Internet Engineering Task Force (IETF) A. Yourtchenko Request for Comments: 7270 P. Aitken Category: Informational B. Claise ISSN: 2070-1721 Cisco Systems, Inc. June 2014
Internet Engineering Task Force (IETF) A. Yourtchenko Request for Comments: 7270 P. Aitken Category: Informational B. Claise ISSN: 2070-1721 Cisco Systems, Inc. June 2014
Cisco-Specific Information Elements Reused in IP Flow Information Export (IPFIX)
IP流信息导出(IPFIX)中重用的Cisco特定信息元素
Abstract
摘要
This document describes some additional IP Flow Information Export (IPFIX) Information Elements in the range of 1-127, which is the range compatible with field types used by NetFlow version 9 in RFC 3954, as specified in the IPFIX Information Model in RFC 7012.
本文档描述了1-127范围内的一些附加IP流信息导出(IPFIX)信息元素,该范围与RFC 3954中NetFlow版本9使用的字段类型兼容,如RFC 7012中IPFIX信息模型所述。
Status of This Memo
关于下段备忘
This document is not an Internet Standards Track specification; it is published for informational purposes.
本文件不是互联网标准跟踪规范;它是为了提供信息而发布的。
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are a candidate for any level of Internet Standard; see Section 2 of RFC 5741.
本文件是互联网工程任务组(IETF)的产品。它代表了IETF社区的共识。它已经接受了公众审查,并已被互联网工程指导小组(IESG)批准出版。并非IESG批准的所有文件都适用于任何级别的互联网标准;见RFC 5741第2节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7270.
有关本文件当前状态、任何勘误表以及如何提供反馈的信息,请访问http://www.rfc-editor.org/info/rfc7270.
Copyright Notice
版权公告
Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有(c)2014 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(http://trustee.ietf.org/license-info)自本文件出版之日起生效。请仔细阅读这些文件,因为它们描述了您对本文件的权利和限制。从本文件中提取的代码组件必须包括信托法律条款第4.e节中所述的简化BSD许可证文本,并提供简化BSD许可证中所述的无担保。
Table of Contents
目录
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Information Elements Overview . . . . . . . . . . . . . . . . 3 4. Information Elements . . . . . . . . . . . . . . . . . . . . 4 4.1. samplingInterval . . . . . . . . . . . . . . . . . . . . 4 4.2. samplingAlgorithm . . . . . . . . . . . . . . . . . . . . 4 4.3. engineType . . . . . . . . . . . . . . . . . . . . . . . 5 4.4. engineId . . . . . . . . . . . . . . . . . . . . . . . . 5 4.5. ipv4RouterSc . . . . . . . . . . . . . . . . . . . . . . 5 4.6. samplerId . . . . . . . . . . . . . . . . . . . . . . . . 6 4.7. samplerMode . . . . . . . . . . . . . . . . . . . . . . . 6 4.8. samplerRandomInterval . . . . . . . . . . . . . . . . . . 6 4.9. classId . . . . . . . . . . . . . . . . . . . . . . . . . 7 4.10. samplerName . . . . . . . . . . . . . . . . . . . . . . . 7 4.11. flagsAndSamplerId . . . . . . . . . . . . . . . . . . . . 7 4.12. forwardingStatus . . . . . . . . . . . . . . . . . . . . 8 4.13. srcTrafficIndex . . . . . . . . . . . . . . . . . . . . . 9 4.14. dstTrafficIndex . . . . . . . . . . . . . . . . . . . . . 10 4.15. className . . . . . . . . . . . . . . . . . . . . . . . . 10 4.16. layer2packetSectionOffset . . . . . . . . . . . . . . . . 10 4.17. layer2packetSectionSize . . . . . . . . . . . . . . . . . 10 4.18. layer2packetSectionData . . . . . . . . . . . . . . . . . 11 5. Other Information Elements . . . . . . . . . . . . . . . . . 11 5.1. Performance Metrics IEs . . . . . . . . . . . . . . . . . 11 5.2. Application Information IEs . . . . . . . . . . . . . . . 11 5.3. IEs Assigned for NetFlow v9 Compatibility . . . . . . . . 11 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 7. Security Considerations . . . . . . . . . . . . . . . . . . . 13 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 13 8.1. Normative References . . . . . . . . . . . . . . . . . . 13 8.2. Informative References . . . . . . . . . . . . . . . . . 13 Appendix A. XML Specification of IPFIX Information Elements . . 15
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Information Elements Overview . . . . . . . . . . . . . . . . 3 4. Information Elements . . . . . . . . . . . . . . . . . . . . 4 4.1. samplingInterval . . . . . . . . . . . . . . . . . . . . 4 4.2. samplingAlgorithm . . . . . . . . . . . . . . . . . . . . 4 4.3. engineType . . . . . . . . . . . . . . . . . . . . . . . 5 4.4. engineId . . . . . . . . . . . . . . . . . . . . . . . . 5 4.5. ipv4RouterSc . . . . . . . . . . . . . . . . . . . . . . 5 4.6. samplerId . . . . . . . . . . . . . . . . . . . . . . . . 6 4.7. samplerMode . . . . . . . . . . . . . . . . . . . . . . . 6 4.8. samplerRandomInterval . . . . . . . . . . . . . . . . . . 6 4.9. classId . . . . . . . . . . . . . . . . . . . . . . . . . 7 4.10. samplerName . . . . . . . . . . . . . . . . . . . . . . . 7 4.11. flagsAndSamplerId . . . . . . . . . . . . . . . . . . . . 7 4.12. forwardingStatus . . . . . . . . . . . . . . . . . . . . 8 4.13. srcTrafficIndex . . . . . . . . . . . . . . . . . . . . . 9 4.14. dstTrafficIndex . . . . . . . . . . . . . . . . . . . . . 10 4.15. className . . . . . . . . . . . . . . . . . . . . . . . . 10 4.16. layer2packetSectionOffset . . . . . . . . . . . . . . . . 10 4.17. layer2packetSectionSize . . . . . . . . . . . . . . . . . 10 4.18. layer2packetSectionData . . . . . . . . . . . . . . . . . 11 5. Other Information Elements . . . . . . . . . . . . . . . . . 11 5.1. Performance Metrics IEs . . . . . . . . . . . . . . . . . 11 5.2. Application Information IEs . . . . . . . . . . . . . . . 11 5.3. IEs Assigned for NetFlow v9 Compatibility . . . . . . . . 11 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 7. Security Considerations . . . . . . . . . . . . . . . . . . . 13 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 13 8.1. Normative References . . . . . . . . . . . . . . . . . . 13 8.2. Informative References . . . . . . . . . . . . . . . . . 13 Appendix A. XML Specification of IPFIX Information Elements . . 15
Section 4 of [RFC7012] defines the IPFIX Information Elements (IEs) in the range of 1-127 to be compatible with the NetFlow version 9 fields, as specified in "Cisco Systems NetFlow Services Export Version 9" [RFC3954]. As [RFC3954] was published in 2004, it does not contain all NetFlow version 9 field types in the range of 1-127. The question was asked whether IPFIX Devices should exclusively report the IANA IPFIX IEs [IANA-IPFIX]. In other words, when upgrading from a NetFlow Metering Process to an IPFIX Metering Process, should the IPFIX Devices stop reporting IEs specific to NetFlow version 9 that were not registered in IANA [IANA-IPFIX]?
