Network Working GroupInternet Engineering Task Force (IETF) A. YourtchenkoInternet-DraftRequest for Comments: 7270 P. AitkenIntended status:Category: Informational B. ClaiseExpires: September 26, 2014ISSN: 2070-1721 Cisco Systems, Inc.March 25,June 2014Cisco SpecificCisco-Specific Information ElementsreusedReused inIPFIX draft-yourtchenko-cisco-ies-11IP Flow Information Export (IPFIX) Abstract This document describes some additionalIPFIXIP Flow Information Export (IPFIX) Information Elements in the range of 1-127, which is the range compatible with field types used by NetFlow version 9 inRFC3954,RFC 3954, as specified in the IPFIX Information Model in RFC 7012. Status of This Memo ThisInternet-Draftdocument issubmitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documentsnot an Internet Standards Track specification; it is published for informational purposes. This document is a product of the Internet Engineering Task Force (IETF).Note that other groups may also distribute working documents as Internet-Drafts. The listIt represents the consensus ofcurrent Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents validthe IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are amaximumcandidate for any level of Internet Standard; see Section 2 of RFC 5741. Information about the current status ofsix monthsthis document, any errata, and how to provide feedback on it may beupdated, replaced, or obsoleted by other documentsobtained atany time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on September 26, 2014.http://www.rfc-editor.org/info/rfc7270. Copyright Notice Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Information Elements Overview . . . . . . . . . . . . . . . . 3 4. Information Elements . . . . . . . . . . . . . . . . . . . . 4 4.1. samplingInterval . . . . . . . . . . . . . . . . . . . . 4 4.2. samplingAlgorithm . . . . . . . . . . . . . . . . . . . . 4 4.3. engineType . . . . . . . . . . . . . . . . . . . . . . . 4 4.4. engineId . . . . . . . . . . . . . . . . . . . . . . . . 5 4.5. ipv4RouterSc . . . . . . . . . . . . . . . . . . . . . . 5 4.6. samplerId . . . . . . . . . . . . . . . . . . . . . . . .56 4.7. samplerMode . . . . . . . . . . . . . . . . . . . . . . .56 4.8. samplerRandomInterval . . . . . . . . . . . . . . . . . . 6 4.9. classId . . . . . . . . . . . . . . . . . . . . . . . . .67 4.10. samplerName . . . . . . . . . . . . . . . . . . . . . . .67 4.11. flagsAndSamplerId . . . . . . . . . . . . . . . . . . . .67 4.12. forwardingStatus . . . . . . . . . . . . . . . . . . . .67 4.13. srcTrafficIndex . . . . . . . . . . . . . . . . . . . . .89 4.14. dstTrafficIndex . . . . . . . . . . . . . . . . . . . . .89 4.15. className . . . . . . . . . . . . . . . . . . . . . . . .810 4.16. layer2packetSectionOffset . . . . . . . . . . . . . . . .910 4.17. layer2packetSectionSize . . . . . . . . . . . . . . . . .910 4.18. layer2packetSectionData . . . . . . . . . . . . . . . . .911 5. Other Information Elements . . . . . . . . . . . . . . . . .911 5.1. Performance Metrics IEs . . . . . . . . . . . . . . . . .911 5.2. Application Information IEs . . . . . . . . . . . . . . .911 5.3. IEsassignedAssigned for NetFlow v9compatibilityCompatibility . . . . . . . .1011 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . .1011 7. Security Considerations . . . . . . . . . . . . . . . . . . .1012 8. References . . . . . . . . . . . . . . . . . . . . . . . . .1012 8.1. Normative References . . . . . . . . . . . . . . . . . .1012 8.2. Informative References . . . . . . . . . . . . . . . . .1113 Appendix A. XML Specification of IPFIX Information Elements . .12 Appendix B. Changes . . . . . . . . . . . . . . . . . . . . . . 18 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 1914 1. IntroductionThe sectionSection 4 of [RFC7012] defines the IPFIX Information Elements (IEs) in the range of 1-127 to be compatible with the NetFlow version 9 fields, as specified inthe"Cisco Systems NetFlow Services Export Version 9" [RFC3954]. As [RFC3954] wasspecifiedpublished in 2004, it does not contain all NetFlow version 9specific fieldsfield types in the range of 1-127. The question was asked whether IPFIX Devices should exclusively report theIPFIXIANA IPFIX IEs[IPFIX-IANA].