Network Performance Insight References · Network Performance Insight services are running on...

IBM Network Performance Insight 1.3.1Document Revision R2E1

Network Performance Insight References

IBM

Note

Before using this information and the product it supports, read the information in “Notices” on page379.

This edition applies to version 1.3.1.0 of IBM® Network Performance Insight® and to all subsequent releases andmodifications until otherwise indicated in new editions.© Copyright International Business Machines Corporation 2015, 2019.US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract withIBM Corp.

Contents

Reference..............................................................................................................vIntended audience....................................................................................................................................... vOrganization..................................................................................................................................................vNetwork Performance Insight architecture................................................................................................. vIBM Community......................................................................................................................................... viiiNetwork Performance Insight technical training........................................................................................ixSupport information.................................................................................................................................... ixConventions used in this publication ......................................................................................................... ix

Typeface conventions ........................................................................................................................... ix

Chapter 1. Reference............................................................................................. 1REST API definitions.................................................................................................................................... 1

Flow APIs................................................................................................................................................1Metric APIs........................................................................................................................................... 32Threshold API.......................................................................................................................................65

Command line interface............................................................................................................................ 68basecamp-manager-cmd command reference................................................................................ 68backup command reference............................................................................................................... 70restore command reference................................................................................................................ 71pack-tool command usage...................................................................................................................71

NetFlow versions....................................................................................................................................... 73NetFlow V1 formats............................................................................................................................. 74NetFlow V5 formats............................................................................................................................. 75V9 field type definitions....................................................................................................................... 76IPFIX Information Elements................................................................................................................83

SNMP formulas........................................................................................................................................ 334SNMP formula language.......................................................................................................................... 334

Language basics................................................................................................................................. 334Writing custom discovery formulas................................................................................................... 335Writing custom collection formulas...................................................................................................341Writing custom metrics...................................................................................................................... 349

Dashboard reference............................................................................................................................... 350Properties of the summary-level dashboards...................................................................................351Properties of the NetFlow dashboards..............................................................................................356Properties of the On Demand Filtering dashboards..........................................................................358

Configuring Flow devices.........................................................................................................................361Supported devices and flow formats.................................................................................................362Configuring NetFlow on Cisco routers............................................................................................... 362Configuring flow on Juniper devices..................................................................................................370Configuring NetStream traffic on Huawei devices............................................................................ 378

Notices..............................................................................................................379Trademarks.............................................................................................................................................. 380Terms and conditions for product documentation................................................................................. 381

iii

Reference

Use the following reference information to enhance your understanding of IBM Network PerformanceInsight and to help you work with IBM Network Performance Insight effectively.

Intended audienceThe audience who are network administrators or network users who are responsible for installing andusing the Network Performance Insight product on an enterprise network.

To install Network Performance Insight successfully, you must have a thorough understanding of thefollowing subjects:

• Network Performance Insight 1.3.1 system• Basic principles of network protocols and network management• NetFlow and Cisco IP SLA concepts• Linux administration• Jazz® for Service Management• IBM Tivoli® Network Manager IP Edition• IBM Tivoli Netcool®/OMNIbus

OrganizationRead this summary to help you find the information that you need.

This information is organized as follows:

• “REST API definitions” on page 1• “Command line interface” on page 68• “Configuring Flow devices” on page 361

Network Performance Insight architectureIBM Network Performance Insight is a network performance monitoring system. It offers both real-timeand historical trends in network performance and interactive view on the network data that helps inreduced network downtime and optimized network performance.

Network Performance Insight provides IBM Netcool Operations Insight with comprehensive IP networkdevice performance monitoring and session traffic analysis.

The following diagram shows how data is flowing through the various components in NetworkPerformance Insight:

© Copyright IBM Corp. 2015, 2019 v

Network Performance Insight servicesNetwork Performance Insight services are running on microservice architecture that has the softwareapplication as a suite of independently deployable, small, modular services in which each service runs aunique process and communicates through a well-defined, lightweight mechanism. Currently, NetworkPerformance Insight 1.3.1 consists of the following microservices:

Foundation services

• Dashboard• DNS• Event• Manager• Storage• UI

Entity Metric services

• Cacti Collector• Exporter• Formula Service• Entity Analytics• SNMP Collector• Threshold

vi Reference

• Tivoli Network Manager Collector

Flow Metric services

• Flow Analytics• Flow Collector

For more information about these services, see their respective sections in IBM Network PerformanceInsight: Product Overview.

