|
Network Working Group Request for Comments: 3954 Category: Informational |
B. Claise, Ed. Cisco Systems October 2004 |
This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.
Copyright © The Internet Society (2004).
This RFC documents the NetFlow services export protocol Version 9 as it was when submitted to the IETF as a basis for further work in the IPFIX WG.
This RFC itself is not a candidate for any level of Internet Standard. The IETF disclaims any knowledge of the fitness of this RFC for any purpose, and in particular notes that it has not had complete IETF review for such things as security, congestion control, or inappropriate interaction with deployed protocols. The RFC Editor has chosen to publish this document at its discretion.
This document specifies the data export format for version 9 of Cisco Systems' NetFlow services, for use by implementations on the network elements and/or matching collector programs. The version 9 export format uses templates to provide access to observations of IP packet flows in a flexible and extensible manner. A template defines a collection of fields, with corresponding descriptions of structure and semantics.
1. Introduction
2. Terminology
2.1. Terminology Summary Table
3. NetFlow High-Level Picture on the Exporter
3.1. The NetFlow Process on the Exporter
3.2. Flow Expiration
3.3. Transport Protocol
4. Packet Layout
5. Export Packet Format
5.1. Header Format
5.2. Template FlowSet Format
5.3. Data FlowSet Format
6. Options
6.1. Options Template FlowSet Format
6.2. Options Data Record Format
7. Template Management
8. Field Type Definitions
9. The Collector Side
10. Security Considerations
10.1. Disclosure of Flow Information Data
10.2. Forgery of Flow Records or Template Records
10.3. Attacks on the NetFlow Collector
11. Examples
11.1. Packet Header Example
11.2. Template FlowSet Example
11.3. Data FlowSet Example
11.4. Options Template FlowSet Example
11.5. Data FlowSet with Options Data Records Example
12. References
12.1. Normative References
12.2. Informative References
13. Authors
14. Acknowledgments
15. Authors' Addresses
16. Full Copyright Statement
Cisco Systems' NetFlow services provide network administrators with access to IP flow information from their data networks. Network elements (routers and switches) gather flow data and export it to collectors. The collected data provides fine-grained metering for highly flexible and detailed resource usage accounting.
A flow is defined as a unidirectional sequence of packets with some common properties that pass through a network device. These collected flows are exported to an external device, the NetFlow collector. Network flows are highly granular; for example, flow records include details such as IP addresses, packet and byte counts, timestamps, Type of Service (ToS), application ports, input and output interfaces, etc.
Exported NetFlow data is used for a variety of purposes, including enterprise accounting and departmental chargebacks, ISP billing, data
warehousing, network monitoring, capacity planning, application monitoring and profiling, user monitoring and profiling, security analysis, and data mining for marketing purposes.
This document specifies NetFlow version 9. It describes the implementation specifications both from network element and NetFlow collector points of view. These specifications should help the deployment of NetFlow version 9 across different platforms and different vendors by limiting the interoperability risks. The NetFlow export format version 9 uses templates to provide access to observations of IP packet flows in a flexible and extensible manner.
A template defines a collection of fields, with corresponding descriptions of structure and semantics.
The template-based approach provides the following advantages:
- New fields can be added to NetFlow flow records without
changing the structure of the export record format. With
previous NetFlow versions, adding a new field in the flow
record implied a new version of the export protocol format and
a new version of the NetFlow collector that supported the
parsing of the new export protocol format.
- Templates that are sent to the NetFlow collector contain the
structural information about the exported flow record fields;
therefore, if the NetFlow collector does not understand the
semantics of new fields, it can still interpret the flow
record.
- Because the template mechanism is flexible, it allows the
export of only the required fields from the flows to the
NetFlow collector. This helps to reduce the exported flow data
volume and provides possible memory savings for the exporter
and NetFlow collector. Sending only the required information
can also reduce network load.
The IETF IPFIX Working Group (IP Flow Information eXport) is developing a new protocol, based on the version 9 of Cisco Systems' NetFlow services. Some enhancements in different domains (congestion aware transport protocol, built-in security, etc... ) have been incorporated in this new IPFIX protocol. Refer to the IPFIX Working Group documents for more details.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14, RFC 2119 [RFC2119].
Various terms used in this document are described in this section. Note that the terminology summary table in Section 2.1 gives a quick overview of the relationships between some of the different terms defined.
Observation Point
An Observation Point is a location in the network where IP packets
can be observed; for example, one or a set of interfaces on a network
device like a router. Every Observation Point is associated with an
Observation Domain.
Observation Domain
The set of Observation Points that is the largest aggregatable set of
flow information at the network device with NetFlow services enabled
is termed an Observation Domain. For example, a router line card
composed of several interfaces with each interface being an
Observation Point.