[IANA-IPFIX]. In other words, when upgrading from a NetFlowmetering processMetering Process to an IPFIX Metering Process, should the IPFIX Devices stop reporting IEs specific to NetFlow version 9specific IEsthat were not registered in IANA[IPFIX-IANA]?[IANA-IPFIX]? This document is intended to fill the gap in this IE range. It describes some additional IPFIX Information Elements in the range of 1-127, which is the range compatible with field types used by NetFlow version 9 in [RFC3954], as specified in the IPFIX Information Model [RFC7012]. With this, IPFIX implementations could export all the Information Elements specified in IANA[IPFIX-IANA],[IANA-IPFIX], regardless of the range. This documentfollowedfollows the[RFC7013]rules(Guidelinesin "Guidelines for Authors and Reviewers ofIPFIXIP Flow Export (IPFIX) InformationElements).Elements" [RFC7013]. This document does not extend [RFC3954]. The IPFIX Protocol([RFC7011])[RFC7011] has its own Information Model([RFC7012],([RFC7012] and IANA[IPFIX-IANA])[IANA-IPFIX]), which is extensible upon application to IANA, subject to expert review byIE-doctors ([RFC7013]).IE-DOCTORS [RFC7013]. Thisdraftdocument extends the IPFIX Information Model. 2. Terminology IPFIX-specific terminology used in this document is defined in Section 2 of [RFC7011]. As in [RFC7011], these IPFIX-specific terms have the first letter of a word capitalized when used in this document. 3. Information Elements Overview The following Information Elements are discussed in the sections below: +----+-----------------------+-----+---------------------------+ | ID | Name | ID | Name | +----+-----------------------+-----+---------------------------+ || | 84 | samplerName | |34 | samplingInterval |8784 |flagsAndSamplerIdsamplerName | | 35 | samplingAlgorithm |8987 |forwardingStatusflagsAndSamplerId | | 38 | engineType |9289 |srcTrafficIndexforwardingStatus | | 39 | engineId |9392 |dstTrafficIndexsrcTrafficIndex | | 43 | ipv4RouterSc |10093 |classNamedstTrafficIndex | | 48 | samplerId |102100 |layer2packetSectionOffsetclassName | | 49 | samplerMode |103102 |layer2packetSectionSizelayer2packetSectionOffset | | 50 | samplerRandomInterval |104103 |layer2packetSectionDatalayer2packetSectionSize | | 51 | classId | 104 | layer2packetSectionData | +----+-----------------------+-----+---------------------------+ Table 1 4. Information Elements 4.1. samplingInterval Description: Deprecated in favor of 305 samplingPacketInterval. When using sampled NetFlow, the rate at which packets are sampled- e.g.-- e.g., a value of 100 indicates that one of every 100 packets is sampled. Abstract Data Type: unsigned32 ElementId: 34 Semantics: quantity Status: deprecated Units: packets 4.2. samplingAlgorithm Description: Deprecated in favor of 304 selectorAlgorithm. The type of algorithm used for sampled NetFlow: 1 - DeterministicSampling;Sampling, 2 - Random Sampling. The values are not compatible with the selectorAlgorithm IE, where "Deterministic" has been replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion isrequired,required; seePSAMP parameters [PSAMP-IANA]."Packet Sampling (PSAMP) Parameters" [IANA-PSAMP]. Abstract Data Type: unsigned8 ElementId: 35 Semantics: identifier Status: deprecated 4.3. engineType Description: Type of flow switching engine in a router/switch: RP = 0, VIP/Line card = 1, PFC/DFC = 2. Reserved for internal use on thecollector.Collector. Abstract Data Type: unsigned8 ElementId: 38 Semantics: identifier Status: deprecated 4.4. engineId Description:VIPVersatile Interface Processor (VIP) or line card slot number of the flow switching engine in a router/switch. Reserved for internal use on thecollector.Collector. Abstract Data Type: unsigned8 ElementId: 39 Semantics: identifier Status: deprecated 4.5. ipv4RouterSc Description: This is a platform-specific field for the Catalyst 5000/Catalyst 6000 family. It is used to store the address of a router that is being shortcut when performing MultiLayer Switching. Abstract Data Type: ipv4Address ElementId: 43 Semantics: default Status: deprecated Reference: [CCO-MLS] describestheMultiLayer Switching. 