[RFC7012]第4节定义了1-127范围内的IPFIX信息元素,以与“Cisco Systems NetFlow Services Export version 9”[RFC3954]中规定的NetFlow version 9字段兼容。由于[RFC3954]于2004年发布,它不包含1-127范围内的所有NetFlow版本9字段类型。有人问IPFIX设备是否应专门报告IANA IPFIX IEs[IANA-IPFIX]。换句话说,当从NetFlow计量过程升级到IPFIX计量过程时,IPFIX设备是否应该停止报告特定于NetFlow版本9的未在IANA[IANA-IPFIX]中注册的IE?
This document is intended to fill the gap in this IE range. It describes some additional IPFIX Information Elements in the range of 1-127, which is the range compatible with field types used by NetFlow version 9 in [RFC3954], as specified in the IPFIX Information Model [RFC7012]. With this, IPFIX implementations could export all the Information Elements specified in IANA [IANA-IPFIX], regardless of the range.
本文件旨在填补IE范围内的空白。它描述了1-127范围内的一些附加IPFIX信息元素,该范围与[RFC3954]中NetFlow版本9使用的字段类型兼容,如IPFIX信息模型[RFC7012]中所述。通过这种方式,IPFIX实现可以导出IANA[IANA-IPFIX]中指定的所有信息元素,而不考虑范围。
This document follows the rules in "Guidelines for Authors and Reviewers of IP Flow Export (IPFIX) Information Elements" [RFC7013]. This document does not extend [RFC3954]. The IPFIX Protocol [RFC7011] has its own Information Model ([RFC7012] and IANA [IANA-IPFIX]), which is extensible upon application to IANA, subject to expert review by IE-DOCTORS [RFC7013]. This document extends the IPFIX Information Model.
本文档遵循“IP流导出(IPFIX)信息元素的作者和审阅者指南”[RFC7013]中的规则。本文件不扩展[RFC3954]。IPFIX协议[RFC7011]有自己的信息模型([RFC7012]和IANA[IANA-IPFIX]),可在应用于IANA时进行扩展,并由IE-DOCTORS[RFC7013]进行专家评审。本文档扩展了IPFIX信息模型。
IPFIX-specific terminology used in this document is defined in Section 2 of [RFC7011]. As in [RFC7011], these IPFIX-specific terms have the first letter of a word capitalized when used in this document.
[RFC7011]第2节定义了本文件中使用的IPFIX专用术语。与[RFC7011]一样,这些IPFIX专用术语在本文件中使用时,单词的首字母大写。
The following Information Elements are discussed in the sections below:
以下各节讨论了以下信息要素:
+----+-----------------------+-----+---------------------------+ | ID | Name | ID | Name | +----+-----------------------+-----+---------------------------+ | 34 | samplingInterval | 84 | samplerName | | 35 | samplingAlgorithm | 87 | flagsAndSamplerId | | 38 | engineType | 89 | forwardingStatus | | 39 | engineId | 92 | srcTrafficIndex | | 43 | ipv4RouterSc | 93 | dstTrafficIndex | | 48 | samplerId | 100 | className | | 49 | samplerMode | 102 | layer2packetSectionOffset | | 50 | samplerRandomInterval | 103 | layer2packetSectionSize | | 51 | classId | 104 | layer2packetSectionData | +----+-----------------------+-----+---------------------------+
+----+-----------------------+-----+---------------------------+ | ID | Name | ID | Name | +----+-----------------------+-----+---------------------------+ | 34 | samplingInterval | 84 | samplerName | | 35 | samplingAlgorithm | 87 | flagsAndSamplerId | | 38 | engineType | 89 | forwardingStatus | | 39 | engineId | 92 | srcTrafficIndex | | 43 | ipv4RouterSc | 93 | dstTrafficIndex | | 48 | samplerId | 100 | className | | 49 | samplerMode | 102 | layer2packetSectionOffset | | 50 | samplerRandomInterval | 103 | layer2packetSectionSize | | 51 | classId | 104 | layer2packetSectionData | +----+-----------------------+-----+---------------------------+
Table 1
表1
Description: Deprecated in favor of 305 samplingPacketInterval. When using sampled NetFlow, the rate at which packets are sampled -- e.g., a value of 100 indicates that one of every 100 packets is sampled.