IP Flow or Flow
An IP Flow, also called a Flow, is defined as a set of IP packets
passing an Observation Point in the network during a certain time
interval. All packets that belong to a particular Flow have a set of
common properties derived from the data contained in the packet and
from the packet treatment at the Observation Point.
Flow Record
A Flow Record provides information about an IP Flow observed at an
Observation Point. In this document, the Flow Data Records are also
referred to as NetFlow services data and NetFlow data.
Exporter
A device (for example, a router) with the NetFlow services enabled,
the Exporter monitors packets entering an Observation Point and
creates Flows from these packets. The information from these Flows
is exported in the form of Flow Records to the NetFlow Collector.
NetFlow Collector
The NetFlow Collector receives Flow Records from one or more
Exporters. It processes the received Export Packet(s); that is, it
parses and stores the Flow Record information. Flow Records can be
optionally aggregated before being stored on the hard disk. The
NetFlow Collector is also referred to as the Collector in this
document.
Export Packet
An Export Packet is a packet originating at the Exporter that carries
the Flow Records of this Exporter and whose destination is the
NetFlow Collector.
Packet Header
The Packet Header is the first part of an Export Packet. The Packet
Header provides basic information about the packet such as the
NetFlow version, number of records contained within the packet, and
sequence numbering.
Template Record
A Template Record defines the structure and interpretation of fields
in a Flow Data Record.
Flow Data Record
A Flow Data Record is a data record that contains values of the Flow
parameters corresponding to a Template Record.
Options Template Record
An Options Template Record defines the structure and interpretation
of fields in an Options Data Record, including defining the scope
within which the Options Data Record is relevant.
Options Data Record
The data record that contains values and scope information of the
Flow measurement parameters, corresponding to an Options Template
Record.
FlowSet
FlowSet is a generic term for a collection of Flow Records that have
a similar structure. In an Export Packet, one or more FlowSets
follow the Packet Header. There are three different types of
FlowSets: Template FlowSet, Options Template FlowSet, and Data
FlowSet.
Template FlowSet
A Template FlowSet is one or more Template Records that have been
grouped together in an Export Packet.
Options Template FlowSet
An Options Template FlowSet is one or more Options Template Records
that have been grouped together in an Export Packet.
Data FlowSet
A Data FlowSet is one or more records, of the same type, that are
grouped together in an Export Packet. Each record is either a Flow
Data Record or an Options Data Record previously defined by a
Template Record or an Options Template Record.
+------------------+---------------------------------------------+ | | Contents | | +--------------------+------------------------+ | FlowSet | Template Record | Data Record | +------------------+--------------------+------------------------+ | | | Flow Data Record(s) | | Data FlowSet | / | or | | | | Options Data Record(s) | +------------------+--------------------+------------------------+ | Template FlowSet | Template Record(s) | / | +------------------+--------------------+------------------------+ | Options Template | Options Template | / | | FlowSet | Record(s) | | +------------------+--------------------+------------------------+
A Data FlowSet is composed of an Options Data Record(s) or Flow Data Record(s). No Template Record is included. A Template Record defines the Flow Data Record, and an Options Template Record defines the Options Data Record.
A Template FlowSet is composed of Template Record(s). No Flow or Options Data Record is included.
An Options Template FlowSet is composed of Options Template Record(s). No Flow or Options Data Record is included.
The NetFlow process on the Exporter is responsible for the creation of Flows from the observed IP packets. The details of this process are beyond the scope of this document.
A Flow is considered to be inactive if no packets belonging to the Flow have been observed at the Observation Point for a given timeout. If any packet is seen within the timeout, the flow is considered an active flow. A Flow can be exported under the following conditions:
To achieve efficiency in terms of processing at the Exporter while handling high volumes of Export Packets, the NetFlow Export Packets are encapsulated into UDP [RFC768] datagrams for export to the NetFlow Collector. However, NetFlow version 9 has been designed to be transport protocol independent. Hence, it can also operate over congestion-aware protocols such as SCTP [RFC2960].
Note that the Exporter can export to multiple Collectors, using independent transport protocols.
UDP [RFC768] is a non congestion-aware protocol, so when deploying NetFlow version 9 in a congestion-sensitive environment, make the connection between Exporter and NetFlow Collector through a dedicated link. This ensures that any burstiness in the NetFlow traffic affects only this dedicated link. When the NetFlow Collector can not be placed within a one-hop distance from the Exporter or when the export path from the Exporter to the NetFlow Collector can not be exclusively used for the NetFlow Export Packets, the export path should be designed so that it can always sustain the maximum burstiness of NetFlow traffic from the Exporter. Note that the congestion can occur on the Exporter in case the export path speed is too low.