4.6. samplerId Description: Deprecated in favor of 302 selectorId. The unique identifier associated with samplerName. Abstract Data Type: unsigned8 ElementId: 48 Semantics: identifier Status: deprecated 4.7. samplerMode Description: Deprecated in favor of 304 selectorAlgorithm. The values are not compatible: selectorAlgorithm=3 is random sampling. The type of algorithm used for sampling data: 1 -deterministic,Deterministic, 2 -random sampling.Random Sampling. Use with samplerRandomInterval. Abstract Data Type: unsigned8 ElementId: 49 Semantics: identifier Status: deprecated 4.8. samplerRandomInterval Description: Deprecated infavourfavor of 305 samplingPacketInterval. Packet interval at which to sample--- in case of random sampling. Used in connection with the samplerMode 0x02 (random sampling) value. Abstract Data Type: unsigned32 ElementId: 50 Semantics: quantity Status: deprecated 4.9. classId Description: Deprecated infavourfavor of 302 selectorId. Characterizes the traffic class,i.e.i.e., QoS treatment. Abstract Data Type: unsigned8 ElementId: 51 Semantics: identifier Status: deprecated 4.10. samplerName Description: Deprecated in favor of 335 selectorName. Name of the flow sampler. Abstract Data Type: string ElementId: 84 Status: deprecated 4.11. flagsAndSamplerId Description: Flow flags and the value of the sampler ID (samplerId) combined in one bitmapped field. Reserved for internal use on thecollector.Collector. Abstract Data Type: unsigned32 ElementId: 87 Semantics: identifier Status: deprecated 4.12. forwardingStatus Description: This Information Element describes the forwarding status of the flow and any attached reasons. TheReduced Size Encodingreduced-size encoding rules as per [RFC7011] apply. The basic encoding is 8 bits. The future extensions could add one or three bytes. The layout of the basic encoding is as follows: MSB - 0 1 2 3 4 5 6 7 - LSB +---+---+---+---+---+---+---+---+ | Status| Reason code or flags | +---+---+---+---+---+---+---+---+ Status: 00b = Unknown 01b = Forwarded 10b = Dropped 11b = Consumed Reason Code (status = 01b, Forwarded) 01 000000b = 64 = Unknown 01 000001b = 65 = Fragmented 01 000010b = 66 = Not Fragmented Reason Code (status = 10b, Dropped) 10 000000b = 128 = Unknown 10 000001b = 129 = ACL deny 10 000010b = 130 = ACL drop 10 000011b = 131 = Unroutable 10 000100b = 132 = Adjacency 10 000101b = 133 = Fragmentation and DF set 10 000110b = 134 = Bad header checksum 10 000111b = 135 = Bad total Length 10 001000b = 136 = Bad header length 10 001001b = 137 = bad TTL 10 001010b = 138 = Policer 10 001011b = 139 = WRED 10 001100b = 140 = RPF 10 001101b = 141 = For us 10 001110b = 142 = Bad output interface 10 001111b = 143 = Hardware Reason Code (status = 11b, Consumed) 11 000000b = 192 = Unknown 11 000001b = 193 = Punt Adjacency 11 000010b = 194 = Incomplete Adjacency 11 000011b = 195 = For us Examples: value : 0x40 = 64 binary: 01000000 decode: 01 -> Forward 000000 -> No further information value : 0x89 = 137 binary: 10001001 decode: 10 -> Drop 001001 -> Fragmentation and DF set Abstract Data Type: unsigned32 ElementId: 89 Semantics: identifier Status: current Reference: See[CCO-NF9FMT] - NetFlow"NetFlow Version 9Record Format.Flow-Record Format" [CCO-NF9FMT]. 4.13. srcTrafficIndex Description: BGP Policy Accounting Source TrafficIndexIndex. Abstract Data Type: unsigned32 ElementId: 92 Semantics: identifier Status: current Reference: BGP policy accounting as described in[CCO-BGPPOL][CCO-BGPPOL]. 4.14. dstTrafficIndex Description: BGP Policy Accounting Destination TrafficIndexIndex. Abstract Data Type: unsigned32 ElementId: 93 Semantics: identifier Status: current Reference: BGP policy accounting as described in[CCO-BGPPOL][CCO-BGPPOL]. 