RFC 7270

Cisco-Specific Information Elements Reused in IP Flow Information Export (IPFIX)

📅 published June 2014, from ietf

RFC 7270: Cisco-Specific Information Elements Reused in IP Flow Information Export (IPFIX) 🎀

Okay bestie, this one comes from the Internet Engineering Task Force (IETF) 💖 It's RFC 7270, written by A. Yourtchenko, P. Aitken, and B. Claise, all from Cisco Systems, Inc. ✨ It's Category: Informational, ISSN 2070-1721, and it's dated June 2014 🦋 The title block doesn't list any RFCs it obsoletes or updates, so no drama there 💅

Abstract 🧚

Okay so this doc adds some extra IP Flow Information Export (IPFIX) Information Elements in the range of 1-127. That range is the one that matches the field types NetFlow version 9 used, as specified in RFC 3954, and it lives in the IPFIX Information Model from RFC 7012 🔥

Status of This Memo 📜

This is not an Internet Standards Track spec. It's published just for informational purposes 🌸

It's a product of the IETF, so it reflects the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every IESG-approved doc is a candidate for any level of Internet Standard, though. Check out Section 2 of RFC 5741 for the details 🧐

If you want the latest status, any errata, or a way to send feedback, go to http://www.rfc-editor.org/info/rfc7270 💜

Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved ✨

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. Please actually read these, because they explain what you can and can't do with the doc 🙈

If you pull Code Components out of this doc, they have to include the Simplified BSD License text from Section 4.e of the Trust Legal Provisions. They come with no warranty, as described in the Simplified BSD License 🫶

Table of Contents 📚

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
3.  Information Elements Overview . . . . . . . . . . . . . . . .   3
4.  Information Elements  . . . . . . . . . . . . . . . . . . . .   4
  4.1.  samplingInterval  . . . . . . . . . . . . . . . . . . . .   4
  4.2.  samplingAlgorithm . . . . . . . . . . . . . . . . . . . .   4
  4.3.  engineType  . . . . . . . . . . . . . . . . . . . . . . .   5
  4.4.  engineId  . . . . . . . . . . . . . . . . . . . . . . . .   5
  4.5.  ipv4RouterSc  . . . . . . . . . . . . . . . . . . . . . .   5
  4.6.  samplerId . . . . . . . . . . . . . . . . . . . . . . . .   6
  4.7.  samplerMode . . . . . . . . . . . . . . . . . . . . . . .   6
  4.8.  samplerRandomInterval . . . . . . . . . . . . . . . . . .   6
  4.9.  classId . . . . . . . . . . . . . . . . . . . . . . . . .   7
  4.10. samplerName . . . . . . . . . . . . . . . . . . . . . . .   7
  4.11. flagsAndSamplerId . . . . . . . . . . . . . . . . . . . .   7
  4.12. forwardingStatus  . . . . . . . . . . . . . . . . . . . .   8
  4.13. srcTrafficIndex . . . . . . . . . . . . . . . . . . . . .   9
  4.14. dstTrafficIndex . . . . . . . . . . . . . . . . . . . . .  10
  4.15. className . . . . . . . . . . . . . . . . . . . . . . . .  10
  4.16. layer2packetSectionOffset . . . . . . . . . . . . . . . .  10
  4.17. layer2packetSectionSize . . . . . . . . . . . . . . . . .  10
  4.18. layer2packetSectionData . . . . . . . . . . . . . . . . .  11
5.  Other Information Elements  . . . . . . . . . . . . . . . . .  11
  5.1.  Performance Metrics IEs . . . . . . . . . . . . . . . . .  11
  5.2.  Application Information IEs . . . . . . . . . . . . . . .  11
  5.3.  IEs Assigned for NetFlow v9 Compatibility . . . . . . . .  11
6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  12
7.  Security Considerations . . . . . . . . . . . . . . . . . . .  13
8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  13
  8.1.  Normative References  . . . . . . . . . . . . . . . . . .  13
  8.2.  Informative References  . . . . . . . . . . . . . . . . .  13
Appendix A.  XML Specification of IPFIX Information Elements  . .  15