An Export Packet consists of a Packet Header followed by one or more FlowSets. The FlowSets can be any of the possible three types: Template, Data, or Options Template.
+--------+-------------------------------------------+
| | +----------+ +---------+ +----------+ |
| Packet | | Template | | Data | | Options | |
| Header | | FlowSet | | FlowSet | | Template | ... |
| | | | | | | FlowSet | |
| | +----------+ +---------+ +----------+ |
+--------+-------------------------------------------+
Export Packet
A FlowSet ID is used to distinguish the different types of FlowSets. FlowSet IDs lower than 256 are reserved for special FlowSets, such as the Template FlowSet (ID 0) and the Options Template FlowSet (ID 1). The Data FlowSets have a FlowSet ID greater than 255.
The format of the Template, Data, and Options Template FlowSets will be discussed later in this document. The Exporter MUST code all binary integers of the Packet Header and the different FlowSets in network byte order (also known as the big-endian byte ordering).
Following are some examples of export packets:
Export Packet:
+--------+--------------------------------------------------------+ | | +----------+ +---------+ +-----------+ +---------+ | | Packet | | Template | | Data | | Options | | Data | | | Header | | FlowSet | | FlowSet | ... | Template | | FlowSet | | | | | | | | | FlowSet | | | | | | +----------+ +---------+ +-----------+ +---------+ | +--------+--------------------------------------------------------+
Export Packet:
+--------+----------------------------------------------+ | | +---------+ +---------+ +---------+ | | Packet | | Data | ... | Data | ... | Data | | | Header | | FlowSet | ... | FlowSet | ... | FlowSet | | | | +---------+ +---------+ +---------+ | +--------+----------------------------------------------+
Export Packet:
+--------+-------------------------------------------------+ | | +----------+ +----------+ +----------+ | | Packet | | Template | | Template | | Options | | | Header | | FlowSet | ... | FlowSet | ... | Template | | | | | | | | | FlowSet | | | | +----------+ +----------+ +----------+ | +--------+-------------------------------------------------+
The Packet Header format is specified as:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version Number | Count |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| sysUpTime |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| UNIX Secs |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Packet Header Field Descriptions
Version
Version of Flow Record format exported in this packet. The
value of this field is 9 for the current version.
Count
The total number of records in the Export Packet, which is the
sum of Options FlowSet records, Template FlowSet records, and
Data FlowSet records.
sysUpTime
Time in milliseconds since this device was first booted.
UNIX Secs
Time in seconds since 0000 UTC 1970, at which the Export Packet
leaves the Exporter.
Sequence Number
Incremental sequence counter of all Export Packets sent from
the current Observation Domain by the Exporter. This value
MUST be cumulative, and SHOULD be used by the Collector to
identify whether any Export Packets have been missed.
Source ID
A 32-bit value that identifies the Exporter Observation Domain.
NetFlow Collectors SHOULD use the combination of the source IP
address and the Source ID field to separate different export
streams originating from the same Exporter.
One of the essential elements in the NetFlow format is the Template FlowSet. Templates greatly enhance the flexibility of the Flow Record format because they allow the NetFlow Collector to process Flow Records without necessarily knowing the interpretation of all the data in the Flow Record. The format of the Template FlowSet is as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 0 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID 256 | Field Count |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type 1 | Field Length 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type 2 | Field Length 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type N | Field Length N |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID 257 | Field Count |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type 1 | Field Length 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type 2 | Field Length 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type M | Field Length M |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID K | Field Count |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Template FlowSet Field Descriptions
FlowSet ID
FlowSet ID value of 0 is reserved for the Template FlowSet.
Length
Total length of this FlowSet. Because an individual Template
FlowSet MAY contain multiple Template Records, the Length value
MUST be used to determine the position of the next FlowSet
record, which could be any type of FlowSet. Length is the sum
of the lengths of the FlowSet ID, the Length itself, and all
Template Records within this FlowSet.
Template ID
Each of the newly generated Template Records is given a unique
Template ID. This uniqueness is local to the Observation
Domain that generated the Template ID. Template IDs 0-255 are
reserved for Template FlowSets, Options FlowSets, and other
reserved FlowSets yet to be created. Template IDs of Data
FlowSets are numbered from 256 to 65535.
Field Count
Number of fields in this Template Record. Because a Template
FlowSet usually contains multiple Template Records, this field
allows the Collector to determine the end of the current
Template Record and the start of the next.
Field Type
A numeric value that represents the type of the field. Refer
to the "Field Type Definitions" section.
Field Length
The length of the corresponding Field Type, in bytes. Refer to
the "Field Type Definitions" section.
