | |
| | | |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Exporting Process(es) |' |
| '----------------------^--------------------' |
| | | |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Intermediate Process(es) |' |
| '----------------------^--------------------' |
| | | |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Collecting Process(es) |' |
| '----------------------^--------------------' |
+------------------------|-|---------------------+
|
IPFIX (Data Records)
Figure B: Basic IPFIX Mediator Component Model
图B：基本IPFIX中介器组件模型
However, other data sources are also possible: an IPFIX Mediator can receive a record stream from non-IPFIX protocols such as NetFlow [RFC3954] exporter(s). This document does not make any particular assumption on how a record stream is transferred to an IPFIX Mediator. Figure C shows the IPFIX Mediator component model in the case of IPFIX protocol conversion from non-IPFIX exporters.
但是，也可以使用其他数据源：IPFIX中介可以从非IPFIX协议（如NetFlow[RFC3954]exporter）接收记录流。本文档没有对记录流如何传输到IPFIX中介进行任何特定假设。图C显示了从非IPFIX导出程序转换IPFIX协议时的IPFIX中介器组件模型。
IPFIX (Data Records)
^
^ |
+------------------------|-|---------------------+
| IPFIX Mediator | | |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Exporting Process(es) |' |
| '----------------------^--------------------' |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Intermediate Process(es) |' |
| '----------------------^--------------------' |
+------------------------|-----------------------+
| record stream
+------------------------|-----------------------+
| Non-IPFIX exporter | |
| +-------------+----------+ |
| | | |
+----------|------------------------|------------+
| |
Packets coming into observation points
IPFIX (Data Records)
^
^ |
+------------------------|-|---------------------+
| IPFIX Mediator | | |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Exporting Process(es) |' |
| '----------------------^--------------------' |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Intermediate Process(es) |' |
| '----------------------^--------------------' |
+------------------------|-----------------------+
| record stream
+------------------------|-----------------------+
| Non-IPFIX exporter | |
| +-------------+----------+ |
| | | |
+----------|------------------------|------------+
| |
Packets coming into observation points
Figure C: IPFIX Mediator Component Model in IPFIX Protocol Conversion
图C:IPFIX协议转换中的IPFIX中介器组件模型
Alternatively, an Original Exporter may provide IPFIX Mediation by hosting one or more Intermediate Processes. The component model in Figure D adds Intermediate Process(es) to the IPFIX Device model illustrated in [RFC5470]. In comparison with Figures 1 or 2 in [RFC5470], the Intermediate Process is located between Exporting Process(es) and IPFIX or PSAMP Metering Process(es).
或者，原始导出器可以通过托管一个或多个中间进程来提供IPFIX中介。图D中的组件模型将中间进程添加到[RFC5470]中所示的IPFIX设备模型中。与[RFC5470]中的图1或图2相比，中间过程位于导出过程和IPFIX或PSAMP计量过程之间。
IPFIX (Data Records)
^ ^
+---------------------------|-|------------------------+
| Original Exporter | | |
| | | |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Exporting Process(es) |' |
| '----------------------^--------------------' |
| | | |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Intermediate Process(es) |' |
| '---------^-----------------------^---------' |
| | Data Records | |
| .----------+---------. .---------+----------. |
| | Metering Process 1 |...| Metering Process N | |
| '----------^---------' '---------^----------' |
| | | |
| .-----------+---------. .---------+-----------. |
| | Observation Point 1 |...| Observation Point N | |
| '-----------^---------' '---------^-----------' |
+--------------|-----------------------|---------------+
| |
Packets coming into Observation Points
IPFIX (Data Records)
^ ^
+---------------------------|-|------------------------+
| Original Exporter | | |
| | | |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Exporting Process(es) |' |
| '----------------------^--------------------' |
| | | |
| .---------------------|-+-------------------. |
| .----------------------+--------------------.| |
| | Intermediate Process(es) |' |
| '---------^-----------------------^---------' |
| | Data Records | |
| .----------+---------. .---------+----------. |
| | Metering Process 1 |...| Metering Process N | |
| '----------^---------' '---------^----------' |
| | | |
| .-----------+---------. .---------+-----------. |
| | Observation Point 1 |...| Observation Point N | |
| '-----------^---------' '---------^-----------' |
+--------------|-----------------------|---------------+
| |
Packets coming into Observation Points
Figure D: IPFIX Mediation Component Model at Original Exporter
图D：原始导出器上的IPFIX中介组件模型
In addition, an Intermediate Process may be collocated with an IPFIX File Reader and/or Writer. Figure E shows an IPFIX Mediation component model with an IPFIX File Writer and/or Reader.
此外，中间进程可以与IPFIX文件读取器和/或写入器并置。图E显示了带有IPFIX文件编写器和/或读取器的IPFIX中介组件模型。
IPFIX (Data Records)
^
^ |
.----------------------|-+--------------------.
.-----------------------+---------------------.|
| IPFIX File Writer |'
'-----------------------^---------------------'
| |
.----------------------|-+--------------------.
.-----------------------+---------------------.|
| Intermediate Process(es) |'
'-----------------------^---------------------'
| |
.----------------------|-+--------------------.
.-----------------------+---------------------.|
| IPFIX File Reader |'
'-----------------------^---------------------'
|
IPFIX (Data Records)
IPFIX (Data Records)
^
^ |
.----------------------|-+--------------------.
.-----------------------+---------------------.|
| IPFIX File Writer |'
'-----------------------^---------------------'
| |
.----------------------|-+--------------------.
.-----------------------+---------------------.|
| Intermediate Process(es) |'
'-----------------------^---------------------'
| |
.----------------------|-+--------------------.
.-----------------------+---------------------.|
| IPFIX File Reader |'
'-----------------------^---------------------'
|
IPFIX (Data Records)
Figure E: IPFIX Mediation Component Model Collocated with IPFIX File Writer/Reader
图E:IPFIX中介组件模型与IPFIX文件编写器/读取器并置
Figure F shows a functional block diagram example in an IPFIX Mediator that has different Intermediate Process types.
图F显示了具有不同中间进程类型的IPFIX中介中的功能框图示例。
IPFIX IPFIX IPFIX
^ ^ ^
| | |
.------------. .-----+-------. .-----+-------. .------+------.
| IPFIX File | | Exporting | | Exporting | | Exporting |
| Writer | | Process 1 | | Process 2 |....| Process N |
'-----^-^----' '-----^-------' '-----^-------' '------^------'
| | | | |
| +-------------+ | |
: Flow Records / Packet Reports :
.------+-------. .-----+--------. .----+---------. .--------------.
| Intermediate | | Intermediate | | Intermediate | | Intermediate |
| Anonymization| | Correlation | | Aggregation | | Selection |
| Process N | | Process N | | Process N | | Process N |
'------|-------' '------|-------' '-----|-|------' '-------|------'
| +---------------+ | |
: : : :
.------+-------. .------+-------. .-------+------. .-------+------.
| Intermediate | | Intermediate | | Intermediate | | Intermediate |
| Selection | | Selection | | Selection | | Selection |
| Process 1 | | Process 2 | | Process 3 | | Process 4 |
'------|-|-----' '------|-------' '-----|--------' '-------|------'
| +--------------+ | +----------------+
| | | | |
: Flow Records / Packet Reports :
.------+------. .-------+-----. .-----+-+-----. .-----+------.
| Collecting | | Collecting | | Collecting | | IPFIX File |
| Process 1 | | Process 2 |...| Process N | | Reader |
'------^------' '------^------' '------^------' '------------'
| | |
Flow Records Flow Records Flow Records
IPFIX IPFIX IPFIX
^ ^ ^
| | |
.------------. .-----+-------. .-----+-------. .------+------.