4.15. className Description: Deprecated in favor of 335 selectorName. Traffic Class Name, associated with the classId Information Element. Abstract Data Type: string ElementId: 100 Status: deprecated 4.16. layer2packetSectionOffset Description: Deprecated in favor ofsectionOffset (409).409 sectionOffset. Layer 2 packet section offset. Potentially a generic packet section offset. Abstract Data Type: unsigned16 ElementId: 102 Semantics: quantity Status: deprecated 4.17. layer2packetSectionSize Description: Deprecated in favor ofdataLinkFrameSize(312).312 dataLinkFrameSize. Layer 2 packet section size. Potentially a generic packet section size. Abstract Data Type: unsigned16 ElementId: 103 Semantics: quantity Status: deprecated 4.18. layer2packetSectionData Description: Deprecated in favor ofdataLinkFrameSection (315).315 dataLinkFrameSection. Layer 2 packet section data. Abstract Data Type: octetArray ElementId: 104 Status: deprecated 5. Other Information Elements 5.1. Performance Metrics IEs ElementId: 65 .. 69 Performance metrics will need a consolidation in the industry, based onRFC6390.[RFC6390]. Once this consolidation happens, via a separate document the IEs 65-69 will either be assigned in the IANA registry or their status will be deprecated. 5.2. Application Information IEs ElementId:101 ElementId:94 .. 96 ElementId: 101 Please refer tothe RFC 6759 [RFC6759][RFC6759]. 5.3. IEsassignedAssigned for NetFlow v9compatibilityCompatibility ElementId: 105..127 These element IDs are not covered by thisdraftdocument and are left "as is",i.e.i.e., for NetFlow v9 compatibility. 6. IANA Considerations This document specifies several new IPFIX Information Elements inthe IPFIXIANA's "IPFIX InformationElementElements" registry [IANA-IPFIX] asdefinedsummarized in Section 3 and detailed in Section 4 above. The following Information Elementsmust behave been assigned: o IE Number 34 for the samplingInterval IE o IE Number 35 for the samplingAlgorithm IE o IE Number 38 for the engineType IE o IE Number 39 for the engineId IE o IE Number 43 for the ipv4RouterSc IE o IE Number 48 for the samplerId IE o IE Number 49 for the samplerMode IE o IE Number 50 for the samplerRandomInterval IE o IE Number 51 for the classId IE o IE Number 84 for the samplerName IE o IE Number 87 for the flagsAndSamplerId IE o IE Number 89 for the forwardingStatus IE o IE Number 92 for the srcTrafficIndex IE o IE Number 93 for the dstTrafficIndex IE o IE Number 100 for the className IE o IE Number 102 for the layer2packetSectionOffset IE o IE Number 103 for the layer2packetSectionSize IE o IE Number 104 for the layer2packetSectionData IE 7. Security Considerations This document specifies the definitions of several Information Elements and does not alter the security considerations of the base protocol. Please refer to the security considerations sections ofRFC 3954[RFC3954] andRFC 7012[RFC7012]. 8. References 8.1. Normative References [RFC7011] Claise, B., Trammell, B., and P. Aitken, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information", STD 77, RFC 7011, September 2013. 8.2. Informative References [CCO-BGPPOL] Cisco, "BGP Policy Accounting and BGP Policy Accounting Output Interface Accounting Features", December 2005, <http://www.cisco.com/en/US/tech/tk365/ technologies_tech_note09186a0080094e88.shtml>. [CCO-MLS] Cisco, "IP MultiLayer Switching Sample Configuration", November 2007,<http://www.cisco.com/en/US/products/hw/switches/ ps700/<http://www.cisco.com/en/US/products/hw/switches/ps700/ products_configuration_example09186a00800ab513.shtml>. [CCO-NF9FMT] Cisco, "NetFlowversionVersion 9 Flow-Recordformat",Format", May 2011, <http://www.cisco.com/en/US/technologies/tk648/tk362/ technologies_white_paper09186a00800a3db9.html>.[IPFIX-IANA][IANA-IPFIX] IANA, "IP Flow Information Export (IPFIX) Entities",2013, <http://www.iana.org/assignments/ipfix/ipfix.xml>. [PSAMP-IANA]<http://www.iana.org/assignments/ipfix/>. [IANA-PSAMP] IANA, "Packet Sampling (PSAMP) Parameters",2013, <http://www.iana.org/assignments/psamp-parameters/ psamp-parameters.xml>.