说明:不推荐使用305 samplingPacketInterval。使用采样网络流时,对数据包进行采样的速率,例如,值100表示每100个数据包中有一个进行了采样。
Abstract Data Type: unsigned32
抽象数据类型:unsigned32
ElementId: 34
元素ID:34
Semantics: quantity
语义:数量
Status: deprecated
状态:已弃用
Units: packets
单位:小包
Description: Deprecated in favor of 304 selectorAlgorithm. The type of algorithm used for sampled NetFlow:
描述:不推荐使用304选择器算法。用于采样网络流的算法类型:
1 - Deterministic Sampling,
1-确定性抽样,
2 - Random Sampling.
2-随机抽样。
The values are not compatible with the selectorAlgorithm IE, where "Deterministic" has been replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion is required; see "Packet Sampling (PSAMP) Parameters" [IANA-PSAMP].
这些值与selectorAlgorithm IE不兼容,其中“确定性”已替换为“基于系统计数”(1)或“基于系统时间”(2),“随机”为(3)。需要转换;请参阅“数据包采样(PSAMP)参数”[IANA-PSAMP]。
Abstract Data Type: unsigned8
抽象数据类型:unsigned8
ElementId: 35
元素ID:35
Semantics: identifier
语义:标识符
Status: deprecated
状态:已弃用
Description: Type of flow switching engine in a router/switch:
描述:路由器/交换机中的流交换引擎类型:
RP = 0,
RP=0,
VIP/Line card = 1,
VIP/线路卡=1,
PFC/DFC = 2.
PFC/DFC=2。
Reserved for internal use on the Collector.
保留供收集器内部使用。
Abstract Data Type: unsigned8
抽象数据类型:unsigned8
ElementId: 38
元素ID:38
Semantics: identifier
语义:标识符
Status: deprecated
状态:已弃用
Description: Versatile Interface Processor (VIP) or line card slot number of the flow switching engine in a router/switch. Reserved for internal use on the Collector.
描述:路由器/交换机中流量交换引擎的多功能接口处理器(VIP)或线路卡插槽号。保留供收集器内部使用。
Abstract Data Type: unsigned8
抽象数据类型:unsigned8
ElementId: 39
元素ID:39
Semantics: identifier
语义:标识符
Status: deprecated
状态:已弃用
Description: This is a platform-specific field for the Catalyst 5000/Catalyst 6000 family. It is used to store the address of a router that is being shortcut when performing MultiLayer Switching.
说明:这是Catalyst 5000/Catalyst 6000系列的平台特定字段。它用于存储在执行多层交换时作为快捷方式的路由器的地址。
Abstract Data Type: ipv4Address
抽象数据类型:ipv4Address
ElementId: 43
元素ID:43
Semantics: default
语义:默认值
Status: deprecated
状态:已弃用
Reference: [CCO-MLS] describes MultiLayer Switching.
参考文献:[CCO-MLS]描述了多层交换。
Description: Deprecated in favor of 302 selectorId. The unique identifier associated with samplerName.
说明:不推荐使用302 selectorId。与采样器名称关联的唯一标识符。
Abstract Data Type: unsigned8
抽象数据类型:unsigned8
ElementId: 48
元素ID:48
Semantics: identifier
语义:标识符
Status: deprecated
状态:已弃用
Description: Deprecated in favor of 304 selectorAlgorithm. The values are not compatible: selectorAlgorithm=3 is random sampling. The type of algorithm used for sampling data: 1 - Deterministic, 2 - Random Sampling. Use with samplerRandomInterval.
描述:不推荐使用304选择器算法。这些值不兼容:selectorAlgorithm=3是随机采样。用于采样数据的算法类型:1-确定性,2-随机采样。与采样间隔一起使用。
Abstract Data Type: unsigned8
抽象数据类型:unsigned8
ElementId: 49
元素ID:49
Semantics: identifier
语义:标识符
Status: deprecated
状态:已弃用
Description: Deprecated in favor of 305 samplingPacketInterval. Packet interval at which to sample -- in case of random sampling. Used in connection with the samplerMode 0x02 (random sampling) value.
说明:不推荐使用305 samplingPacketInterval。采样的数据包间隔——在随机采样的情况下。与samplerMode 0x02(随机采样)值一起使用。
Abstract Data Type: unsigned32
抽象数据类型:unsigned32
ElementId: 50
元素ID:50
Semantics: quantity
语义:数量
Status: deprecated
状态:已弃用
Description: Deprecated in favor of 302 selectorId. Characterizes the traffic class, i.e., QoS treatment.
说明:不推荐使用302 selectorId。描述流量类别,即QoS处理。
Abstract Data Type: unsigned8
抽象数据类型:unsigned8
ElementId: 51
元素ID:51
Semantics: identifier
语义:标识符
Status: deprecated
状态:已弃用
Description: Deprecated in favor of 335 selectorName. Name of the flow sampler.
描述:不推荐使用335 selectorName。流量采样器的名称。
Abstract Data Type: string
抽象数据类型:string
ElementId: 84
元素ID:84
Status: deprecated
状态:已弃用
Description: Flow flags and the value of the sampler ID (samplerId) combined in one bitmapped field. Reserved for internal use on the Collector.
描述:流标志和采样器ID(采样器ID)的值组合在一个位图字段中。保留供收集器内部使用。
Abstract Data Type: unsigned32
抽象数据类型:unsigned32
ElementId: 87
元素ID:87
Semantics: identifier
语义:标识符
Status: deprecated
状态:已弃用
Description: This Information Element describes the forwarding status of the flow and any attached reasons. The reduced-size encoding rules as per [RFC7011] apply.