1. Introduction ✨

Okay, so Section 4 of [RFC7012] defines the IPFIX Information Elements (IEs) in the range of 1-127 to be compatible with the NetFlow version 9 fields. Those fields are described in "Cisco Systems NetFlow Services Export Version 9" [RFC3954] 💅

Here's the tea: [RFC3954] came out in 2004, so it doesn't cover every NetFlow version 9 field type in the 1-127 range. People started asking whether IPFIX Devices should only report the IANA IPFIX IEs [IANA-IPFIX]. Like, when you upgrade from a NetFlow Metering Process to an IPFIX Metering Process, should IPFIX Devices stop reporting the NetFlow version 9 specific IEs that never got registered in IANA [IANA-IPFIX]? 🤔

This doc is here to fill that gap. It describes some extra IPFIX Information Elements in the 1-127 range, the range that's compatible with the NetFlow version 9 field types used in [RFC3954], as specified in the IPFIX Information Model [RFC7012]. With this, IPFIX implementations can export all the Information Elements specified in IANA [IANA-IPFIX], no matter which range they're in 🦋

This doc follows the rules in "Guidelines for Authors and Reviewers of IP Flow Export (IPFIX) Information Elements" [RFC7013]. It does not extend [RFC3954]. The IPFIX Protocol [RFC7011] has its own Information Model ([RFC7012] and IANA [IANA-IPFIX]), and that model can be extended by applying to IANA, subject to expert review by IE-DOCTORS [RFC7013]. This doc extends the IPFIX Information Model 🎀

2. Terminology 🧠

IPFIX-specific terminology used in this doc is defined in Section 2 of [RFC7011]. As in [RFC7011], these IPFIX-specific terms get a capitalized first letter when they show up in this doc 💖

3. Information Elements Overview 🌸

Here are the Information Elements we'll be talking about in the sections below 👇

+----+-----------------------+-----+---------------------------+
| ID | Name                  |  ID | Name                      |
+----+-----------------------+-----+---------------------------+
| 34 | samplingInterval      |  84 | samplerName               |
| 35 | samplingAlgorithm     |  87 | flagsAndSamplerId         |
| 38 | engineType            |  89 | forwardingStatus          |
| 39 | engineId              |  92 | srcTrafficIndex           |
| 43 | ipv4RouterSc          |  93 | dstTrafficIndex           |
| 48 | samplerId             | 100 | className                 |
| 49 | samplerMode           | 102 | layer2packetSectionOffset |
| 50 | samplerRandomInterval | 103 | layer2packetSectionSize   |
| 51 | classId               | 104 | layer2packetSectionData   |
+----+-----------------------+-----+---------------------------+
                             Table 1

4. Information Elements 🧚

4.1. samplingInterval ⏱️

Description: Deprecated in favor of 305 samplingPacketInterval. When you're using sampled NetFlow, this is the rate at which packets get sampled. E.g., a value of 100 means one out of every 100 packets is sampled 📦

  • Abstract Data Type: unsigned32
  • ElementId: 34
  • Semantics: quantity
  • Status: deprecated
  • Units: packets

4.2. samplingAlgorithm 🎲

Description: Deprecated in favor of 304 selectorAlgorithm. This is the type of algorithm used for sampled NetFlow:

1 - Deterministic Sampling,
2 - Random Sampling.

The values aren't compatible with the selectorAlgorithm IE. There, "Deterministic" got replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion is required, so see "Packet Sampling (PSAMP) Parameters" [IANA-PSAMP] 🙈

  • Abstract Data Type: unsigned8
  • ElementId: 35
  • Semantics: identifier
  • Status: deprecated

4.3. engineType ⚙️

Description: This is the type of flow switching engine in a router/switch:

RP = 0,
VIP/Line card = 1,
PFC/DFC = 2.