| IPFIX File | | Exporting | | Exporting | | Exporting |
| Writer | | Process 1 | | Process 2 |....| Process N |
'-----^-^----' '-----^-------' '-----^-------' '------^------'
| | | | |
| +-------------+ | |
: Flow Records / Packet Reports :
.------+-------. .-----+--------. .----+---------. .--------------.
| Intermediate | | Intermediate | | Intermediate | | Intermediate |
| Anonymization| | Correlation | | Aggregation | | Selection |
| Process N | | Process N | | Process N | | Process N |
'------|-------' '------|-------' '-----|-|------' '-------|------'
| +---------------+ | |
: : : :
.------+-------. .------+-------. .-------+------. .-------+------.
| Intermediate | | Intermediate | | Intermediate | | Intermediate |
| Selection | | Selection | | Selection | | Selection |
| Process 1 | | Process 2 | | Process 3 | | Process 4 |
'------|-|-----' '------|-------' '-----|--------' '-------|------'
| +--------------+ | +----------------+
| | | | |
: Flow Records / Packet Reports :
.------+------. .-------+-----. .-----+-+-----. .-----+------.
| Collecting | | Collecting | | Collecting | | IPFIX File |
| Process 1 | | Process 2 |...| Process N | | Reader |
'------^------' '------^------' '------^------' '------------'
| | |
Flow Records Flow Records Flow Records
Figure F: IPFIX Mediation Functional Block Diagram
图F:IPFIX中介功能框图
A Collecting Process in an IPFIX Mediator is not different from the Collecting Process described in [RFC5101]. Additional functions in an IPFIX Mediator include transmitting the set of Data Records and Control Information to one or more components, i.e., Intermediate Processes and other applications. In other words, a Collecting Process may duplicate the set and transmit it to one or more components in sequence or in parallel. In the case of an IPFIX
IPFIX中介中的收集过程与[RFC5101]中描述的收集过程没有什么不同。IPFIX中介中的其他功能包括将数据记录集和控制信息传输到一个或多个组件，即中间进程和其他应用程序。换言之，收集过程可以复制集合，并以顺序或并行方式将其传输到一个或多个组件。在IPFIX的情况下
Mediator, the Control Information described in [RFC5470] includes IPFIX Message Header information and Transport Session Information along with information about the Metering Process and the Exporting Process in an Original Exporter, e.g., Sampling parameters.
作为中介，[RFC5470]中描述的控制信息包括IPFIX消息头信息和传输会话信息，以及原始导出器中的计量过程和导出过程的信息，例如采样参数。
An Exporting Process in an IPFIX Mediator is not different from the Exporting Process described in [RFC5101]. Additional functions in an IPFIX Mediator may include the following:
IPFIX中介中的导出过程与[RFC5101]中描述的导出过程没有什么不同。IPFIX中介中的其他功能可能包括以下内容：
o Receiving the trigger to transmit the Template Withdrawal Messages from Intermediate Process(es) when relevant Templates become invalid due to, for example, incoming session failure.
o 当相关模板因（例如）传入会话失败而变得无效时，接收触发器以从中间进程发送模板撤回消息。
o Transmitting the origin (e.g., Observation Point, Observation Domain ID, Original Exporter IP address, etc.) of the data in additional Data Record fields or additional Data Records. The parameters that represent the origin should be configurable.
o 在附加数据记录字段或附加数据记录中传输数据的来源（例如，观测点、观测域ID、原始导出器IP地址等）。表示原点的参数应该是可配置的。
An Intermediate Process is a key functional block for IPFIX Mediation. Its typical functions include the following:
中间进程是IPFIX中介的关键功能块。其典型功能包括：
o Generating a new record stream from an input record stream including context information (e.g., Observation Domain ID and Transport Session Information) and transmitting it to other components.
o 从包含上下文信息（例如，观察域ID和传输会话信息）的输入记录流生成新记录流，并将其传输到其他组件。
o Reporting statistics and interpretations for IPFIX Metering Processes, PSAMP Metering Processes, and Exporting Processes from an Original Exporter. See Section 4 of [RFC5101] and Section 6 of [RFC5476] for relevant statistics data structures and interpretations, respectively. Activation of this function should be configurable.
o 报告IPFIX计量过程、PSAMP计量过程和原始导出器导出过程的统计数据和解释。相关统计数据结构和解释分别见[RFC5101]第4节和[RFC5476]第6节。此功能的激活应该是可配置的。
o Maintaining the configurable relation between Collecting Process(es)/Metering Process(es) and Exporting Process(es)/other Intermediate Process(es).
o 维护收集流程/计量流程和导出流程/其他中间流程之间的可配置关系。
o Maintaining database(s) of Data Records in the case of an Intermediate Aggregation Process and an Intermediate Correlation Process. The function has the Data Record expiration rules described in the next subsection.
o 在中间聚合过程和中间关联过程中维护数据记录数据库。该函数具有下一小节中描述的数据记录过期规则。
o Maintaining statistics on the Intermediate Process itself, such as the number of input/output Data Records, etc.
o 维护中间过程本身的统计信息，如输入/输出数据记录的数量等。
o Maintaining additional information about output record streams, which includes information related to the Original Exporters, Observation Domain, and administrative domain as well as some configuration parameters related to each function.
o 维护有关输出记录流的附加信息，包括与原始导出器、观察域和管理域相关的信息，以及与每个功能相关的一些配置参数。
In the case of an Intermediate Aggregation Process, Intermediate Anonymization Process, and Intermediate Correlation Process, the value of the "flowKeyIndicator" needs to be modified when modifying the data structure defined by an original Template.
在中间聚合过程、中间匿名过程和中间关联过程的情况下，修改原始模板定义的数据结构时，需要修改“flowKeyIndicator”的值。
For example, an Intermediate Aggregation Process aggregating incoming Flow Records composed of the sourceIPv4Address and destinationIPv4Address Flow Keys into outgoing Flow Records with the destinationIPv4Address Flow Key must modify the incoming flowKeyIndicator to contain only the destinationIPv4Address.
例如，将由sourceIPv4Address和destinationIPv4Address流键组成的传入流记录聚合为具有destinationIPv4Address流键的传出流记录的中间聚合进程必须修改传入流键指示器，使其仅包含destinationIPv4Address。
An Intermediate Aggregation Process and Intermediate Correlation Process need to have expiration conditions to export cached Data Records. In the case of the Metering Process in an Original Exporter, these conditions are described in [RFC5470]. In the case of the Intermediate Process, these conditions are as follows:
中间聚合进程和中间关联进程需要具有过期条件才能导出缓存的数据记录。对于原始出口商的计量过程，[RFC5470]中描述了这些条件。对于中间过程，这些条件如下：
o If there are no input Data Records belonging to a cached Flow for a certain time period, aggregated Flow Records will expire. This time period should be configurable at the Intermediate Process.
o 如果在特定时间段内没有属于缓存流的输入数据记录，则聚合流记录将过期。此时间段应可在中间过程中配置。
o If the Intermediate Process experiences resource constraints (e.g., lack of memory to store Flow Records), aggregated Flow Records may prematurely expire.
o 如果中间流程遇到资源限制（例如，缺少存储流记录的内存），聚合流记录可能会提前过期。
o For long-running Flows, the Intermediate Process should cause the Flow to expire on a regular basis or on the basis of an expiration policy. This periodicity or expiration policy should be configurable at the Intermediate Process.
o 对于长时间运行的流，中间进程应定期或根据过期策略使流过期。此周期或过期策略应在中间流程中配置。
In the case of an Intermediate Correlation Process, a cached Data Record may be prematurely expired (and discarded) when no correlation can be computed with newly received Data Records. For example, an Intermediate Correlation Process computing one-way delay may discard the cached Packet Report when no other matching Packet Report are observed within a certain time period.