描述:此信息元素描述流的转发状态和任何附加原因。按照[RFC7011]的缩减大小编码规则适用。
The basic encoding is 8 bits. The future extensions could add one or three bytes. The layout of the basic encoding is as follows:
基本编码是8位。未来的扩展可以添加一个或三个字节。基本编码的布局如下所示:
MSB - 0 1 2 3 4 5 6 7 - LSB +---+---+---+---+---+---+---+---+ | Status| Reason code or flags | +---+---+---+---+---+---+---+---+
MSB - 0 1 2 3 4 5 6 7 - LSB +---+---+---+---+---+---+---+---+ | Status| Reason code or flags | +---+---+---+---+---+---+---+---+
Status:
地位:
00b = Unknown 01b = Forwarded 10b = Dropped 11b = Consumed
00b=未知01b=转发10b=丢弃11b=消耗
Reason Code (status = 01b, Forwarded)
原因代码(状态=01b,已转发)
01 000000b = 64 = Unknown 01 000001b = 65 = Fragmented 01 000010b = 66 = Not Fragmented
01 000000b = 64 = Unknown 01 000001b = 65 = Fragmented 01 000010b = 66 = Not Fragmented
Reason Code (status = 10b, Dropped)
原因代码(状态=10b,已删除)
10 000000b = 128 = Unknown 10 000001b = 129 = ACL deny 10 000010b = 130 = ACL drop 10 000011b = 131 = Unroutable 10 000100b = 132 = Adjacency 10 000101b = 133 = Fragmentation and DF set 10 000110b = 134 = Bad header checksum 10 000111b = 135 = Bad total Length 10 001000b = 136 = Bad header length 10 001001b = 137 = bad TTL 10 001010b = 138 = Policer 10 001011b = 139 = WRED 10 001100b = 140 = RPF 10 001101b = 141 = For us 10 001110b = 142 = Bad output interface 10 001111b = 143 = Hardware
10 000000b = 128 = Unknown 10 000001b = 129 = ACL deny 10 000010b = 130 = ACL drop 10 000011b = 131 = Unroutable 10 000100b = 132 = Adjacency 10 000101b = 133 = Fragmentation and DF set 10 000110b = 134 = Bad header checksum 10 000111b = 135 = Bad total Length 10 001000b = 136 = Bad header length 10 001001b = 137 = bad TTL 10 001010b = 138 = Policer 10 001011b = 139 = WRED 10 001100b = 140 = RPF 10 001101b = 141 = For us 10 001110b = 142 = Bad output interface 10 001111b = 143 = Hardware
Reason Code (status = 11b, Consumed)
原因代码(状态=11b,已消耗)
11 000000b = 192 = Unknown 11 000001b = 193 = Punt Adjacency 11 000010b = 194 = Incomplete Adjacency 11 000011b = 195 = For us
11 000000b = 192 = Unknown 11 000001b = 193 = Punt Adjacency 11 000010b = 194 = Incomplete Adjacency 11 000011b = 195 = For us
Examples:
示例:
value : 0x40 = 64 binary: 01000000 decode: 01 -> Forward 000000 -> No further information
value : 0x40 = 64 binary: 01000000 decode: 01 -> Forward 000000 -> No further information
value : 0x89 = 137 binary: 10001001 decode: 10 -> Drop 001001 -> Fragmentation and DF set
value : 0x89 = 137 binary: 10001001 decode: 10 -> Drop 001001 -> Fragmentation and DF set
Abstract Data Type: unsigned32
抽象数据类型:unsigned32
ElementId: 89
元素ID:89
Semantics: identifier
语义:标识符
Status: current
状态:当前
Reference: See "NetFlow Version 9 Flow-Record Format" [CCO-NF9FMT].
参考:见“NetFlow版本9流量记录格式”[CCO-NF9FMT]。
Description: BGP Policy Accounting Source Traffic Index.
描述:BGP策略记帐源流量索引。
Abstract Data Type: unsigned32
抽象数据类型:unsigned32
ElementId: 92
元素ID:92
Semantics: identifier
语义:标识符
Status: current
状态:当前
Reference: BGP policy accounting as described in [CCO-BGPPOL].
参考:BGP政策会计,如[CCO-BGPPOL]所述。
Description: BGP Policy Accounting Destination Traffic Index.
描述:BGP策略记帐目标流量索引。
Abstract Data Type: unsigned32
抽象数据类型:unsigned32
ElementId: 93
元素ID:93
Semantics: identifier
语义:标识符
Status: current
状态:当前
Reference: BGP policy accounting as described in [CCO-BGPPOL].
参考:BGP政策会计,如[CCO-BGPPOL]所述。
Description: Deprecated in favor of 335 selectorName. Traffic Class Name, associated with the classId Information Element.
描述:不推荐使用335 selectorName。与classId信息元素关联的流量类名称。
Abstract Data Type: string
抽象数据类型:string
ElementId: 100
元素ID:100
Status: deprecated
状态:已弃用
Description: Deprecated in favor of 409 sectionOffset. Layer 2 packet section offset. Potentially a generic packet section offset.
说明:不推荐使用409 sectionOffset。第2层包段偏移量。可能是通用数据包段偏移量。
Abstract Data Type: unsigned16
抽象数据类型:unsigned16
ElementId: 102
元素ID:102
Semantics: quantity
语义:数量
Status: deprecated
状态:已弃用
Description: Deprecated in favor of 312 dataLinkFrameSize. Layer 2 packet section size. Potentially a generic packet section size.
说明:不推荐使用312 dataLinkFrameSize。第2层数据包部分大小。可能是通用数据包节大小。
Abstract Data Type: unsigned16
抽象数据类型:unsigned16
ElementId: 103
元素ID:103
Semantics: quantity
语义:数量
Status: deprecated
状态:已弃用
Description: Deprecated in favor of 315 dataLinkFrameSection. Layer 2 packet section data.