Reserved for internal use on the Collector ⚠️

  • Abstract Data Type: unsigned8
  • ElementId: 38
  • Semantics: identifier
  • Status: deprecated

4.4. engineId 🔧

Description: This is the Versatile Interface Processor (VIP) or line card slot number of the flow switching engine in a router/switch. Reserved for internal use on the Collector ⚠️

  • Abstract Data Type: unsigned8
  • ElementId: 39
  • Semantics: identifier
  • Status: deprecated

4.5. ipv4RouterSc 🛣️

Description: This is a platform-specific field for the Catalyst 5000/Catalyst 6000 family. It's used to store the address of a router that's being shortcut when doing MultiLayer Switching 🔀

  • Abstract Data Type: ipv4Address
  • ElementId: 43
  • Semantics: default
  • Status: deprecated

Reference: [CCO-MLS] describes MultiLayer Switching 📖

4.6. samplerId 🪪

Description: Deprecated in favor of 302 selectorId. This is the unique identifier associated with samplerName 💜

  • Abstract Data Type: unsigned8
  • ElementId: 48
  • Semantics: identifier
  • Status: deprecated

4.7. samplerMode 🎛️

Description: Deprecated in favor of 304 selectorAlgorithm. The values aren't compatible, because selectorAlgorithm=3 is random sampling. This is the type of algorithm used for sampling data: 1 - Deterministic, 2 - Random Sampling. Use it with samplerRandomInterval 🧩

  • Abstract Data Type: unsigned8
  • ElementId: 49
  • Semantics: identifier
  • Status: deprecated

4.8. samplerRandomInterval 🎰

Description: Deprecated in favor of 305 samplingPacketInterval. This is the packet interval to sample at, for random sampling. It's used with the samplerMode 0x02 (random sampling) value 🎲

  • Abstract Data Type: unsigned32
  • ElementId: 50
  • Semantics: quantity
  • Status: deprecated

4.9. classId 🏷️

Description: Deprecated in favor of 302 selectorId. This characterizes the traffic class, i.e., its QoS treatment 🚦

  • Abstract Data Type: unsigned8
  • ElementId: 51
  • Semantics: identifier
  • Status: deprecated

4.10. samplerName 🪄

Description: Deprecated in favor of 335 selectorName. This is the name of the flow sampler 💅

  • Abstract Data Type: string
  • ElementId: 84
  • Status: deprecated

4.11. flagsAndSamplerId 🚩

Description: Flow flags and the value of the sampler ID (samplerId) combined into one bitmapped field. Reserved for internal use on the Collector ⚠️

  • Abstract Data Type: unsigned32
  • ElementId: 87
  • Semantics: identifier
  • Status: deprecated

4.12. forwardingStatus ✨

okay bestie, this one tells you what happened to a flow 🦋 It's the forwarding status, plus any reasons attached to it. The reduced-size encoding rules from [RFC7011] apply here too, so no surprises 💅

The basic encoding is 8 bits. Future extensions could add one or three bytes, so keep that in mind 🌸 Here's the layout:

MSB -   0   1   2   3   4   5   6   7   - LSB
      +---+---+---+---+---+---+---+---+
      | Status|  Reason code or flags |
      +---+---+---+---+---+---+---+---+

The first two bits are the Status, and the rest hold the reason code or flags. The Status values are:

00b = Unknown
01b = Forwarded
10b = Dropped
11b = Consumed

Now the reason codes, which depend on the status 🔥

When the status is 01b (Forwarded):

01 000000b = 64 = Unknown
01 000001b = 65 = Fragmented
01 000010b = 66 = Not Fragmented

When the status is 10b (Dropped), the list gets longer, so buckle up 💀

10 000000b = 128 = Unknown
10 000001b = 129 = ACL deny
10 000010b = 130 = ACL drop
10 000011b = 131 = Unroutable
10 000100b = 132 = Adjacency
10 000101b = 133 = Fragmentation and DF set
10 000110b = 134 = Bad header checksum
10 000111b = 135 = Bad total Length
10 001000b = 136 = Bad header length
10 001001b = 137 = bad TTL
10 001010b = 138 = Policer
10 001011b = 139 = WRED
10 001100b = 140 = RPF
10 001101b = 141 = For us
10 001110b = 142 = Bad output interface
10 001111b = 143 = Hardware