在中间关联处理的情况下，当不能计算与新接收的数据记录的关联时，缓存的数据记录可能会提前过期（并被丢弃）。例如，当在特定时间段内没有观察到其他匹配的分组报告时，计算单向延迟的中间相关处理可以丢弃高速缓存的分组报告。
This section describes the functional blocks of specific Intermediate Processes.
本节描述了特定中间过程的功能块。
When receiving a non-IPFIX record stream, the Intermediate Conversion Process covers the following functions:
当接收到非IPFIX记录流时，中间转换过程包括以下功能：
o Determining the IPFIX Information Element identifiers that correspond to the fields of the non-IPFIX records (e.g., converting the NetFlow V9 protocol [RFC3954] to the IPFIX Information Model [RFC5102]).
o 确定对应于非IPFIX记录字段的IPFIX信息元素标识符（例如，将NetFlow V9协议[RFC3954]转换为IPFIX信息模型[RFC5102]）。
o Transforming the non-IPFIX records into Data Records, (Options) Template Records, and/or Data Records defined by Options Templates.
o 将非IPFIX记录转换为数据记录、（选项）模板记录和/或由选项模板定义的数据记录。
o Converting additional information (e.g., sampling rate, sampling algorithm, and observation information) into appropriate fields in the existing Data Records or into Data Records defined by new Options Templates.
o 将附加信息（例如采样率、采样算法和观测信息）转换为现有数据记录中的适当字段或新选项模板定义的数据记录。
IPFIX transport protocol conversion can be used to enhance the export reliability, for example, for data retention and accounting. In this case, the Intermediate Conversion Process covers the following functions:
IPFIX传输协议转换可用于增强导出可靠性，例如，用于数据保留和记帐。在这种情况下，中间转换过程包括以下功能：
o Relaying Data Records, (Options) Template Records, and Data Records defined by Options Templates.
o 中继数据记录、（选项）模板记录和由选项模板定义的数据记录。
o Setting the trigger for the Exporting Process in order to export IPFIX Template Withdrawal Messages relevant to the Templates when Templates becomes invalid due to, for example, incoming session failure. This case applies to SCTP and TCP Transport Sessions on the outgoing side only.
o 设置导出过程的触发器，以便在模板因（例如）传入会话失败而变得无效时导出与模板相关的IPFIX模板撤回消息。这种情况仅适用于传出端的SCTP和TCP传输会话。
o Maintaining the mapping information about Transport Sessions, Observation Domain IDs, and Template IDs on the incoming and outgoing sides in order to ensure the consistency of scope field values of incoming and outgoing Data Records defined by Options Templates and of Template IDs of incoming and outgoing IPFIX Template Withdrawal Messages.
o 在传入和传出端维护有关传输会话、观察域ID和模板ID的映射信息，以确保由选项模板定义的传入和传出数据记录的范围字段值与传入和传出IPFIX模板撤回消息的模板ID的范围字段值一致。
An Intermediate Selection Process has analogous functions to the PSAMP Selection Process described in [RFC5475]. The difference is that the Intermediate Selection Process takes a record stream, e.g., Flow Records or Packet Reports, instead of observed packets as its input.
中间选择过程具有与[RFC5475]中描述的PSAMP选择过程类似的功能。不同之处在于，中间选择过程将记录流（例如流记录或数据包报告）而不是观察到的数据包作为其输入。
The typical function is property match filtering that retrieves a record stream of interest. The function selects a Data Record if the value of a specific field in the Data Record equals a configured value or falls within a configured range.
典型的函数是属性匹配筛选，用于检索感兴趣的记录流。如果数据记录中特定字段的值等于配置值或在配置范围内，此函数将选择数据记录。
An Intermediate Aggregation Process covers the following functions:
中间聚合过程包括以下功能：
o Merging a set of Data Records within a certain time period into one Flow Record by summing up the counters where appropriate.
o 在适当的情况下，通过对计数器求和，将特定时间段内的一组数据记录合并为一个流记录。
o Maintaining statistics and additional information about aggregated Flow Records.
o 维护有关聚合流记录的统计信息和附加信息。
The statistics for an aggregated Flow Record may include the number of original Data Records and the maximum and minimum values of per-flow counters. Additional information may include an aggregation time period, a new set of Flow Keys, and observation location information involved in the Flow aggregation. Observation location information can be tuples of (Observation Point, Observation Domain ID, Original Exporter IP address) or another identifier indicating the location where the measured traffic has been observed.
聚合流记录的统计信息可能包括原始数据记录的数量以及每个流计数器的最大值和最小值。附加信息可以包括聚合时间段、一组新的流密钥以及流聚合中涉及的观测位置信息。观测位置信息可以是元组（观测点、观测域ID、原始导出器IP地址）或另一个标识符，指示观测到的流量的位置。
o Aggregation of Data Records, which can be done in the following ways:
o 数据记录的聚合，可通过以下方式完成：
* Spatial composition
* 空间构成
With spatial composition, Data Records sharing common properties are merged into one Flow Record within a certain time period. One typical aggregation can be based on a new set of Flow Keys. Generally, a set of common properties smaller than an original set of Flow Keys results in a higher level of aggregation. Another aggregation can be based on a set of Observation Points within an Observation Domain, on a set of Observation Domains within an Exporter, or on a set of Exporters.
通过空间组合，共享公共属性的数据记录在特定时间段内合并为一个流记录。一个典型的聚合可以基于一组新的流键。通常，一组比原始流键集小的公共属性会导致更高级别的聚合。另一种聚合可以基于观察域内的一组观察点、导出器内的一组观察域或一组导出器。
If some fields do not serve as Flow Keys or per-Flow counters, their values may change from Data Records to Data Records within an aggregated Flow Record. The Intermediate Aggregation Process determines their values by the first Data Record received, a specific Exporter IP address, or other appropriate decisions.
如果某些字段不用作流键或每流计数器，则它们的值可能会在聚合流记录中从数据记录更改为数据记录。中间聚合过程通过接收到的第一条数据记录、特定的导出器IP地址或其他适当的决定来确定它们的值。
Furthermore, a new identifier indicating a group of observation locations can be introduced, for example, to indicate PoPs (Points of Presence) in a large network, or a logical interface composed of physical interfaces with link aggregation.
此外，可以引入指示一组观测位置的新标识符，例如，用于指示大型网络中的pop（存在点），或由具有链路聚合的物理接口组成的逻辑接口。
* Temporal composition
* 时间成分
With temporal composition, multiple Flow Records with identical Flow Key values are merged into a single Flow Record of longer Flow duration if they arrive within a certain time interval. The main difference to spatial composition is that Flow Records are only merged if they originate from the same Observation Point and if the Flow Key values are identical. For example, multiple Flow Records with a Flow duration of less than one minute can be merged into a single Flow Record with more than ten minutes Flow duration.
通过时间合成，如果在某个时间间隔内到达，则具有相同流键值的多个流记录合并为一个流持续时间较长的流记录。空间构成的主要区别在于，只有当流量记录来自同一观测点且流量键值相同时，才会合并流量记录。例如，流持续时间小于1分钟的多个流记录可以合并为流持续时间大于10分钟的单个流记录。
In addition, the Intermediate Aggregation Process with temporal composition produces aggregated counters while reducing the number of Flow Records on a Collector. Some specific non-key fields, such as the minimumIpTotalLength/maximumIpTotalLength or minimumTTL/maximumTTL, will contain the minimum and maximum values for the new aggregated Flow.
此外，具有时间组合的中间聚合过程生成聚合计数器，同时减少收集器上的流记录数。一些特定的非关键字段，如MinimumiPottalLength/MaximumiPottalLength或minimumTTL/maximumTTL，将包含新聚合流的最小值和最大值。
Spatial and temporal composition can be combined in a single Intermediate Aggregation Process. The Intermediate Aggregation Process can be combined with the Intermediate Selection Process in order to aggregate only a subset of the original Flow Records, for example, Flow Records with small numbers of packets as described in Section 6.2.