说明:不推荐使用315 dataLinkFrameSection。第2层包段数据。
Abstract Data Type: octetArray
抽象数据类型:Octeraray
ElementId: 104
元素ID:104
Status: deprecated
状态:已弃用
ElementId: 65 .. 69
元素ID:65。。69
Performance metrics will need a consolidation in the industry, based on [RFC6390]. Once this consolidation happens, via a separate document the IEs 65-69 will either be assigned in the IANA registry or their status will be deprecated.
性能指标需要根据[RFC6390]在行业内进行整合。一旦发生这种整合,IEs 65-69将通过单独的文档在IANA注册表中分配,或者其状态将被弃用。
ElementId: 94 .. 96
元素ID:94。。96
ElementId: 101
元素ID:101
Please refer to [RFC6759].
请参考[RFC6759]。
ElementId: 105..127
元素ID:105..127
These element IDs are not covered by this document and are left "as is", i.e., for NetFlow v9 compatibility.
这些元素ID不包含在本文档中,而是保留为“原样”,即为了与NetFlow v9兼容。
This document specifies several new IPFIX Information Elements in IANA's "IPFIX Information Elements" registry [IANA-IPFIX] as summarized in Section 3 and detailed in Section 4 above. The following Information Elements have been assigned:
本文件规定了IANA“IPFIX信息元素”注册表[IANA-IPFIX]中的几个新IPFIX信息元素,如第3节所述,并在上文第4节中详细说明。已分配以下信息元素:
o IE Number 34 for the samplingInterval IE
o 第34号IE用于采样间隔IE
o IE Number 35 for the samplingAlgorithm IE
o 抽样算法的第35号IE
o IE Number 38 for the engineType IE
o 发动机类型IE的38号IE
o IE Number 39 for the engineId IE
o 发动机编号39
o IE Number 43 for the ipv4RouterSc IE
o ipv4RouterSc IE的IE编号43
o IE Number 48 for the samplerId IE
o 取样器ID IE的IE编号48
o IE Number 49 for the samplerMode IE
o 用于采样器模式IE的49号IE
o IE Number 50 for the samplerRandomInterval IE
o 采样器随机间隔的IE编号50
o IE Number 51 for the classId IE
o 第51号IE为classId IE
o IE Number 84 for the samplerName IE
o 取样器名称IE编号84
o IE Number 87 for the flagsAndSamplerId IE
o 用于旗杆和采样器ID的87号IE
o IE Number 89 for the forwardingStatus IE
o 货运公司的第89号IE
o IE Number 92 for the srcTrafficIndex IE
o SRCTRAFFICE索引的IE编号92
o IE Number 93 for the dstTrafficIndex IE
o DST流量索引的93号IE
o IE Number 100 for the className IE
o IE编号100表示类名IE
o IE Number 102 for the layer2packetSectionOffset IE
o 第2层包装部分的102号IE偏移IE
o IE Number 103 for the layer2packetSectionSize IE
o 第103层的IE编号2包装截面尺寸IE
o IE Number 104 for the layer2packetSectionData IE
o 用于LayerPacketSectionData IE的IE编号104
This document specifies the definitions of several Information Elements and does not alter the security considerations of the base protocol. Please refer to the security considerations sections of [RFC3954] and [RFC7012].
本文件规定了若干信息元素的定义,并没有改变基本协议的安全考虑。请参阅[RFC3954]和[RFC7012]中的安全注意事项部分。
[RFC7011] Claise, B., Trammell, B., and P. Aitken, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information", STD 77, RFC 7011, September 2013.
[RFC7011]Claise,B.,Trammell,B.,和P.Aitken,“流量信息交换的IP流量信息导出(IPFIX)协议规范”,STD 77,RFC 7011,2013年9月。
[CCO-BGPPOL] Cisco, "BGP Policy Accounting and BGP Policy Accounting Output Interface Accounting Features", December 2005, <http://www.cisco.com/en/US/tech/tk365/ technologies_tech_note09186a0080094e88.shtml>.
[CCO-BGPPOL]思科,“BGP政策会计和BGP政策会计输出接口会计功能”,2005年12月<http://www.cisco.com/en/US/tech/tk365/ technologies\u tech\u note09186a0080094e88.shtml>。
[CCO-MLS] Cisco, "IP MultiLayer Switching Sample Configuration", November 2007, <http://www.cisco.com/en/US/products/hw/switches/ps700/ products_configuration_example09186a00800ab513.shtml>.
[CCO-MLS]Cisco,“IP多层交换示例配置”,2007年11月<http://www.cisco.com/en/US/products/hw/switches/ps700/ 产品配置示例09186A00800AB513.shtml>。
[CCO-NF9FMT] Cisco, "NetFlow Version 9 Flow-Record Format", May 2011, <http://www.cisco.com/en/US/technologies/tk648/tk362/ technologies_white_paper09186a00800a3db9.html>.
[CCO-NF9FMT]思科,“NetFlow版本9流量记录格式”,2011年5月<http://www.cisco.com/en/US/technologies/tk648/tk362/ technologies\u white\u paper09186a00800a3db9.html>。
[IANA-IPFIX] IANA, "IP Flow Information Export (IPFIX) Entities", <http://www.iana.org/assignments/ipfix/>.
[IANA-IPFIX]IANA,“IP流信息导出(IPFIX)实体”<http://www.iana.org/assignments/ipfix/>.
[IANA-PSAMP] IANA, "Packet Sampling (PSAMP) Parameters", <http://www.iana.org/assignments/psamp-parameters/>.
[IANA-PSAMP]IANA,“数据包采样(PSAMP)参数”<http://www.iana.org/assignments/psamp-parameters/>.