And when the status is 11b (Consumed):

11 000000b = 192 = Unknown
11 000001b = 193 = Punt Adjacency
11 000010b = 194 = Incomplete Adjacency
11 000011b = 195 = For us

Let's do some examples, because examples make everything click ✨

value : 0x40 = 64
binary: 01000000
decode: 01        -> Forward
          000000  -> No further information
value : 0x89 = 137
binary: 10001001
decode: 10        -> Drop
          001001  -> Fragmentation and DF set

Here are the IE details 🎀

Abstract Data Type:  unsigned32
ElementId:  89
Semantics:  identifier
Status:  current
Reference:
   See "NetFlow Version 9 Flow-Record Format" [CCO-NF9FMT].

4.13. srcTrafficIndex 🦋

This one is the BGP Policy Accounting Source Traffic Index. Source traffic index, but make it BGP 🌈

Abstract Data Type:  unsigned32
ElementId:  92
Semantics:  identifier
Status:  current
Reference:
   BGP policy accounting as described in [CCO-BGPPOL].

4.14. dstTrafficIndex 🍓

Same energy as the source one, just for the destination. It's the BGP Policy Accounting Destination Traffic Index 💜

Abstract Data Type:  unsigned32
ElementId:  93
Semantics:  identifier
Status:  current
Reference:
   BGP policy accounting as described in [CCO-BGPPOL].

4.15. className 🥀

This one is deprecated, so it's giving retired 😭 It got replaced by 335 selectorName. It's the Traffic Class Name, tied to the classId IE.

Abstract Data Type:  string
ElementId:  100
Status:  deprecated

4.16. layer2packetSectionOffset 🫶

Also deprecated, bestie 🙈 Use 409 sectionOffset instead. It's the Layer 2 packet section offset, and it could potentially be a generic packet section offset.

Abstract Data Type:  unsigned16
ElementId:  102
Semantics:  quantity
Status:  deprecated

4.17. layer2packetSectionSize 🧚

Deprecated again, so the replacement here is 312 dataLinkFrameSize ✨ This is the Layer 2 packet section size, and potentially a generic packet section size too.

Abstract Data Type:  unsigned16
ElementId:  103
Semantics:  quantity
Status:  deprecated

4.18. layer2packetSectionData 👑

Last one in this group, and it's deprecated too 💅 Use 315 dataLinkFrameSection instead. It's the Layer 2 packet section data.

Abstract Data Type:  octetArray
ElementId:  104
Status:  deprecated

5. Other Information Elements 🌸

5.1. Performance Metrics IEs 📈

ElementId: 65 .. 69

Performance metrics need a consolidation in the industry, and that work is based on [RFC6390] 🧠 Once that consolidation happens, through a separate document, the IEs 65-69 will either be assigned in the IANA registry or get deprecated. Stay tuned 👀

5.2. Application Information IEs 💖

ElementId: 94 .. 96
ElementId: 101

For these, please refer to [RFC6759] 🎀

5.3. IEs Assigned for NetFlow v9 Compatibility 🦋

ElementId: 105..127

These element IDs aren't covered by this document. They're left "as is", meaning they exist for NetFlow v9 compatibility 🌈

6. IANA Considerations 📋

This document specifies several new IPFIX Information Elements in IANA's "IPFIX Information Elements" registry [IANA-IPFIX], as summarized in Section 3 and detailed in Section 4 above. The following Information Elements have been assigned:

  • IE Number 34 for the samplingInterval IE
  • IE Number 35 for the samplingAlgorithm IE
  • IE Number 38 for the engineType IE
  • IE Number 39 for the engineId IE
  • IE Number 43 for the ipv4RouterSc IE
  • IE Number 48 for the samplerId IE
  • IE Number 49 for the samplerMode IE
  • IE Number 50 for the samplerRandomInterval IE
  • IE Number 51 for the classId IE
  • IE Number 84 for the samplerName IE
  • IE Number 87 for the flagsAndSamplerId IE
  • IE Number 89 for the forwardingStatus IE
  • IE Number 92 for the srcTrafficIndex IE
  • IE Number 93 for the dstTrafficIndex IE
  • IE Number 100 for the className IE
  • IE Number 102 for the layer2packetSectionOffset IE
  • IE Number 103 for the layer2packetSectionSize IE
  • IE Number 104 for the layer2packetSectionData IE