空间和时间组合可以在单个中间聚合过程中进行组合。中间聚合过程可与中间选择过程结合，以便仅聚合原始流记录的子集，例如，如第6.2节所述，具有少量数据包的流记录。
An Intermediate Anonymization Process covers the following typical functions:
中间匿名过程包括以下典型功能：
o Deleting specified fields
o 删除指定字段
The function deletes existing fields in accordance with some instruction rules. Examples include hiding network topology information and private information. In the case of feeding Data Records to end customers, disclosing vulnerabilities is avoided by deleting fields, e.g., "ipNextHopIP{v4|v6}Address", "bgpNextHopIP{v4|v6}Address", "bgp{Next|Prev}AdjacentAsNumber", and "mplsLabelStackSection", as described in [RFC5102].
该函数根据某些指令规则删除现有字段。示例包括隐藏网络拓扑信息和私有信息。在向终端客户提供数据记录的情况下，可以通过删除字段（如[RFC5102]中所述的“ipNextHopIP{v4 | v6}地址”、“bgpNextHopIP{v4 | v6}地址”、“bgp{Next | Prev}邻接成员”和“mplsLabelStackSection”）来避免泄露漏洞。
o Anonymizing values of specified fields
o 匿名化指定字段的值
The function modifies the values of specified fields. Examples include anonymizing customers' private information, such as IP address and port number, in accordance with a privacy protection policy. The Intermediate Anonymization Process may also report anonymized fields and the anonymization method as additional information.
该函数修改指定字段的值。示例包括根据隐私保护政策匿名化客户的私人信息，如IP地址和端口号。中间匿名化过程还可以报告匿名化字段和匿名化方法作为附加信息。
An Intermediate Correlation Process can be viewed as a special case of the Intermediate Aggregation Process, covering the following typical functions:
中间关联过程可视为中间聚合过程的特例，涵盖以下典型功能：
o Producing new information including metrics, counters, attributes, or packet property parameters by evaluating the correlation among sets of Data Records or among Data Records and other meta data after gathering sets of Data Records within a certain time period.
o 在特定时间段内收集数据记录集后，通过评估数据记录集之间或数据记录与其他元数据之间的相关性，生成新信息，包括度量、计数器、属性或数据包属性参数。
o Adding new fields into a Data Record or creating a new Data Record.
o 向数据记录中添加新字段或创建新数据记录。
A correlation of Data Records can be done in the following ways, which can be implemented individually or in combinations.
数据记录的关联可以通过以下方式完成，这些方式可以单独实现，也可以组合实现。
o One-to-one correlation between Data Records, with the following examples:
o 数据记录之间的一对一关联，示例如下：
* One-way delay, Packet delay variation in [RFC5481] The metrics come from the correlation of the timestamp value on a pair of Packet Reports indicating an identical packet at different Observation Points in the network.
* 单向延迟，数据包延迟变化[RFC5481]度量来自一对数据包报告上的时间戳值的相关性，该数据包报告指示网络中不同观察点处的相同数据包。
* Packet inter-arrival time The metrics come from the correlation of the timestamp value on consecutive Packet Reports from a single Exporter.
* 数据包到达间时间度量来自单个导出器的连续数据包报告上的时间戳值的相关性。
* Rate-limiting ratio, compression ratio, optimization ratio, etc. The data values come from the correlation of Data Records indicating an identical Flow observed on the incoming/outgoing points of a WAN interface.
* 速率限制比率、压缩比率、优化比率等。数据值来自数据记录的相关性，这些数据记录指示在WAN接口的输入/输出点上观察到的相同流。
o Correlation amongst Data Records, with the following examples:
o 数据记录之间的相关性，举例如下：
* Bidirectional Flow composition The method of exporting and representing a Bidirectional Flow (Biflow) is described in [RFC5103]. The Bidirectional Flow composition is a special case of Flow Key aggregation. The Flow Records are merged into one Flow Record as Biflow if Non-directional Key Fields match and the Directional Key Fields match their reverse direction counterparts. The direction assignment method to assign the Biflow Source and Destination as additional information may be reported. In the case of an Intermediate Aggregation Process, the direction may be assigned arbitrarily (see [RFC5103], Section 5.3).
* 双向流合成[RFC5103]中描述了导出和表示双向流（双向流）的方法。双向流组合是流密钥聚合的一种特殊情况。如果非方向键字段匹配且方向键字段与其反向对应项匹配，则流记录将合并为一个流记录。可以报告将双流源和目的地分配为附加信息的方向分配方法。在中间聚合过程的情况下，可以任意指定方向（参见[RFC5103]，第5.3节）。
* Average/maximum/minimum for packets, bytes, one-way delay, packet loss, etc. The data values come from the correlation of multiple Data Records gathered in a certain time interval.
* 数据包、字节、单向延迟、数据包丢失等的平均值/最大值/最小值。数据值来自在特定时间间隔内收集的多个数据记录的相关性。
o Correlation between Data Record and other meta data
o 数据记录和其他元数据之间的相关性
Typical examples are derived packet property parameters described in [RFC5102]. The parameters are retrieved based on the value of the specified field in an input Data Record, compensating for traditional exporting devices or probes that are unable to add packet property parameters. Typical derived packet property parameters are as follows:
典型的例子是[RFC5102]中描述的派生数据包属性参数。根据输入数据记录中指定字段的值检索参数，以补偿无法添加数据包属性参数的传统导出设备或探测器。典型的派生数据包属性参数如下所示：
* "bgpNextHop{IPv4|IPv6}Address" described in [RFC5102] This value indicates the egress router of a network domain. It is useful for making a traffic matrix that covers the whole network domain.
* [RFC5102]中描述的“bgpNextHop{IPv4 | IPv6}地址”此值表示网络域的出口路由器。它有助于生成覆盖整个网络域的流量矩阵。
* BGP community attributes This attribute indicates tagging for routes of geographical and topological information and source types (e.g., transit, peer, or customer) as described in [RFC4384]. Therefore, network administrators can monitor the geographically-based or source-type-based traffic volume by correlating the attribute.
* BGP社区属性此属性表示[RFC4384]中所述的地理和拓扑信息以及源类型（例如，运输、对等或客户）的路线标记。因此，网络管理员可以通过关联属性来监控基于地理位置或基于源类型的通信量。
* "mplsVpnRouteDistinguisher" described in [RFC5102] This value indicates the VPN customer's identification, which cannot be extracted from the core router in MPLS networks. Thanks to this correlation, network administrators can monitor the customer-based traffic volume even on core routers.
* [RFC5102]中描述的“mplsVpnRouteDistinguisher”此值表示VPN客户的标识，无法从MPLS网络中的核心路由器提取该标识。由于这种相关性，网络管理员甚至可以在核心路由器上监控基于客户的通信量。
An IPFIX Mediator may be able to simultaneously support more than one Intermediate Process. Multiple Intermediate Processes generally are configured in the following ways.
IPFIX中介可以同时支持多个中间进程。多个中间过程通常按以下方式配置。
o Parallel Intermediate Processes
o 并行中间过程
A record stream is processed by multiple Intermediate Processes in parallel to fulfill the requirements of different applications. In this setup, every Intermediate Process receives a copy of the entire record stream as its input.
记录流由多个中间进程并行处理，以满足不同应用程序的要求。在此设置中，每个中间进程都会接收整个记录流的副本作为其输入。
o Serial Intermediate Processes
o 串行中间过程
To execute flexible manipulation of a record stream, the Intermediate Processes are connected serially. In that case, an output record stream from one Intermediate Process forms an input record stream for a succeeding Intermediate Process.