The format of the Data FlowSet is as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = Template ID | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1 - Field Value 1 | Record 1 - Field Value 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1 - Field Value 3 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2 - Field Value 1 | Record 2 - Field Value 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2 - Field Value 3 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 3 - Field Value 1 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Data FlowSet Field Descriptions
FlowSet ID = Template ID
Each Data FlowSet is associated with a FlowSet ID. The FlowSet
ID maps to a (previously generated) Template ID. The Collector
MUST use the FlowSet ID to find the corresponding Template
Record and decode the Flow Records from the FlowSet.
Length
The length of this FlowSet. Length is the sum of the lengths
of the FlowSet ID, Length itself, all Flow Records within this
FlowSet, and the padding bytes, if any.
Record N - Field Value M
The remainder of the Data FlowSet is a collection of Flow Data
Record(s), each containing a set of field values. The Type and
Length of the fields have been previously defined in the
Template Record referenced by the FlowSet ID or Template ID.
Padding
The Exporter SHOULD insert some padding bytes so that the
subsequent FlowSet starts at a 4-byte aligned boundary. It is
important to note that the Length field includes the padding
bytes. Padding SHOULD be using zeros.
Interpretation of the Data FlowSet format can be done only if the Template FlowSet corresponding to the Template ID is available at the Collector.
The Options Template Record (and its corresponding Options Data Record) is used to supply information about the NetFlow process configuration or NetFlow process specific data, rather than supplying information about IP Flows.
For example, the Options Template FlowSet can report the sample rate of a specific interface, if sampling is supported, along with the sampling method used.
The format of the Options Template FlowSet follows.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 1 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID | Option Scope Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option Length | Scope 1 Field Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Field Length | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope N Field Length | Option 1 Field Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Field Length | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option M Field Length | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Options Template FlowSet Field Definitions
FlowSet ID = 1
A FlowSet ID value of 1 is reserved for the Options Template.
Length
Total length of this FlowSet. Each Options Template FlowSet
MAY contain multiple Options Template Records. Thus, the
Length value MUST be used to determine the position of the next
FlowSet record, which could be either a Template FlowSet or
Data FlowSet.
Length is the sum of the lengths of the FlowSet ID, the Length itself, and all Options Template Records within this FlowSet Template ID.
Template ID
Template ID of this Options Template. This value is greater
than 255.
Option Scope Length
The length in bytes of any Scope field definition contained in
the Options Template Record (The use of "Scope" is described
below).
Option Length
The length (in bytes) of any options field definitions
contained in this Options Template Record.
Scope 1 Field Type
The relevant portion of the Exporter/NetFlow process to which
the Options Template Record refers.
Currently defined values are:
1 System
2 Interface
3 Line Card
4 Cache
5 Template
For example, the NetFlow process can be implemented on a per-
interface basis, so if the Options Template Record were
reporting on how the NetFlow process is configured, the Scope
for the report would be 2 (interface). The associated
interface ID would then be carried in the associated Options
Data FlowSet. The Scope can be limited further by listing
multiple scopes that all must match at the same time. Note
that the Scope fields always precede the Option fields.
Scope 1 Field Length
The length (in bytes) of the Scope field, as it would appear in
an Options Data Record.
Option 1 Field Type
A numeric value that represents the type of field that would
appear in the Options Template Record. Refer to the Field Type
Definitions section.
Option 1 Field Length
The length (in bytes) of the Option field.
Padding
The Exporter SHOULD insert some padding bytes so that the
subsequent FlowSet starts at a 4-byte aligned boundary. It is
important to note that the Length field includes the padding
bytes. Padding SHOULD be using zeros.
The Options Data Records are sent in Data FlowSets, on a regular basis, but not with every Flow Data Record. How frequently these Options Data Records are exported is configurable. See the "Templates Management" section for more details.
The format of the Data FlowSet containing Options Data Records follows.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = Template ID | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1 - Scope 1 Value |Record 1 - Option Field 1 Value|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Record 1 - Option Field 2 Value| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2 - Scope 1 Value |Record 2 - Option Field 1 Value|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Record 2 - Option Field 2 Value| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 3 - Scope 1 Value |Record 3 - Option Field 1 Value|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Record 3 - Option Field 2 Value| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Options Data Records of the Data FlowSet Field Descriptions
FlowSet ID = Template ID
A FlowSet ID precedes each group of Options Data Records within
a Data FlowSet. The FlowSet ID maps to a previously generated
Template ID corresponding to this Options Template Record. The
Collector MUST use the FlowSet ID to map the appropriate type
and length to any field values that follow.
Length
The length of this FlowSet. Length is the sum of the lengths of
the FlowSet ID, Length itself, all the Options Data Records
within this FlowSet, and the padding bytes, if any.