7. Security Considerations 🔐

This document is where the definitions of several Information Elements live. It doesn't change the security considerations of the base protocol 🙏 For those, you need to check out the security considerations sections of [RFC3954] and [RFC7012]. Don't skip them, they matter!! 🚨

8. References 📚

8.1. Normative References

  • [RFC7011] Claise, B., Trammell, B., and P. Aitken, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information", STD 77, RFC 7011, September 2013.

8.2. Informative References

That's the end of this bit, and there's more coming, so stay with me 💖🫶

Appendix A. XML Specification of IPFIX Information Elements ✨

okay bestie, this is the machine-readable version of the IPFIX Information Elements 🤖💖 every field gets its own <field> entry with a name, data type, element ID, applicability, and status, so tools can read the whole list without a human squinting at prose 👀 the XML is copied exactly below, and I'm not touching a single character of it 🫶

<?xml version="1.0" encoding="UTF-8"?>

<fieldDefinitions xmlns="urn:ietf:params:xml:ns:ipfix-info"
              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xsi:schemaLocation="urn:ietf:params:xml:ns:ipfix-info
              ipfix-info.xsd">

  <field name="samplingInterval" dataType="unsigned32"
           group=""
           dataTypeSemantics="quantity"
           elementId="34" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Deprecated in favor of 305 samplingPacketInterval.  When using
     sampled NetFlow, the rate at which packets are sampled --
     e.g., a value of 100 indicates that one of every 100 packets
     is sampled.
     </paragraph>
    </description>
  </field>
  <field name="samplingAlgorithm" dataType="unsigned8"
           group=""
           dataTypeSemantics="identifier"
           elementId="35" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Deprecated in favor of 304 selectorAlgorithm.  The type of
     algorithm used for sampled NetFlow: 1 - Deterministic Sampling,
     2 - Random Sampling.  The values are not compatible with the
     selectorAlgorithm IE, where "Deterministic" has been replaced
     by "Systematic count-based" (1) or "Systematic time-based" (2),
     and "Random" is (3).  Conversion is required; see
     [IANA-PSAMP] PSAMP parameters.
     </paragraph>
    </description>
  </field>
  <field name="engineType" dataType="unsigned8"
           group=""
           dataTypeSemantics="identifier"
           elementId="38" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Type of flow switching engine in a router/switch: RP = 0,
     VIP/Line card = 1, PFC/DFC = 2.  Reserved for internal use on
     the Collector.
     </paragraph>