为了对记录流执行灵活的操作，中间进程串行连接。在这种情况下，来自一个中间进程的输出记录流形成后续中间进程的输入记录流。
In addition to the combination of Intermediate Processes, the combination of some components (Exporting Process, Collecting Process, IPFIX File Writer and Reader) can be applied to provide various data reduction techniques. This section shows some combinations along with examples.
除了中间过程的组合之外，还可以应用一些组件（导出过程、收集过程、IPFIX文件编写器和读取器）的组合来提供各种数据简化技术。本节显示了一些组合以及示例。
The combination of one or more Intermediate Selection Processes and Exporting Processes can determine to which Collector input Data Records are exported. Applicable examples include exporting Data Records to a dedicated Collector on the basis of a customer or an organization. For example, an Intermediate Selection Process selects Data Records from a record stream on the basis of the peering autonomous system number, and an Exporting Process sends them to a dedicated Collector, as shown in the Figure G.
一个或多个中间选择过程和导出过程的组合可以确定将输入数据记录导出到哪个采集器。适用的示例包括基于客户或组织将数据记录导出到专用收集器。例如，中间选择过程根据对等自治系统编号从记录流中选择数据记录，导出过程将其发送到专用收集器，如图G所示。
.----------------------. .------------.
| Intermediate | | Exporting |
| Selection Process 1 | | Process 1 |
+--+--- Peering AS #10 ---+-->| +--> Collector 1
| '----------------------' '------------'
| .----------------------. .------------.
record | | Intermediate | | Exporting |
stream | | Selection Process 2 | | Process 2 |
-------+--+--- Peering AS #20 ---+-->| +--> Collector 2
| '----------------------' '------------'
| .----------------------. .------------.
| | Intermediate | | Exporting |
| | Selection Process 3 | | Process 3 |
+--+--- Peering AS #30 ---+-->| +--> Collector 3
'----------------------' '------------'
.----------------------. .------------.
| Intermediate | | Exporting |
| Selection Process 1 | | Process 1 |
+--+--- Peering AS #10 ---+-->| +--> Collector 1
| '----------------------' '------------'
| .----------------------. .------------.
record | | Intermediate | | Exporting |
stream | | Selection Process 2 | | Process 2 |
-------+--+--- Peering AS #20 ---+-->| +--> Collector 2
| '----------------------' '------------'
| .----------------------. .------------.
| | Intermediate | | Exporting |
| | Selection Process 3 | | Process 3 |
+--+--- Peering AS #30 ---+-->| +--> Collector 3
'----------------------' '------------'
Figure G: Data-Based Collector Selection
图G：基于数据的采集器选择
The combination of one or more Intermediate Selection Processes and Intermediate Aggregation Processes can efficiently reduce the amount of Flow Records. The combination structure is similar to the concept of the Composite Selector described in [RFC5474]. For example, an Intermediate Selection Process selects Flows consisting of a small number of packets and then transmits them to an Intermediate Aggregation Process. Another Intermediate Selection Process selects other Flow Records and then transmits them to an Exporting Process, as shown in Figure H. This results in aggregation on the basis of the distribution of the number of packets per Flow.
一个或多个中间选择过程和中间聚合过程的组合可以有效地减少流记录的数量。组合结构类似于[RFC5474]中描述的复合选择器的概念。例如，中间选择过程选择由少量数据包组成的流，然后将它们发送到中间聚合过程。另一个中间选择过程选择其他流记录，然后将其传输到导出过程，如图H所示。这将根据每个流的数据包数分布进行聚合。
.------------------. .--------------. .------------.
| Intermediate | | Intermediate | | Exporting |
| Selection | | Aggregation | | Process |
| Process 1 | | Process | | |
+-+ packetDeltaCount +->| +->| |
| | <= 5 | | | | |
record | '------------------' '--------------' | |
stream | .------------------. | |
-------+ | Intermediate | | |
| | Selection | | |
| | Process 2 | | |
+-+ packetDeltaCount +------------------->| |
| > 5 | | |
'------------------' '------------'
.------------------. .--------------. .------------.
| Intermediate | | Intermediate | | Exporting |
| Selection | | Aggregation | | Process |
| Process 1 | | Process | | |
+-+ packetDeltaCount +->| +->| |
| | <= 5 | | | | |
record | '------------------' '--------------' | |
stream | .------------------. | |
-------+ | Intermediate | | |
| | Selection | | |
| | Process 2 | | |
+-+ packetDeltaCount +------------------->| |
| > 5 | | |
'------------------' '------------'
Figure H: Flow Selection and Aggregation Example
图H：流选择和聚合示例
An IPFIX File Writer [RFC5655] stores Data Records in a file system. When Data Records include problematic Information Elements, an Intermediate Anonymization Process can delete these fields before the IPFIX File Writer handles them, as shown in Figure I.
IPFIX文件写入程序[RFC5655]将数据记录存储在文件系统中。当数据记录包含有问题的信息元素时，中间匿名过程可以在IPFIX文件编写器处理这些字段之前删除这些字段，如图I所示。
.---------------. .---------------. .-------------.
| Collecting | | Intermediate | | IPFIX |
IPFIX | Process | | Anonymization | | File |
----->| +->| Process +->| Writer |
'---------------' '---------------' '-------------'
.---------------. .---------------. .-------------.
| Collecting | | Intermediate | | IPFIX |
IPFIX | Process | | Anonymization | | File |
----->| +->| Process +->| Writer |
'---------------' '---------------' '-------------'
Figure I: IPFIX Mediation Example with IPFIX File Writer
图一：带有IPFIX文件编写器的IPFIX中介示例
In contrast, an IPFIX File Reader [RFC5655] retrieves stored Data Records when administrators want to retrieve past Data Records from a given time period. If the data structure of the Data Records from the IPFIX File Reader is different from what administrators want, an Intermediate Anonymization Process and Intermediate Correlation Process can modify the data structure, as shown in Figure J.
相反，当管理员想要检索给定时间段内过去的数据记录时，IPFIX文件读取器[RFC5655]检索存储的数据记录。如果来自IPFIX文件读取器的数据记录的数据结构与管理员想要的不同，则中间匿名过程和中间关联过程可以修改数据结构，如图J所示。
.-------------. .---------------. .---------------. .-----------.
| IPFIX | | Intermediate | | Intermediate | | Exporting |
| File | | Anonymization | | Correlation | | Process |
| Reader +->| Process +->| Process +->| |
'-------------' '---------------' '---------------' '-----------'
.-------------. .---------------. .---------------. .-----------.
| IPFIX | | Intermediate | | Intermediate | | Exporting |
| File | | Anonymization | | Correlation | | Process |
| Reader +->| Process +->| Process +->| |
'-------------' '---------------' '---------------' '-----------'
Figure J: IPFIX Mediation Example with IPFIX File Reader
图J:IPFIX文件读取器的IPFIX中介示例
In the case where distributed IPFIX Mediators enable on-demand export of Data Records that have been previously stored by a File Writer, a collecting infrastructure with huge storage capacity for data retention can be set up.
如果分布式IPFIX中介支持按需导出以前由文件编写器存储的数据记录，则可以设置具有巨大存储容量的数据保留收集基础设施。
The IPFIX Message Header [RFC5101] includes Export Time, Sequence Number, and Observation Domain ID fields. This section describes some consideration points for the IPFIX Message Header encoding in the context of IPFIX Mediation.
IPFIX消息头[RFC5101]包括导出时间、序列号和观察域ID字段。本节介绍IPFIX中介上下文中IPFIX消息头编码的一些注意事项。
Export Time
导出时间
An IPFIX Mediator can set the Export Time in two ways.