Record N - Option Field M Value
The remainder of the Data FlowSet is a collection of Flow
Records, each containing a set of scope and field values. The
type and length of the fields were previously defined in the
Options Template Record referenced by the FlowSet ID or
Template ID.
Padding
The Exporter SHOULD insert some padding bytes so that the
subsequent FlowSet starts at a 4-byte aligned boundary. It is
important to note that the Length field includes the padding
bytes. Padding SHOULD be using zeros.
The Data FlowSet format can be interpreted only if the Options Template FlowSet corresponding to the Template ID is available at the Collector.
Flow Data records that correspond to a Template Record MAY appear in the same and/or subsequent Export Packets. The Template Record is not necessarily carried in every Export Packet. As such, the NetFlow Collector MUST store the Template Record to interpret the corresponding Flow Data Records that are received in subsequent data packets.
A NetFlow Collector that receives Export Packets from several Observation Domains from the same Exporter MUST be aware that the uniqueness of the Template ID is not guaranteed across Observation Domains.
The Template IDs must remain constant for the life of the NetFlow process on the Exporter. If the Exporter or the NetFlow process restarts for any reason, all information about Templates will be lost and new Template IDs will be created. Template IDs are thus not guaranteed to be consistent across an Exporter or NetFlow process restart.
A newly created Template record is assigned an unused Template ID from the Exporter. If the template configuration is changed, the current Template ID is abandoned and SHOULD NOT be reused until the
NetFlow process or Exporter restarts. If a Collector should receive a new definition for an already existing Template ID, it MUST discard the previous template definition and use the new one.
If a configured Template Record on the Exporter is deleted, and re- configured with exactly the same parameters, the same Template ID COULD be reused.
The Exporter sends the Template FlowSet and Options Template FlowSet under the following conditions:
* Every N number of Export Packets.
* On a time basis, so every N number of minutes.
Both options MUST be configurable by the user on the Exporter.
When one of these expiry conditions is met, the Exporter MUST send
the Template FlowSet and Options Template.
The following table describes all the field type definitions that an Exporter MAY support. The fields are a selection of Packet Header fields, lookup results (for example, the autonomous system numbers or the subnet masks), and properties of the packet such as length.
Field Type Value Length Description
(bytes)
Incoming counter with length N x 8 bits for the
IN_BYTES 1 N number of bytes associated
with an IP Flow. By default
N is 4
Incoming counter with length N x 8 bits for the
IN_PKTS 2 N number of packets
associated with an IP Flow.
By default N is 4
FLOWS 3 N Number of Flows
that were aggregated;
by default N is 4
PROTOCOL 4 1 IP protocol byte
Type of service byte
TOS 5 1 setting when entering
the incoming interface
TCP flags; cumulative of
TCP_FLAGS 6 1 all the TCP flags seen in
this Flow
TCP/UDP source port number
L4_SRC_PORT 7 2 (for example, FTP, Telnet,
or equivalent)
IPV4_SRC_ADDR 8 4 IPv4 source address
The number of contiguous bits in the source subnet
SRC_MASK 9 1 mask (i.e., the mask in
slash notation)
Input interface index.
INPUT_SNMP 10 N By default N is 2, but
higher values can be used
TCP/UDP destination port
L4_DST_PORT 11 2 number (for example, FTP,
Telnet, or equivalent)
IPV4_DST_ADDR 12 4 IPv4 destination address
The number of contiguous bits in the destination
DST_MASK 13 1 subnet mask (i.e., the mask
in slash notation)
Output interface index.
OUTPUT_SNMP 14 N By default N is 2, but
higher values can be used
IPV4_NEXT_HOP 15 4 IPv4 address of the next-
hop router
Source BGP autonomous
SRC_AS 16 N system number where N could
be 2 or 4. By default N is
2
Destination BGP autonomous
DST_AS 17 N system number where N could
be 2 or 4. By default N is
2
BGP_IPV4_NEXT_HOP 18 4 Next-hop router's IP
address in the BGP domain
IP multicast outgoing packet counter with length
MUL_DST_PKTS 19 N N x 8 bits for packets
associated with the IP
Flow. By default N is 4
IP multicast outgoing Octet (byte) counter with length N x 8 bits for the
MUL_DST_BYTES 20 N number of bytes associated
with the IP Flow. By
default N is 4
sysUptime in msec at which
LAST_SWITCHED 21 4 the last packet of this
Flow was switched
sysUptime in msec at which
FIRST_SWITCHED 22 4 the first packet of this
Flow was switched
Outgoing counter with length N x 8 bits for the
OUT_BYTES 23 N number of bytes associated
with an IP Flow. By
default N is 4
Outgoing counter with length N x 8 bits for the
OUT_PKTS 24 N number of packets
associated with an IP Flow.