[RFC3954] Claise, B., "Cisco Systems NetFlow Services Export Version 9", RFC 3954, October 2004.
[RFC3954]Claise,B.,“Cisco Systems NetFlow服务导出版本9”,RFC 3954,2004年10月。
[RFC6390] Clark, A. and B. Claise, "Guidelines for Considering New Performance Metric Development", BCP 170, RFC 6390, October 2011.
[RFC6390]Clark,A.和B.Claise,“考虑新性能指标开发的指南”,BCP 170,RFC 63902011年10月。
[RFC6759] Claise, B., Aitken, P., and N. Ben-Dvora, "Cisco Systems Export of Application Information in IP Flow Information Export (IPFIX)", RFC 6759, November 2012.
[RFC6759]Claise,B.,Aitken,P.,和N.Ben Dvora,“思科系统在IP流信息导出(IPFIX)中导出应用程序信息”,RFC 6759,2012年11月。
[RFC7012] Claise, B. and B. Trammell, "Information Model for IP Flow Information Export (IPFIX)", RFC 7012, September 2013.
[RFC7012]Claise,B.和B.Trammell,“IP流信息导出(IPFIX)的信息模型”,RFC 7012,2013年9月。
[RFC7013] Trammell, B. and B. Claise, "Guidelines for Authors and Reviewers of IP Flow Information Export (IPFIX) Information Elements", BCP 184, RFC 7013, September 2013.
[RFC7013]Trammell,B.和B.Claise,“IP流信息导出(IPFIX)信息元素的作者和评审员指南”,BCP 184,RFC 7013,2013年9月。
<?xml version="1.0" encoding="UTF-8"?>
<?xml version="1.0" encoding="UTF-8"?>
<fieldDefinitions xmlns="urn:ietf:params:xml:ns:ipfix-info" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:ietf:params:xml:ns:ipfix-info ipfix-info.xsd">
<fieldDefinitions xmlns="urn:ietf:params:xml:ns:ipfix-info" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:ietf:params:xml:ns:ipfix-info ipfix-info.xsd">
<field name="samplingInterval" dataType="unsigned32" group="" dataTypeSemantics="quantity" elementId="34" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 305 samplingPacketInterval. When using sampled NetFlow, the rate at which packets are sampled -- e.g., a value of 100 indicates that one of every 100 packets is sampled. </paragraph> </description> </field> <field name="samplingAlgorithm" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="35" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 304 selectorAlgorithm. The type of algorithm used for sampled NetFlow: 1 - Deterministic Sampling, 2 - Random Sampling. The values are not compatible with the selectorAlgorithm IE, where "Deterministic" has been replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion is required; see [IANA-PSAMP] PSAMP parameters. </paragraph> </description> </field> <field name="engineType" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="38" applicability="flow" status="deprecated"> <description> <paragraph> Type of flow switching engine in a router/switch: RP = 0, VIP/Line card = 1, PFC/DFC = 2. Reserved for internal use on the Collector. </paragraph>
<field name="samplingInterval" dataType="unsigned32" group="" dataTypeSemantics="quantity" elementId="34" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 305 samplingPacketInterval. When using sampled NetFlow, the rate at which packets are sampled -- e.g., a value of 100 indicates that one of every 100 packets is sampled. </paragraph> </description> </field> <field name="samplingAlgorithm" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="35" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 304 selectorAlgorithm. The type of algorithm used for sampled NetFlow: 1 - Deterministic Sampling, 2 - Random Sampling. The values are not compatible with the selectorAlgorithm IE, where "Deterministic" has been replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion is required; see [IANA-PSAMP] PSAMP parameters. </paragraph> </description> </field> <field name="engineType" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="38" applicability="flow" status="deprecated"> <description> <paragraph> Type of flow switching engine in a router/switch: RP = 0, VIP/Line card = 1, PFC/DFC = 2. Reserved for internal use on the Collector. </paragraph>
</description> </field> <field name="engineId" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="39" applicability="flow" status="deprecated"> <description> <paragraph> Versatile Interface Processor (VIP) or line card slot number of the flow switching engine in a router/switch. Reserved for internal use on the Collector. </paragraph> </description> </field> <field name="ipv4RouterSc" dataType="ipv4Address" group="" dataTypeSemantics="default" elementId="43" applicability="flow" status="deprecated"> <description> <paragraph> This is a platform-specific field for the Catalyst 5000/Catalyst 6000 family. It is used to store the address of a router that is being shortcut when performing MultiLayer Switching. </paragraph> </description> <reference> http://www.cisco.com/en/US/products/hw/switches/ps700/ products_configuration_example09186a00800ab513.shtml describes MultiLayer Switching. </reference> </field> <field name="samplerId" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="48" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 302 selectorId. The unique identifier associated with samplerName. </paragraph> </description> </field> <field name="samplerMode" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="49" applicability="flow" status="deprecated"> <description> <paragraph>
</description> </field> <field name="engineId" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="39" applicability="flow" status="deprecated"> <description> <paragraph> Versatile Interface Processor (VIP) or line card slot number of the flow switching engine in a router/switch. Reserved for internal use on the Collector. </paragraph> </description> </field> <field name="ipv4RouterSc" dataType="ipv4Address" group="" dataTypeSemantics="default" elementId="43" applicability="flow" status="deprecated"> <description> <paragraph> This is a platform-specific field for the Catalyst 5000/Catalyst 6000 family. It is used to store the address of a router that is being shortcut when performing MultiLayer Switching. </paragraph> </description> <reference> http://www.cisco.com/en/US/products/hw/switches/ps700/ products_configuration_example09186a00800ab513.shtml describes MultiLayer Switching. </reference> </field> <field name="samplerId" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="48" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 302 selectorId. The unique identifier associated with samplerName. </paragraph> </description> </field> <field name="samplerMode" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="49" applicability="flow" status="deprecated"> <description> <paragraph>