IPFIX中介可以通过两种方式设置导出时间。
* Case 1: keeping the field value of incoming Transport Sessions
* 案例1：保留传入传输会话的字段值
* Case 2: setting the time at which an IPFIX Message leaves the IPFIX Mediator
* 案例2：设置IPFIX消息离开IPFIX中介的时间
Case 1 can be applied when an IPFIX Mediator operates as a proxy at the IPFIX Message level rather than the Data Record level. In case 2, the IPFIX Mediator needs to handle any delta timestamp fields described in [RFC5102], such as "flowStartDeltaMicroseconds" and "flowEndDeltaMicroseconds".
当IPFIX中介在IPFIX消息级别而不是数据记录级别作为代理运行时，可以应用案例1。在案例2中，IPFIX中介需要处理[RFC5102]中描述的任何增量时间戳字段，例如“flowStartDeltaMicroseconds”和“flowEndDeltaMicroseconds”。
Sequence Number
序列号
In the case where an IPFIX Mediator relays IPFIX Messages from one Transport Session to another Transport Session, the IPFIX Mediator needs to handle the Sequence Number properly. In particular, the Sequence Number in the outgoing session is not allowed to be re-initialized, even when the incoming session shuts down and restarts.
在IPFIX中介将IPFIX消息从一个传输会话中继到另一个传输会话的情况下，IPFIX中介需要正确处理序列号。特别是，即使传入会话关闭并重新启动，也不允许重新初始化传出会话中的序列号。
Observation Domain ID
观察域ID
According to [RFC5101], the Observation Domain ID in the IPFIX Message Header is locally unique per Exporting Process. In contrast to the Observation Domain ID used by an Original Exporter, the Observation Domain ID used by an IPFIX Mediator does not necessarily represent a set of Observation Points located at the IPFIX Mediator itself.
根据[RFC5101]，IPFIX消息头中的观察域ID在每个导出进程中都是本地唯一的。与原始导出器使用的观察域ID不同，IPFIX中介器使用的观察域ID不一定代表位于IPFIX中介器本身的一组观察点。
An IPFIX Mediator may act as a proxy by relaying entire IPFIX Messages. In this case, it may report information about the Original Exporters by using the Observation Domain ID of the outgoing Messages as the scope field in an Options Template Record.
IPFIX中介可以通过中继整个IPFIX消息来充当代理。在这种情况下，它可以通过使用传出消息的观察域ID作为选项模板记录中的范围字段来报告有关原始导出器的信息。
Otherwise, the IPFIX Mediator should have a function to export the observation location information regarding the Original Exporter. The information contains the IP addresses and Observation Domain IDs used by the Original Exporters and some information about the Transport Session, for example, the source port number, so that different Exporting Processes on the same Original Exporter can be identified. As far as privacy policy permits, an IPFIX Mediator reports the information to an IPFIX Collector.
否则，IPFIX中介应该具有导出有关原始导出器的观察位置信息的功能。该信息包含原始导出器使用的IP地址和观察域ID，以及有关传输会话的一些信息，例如源端口号，以便可以识别同一原始导出器上的不同导出过程。在隐私政策允许的范围内，IPFIX中介将信息报告给IPFIX收集器。
If information about a set of Original Exporters needs to be reported, it can be useful to export it as Common Properties as specified in [RFC5473]. The commonPropertiesID may then serve as a scope for the set of Original Exporters. The Common Properties
如果需要报告关于一组原始导出器的信息，可以将其导出为[RFC5473]中指定的公共属性。然后，commonPropertiesID可以作为原始导出器集的范围。共性
Withdrawal Message [RFC5473] can be used to indicate that an incoming Transport Session from one of the Original Exporters was closed.
退出消息[RFC5473]可用于指示来自原始导出程序之一的传入传输会话已关闭。
IPFIX Mediation reuses the general information models from [RFC5102] and [RFC5477], and, depending on the Intermediate Processes type, potentially Information Elements such as:
IPFIX中介重用[RFC5102]和[RFC5477]中的常规信息模型，并且根据中间进程类型，可能会重用以下信息元素：
o Original Exporter IP address, Observation Domain ID, and source port number about the Transport Session at the Original Exporter, in the case where an IPFIX Mediator reports original observation location information in Section 7. The Information Elements contained in the Export Session Details Options Template in [RFC5655] may be utilized for this purpose.
o 原始导出器IP地址、观察域ID和关于原始导出器上传输会话的源端口号，如果IPFIX中介器在第7节中报告原始观察位置信息。[RFC5655]中导出会话详细信息选项模板中包含的信息元素可用于此目的。
o Report on the applied IPFIX Mediation functions as described in Section 6.7. in [RFC5982].
o 如第6.7节所述，报告应用的IPFIX中介功能。在[RFC5982]中。
o Certificate of an Original Exporter in Section 9. The Information Element exporterCertificate in [RFC5655] may be utilized for this purpose.
o 第9节中原始出口商的证书。[RFC5655]中的信息元素exporterCertificate可用于此目的。
As Mediators act as both IPFIX Collecting Processes and Exporting Processes, the Security Considerations for IPFIX [RFC5101] also apply to Mediators. The Security Considerations for IPFIX Files [RFC5655] also apply to IPFIX Mediators that write IPFIX Files or use them for internal storage. In addition, there are a few specific considerations that IPFIX Mediator implementations must take into account.
由于中介同时充当IPFIX收集进程和导出进程，IPFIX[RFC5101]的安全注意事项也适用于中介。IPFIX文件[RFC5655]的安全注意事项也适用于编写IPFIX文件或将其用于内部存储的IPFIX中介。此外，IPFIX中介器实现还必须考虑一些特定的注意事项。
By design, IPFIX Mediators are "men-in-the-middle": they intercede in the communication between an Original Exporter (or another upstream Mediator) and a downstream Collecting Process. TLS provides no way to connect the session between the Mediator and the Original Exporter to the session between the Mediator and the downstream Collecting Process; indeed, this is by design. This has important implications for the level of confidentiality provided across an IPFIX Mediator and the ability to protect data integrity and Original Exporter authenticity across a Mediator. In general, a Mediator should maintain the same level of integrity and confidentiality protection on both sides of the mediation operation, except in situations where the Mediator is explicitly deployed as a gateway between trusted and untrusted networks.
根据设计，IPFIX调解人是“中间人”：他们在原始出口商（或另一上游调解人）和下游采集流程之间的通信中进行调解。TLS无法将中介器和原始导出器之间的会话连接到中介器和下游收集进程之间的会话；事实上，这是故意的。这对于跨IPFIX中介提供的机密性级别以及跨中介保护数据完整性和原始导出器真实性的能力具有重要影响。一般来说，中介应在中介操作的两侧保持相同级别的完整性和机密性保护，除非中介被明确部署为可信和不可信网络之间的网关。
Subsequent subsections deal with specific security issues raised by IPFIX Mediation.
后续小节将处理IPFIX中介引起的特定安全问题。
An IPFIX Mediator that accepts IPFIX Messages over a Transport Session protected by TLS [RFC5246] or DTLS [RFC4347] and that then exports IPFIX Messages derived therefrom in cleartext is a potentially serious vulnerability in an IPFIX infrastructure. The concern here is that confidentiality protection may be lost across a Mediator.
IPFIX中介通过受TLS[RFC5246]或DTLS[RFC4347]保护的传输会话接受IPFIX消息，然后以明文形式导出由此派生的IPFIX消息，这是IPFIX基础结构中的一个潜在严重漏洞。这里的问题是，调解人可能会失去保密保护。
Therefore, an IPFIX Mediator that receives IPFIX Messages from an upstream Exporting Process protected using TLS or DTLS must provide for sending of IPFIX Messages resulting from the operation of the Intermediate Process(es) to a downstream Collecting Process using TLS or DTLS by default. It may be configurable to export records derived from protected records in cleartext but only when application requirements allow.