By default N is 4
IPV6_SRC_ADDR 27 16 IPv6 source address
IPV6_DST_ADDR 28 16 IPv6 destination address
IPV6_SRC_MASK 29 1 Length of the IPv6 source
mask in contiguous bits
Length of the IPv6
IPV6_DST_MASK 30 1 destination mask in
contiguous bits
IPV6_FLOW_LABEL 31 3 IPv6 flow label as per
RFC 2460 definition
Internet Control Message
ICMP_TYPE 32 2 Protocol (ICMP) packet
type; reported as
ICMP Type * 256 + ICMP code
MUL_IGMP_TYPE 33 1 Internet Group Management
Protocol (IGMP) packet type
When using sampled NetFlow, the rate at which packets
SAMPLING_INTERVAL 34 4 are sampled; for example, a
value of 100 indicates that
one of every hundred
packets is sampled
For sampled NetFlow platform-wide:
SAMPLING_ALGORITHM 35 1 0x01 deterministic sampling
0x02 random sampling
Use in connection with
SAMPLING_INTERVAL
Timeout value (in seconds)
FLOW_ACTIVE_TIMEOUT 36 2 for active flow entries
in the NetFlow cache
Timeout value (in seconds)
FLOW_INACTIVE_TIMEOUT 37 2 for inactive Flow entries
in the NetFlow cache
Type of Flow switching
ENGINE_TYPE 38 1 engine (route processor,
linecard, etc...)
ENGINE_ID 39 1 ID number of the Flow
switching engine
Counter with length N x 8 bits for the number
TOTAL_BYTES_EXP 40 N of bytes exported by the
Observation Domain. By
default N is 4
Counter with length N x 8 bits for the number
TOTAL_PKTS_EXP 41 N of packets exported by the
Observation Domain. By
default N is 4
Counter with length N x 8 bits for the number
TOTAL_FLOWS_EXP 42 N of Flows exported by the
Observation Domain. By
default N is 4
MPLS_TOP_LABEL_TYPE 46 1 MPLS Top Label Type:
0x00 UNKNOWN
0x01 TE-MIDPT
0x02 ATOM
0x03 VPN
0x04 BGP
0x05 LDP
Forwarding Equivalent Class
MPLS_TOP_LABEL_IP_ADDR 47 4 corresponding to the MPLS
Top Label
FLOW_SAMPLER_ID 48 1 Identifier shown
in "show flow-sampler"
The type of algorithm used for sampling data:
FLOW_SAMPLER_MODE 49 1 0x02 random sampling
Use in connection with
FLOW_SAMPLER_MODE
Packet interval at which to
FLOW_SAMPLER_RANDOM_INTERVAL 50 4 sample. Use in connection
with FLOW_SAMPLER_MODE
Type of Service byte
DST_TOS 55 1 setting when exiting
outgoing interface
SRC_MAC 56 6 Source MAC Address
DST_MAC 57 6 Destination MAC Address
Virtual LAN identifier
SRC_VLAN 58 2 associated with ingress
interface
Virtual LAN identifier
DST_VLAN 59 2 associated with egress
interface
Internet Protocol Version Set to 4 for IPv4, set to 6
IP_PROTOCOL_VERSION 60 1 for IPv6. If not present in
the template, then version
4 is assumed
Flow direction:
DIRECTION 61 1 0 - ingress flow
1 - egress flow
IPV6_NEXT_HOP 62 16 IPv6 address of the
next-hop router
BGP_IPV6_NEXT_HOP 63 16 Next-hop router in the BGP
domain
Bit-encoded field
IPV6_OPTION_HEADERS 64 4 identifying IPv6 option
headers found in the flow
MPLS_LABEL_1 70 3 MPLS label at position 1 in
the stack
MPLS_LABEL_2 71 3 MPLS label at position 2 in
the stack
MPLS_LABEL_3 72 3 MPLS label at position 3 in
the stack
MPLS_LABEL_4 73 3 MPLS label at position 4 in
the stack
MPLS_LABEL_5 74 3 MPLS label at position 5 in
the stack
MPLS_LABEL_6 75 3 MPLS label at position 6 in
the stack
MPLS_LABEL_7 76 3 MPLS label at position 7 in
the stack
MPLS_LABEL_8 77 3 MPLS label at position 8 in
the stack
MPLS_LABEL_9 78 3 MPLS label at position 9 in
the stack
MPLS_LABEL_10 79 3 MPLS label at position 10
in the stack
The value field is a numeric identifier for the field type. The following value fields are reserved for proprietary field types: 25, 26, 43 to 45, 51 to 54, and 65 to 69.