<http://www.iana.org/assignments/psamp-parameters/>. [RFC3954] Claise, B., "Cisco Systems NetFlow Services Export Version 9", RFC 3954, October 2004. [RFC6390] Clark, A. and B. Claise, "Guidelines for Considering New Performance Metric Development", BCP 170, RFC 6390, October 2011. [RFC6759] Claise, B., Aitken, P., and N. Ben-Dvora, "Cisco Systems Export of Application Information in IP Flow Information Export (IPFIX)", RFC 6759, November 2012. [RFC7012] Claise, B. and B. Trammell, "Information Model for IP Flow Information Export (IPFIX)", RFC 7012, September 2013. [RFC7013] Trammell, B. and B. Claise, "Guidelines for Authors and Reviewers of IP Flow Information Export (IPFIX) Information Elements", BCP 184, RFC 7013, September 2013. Appendix A. XML Specification of IPFIX Information Elements <?xml version="1.0" encoding="UTF-8"?> <fieldDefinitions xmlns="urn:ietf:params:xml:ns:ipfix-info" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:ietf:params:xml:ns:ipfix-info ipfix-info.xsd"> <field name="samplingInterval" dataType="unsigned32" group="" dataTypeSemantics="quantity" elementId="34" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 305 samplingPacketInterval. When using sampled NetFlow, the rate at which packets are sampled- e.g.-- e.g., a value of 100 indicates that one of every 100 packets is sampled. </paragraph> </description> </field> <field name="samplingAlgorithm" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="35" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 304 selectorAlgorithm. The type of algorithm used for sampled NetFlow: 1 - DeterministicSampling;Sampling, 2 - Random Sampling. The values are not compatible with the selectorAlgorithm IE, where "Deterministic" has been replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion isrequired,required; see<REF:PSAMP-IANA>PSAMP[REF:IANA-PSAMP] PSAMP parameters. </paragraph> </description> </field> <field name="engineType" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="38" applicability="flow" status="deprecated"> <description> <paragraph> Type of flow switching engine in a router/switch: RP = 0, VIP/Line card = 1, PFC/DFC = 2. Reserved for internal use on thecollector.Collector. </paragraph> </description> </field> <field name="engineId" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="39" applicability="flow" status="deprecated"> <description> <paragraph>VIPVersatile Interface Processor (VIP) or line card slot number of the flow switching engine in a router/switch. Reserved for internal use on thecollector.Collector. </paragraph> </description> </field> <field name="ipv4RouterSc" dataType="ipv4Address" group="" dataTypeSemantics="default" elementId="43" applicability="flow" status="deprecated"> <description> <paragraph> This is a platform-specific field for the Catalyst 5000/Catalyst 6000 family. It is used to store the address of a router that is being shortcut when performing MultiLayer Switching. </paragraph> </description> <reference>http://www .cisco.com /en/US/pro ducts/hw/s witches/ps 700/products_configuration_example09186a00800ab513.shtmlhttp://www.cisco.com/en/US/products/hw/switches/ps700/ products_configuration_example09186a00800ab513.shtml describestheMultiLayer Switching. </reference> </field> <field name="samplerId" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="48" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 302 selectorId. The unique identifier associated with samplerName. </paragraph> </description> </field> <field name="samplerMode" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="49" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 304 selectorAlgorithm. The values are not compatible: selectorAlgorithm=3 is random sampling. The type of algorithm used forsampling data:sampled NetFlow: 1 -deterministic,Deterministic Sampling, 2 -random sampling.Random Sampling. Use with samplerRandomInterval. </paragraph> </description> </field> <field