因此，从使用TLS或DTL保护的上游导出进程接收IPFIX消息的IPFIX中介器必须提供将中间进程操作产生的IPFIX消息发送到默认情况下使用TLS或DTL的下游收集进程的功能。它可以配置为以明文形式导出来自受保护记录的记录，但仅当应用程序要求允许时。
There are two common use cases for this. First, a Mediator performing a transformation that leads to a reduction in the required level of security (e.g., by removing all information requiring confidentiality from the output records) may export records downstream without confidentiality protection. Second, a mediator that acts as a proxy between an external (untrusted) network and an internal (trusted) network may export records without TLS when the additional overhead of TLS is unnecessary (e.g., on a physically protected network in the same locked equipment rack).
这有两个常见的用例。首先，执行导致所需安全级别降低的转换（例如，通过从输出记录中删除所有需要保密的信息）的中介可以将记录导出到下游而不受保密保护。其次，当不需要TLS的额外开销时（例如，在同一锁定设备机架中的物理保护网络上），充当外部（不受信任）网络和内部（受信任）网络之间代理的中介可以导出不带TLS的记录。
There is a similar problem in the opposite direction: as an IPFIX Mediator's signature on a TLS session to a downstream Collecting Process acts as an implicit assertion of the trustworthiness of the data within the session, a poorly deployed IPFIX Mediator could be used to "legitimize" records derived from untrusted sources. Unprotected sessions from the Original Exporter are generally untrusted, because they could have been tampered with or forged by an unauthorized third party. The concern here is that a Mediator could be used to add inappropriate trust to external information whose integrity cannot be guaranteed.
在相反的方向上也存在类似的问题：由于IPFIX中介在TLS会话上对下游收集进程的签名作为会话内数据可信度的隐式断言，部署不当的IPFIX中介可用于“合法化”来自不可信源的记录。原始导出程序的未受保护会话通常不受信任，因为它们可能被未经授权的第三方篡改或伪造。这里的问题是，调解人可能会被用来为无法保证完整性的外部信息添加不适当的信任。
When specific deployment requirements allow, an IPFIX Mediator may export signed IPFIX Messages containing records derived from records received without integrity protection via TLS. One such deployment consideration would be the reverse of the second case above: when the Mediator acts as a proxy between an internal (trusted) and an
在特定部署要求允许的情况下，IPFIX中介可以导出已签名的IPFIX消息，其中包含从通过TLS接收的没有完整性保护的记录派生的记录。一个这样的部署考虑因素与上面第二种情况相反：当调解人充当内部（受信任的）和代理之间的代理时
external (untrusted) network and when the path from the Original Exporter is protected using some other method and the overhead of a TLS session is unnecessary.
外部（不受信任）网络，并且使用其他方法保护来自原始导出器的路径，并且不需要TLS会话的开销。
In such cases, the IPFIX Mediator should notify the downstream Collector about the missing protection of all or part of the original record stream as part of the Transport Session Information.
在这种情况下，作为传输会话信息的一部分，IPFIX中介器应将原始记录流的全部或部分丢失保护的情况通知下游收集器。
Because the Transport Session between an IPFIX Mediator and an Original Exporter is independent from the Transport Session between the Mediator and the downstream Collecting Process, there is no existing method via TLS to assert the identity of the original Exporting Process downstream. However, an IPFIX Mediator, which modifies the stream of IPFIX Messages sent to it, is by definition a trusted entity in the infrastructure. Therefore, the IPFIX Mediator's signature on an outgoing Transport Session can be treated as an implicit assertion that the Original Exporter was positively identified by the Mediator and that the source information it received was trustworthy. However, as noted in the previous section, IPFIX Mediators must in this circumstance take care not to provide an inappropriate upgrade of trust.
由于IPFIX中介器和原始导出器之间的传输会话独立于中介器和下游收集进程之间的传输会话，因此没有通过TLS断言下游原始导出进程身份的现有方法。但是，根据定义，修改发送给它的IPFIX消息流的IPFIX中介是基础结构中的受信任实体。因此，可以将IPFIX中介在传出传输会话上的签名视为一种隐式断言，即中介已确定原始导出程序，并且它收到的源信息是可信的。但是，如前一节所述，在这种情况下，IPFIX调解人必须注意不要提供不适当的信任升级。
If the X.509 certificates [RFC5280] used to protect a Transport Session between an Original Exporter and an IPFIX Mediator are required downstream, an IPFIX Mediator may export Transport Session Information, including the exporterCertificate and the collectorCertificate Information Elements, with the Export Session Details Options Template defined in Section 8.1.3 of [RFC5655] or the Message Details Options Template defined in Section 8.1.4 of [RFC5655] in order to export this information downstream. However, in this case, the IPFIX Mediator is making an implicit assertion that the upstream session was properly protected and therefore trustworthy or that the Mediator has otherwise been configured to trust the information from the Original Exporter and, as such, must protect the Transport Session to the downstream Collector using TLS or DTLS as well.
如果下游需要用于保护原始导出器和IPFIX中介器之间的传输会话的X.509证书[RFC5280]，IPFIX中介器可以导出传输会话信息，包括exporterCertificate和collectorCertificate信息元素，使用[RFC5655]第8.1.3节中定义的导出会话详细信息选项模板或[RFC5655]第8.1.4节中定义的消息详细信息选项模板，将该信息导出到下游。但是，在这种情况下，IPFIX中介正在隐式断言上游会话已得到适当保护，因此是可信的，或者中介已配置为信任来自原始导出器的信息，因此，还必须使用TLS或DTL保护到下游收集器的传输会话。
Information from multiple sources may only be combined within a Mediator when that Mediator is applied for that specific purpose (e.g., spatial aggregation or concentration of records). In all other cases, an IPFIX Mediator must provide for keeping traffic data from multiple sources separate. Though the details of this are application-specific, this generally entails separating Transport
来自多个来源的信息只有在一个中介应用于特定目的（例如，记录的空间聚集或集中）时才能在该中介中进行组合。在所有其他情况下，IPFIX中介必须提供将来自多个源的流量数据分开的功能。尽管这方面的细节是特定于应用程序的，但这通常需要分离传输
Sessions within the Mediator and associating them with information related to the source or purpose, e.g., network or hardware address range, virtual LAN tag, interface identifiers, and so on.
会话，并将它们与与源或目的相关的信息关联，例如，网络或硬件地址范围、虚拟LAN标记、接口标识符等。
[RFC5101] Claise, B., Ed., "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information", RFC 5101, January 2008.
[RFC5101]Claise，B.，Ed.，“交换IP流量信息的IP流量信息导出（IPFIX）协议规范”，RFC 5101，2008年1月。
[RFC5470] Sadasivan, G., Brownlee, N., Claise, B., and J. Quittek, "Architecture for IP Flow Information Export", RFC 5470, March 2009.
[RFC5470]Sadasivan，G.，Brownlee，N.，Claise，B.，和J.Quitek，“IP流信息导出架构”，RFC 54702009年3月。
[RFC5476] Claise, B., Ed., Johnson, A., and J. Quittek, "Packet Sampling (PSAMP) Protocol Specifications", RFC 5476, March 2009.
[RFC5476]Claise，B.，Ed.，Johnson，A.，和J.Quittek，“数据包采样（PSAMP）协议规范”，RFC 54762009年3月。
[RFC5655] Trammell, B., Boschi, E., Mark, L., Zseby, T., and A. Wagner, "Specification of the IP Flow Information Export (IPFIX) File Format", RFC 5655, October 2009.