Network Performance Insight additional components

Some of the additional components that are introduced in Network Performance Insight, V1.3.1 forenhanced functions are described here:Technology Packs

A set of ready-to-use Technology Packs is provided to perform second-level discovery and polling ofresources to collect entity metric data . These Technology Packs can help to collect standard SNMPmetrics, IP SLA metrics, and Performance Metric OOTB Device Support metrics.

For more information, see Installing the Technology Packs section in Installing and Configuring IBMNetwork Performance Insight.

Network Performance Insight Dashboards

These interactive dashboards are the built-in, JSON-based dashboards suite that can displayaggregated network data from Network Performance Insight database with the help of REST API calls.It supports a combination of data from multiple data sources.

This feature provides a wide variety of dashboards for Network Operators, Network Engineers, andNetwork Capacity Planners. These dashboards help in pinpointing the troubled resources and generalresource performance. A number of web-based configuration options are available to control the datathat is displayed on the dashboards.

For more information, see Network Performance Insight Dashboards section in IBM NetworkPerformance Insight: Product Overview.

Note: Networks for Operations Insight is a solution extension of Netcool Operations Insight thatincludes the following components and products:

• Tivoli Network Manager• Tivoli Netcool Configuration Manager• Network Performance Insight• Network Health Dashboard• Device Dashboard• Topology Search

Hortonworks Data Platform components

Hortonworks Data Platform (HDP®) can be used to help process and analyze the volume, variety, andvelocity of data that continually enters your organization every day. Network Performance Insight isinstalled as a service extension to the installed HDP® stack.

The features of HDP® that are used in Network Performance Insight:

• HDP®

• Default support for rolling upgrades for Hadoop services• Support for long-running applications within YARN for enhanced reliability

Reference vii

• Spark in-memory distributed compute engine for dramatic performance increase• Apache Ambari operational framework. Apache Ambari is an open framework for provisioning,

managing, and monitoring Apache Hadoop clusters. Ambari provides an intuitive and easy-to-useHadoop management web UI backed by its collection of tools and APIs that simplify the operation ofHadoop clusters.

• Essentially includes the following open source technologies for working with Network PerformanceInsight:

– Apache Hadoop– Apache Kafka– Apache Ambari– Apache Spark– Apache ZooKeeper

Note: Because Zookeeper requires a majority, it is best to use an odd number of machines. Forexample, with four machines ZooKeeper can handle the failure of a single machine; if two machinesfail, the remaining two machines do not constitute a majority. However, with five machinesZooKeeper can handle the failure of two machines.

Integrated products

Products that are integrated with Network Performance Insight 1.3.1:Cassandra

It is available as a microservice that can be installed along with other microservices in NetworkPerformance Insight. All the inventory metadata is stored in Cassandra.

Jazz for Service ManagementDashboard Application Services Hub provides visualization and dashboard services in Jazz for ServiceManagement. It has a single console for administering IBM products and related applications.Visualization for Network Performance Insight is federated into Dashboard Application Services Hub.

IBM Tivoli Network Manager IP EditionTivoli Network Manager provides first-level device discovery and polling of some standard SNMPmetrics.

Tivoli Netcool/OMNIbus component of IBM Netcool Operations InsightNetcool Operations Insight is powered by the fault management capabilities of IBM Tivoli Netcool/OMNIbus. In Network Performance Insight, V1.3.1, Tivoli Netcool/OMNIbus is an important part ofthe solution for monitoring the network threshold violations.

Related informationIBM Network Performance Insight on IBM Knowledge CenterHortonworks Data PlatformHDFS ArchitectureApache Hadoop YARNApache KafkaApache ZookeeperIBM Networks for Operations Insight

IBM CommunityConnect, learn, and share with professionals and product support technical experts who provide theirperspectives and expertise.

Access the IBM Network Performance Insight community. Use IBM Community in the following ways:

viii Reference

http://hadoop.apache.org/

https://kafka.apache.org/

https://ambari.apache.org/

https://spark.apache.org/

https://zookeeper.apache.org/

http://www.ibm.com/support/knowledgecenter/SSCVHB

https://hortonworks.com/products/data-platforms/hdp/

https://hadoop.apache.org/docs/r2.7.2/hadoop-project-dist/hadoop-hdfs/HdfsDesign.html#HDFS_Architecture

http://hadoop.apache.org/docs/current/hadoop-yarn/hadoop-yarn-site/YARN.html

http://kafka.apache.org/documentation.html

http://zookeeper.apache.org/

https://www.ibm.com/support/knowledgecenter/SSTPTP_1.4.1/com.ibm.netcool_ops.doc/omn_nmip/task/nnm_noi_ins_extendtonetcooloperationsinsight.html

https://www.ibm.com/developerworks/community/groups/service/html/communitystart?communityUuid=eaa9489e-3122-440a-93a3-ee5cd204c603

• Become involved with transparent development, an ongoing, open engagement between other usersand IBM developers of Tivoli products. You can access early designs, sprint demonstrations, productroadmaps, and prerelease code.