Deprecated in favor of 304 selectorAlgorithm. The values are not compatible: selectorAlgorithm=3 is random sampling. The type of algorithm used for sampled NetFlow: 1 - Deterministic Sampling, 2 - Random Sampling. Use with samplerRandomInterval. </paragraph> </description> </field> <field name="samplerRandomInterval" dataType="unsigned32" group="" dataTypeSemantics="quantity" elementId="50" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 305 samplingPacketInterval. Packet interval at which to sample -- in case of random sampling. Used in connection with the samplerMode 0x02 (random sampling) value. </paragraph> </description> </field> <field name="classId" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="51" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 302 selectorId. Characterizes the traffic class, i.e., QoS treatment. </paragraph> </description> </field> <field name="samplerName" dataType="string" group="" dataTypeSemantics="" elementId="84" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 335 selectorName. Name of the flow sampler. </paragraph> </description> </field> <field name="flagsAndSamplerId" dataType="unsigned32" group="" dataTypeSemantics="identifier" elementId="87" applicability="flow" status="deprecated"> <description> <paragraph> Flow flags and the value of the sampler ID (samplerId) combined
Deprecated in favor of 304 selectorAlgorithm. The values are not compatible: selectorAlgorithm=3 is random sampling. The type of algorithm used for sampled NetFlow: 1 - Deterministic Sampling, 2 - Random Sampling. Use with samplerRandomInterval. </paragraph> </description> </field> <field name="samplerRandomInterval" dataType="unsigned32" group="" dataTypeSemantics="quantity" elementId="50" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 305 samplingPacketInterval. Packet interval at which to sample -- in case of random sampling. Used in connection with the samplerMode 0x02 (random sampling) value. </paragraph> </description> </field> <field name="classId" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="51" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 302 selectorId. Characterizes the traffic class, i.e., QoS treatment. </paragraph> </description> </field> <field name="samplerName" dataType="string" group="" dataTypeSemantics="" elementId="84" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 335 selectorName. Name of the flow sampler. </paragraph> </description> </field> <field name="flagsAndSamplerId" dataType="unsigned32" group="" dataTypeSemantics="identifier" elementId="87" applicability="flow" status="deprecated"> <description> <paragraph> Flow flags and the value of the sampler ID (samplerId) combined
in one bitmapped field. Reserved for internal use on the Collector. </paragraph> </description> </field> <field name="forwardingStatus" dataType="unsigned32" group="" dataTypeSemantics="identifier" elementId="89" applicability="flow" status="current"> <description> <paragraph> This Information Element describes the forwarding status of the flow and any attached reasons. The reduced-size encoding rules as per [RFC7011] apply. </paragraph> <artwork> The basic encoding is 8 bits. The future extensions could add one or three bytes. The layout of the basic encoding is as follows:
在一个位图字段中。保留供收集器内部使用</段落></description></field><field name=“forwardingStatus”dataType=“unsigned32”group=”“dataTypeSemantics=“identifier”elementId=“89”affiliability=“flow”status=“current”><description><paration>此信息元素描述流的转发状态和任何附加原因。按照[RFC7011]的缩减大小编码规则适用</段落><artwork>基本编码为8位。未来的扩展可以添加一个或三个字节。基本编码的布局如下所示:
MSB - 0 1 2 3 4 5 6 7 - LSB +---+---+---+---+---+---+---+---+ | Status| Reason code or flags | +---+---+---+---+---+---+---+---+ Status:
MSB - 0 1 2 3 4 5 6 7 - LSB +---+---+---+---+---+---+---+---+ | Status| Reason code or flags | +---+---+---+---+---+---+---+---+ Status:
00b = Unknown 01b = Forwarded 10b = Dropped 11b = Consumed
00b=未知01b=转发10b=丢弃11b=消耗
Reason Code (status = 01b, Forwarded)
原因代码(状态=01b,已转发)
01 000000b = 64 = Unknown 01 000001b = 65 = Fragmented 01 000010b = 66 = Not Fragmented
01 000000b = 64 = Unknown 01 000001b = 65 = Fragmented 01 000010b = 66 = Not Fragmented
Reason Code (status = 10b, Dropped)
原因代码(状态=10b,已删除)
10 000000b = 128 = Unknown 10 000001b = 129 = ACL deny 10 000010b = 130 = ACL drop 10 000011b = 131 = Unroutable 10 000100b = 132 = Adjacency 10 000101b = 133 = Fragmentation and DF set 10 000110b = 134 = Bad header checksum 10 000111b = 135 = Bad total Length 10 001000b = 136 = Bad header length
10 000000b = 128 = Unknown 10 000001b = 129 = ACL deny 10 000010b = 130 = ACL drop 10 000011b = 131 = Unroutable 10 000100b = 132 = Adjacency 10 000101b = 133 = Fragmentation and DF set 10 000110b = 134 = Bad header checksum 10 000111b = 135 = Bad total Length 10 001000b = 136 = Bad header length
10 001001b = 137 = bad TTL 10 001010b = 138 = Policer 10 001011b = 139 = WRED 10 001100b = 140 = RPF 10 001101b = 141 = For us 10 001110b = 142 = Bad output interface 10 001111b = 143 = Hardware
10 001001b = 137 = bad TTL 10 001010b = 138 = Policer 10 001011b = 139 = WRED 10 001100b = 140 = RPF 10 001101b = 141 = For us 10 001110b = 142 = Bad output interface 10 001111b = 143 = Hardware