[RFC5655]Trammell，B.，Boschi，E.，Mark，L.，Zseby，T.，和A.Wagner，“IP流信息导出（IPFIX）文件格式规范”，RFC 56552009年10月。
[PSAMP-MIB] Dietz, T., Claise, B., and J. Quittek, "Definitions of Managed Objects for Packet Sampling", Work in Progress, March 2011.
[PSAMP-MIB]Dietz，T.，Claise，B.，和J.Quittek，“数据包采样管理对象的定义”，正在进行的工作，2011年3月。
[RFC3917] Quittek, J., Zseby, T., Claise, B., and S. Zander, "Requirements for IP Flow Information Export (IPFIX)", RFC 3917, October 2004.
[RFC3917]Quitek，J.，Zseby，T.，Claise，B.，和S.Zander，“IP流信息导出（IPFIX）的要求”，RFC 39172004年10月。
[RFC3954] Claise, B., Ed., "Cisco Systems NetFlow Services Export Version 9", RFC 3954, October 2004.
[RFC3954]Claise，B.，Ed.，“Cisco Systems NetFlow服务导出版本9”，RFC 3954，2004年10月。
[RFC4347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer Security", RFC 4347, April 2006.
[RFC4347]Rescorla，E.和N.Modadugu，“数据报传输层安全”，RFC 4347，2006年4月。
[RFC4384] Meyer, D., "BGP Communities for Data Collection", BCP 114, RFC 4384, February 2006.
[RFC4384]Meyer，D.，“BGP社区用于数据收集”，BCP 114，RFC 4384，2006年2月。
[RFC5102] Quittek, J., Bryant, S., Claise, B., Aitken, P., and J. Meyer, "Information Model for IP Flow Information Export", RFC 5102, January 2008.
[RFC5102]Quitek，J.，Bryant，S.，Claise，B.，Aitken，P.，和J.Meyer，“IP流信息导出的信息模型”，RFC 5102，2008年1月。
[RFC5103] Trammell, B. and E. Boschi, "Bidirectional Flow Export Using IP Flow Information Export (IPFIX)", RFC 5103, January 2008.
[RFC5103]Trammell，B.和E.Boschi，“使用IP流量信息导出（IPFIX）的双向流量导出”，RFC 5103，2008年1月。
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, August 2008.
[RFC5246]Dierks，T.和E.Rescorla，“传输层安全（TLS）协议版本1.2”，RFC 5246，2008年8月。
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, May 2008.
[RFC5280]Cooper，D.，Santesson，S.，Farrell，S.，Boeyen，S.，Housley，R.，和W.Polk，“Internet X.509公钥基础设施证书和证书撤销列表（CRL）配置文件”，RFC 52802008年5月。
[RFC5472] Zseby, T., Boschi, E., Brownlee, N., and B. Claise, "IP Flow Information Export (IPFIX) Applicability", RFC 5472, March 2009.
[RFC5472]Zseby，T.，Boschi，E.，Brownlee，N.，和B.Claise，“IP流信息导出（IPFIX）适用性”，RFC 54722009年3月。
[RFC5473] Boschi, E., Mark, L., and B. Claise, "Reducing Redundancy in IP Flow Information Export (IPFIX) and Packet Sampling (PSAMP) Reports", RFC 5473, March 2009.
[RFC5473]Boschi，E.，Mark，L.，和B.Claise，“减少IP流信息导出（IPFIX）和数据包采样（PSAMP）报告中的冗余”，RFC 5473，2009年3月。
[RFC5474] Duffield, N., Ed., Chiou, D., Claise, B., Greenberg, A., Grossglauser, M., and J. Rexford, "A Framework for Packet Selection and Reporting", RFC 5474, March 2009.
[RFC5474]Duffield，N.，Ed.，Chiou，D.，Claise，B.，Greenberg，A.，Grossglauser，M.，和J.Rexford，“数据包选择和报告框架”，RFC 54742009年3月。
[RFC5475] Zseby, T., Molina, M., Duffield, N., Niccolini, S., and F. Raspall, "Sampling and Filtering Techniques for IP Packet Selection", RFC 5475, March 2009.
[RFC5475]Zseby，T.，Molina，M.，Duffield，N.，Niccolini，S.，和F.Raspall，“IP数据包选择的采样和过滤技术”，RFC 5475，2009年3月。
[RFC5477] Dietz, T., Claise, B., Aitken, P., Dressler, F., and G. Carle, "Information Model for Packet Sampling Exports", RFC 5477, March 2009.
[RFC5477]Dietz，T.，Claise，B.，Aitken，P.，Dressler，F.，和G.Carle，“数据包抽样出口的信息模型”，RFC 5477，2009年3月。
[RFC5481] Morton, A. and B. Claise, "Packet Delay Variation Applicability Statement", RFC 5481, March 2009.
[RFC5481]Morton，A.和B.Claise，“数据包延迟变化适用性声明”，RFC 54812009年3月。
[RFC5815] Dietz, T., Ed., Kobayashi, A., Claise, B., and G. Muenz, "Definitions of Managed Objects for IP Flow Information Export", RFC 5815, April 2010.
[RFC5815]Dietz，T.，Ed.，Kobayashi，A.，Claise，B.，和G.Muenz，“IP流信息导出的托管对象定义”，RFC 5815，2010年4月。
[RFC5982] Kobayashi, A., Ed., and B. Claise, Ed., "IP Flow Information Export (IPFIX) Mediation: Problem Statement", RFC 5982, August 2010.
[RFC5982]Kobayashi，A.，Ed.，和B.Claise，Ed.，“IP流信息导出（IPFIX）调解：问题陈述”，RFC 59822010年8月。
We would like to thank the following persons: Brian Trammell for his contribution regarding the improvement of the terminology section and the security considerations section; Daisuke Matsubara, Tsuyoshi Kondoh, Hiroshi Kurakami, and Haruhiko Nishida for their contribution during the initial phases of the document; Nevil Brownlee and Juergen Quittek for their technical reviews and feedback.
我们要感谢以下人员：Brian Trammell对术语部分和安全考虑部分的改进做出了贡献；松原大辅、近藤俊吉、黑水浩和西田春彦在文件初始阶段的贡献；Nevil Brownlee和Juergen Quitek感谢他们的技术审查和反馈。
Authors' Addresses
作者地址
Atsushi Kobayashi Nippon Telegraph and Telephone East Corporation 26F 3-20-2, Nishi-shinjuku 3-chome Shinjuku, Tokyo 163-8019 Japan Phone: +81-3-5353-3636 EMail: akoba@orange.plala.or.jp
日本电报电话东公司东京西新宿3-chome新宿26F 3-20-2日本小林尊163-8019电话：+81-3-5353-3636电子邮件：akoba@orange.plala.or.jp
Benoit Claise Cisco Systems, Inc. De Kleetlaan 6a b1 Diegem 1831 Belgium Phone: +32 2 704 5622 EMail: bclaise@cisco.com
Benoit Claise Cisco Systems，Inc.De Kleetlaan 6a b1 Diegem 1831比利时电话：+32 2 704 5622电子邮件：bclaise@cisco.com
Gerhard Muenz Technische Universitaet Muenchen Boltzmannstr. 3 Garching 85748 Germany EMail: muenz@net.in.tum.de URI: http://www.net.in.tum.de/~muenz
德国慕尼黑科技大学。3加兴85748德国电子邮件：muenz@net.in.tum.deURI:http://www.net.in.tum.de/~muenz
Keisuke Ishibashi NTT Service Integration Platform Laboratories 3-9-11 Midori-cho Musashino-shi 180-8585 Japan Phone: +81-422-59-3407 EMail: ishibashi.keisuke@lab.ntt.co.jp
石桥惠介NTT服务集成平台实验室3-9-11 Midori cho Musashino shi 180-8585日本电话：+81-422-59-3407电子邮件：石桥。keisuke@lab.ntt.co.jp