name="samplerRandomInterval" dataType="unsigned32" group="" dataTypeSemantics="quantity" elementId="50" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated infavourfavor of 305 samplingPacketInterval. Packet interval at which to sample--- in case of random sampling. Used in connection with the samplerMode 0x02 (random sampling) value. </paragraph> </description> </field> <field name="classId" dataType="unsigned8" group="" dataTypeSemantics="identifier" elementId="51" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated infavourfavor of 302 selectorId. Characterizes the traffic class,i.e.i.e., QoS treatment. </paragraph> </description> </field> <field name="samplerName" dataType="string" group="" dataTypeSemantics="" elementId="84" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 335 selectorName. Name of the flow sampler. </paragraph> </description> </field> <field name="flagsAndSamplerId" dataType="unsigned32" group="" dataTypeSemantics="identifier" elementId="87" applicability="flow" status="deprecated"> <description> <paragraph> Flow flags and the value of the sampler ID (samplerId) combined in one bitmapped field. Reserved for internal use on thecollector.Collector. </paragraph> </description> </field> <field name="forwardingStatus" dataType="unsigned32" group="" dataTypeSemantics="identifier" elementId="89" applicability="flow" status="current"> <description> <paragraph> This Information Element describes the forwarding status of the flow and any attached reasons. TheReduced Size Encodingreduced-size encoding rules as per<REF:RFC7011>[REF:RFC7011] apply. </paragraph> <artwork> The basic encoding is 8 bits. The future extensions could add one or three bytes. The layout of the basic encoding is as follows: MSB - 0 1 2 3 4 5 6 7 - LSB +---+---+---+---+---+---+---+---+ | Status| Reason code or flags | +---+---+---+---+---+---+---+---+ Status: 00b = Unknown 01b = Forwarded 10b = Dropped 11b = Consumed Reason Code (status = 01b, Forwarded) 01 000000b = 64 = Unknown 01 000001b = 65 = Fragmented 01 000010b = 66 = Not Fragmented Reason Code (status = 10b, Dropped) 10 000000b = 128 = Unknown 10 000001b = 129 = ACL deny 10 000010b = 130 = ACL drop 10 000011b = 131 = Unroutable 10 000100b = 132 = Adjacency 10 000101b = 133 = Fragmentation and DF set 10 000110b = 134 = Bad header checksum 10 000111b = 135 = Bad total Length 10 001000b = 136 = Bad header length 10 001001b = 137 = bad TTL 10 001010b = 138 = Policer 10 001011b = 139 = WRED 10 001100b = 140 = RPF 10 001101b = 141 = For us 10 001110b = 142 = Bad output interface 10 001111b = 143 = Hardware Reason Code (status = 11b, Consumed) 11 000000b = 192 = Unknown 11 000001b = 193 = Punt Adjacency 11 000010b = 194 = Incomplete Adjacency 11 000011b = 195 = For us Examples: value : 0x40 = 64 binary: 01000000 decode: 01 -> Forward 000000 -> No further information value : 0x89 = 137 binary: 10001001 decode: 10 -> Drop 001001 -> Fragmentation and DF set </artwork> </description> <reference> Seehttp:/ /www.cisco .com/en/US /technolog ies/tk648/tk362/technologies_white_paper09186a00800a3db9.htmlhttp://www.cisco.com/en/US/technologies/tk648/tk362/ technologies_white_paper09186a00800a3db9.html - NetFlow Version 9RecordFlow-Record Format. </reference> </field> <field name="srcTrafficIndex" dataType="unsigned32" group="" dataTypeSemantics="identifier" elementId="92" applicability="flow" status="current"> <description> <paragraph> BGP Policy Accounting Source TrafficIndexIndex. </paragraph> </description> <reference> BGP policy accounting as described inhttp://www .cisco.com /en/US/tech/tk365/technologies_tech_note09186a0080094e88.shtmlhttp://www.cisco.com/en/US/tech/tk365/ technologies_tech_note09186a0080094e88.shtml </reference> </field> <field name="dstTrafficIndex" dataType="unsigned32" group="" dataTypeSemantics="identifier" elementId="93" applicability="flow" status="current"> <description> <paragraph> BGP Policy Accounting Destination TrafficIndexIndex. </paragraph> </description> <reference> BGP policy accounting as described