    </description>
  </field>
  <field name="engineId" dataType="unsigned8"
          group=""
          dataTypeSemantics="identifier"
          elementId="39" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Versatile Interface Processor (VIP) or line card slot number of
     the flow switching engine in a router/switch.  Reserved for
     internal use on the Collector.
     </paragraph>
    </description>
  </field>
  <field name="ipv4RouterSc" dataType="ipv4Address"
          group=""
          dataTypeSemantics="default"
          elementId="43" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     This is a platform-specific field for the Catalyst 5000/Catalyst
     6000 family.  It is used to store the address of a router that
     is being shortcut when performing MultiLayer Switching.
     </paragraph>
    </description>
    <reference>
     http://www.cisco.com/en/US/products/hw/switches/ps700/
     products_configuration_example09186a00800ab513.shtml
     describes MultiLayer Switching.
    </reference>
  </field>
  <field name="samplerId" dataType="unsigned8"
          group=""
          dataTypeSemantics="identifier"
          elementId="48" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Deprecated in favor of 302 selectorId.  The unique identifier
     associated with samplerName.
     </paragraph>
    </description>
  </field>
  <field name="samplerMode" dataType="unsigned8"
          group=""
          dataTypeSemantics="identifier"
          elementId="49" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Deprecated in favor of 304 selectorAlgorithm.  The values are
     not compatible: selectorAlgorithm=3 is random sampling.  The
     type of algorithm used for sampled NetFlow: 1 - Deterministic
     Sampling, 2 - Random Sampling.  Use with samplerRandomInterval.
     </paragraph>
    </description>
  </field>
  <field name="samplerRandomInterval" dataType="unsigned32"
          group=""
          dataTypeSemantics="quantity"
          elementId="50" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Deprecated in favor of 305 samplingPacketInterval.  Packet
     interval at which to sample -- in case of random sampling.  Used
     in connection with the samplerMode 0x02 (random sampling) value.
     </paragraph>
    </description>
  </field>
  <field name="classId" dataType="unsigned8"
          group=""
          dataTypeSemantics="identifier"
          elementId="51" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Deprecated in favor of 302 selectorId.  Characterizes the
     traffic class, i.e., QoS treatment.
     </paragraph>
    </description>
  </field>
  <field name="samplerName" dataType="string"
          group=""
          dataTypeSemantics=""
          elementId="84" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Deprecated in favor of 335 selectorName.  Name of the flow
     sampler.
     </paragraph>
    </description>
  </field>
  <field name="flagsAndSamplerId" dataType="unsigned32"
          group=""
          dataTypeSemantics="identifier"
          elementId="87" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Flow flags and the value of the sampler ID (samplerId) combined
     in one bitmapped field.  Reserved for internal use on the
     Collector.
     </paragraph>
    </description>
  </field>
  <field name="forwardingStatus" dataType="unsigned32"
          group=""
          dataTypeSemantics="identifier"
          elementId="89" applicability="flow" status="current">
    <description>
     <paragraph>
     This Information Element describes the forwarding status of the
     flow and any attached reasons.  The reduced-size encoding rules
     as per [RFC7011] apply.
     </paragraph>
     <artwork>
        The basic encoding is 8 bits.  The future extensions
        could add one or three bytes.  The layout of the basic
        encoding is as follows:

          MSB -   0   1   2   3   4   5   6   7   - LSB
              +---+---+---+---+---+---+---+---+
              | Status|  Reason code or flags |
              +---+---+---+---+---+---+---+---+
        Status:

        00b = Unknown
        01b = Forwarded
        10b = Dropped
        11b = Consumed

        Reason Code (status = 01b, Forwarded)

        01 000000b = 64 = Unknown
        01 000001b = 65 = Fragmented
        01 000010b = 66 = Not Fragmented

        Reason Code (status = 10b, Dropped)

        10 000000b = 128 = Unknown
        10 000001b = 129 = ACL deny
        10 000010b = 130 = ACL drop
        10 000011b = 131 = Unroutable
        10 000100b = 132 = Adjacency
        10 000101b = 133 = Fragmentation and DF set
        10 000110b = 134 = Bad header checksum
        10 000111b = 135 = Bad total Length
        10 001000b = 136 = Bad header length
        10 001001b = 137 = bad TTL
        10 001010b = 138 = Policer
        10 001011b = 139 = WRED
        10 001100b = 140 = RPF
        10 001101b = 141 = For us
        10 001110b = 142 = Bad output interface
        10 001111b = 143 = Hardware

        Reason Code (status = 11b, Consumed)

        11 000000b = 192 = Unknown
        11 000001b = 193 = Punt Adjacency
        11 000010b = 194 = Incomplete Adjacency
        11 000011b = 195 = For us

        Examples:

          value : 0x40 = 64
          binary: 01000000
          decode: 01     -> Forward
                8000000  -> No further information

          value : 0x89 = 137
          binary: 10001001
          decode: 10     -> Drop
                001001  -> Fragmentation and DF set
     </artwork>
    </description>
    <reference>
     See http://www.cisco.com/en/US/technologies/tk648/tk362/
     technologies_white_paper09186a00800a3db9.html -
     NetFlow Version 9 Flow-Record Format.
    </reference>
  </field>
  <field name="srcTrafficIndex" dataType="unsigned32"
          group=""
          dataTypeSemantics="identifier"
          elementId="92" applicability="flow" status="current">
    <description>
     <paragraph>
     BGP Policy Accounting Source Traffic Index.
     </paragraph>
    </description>
    <reference>
     BGP policy accounting as described in
     http://www.cisco.com/en/US/tech/tk365/
     technologies_tech_note09186a0080094e88.shtml
    </reference>