When extensibility is required, the new field types will be added to the list. The new field types have to be updated on the Exporter and Collector but the NetFlow export format would remain unchanged. Refer to the latest documentation at http://www.cisco.com for the newly updated list.
In some cases the size of a field type is fixed by definition, for example PROTOCOL, or IPV4_SRC_ADDR. However in other cases they are defined as a variant type. This improves the memory efficiency in the collector and reduces the network bandwidth requirement between the Exporter and the Collector. As an example, in the case IN_BYTES, on an access router it might be sufficient to use a 32 bit counter (N
= 4), whilst on a core router a 64 bit counter (N = 8) would be required.
All counters and counter-like objects are unsigned integers of size N
* 8 bits.
The Collector receives Template Records from the Exporter, normally before receiving Flow Data Records (or Options Data Records). The Flow Data Records (or Options Data Records) can then be decoded and stored locally on the devices. If the Template Records have not been received at the time Flow Data Records (or Options Data Records) are received, the Collector SHOULD store the Flow Data Records (or Options Data Records) and decode them after the Template Records are received. A Collector device MUST NOT assume that the Data FlowSet and the associated Template FlowSet (or Options Template FlowSet) are exported in the same Export Packet.
The Collector MUST NOT assume that one and only one Template FlowSet is present in an Export Packet.
The life of a template at the Collector is limited to a fixed refresh timeout. Templates not refreshed from the Exporter within the timeout are expired at the Collector. The Collector MUST NOT attempt to decode the Flow or Options Data Records with an expired Template. At any given time the Collector SHOULD maintain the following for all the current Template Records and Options Template Records: Exporter, Observation Domain, Template ID, Template Definition, Last Received.
Note that the Observation Domain is identified by the Source ID field from the Export Packet.
In the event of a clock configuration change on the Exporter, the Collector SHOULD discard all Template Records and Options Template Records associated with that Exporter, in order for Collector to learn the new set of fields: Exporter, Observation Domain, Template ID, Template Definition, Last Received.
Template IDs are unique per Exporter and per Observation Domain.
If the Collector receives a new Template Record (for example, in the case of an Exporter restart) it MUST immediately override the existing Template Record.
Finally, note that the Collector MUST accept padding in the Data FlowSet and Options Template FlowSet, which means for the Flow Data Records, the Options Data Records and the Template Records. Refer to the terminology summary table in Section 2.1.
The NetFlow version 9 protocol was designed with the expectation that the Exporter and Collector would remain within a single private network. However the NetFlow version 9 protocol might be used to transport Flow Records over the public Internet which exposes the Flow Records to a number of security risks. For example an attacker might capture, modify or insert Export Packets. There is therefore a risk that IP Flow information might be captured or forged, or that attacks might be directed at the NetFlow Collector.
The designers of NetFlow Version 9 did not impose any
confidentiality, integrity or authentication requirements on the
protocol because this reduced the efficiency of the implementation
and it was believed at the time that the majority of deployments
would confine the Flow Records to private networks, with the
Collector(s) and Exporter(s) in close proximity.
The IPFIX protocol (IP Flow Information eXport), which has chosen the NetFlow version 9 protocol as the base protocol, addresses the security considerations discussed in this section. See the security section of IPFIX requirement draft [RFC3917] for more information.
Because the NetFlow Version 9 Export Packets are not encrypted, the observation of Flow Records can give an attacker information about the active flows in the network, communication endpoints and traffic patterns. This information can be used both to spy on user behavior and to plan and conceal future attacks.
The information that an attacker could derive from the interception of Flow Records depends on the Flow definition. For example, a Flow Record containing the source and destination IP addresses might reveal privacy sensitive information regarding the end user's activities, whilst a Flow Record only containing the source and destination IP network would be less revealing.
If Flow Records are used in accounting and/or security applications, there may be a strong incentive to forge exported Flow Records (for example to defraud the service provider, or to prevent the detection of an attack). This can be done either by altering the Flow Records on the path between the Observer and the Collector, or by injecting forged Flow Records that pretend to be originated by the Exporter.
An attacker could forge Templates and/or Options Templates and thereby try to confuse the NetFlow Collector, rendering it unable to decode the Export Packets.
Denial of service attacks on the NetFlow Collector can consume so many resources from the machine that, the Collector is unable to capture or decode some NetFlow Export Packets. Such hazards are not explicitly addressed by the NetFlow Version 9 protocol, although the normal methods used to protect a server from a DoS attack will mitigate the problem.
Let us consider the example of an Export Packet composed of a Template FlowSet, a Data FlowSet (which contains three Flow Data Records), an Options Template FlowSet, and a Data FlowSet (which contains two Options Data Records).