inhttp://www .cisco.com /en/US/tech/tk365/technologies_tech_note09186a0080094e88.shtmlhttp://www.cisco.com/en/US/tech/tk365/ technologies_tech_note09186a0080094e88.shtml </reference> </field> <field name="className" dataType="string" group="" dataTypeSemantics="" elementId="100" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 335 selectorName. Traffic Class Name, associated with the classId Information Element. </paragraph> </description> </field> <field name="layer2packetSectionOffset" dataType="unsigned16" group="" dataTypeSemantics="quantity" elementId="102" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 409 sectionOffset. Layer 2 packet section offset. Potentially a generic packet section offset. </paragraph> </description> </field> <field name="layer2packetSectionSize" dataType="unsigned16" group="" dataTypeSemantics="quantity" elementId="103" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 312 dataLinkFrameSize. Layer 2 packet section size. Potentially a generic packet section size. </paragraph> </description> </field> <field name="layer2packetSectionData" dataType="octetArray" group="" dataTypeSemantics="" elementId="104" applicability="flow" status="deprecated"> <description> <paragraph> Deprecated in favor of 315 dataLinkFrameSection. Layer 2 packet section data. </paragraph> </description> </field> </fieldDefinitions>Appendix B. Changes To be removed by RFC Editor before publication 01: initial revision presented at the IETF meeting. 02: removed "flow" from flowSamplerId, flowSamplerMode, and flowSamplerRandomInterval; updated the related drafts in references; added the "reference" column to the XML definitions; renamed fsFlowEntryTotalCount into deltaFlowCount to keep the naming in sync with draft-trammell-ipfix-a9n. Also minor changes to formatting and added the IE overview table. 03: updated the references to draft-claise-export-application-info- in-ipfix, slightly tweaked the title and removed the unused reference to draft-ietf-ipfix-flow-selection-tech. 04: sync the references. 05: update references to draft-claise-export-application-info-in- ipfix with reference to rfc6759, draft-trammell-ipfix-a9n to draft- ietf-ipfix-a9n, draft-kashima-ipfix-data-link-layer-monitoring to draft-ietf-ipfix-data-link-layer-monitoring. 06: sync the references. 07: Update per comment from Andrew Feren - change semantics of ipv4RouterSc to "identifier" and remove deltaFlowCount as it made it to IANA. Update references RFC5101 to RFC7011, draft-ietf-ipfix- data-link-layer-monitoring from -03 to -04. 08: restore the 84 samplerName after its accidental deletion from table 1 in -07; mark 101-103 IEs as deprecated, include the paragraph on IE 105..126 that are not discussed in this draft. 09: now that IANA assigned the IPFIX Information Elements in draft- ietf-ipfix-data-link-layer-monitoring, this draft is updated to simplify IANA's/editor's work, with changes as follows. TBD02 became 409 as sectionOffset is now assigned by IANA. Removed "EDITOR's NOTE" for layer2packetSectionOffset, layer2packetSectionSize, layer2packetSectionData, ietf-ipfix-data-link-layer-monitoring. 10: reflect the comments from GEN-ART / LC reviews. Change the wording in abstract/introduction, add required clarifications. Per Andrew Feren, the semantic for ipv4RouterSc should be "default", not "identifier" - fixed. Alas, unfortunately no way to affect how xml2rfc trims the super-long URLs, so I could not make splitting of the URLs nicer. 11: remove the sentence from 'security considerations' per thread about Alissa Cooper's DISCUSS thread. Remove the #97, which is not in RFC6759.Authors' Addresses Andrew Yourtchenko Cisco Systems, Inc. De Kleetlaan, 7 Brussels, Diegem B-1831 Belgium Phone: +32 2 704 5494Email:EMail: ayourtch@cisco.com Paul Aitken Cisco Systems, Inc. 96 Commercial Quay Edinburgh EH6 6LX Scotland Phone: +44 131 561 3616Email:EMail: paitken@cisco.com Benoit Claise Cisco Systems, Inc. De Kleetlaan, 6a b1 Diegem B-1831 Belgium Phone: +32 2 704 5622Email:EMail: bclaise@cisco.com