  </field>
  <field name="dstTrafficIndex" dataType="unsigned32"
          group=""
          dataTypeSemantics="identifier"
          elementId="93" applicability="flow" status="current">
    <description>
     <paragraph>
     BGP Policy Accounting Destination Traffic Index.
     </paragraph>
    </description>
    <reference>
     BGP policy accounting as described in
     http://www.cisco.com/en/US/tech/tk365/
     technologies_tech_note09186a0080094e88.shtml
    </reference>
  </field>
  <field name="className" dataType="string"
          group=""
          dataTypeSemantics=""
          elementId="100" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Deprecated in favor of 335 selectorName.  Traffic Class Name,
     associated with the classId Information Element.
     </paragraph>
    </description>
  </field>
  <field name="layer2packetSectionOffset" dataType="unsigned16"
          group=""
          dataTypeSemantics="quantity"
          elementId="102" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Deprecated in favor of 409 sectionOffset.
     Layer 2 packet section offset.  Potentially a generic packet
     section offset.
     </paragraph>
    </description>
  </field>
  <field name="layer2packetSectionSize" dataType="unsigned16"
          group=""
          dataTypeSemantics="quantity"
          elementId="103" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Deprecated in favor of 312 dataLinkFrameSize.
     Layer 2 packet section size.  Potentially a generic packet
     section size.

     </paragraph>
    </description>
  </field>
  <field name="layer2packetSectionData" dataType="octetArray"
          group=""
          dataTypeSemantics=""
          elementId="104" applicability="flow" status="deprecated">
    <description>
     <paragraph>
     Deprecated in favor of 315 dataLinkFrameSection.
     Layer 2 packet section data.
     </paragraph>
    </description>
  </field>
</fieldDefinitions>

Quick bestie recap of the fields in this list 💅

  • samplingInterval (elementId 34, deprecated) 🎀
  • samplingAlgorithm (elementId 35, deprecated) 🎀
  • engineType (elementId 38, deprecated) 🎀
  • engineId (elementId 39, deprecated) 🎀
  • ipv4RouterSc (elementId 43, deprecated) 🎀
  • samplerId (elementId 48, deprecated) 🎀
  • samplerMode (elementId 49, deprecated) 🎀
  • samplerRandomInterval (elementId 50, deprecated) 🎀
  • classId (elementId 51, deprecated) 🎀
  • samplerName (elementId 84, deprecated) 🎀
  • flagsAndSamplerId (elementId 87, deprecated) 🎀
  • forwardingStatus (elementId 89, current) ✨
  • srcTrafficIndex (elementId 92, current) ✨
  • dstTrafficIndex (elementId 93, current) ✨
  • className (elementId 100, deprecated) 🎀
  • layer2packetSectionOffset (elementId 102, deprecated) 🎀
  • layer2packetSectionSize (elementId 103, deprecated) 🎀
  • layer2packetSectionData (elementId 104, deprecated) 🎀

Authors' Addresses ✨

Andrew Yourtchenko
Cisco Systems, Inc.
De Kleetlaan, 7
Brussels, Diegem  B-1831
Belgium

Phone: +32 2 704 5494
EMail: ayourtch@cisco.com


Paul Aitken
Cisco Systems, Inc.
96 Commercial Quay
Edinburgh  EH6 6LX
Scotland

Phone: +44 131 561 3616
EMail: paitken@cisco.com


Benoit Claise
Cisco Systems, Inc.
De Kleetlaan, 6a b1
Diegem  B-1831
Belgium

Phone: +32 2 704 5622
EMail: bclaise@cisco.com
📦 where this page comes from