Export Packet:
+--------+---------------------------------------------. . . | | +--------------+ +-----------------------+ | Packet | | Template | | Data | | Header | | FlowSet | | FlowSet | . . . | | | (1 Template) | | (3 Flow Data Records) | | | +--------------+ +-----------------------+ +--------+---------------------------------------------. . .
. . .+-------------------------------------------------+
+------------------+ +--------------------------+ |
| Options | | Data | |
. . .| Template FlowSet | | FlowSet | |
| (1 Template) | | (2 Options Data Records) | |
+------------------+ +--------------------------+ |
. . .--------------------------------------------------+
The Packet Header is composed of:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version = 9 | Count = 7 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| sysUpTime |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| UNIX Secs |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
We want to report the following Field Types:
- The source IP address (IPv4), so the length is 4 - The destination IP address (IPv4), so the length is 4 - The next-hop IP address (IPv4), so the length is 4 - The number of bytes of the Flow - The number of packets of the Flow
Therefore, the Template FlowSet is composed of the following:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 0 | Length = 28 bytes |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID 256 | Field Count = 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IP_SRC_ADDR = 8 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IP_DST_ADDR = 12 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IP_NEXT_HOP = 15 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IN_PKTS = 2 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IN_BYTES = 1 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
In this example, we report the following three Flow Records:
Src IP addr. | Dst IP addr. | Next Hop addr. | Packet | Bytes
| | | Number | Number
---------------------------------------------------------------
198.168.1.12 | 10.5.12.254 | 192.168.1.1 | 5009 | 5344385
192.168.1.27 | 10.5.12.23 | 192.168.1.1 | 748 | 388934
192.168.1.56 | 10.5.12.65 | 192.168.1.1 | 5 | 6534
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 256 | Length = 64 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 198.168.1.12 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10.5.12.254 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 192.168.1.1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5009 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5344385 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 192.168.1.27 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10.5.12.23 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 192.168.1.1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 748 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 388934 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 192.168.1.56 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10.5.12.65 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 192.168.1.1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 6534 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Note that padding was not necessary in this example.
Per line card (the Exporter is composed of two line cards), we want to report the following Field Types:
- Total number of Export Packets - Total number of exported Flows
The format of the Options Template FlowSet is as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 1 | Length = 24 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID 257 | Option Scope Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option Length = 8 | Scope 1 Field Type = 3 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Field Length = 2 | TOTAL_EXP_PKTS_SENT = 41 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 2 | TOTAL_FLOWS_EXP = 42 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 2 | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
In this example, we report the following two records:
Line Card ID | Export Packet| Export Flow
------------------------------------------ Line Card 1 | 345 | 10201 Line Card 2 | 690 | 20402
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 257 | Length = 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 1 | 345 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10201 | 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 690 | 20402 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC768] Postel, J., "User Datagram Protocol", STD 6, RFC 768,
August 1980.
[RFC793] Postel, J., "Transmission Control Protocol", STD 7, RFC
793, September 1981.
[RFC2960] Stewart, R., Xie, Q., Morneault, K., Sharp, C.,
Schwarzbauer, H., Taylor, T., Rytina, I., Kalla, M.,
Zhang, L., and V. Paxson, "Stream Control Transmission
Protocol", RFC 2960, October 2000.
[RFC3917] Quittek, J., Zseby, T., Claise, B., and S. Zander,
"Requirements for IP Flow Information Export (IPFIX)",
RFC 3917, October 2004.
This document was jointly written by Vamsidhar Valluri, Martin Djernaes, Ganesh Sadasivan, and Benoit Claise.
I would like to thank Pritam Shah, Paul Kohler, Dmitri Bouianovski, and Stewart Bryant for their valuable technical feedback.
Benoit Claise (Editor)
Cisco Systems
De Kleetlaan 6a b1
1831 Diegem
Belgium
Phone: +32 2 704 5622
EMail: bclaise@cisco.com
Ganesh Sadasivan
Cisco Systems, Inc.
3750 Cisco Way
San Jose, CA 95134
USA
Phone: +1 408 527-0251
EMail: gsadasiv@cisco.com
Vamsi Valluri
Cisco Systems, Inc.
510 McCarthy Blvd.
San Jose, CA 95035
USA
Phone: +1 408 525-1835
EMail: vvalluri@cisco.com
Martin Djernaes
Cisco Systems, Inc.
510 McCarthy Blvd.
San Jose, CA 95035
USA
Phone: +1 408 853-1676
EMail: djernaes@cisco.com
Copyright © The Internet Society (2004).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and at www.rfc-editor.org, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the ISOC's procedures with respect to rights in ISOC Documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf- ipr@ietf.org.
Funding for the RFC Editor function is currently provided by the Internet Society.