Reason Code (status = 11b, Consumed)
原因代码(状态=11b,已消耗)
11 000000b = 192 = Unknown 11 000001b = 193 = Punt Adjacency 11 000010b = 194 = Incomplete Adjacency 11 000011b = 195 = For us
11 000000b = 192 = Unknown 11 000001b = 193 = Punt Adjacency 11 000010b = 194 = Incomplete Adjacency 11 000011b = 195 = For us
Examples:
示例:
value : 0x40 = 64 binary: 01000000 decode: 01 -> Forward 000000 -> No further information
value : 0x40 = 64 binary: 01000000 decode: 01 -> Forward 000000 -> No further information
value : 0x89 = 137 binary: 10001001 decode: 10 -> Drop 001001 -> Fragmentation and DF set </artwork> </description> <reference> See http://www.cisco.com/en/US/technologies/tk648/tk362/ technologies_white_paper09186a00800a3db9.html - NetFlow Version 9 Flow-Record Format. </reference> </field> <field name="srcTrafficIndex" dataType="unsigned32" group="" dataTypeSemantics="identifier" elementId="92" applicability="flow" status="current"> <description> <paragraph> BGP Policy Accounting Source Traffic Index. </paragraph> </description> <reference> BGP policy accounting as described in http://www.cisco.com/en/US/tech/tk365/ technologies_tech_note09186a0080094e88.shtml </reference>
value : 0x89 = 137 binary: 10001001 decode: 10 -> Drop 001001 -> Fragmentation and DF set </artwork> </description> <reference> See http://www.cisco.com/en/US/technologies/tk648/tk362/ technologies_white_paper09186a00800a3db9.html - NetFlow Version 9 Flow-Record Format. </reference> </field> <field name="srcTrafficIndex" dataType="unsigned32" group="" dataTypeSemantics="identifier" elementId="92" applicability="flow" status="current"> <description> <paragraph> BGP Policy Accounting Source Traffic Index. </paragraph> </description> <reference> BGP policy accounting as described in http://www.cisco.com/en/US/tech/tk365/ technologies_tech_note09186a0080094e88.shtml </reference>
</field> <field name="dstTrafficIndex" dataType="unsigned32" group="" dataTypeSemantics="identifier" elementId="93" applicability="flow" status="current"> <description> <paragraph> BGP Policy Accounting Destination Traffic Index. </paragraph> </description> <reference> BGP policy accounting as described in http://www.cisco.com/en/US/tech/tk365/ technologies_tech_note09186a0080094e88.shtml </reference> </field> <field name="className" dataType="string" group="" dataTypeSemantics="" elementId="100" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 335 selectorName. Traffic Class Name, associated with the classId Information Element. </paragraph> </description> </field> <field name="layer2packetSectionOffset" dataType="unsigned16" group="" dataTypeSemantics="quantity" elementId="102" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 409 sectionOffset. Layer 2 packet section offset. Potentially a generic packet section offset. </paragraph> </description> </field> <field name="layer2packetSectionSize" dataType="unsigned16" group="" dataTypeSemantics="quantity" elementId="103" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 312 dataLinkFrameSize. Layer 2 packet section size. Potentially a generic packet section size.
</field> <field name="dstTrafficIndex" dataType="unsigned32" group="" dataTypeSemantics="identifier" elementId="93" applicability="flow" status="current"> <description> <paragraph> BGP Policy Accounting Destination Traffic Index. </paragraph> </description> <reference> BGP policy accounting as described in http://www.cisco.com/en/US/tech/tk365/ technologies_tech_note09186a0080094e88.shtml </reference> </field> <field name="className" dataType="string" group="" dataTypeSemantics="" elementId="100" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 335 selectorName. Traffic Class Name, associated with the classId Information Element. </paragraph> </description> </field> <field name="layer2packetSectionOffset" dataType="unsigned16" group="" dataTypeSemantics="quantity" elementId="102" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 409 sectionOffset. Layer 2 packet section offset. Potentially a generic packet section offset. </paragraph> </description> </field> <field name="layer2packetSectionSize" dataType="unsigned16" group="" dataTypeSemantics="quantity" elementId="103" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 312 dataLinkFrameSize. Layer 2 packet section size. Potentially a generic packet section size.
</paragraph> </description> </field> <field name="layer2packetSectionData" dataType="octetArray" group="" dataTypeSemantics="" elementId="104" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 315 dataLinkFrameSection. Layer 2 packet section data. </paragraph> </description> </field> </fieldDefinitions>
</paragraph> </description> </field> <field name="layer2packetSectionData" dataType="octetArray" group="" dataTypeSemantics="" elementId="104" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 315 dataLinkFrameSection. Layer 2 packet section data. </paragraph> </description> </field> </fieldDefinitions>
Authors' Addresses
作者地址
Andrew Yourtchenko Cisco Systems, Inc. De Kleetlaan, 7 Brussels, Diegem B-1831 Belgium
Andrew Yourtchenko Cisco Systems,Inc.De Kleetlaan,布鲁塞尔7号,Diegem B-1831比利时
Phone: +32 2 704 5494 EMail: ayourtch@cisco.com
Phone: +32 2 704 5494 EMail: ayourtch@cisco.com
Paul Aitken Cisco Systems, Inc. 96 Commercial Quay Edinburgh EH6 6LX Scotland
Paul Aitken Cisco Systems,Inc.96爱丁堡商业码头EH6 6LX苏格兰
Phone: +44 131 561 3616 EMail: paitken@cisco.com
Phone: +44 131 561 3616 EMail: paitken@cisco.com
Benoit Claise Cisco Systems, Inc. De Kleetlaan, 6a b1 Diegem B-1831 Belgium
Benoit Claise Cisco Systems,Inc.De Kleetlaan,6a b1 Diegem B-1831比利时
Phone: +32 2 704 5622 EMail: bclaise@cisco.com
Phone: +32 2 704 5622 EMail: bclaise@cisco.com