• Connect one-on-one with the experts to collaborate and network about Tivoli and the Network andService Assurance community.

• Read blogs to benefit from the expertise and experience of others.• Use wikis and forums to collaborate with the broader user community.

Network Performance Insight technical trainingFor Tivoli technical training information, see the following Network Performance Insight Training websiteat https://tnpmsupport.persistentsys.com/updated_trainings.

Support informationIf you have a problem with your IBM Software, you want to resolve it quickly. IBM provides the followingways for you to obtain the support you need:Online

Access the IBM Software Support site at https://www-947.ibm.com/support/servicerequest/newServiceRequest.action

IBM Support AssistantThe IBM Support Assistant is a free local software serviceability workbench that helps you resolvequestions and problems with IBM Software products. The Support Assistant provides quick access tosupport-related information and serviceability tools for problem determination. To install the SupportAssistant software, go to https://www.ibm.com/software/support/isa.

Troubleshooting GuideFor more information about resolving problems, see the problem determination information for thisproduct.

Conventions used in this publicationSeveral conventions are used in this publication for special terms, actions, commands, and paths that aredependent on your operating system.

Typeface conventionsThis publication uses the following typeface conventions:

Bold

• Lowercase commands and mixed case commands that are otherwise difficult to distinguish fromsurrounding text

• Interface controls (check boxes, push buttons, radio buttons, spin buttons, fields, folders, icons, listboxes, items inside list boxes, multicolumn lists, containers, menu choices, menu names, tabs,property sheets), labels (such as Tip:, and Operating system considerations:)

• Keywords and parameters in text

Italic

• Citations (examples: titles of publications, diskettes, and CDs)• Words defined in text (example: a nonswitched line is called a point-to-point line)• Emphasis of words and letters (words as words example: "Use the word that to introduce a

restrictive clause."; letters as letters example: "The LUN address must start with the letter L.")

Reference ix

https://tnpmsupport.persistentsys.com/updated_trainings

https://www-947.ibm.com/support/servicerequest/newServiceRequest.action

https://www-947.ibm.com/support/servicerequest/newServiceRequest.action

https://www.ibm.com/software/support/isa

• New terms in text (except in a definition list): a view is a frame in a workspace that contains data.• Variables and values you must provide: ... where myname represents....

Monospace

• Examples and code examples• File names, programming keywords, and other elements that are difficult to distinguish from

surrounding text• Message text and prompts addressed to the user• Text that the user must type• Values for arguments or command options

Bold monospace

• Command names, and names of macros and utilities that you can type as commands• Environment variable names in text• Keywords• Parameter names in text: API structure parameters, command parameters and arguments, andconfiguration parameters

• Process names• Registry variable names in text• Script names

x IBM Network Performance Insight 1.3.1: Network Performance Insight References

Chapter 1. ReferenceUse the following reference information to enhance your understanding of IBM Network PerformanceInsight and to help you work with IBM Network Performance Insight effectively.

REST API definitionsThe APIs in Network Performance Insight that give access to the database data for constructing thedashboards.

Using Network Performance Insight REST API commands requires the same permissions as using the webinterface. These REST APIs are available so that you can retrieve the data outside of the web interface.

Each REST resource contains information such as URLs, functions, parameters, descriptions, sampleinput, and output data.

Common REST API status codesREST API status codes

HTTP status code Generic description

200 Success

400 Failure

Flow APIsREST APIs that are related Flow data that is collected by Flow Collector Service and analyzed by FlowAnalytics Service.

aggregationProvides a list of Flow aggregations that are visible to the user.

This API queries and retrieves information from CFG.AGGREGATION_DISABLE table.

URL

https://[host]:[port]/service/dataset/flow/aggregation

https://<myserver.ibm.com>:9443/service/dataset/flow/aggregation

Method

The supported request type.

https GET

URL parameters

Name Required Default value Description

visible No true Fields that must bereturned.

© Copyright IBM Corp. 2015, 2019 1

Sample URLs

/service/dataset/flow/aggregation/service/dataset/flow/aggregation/?visible=true

Response

The results are returned as JSON data that contains an array of the following fields:

Name Data type Description

aggregation string The key for the aggregation onthe flow metric.

agg_fields string The columns that are used togroup by for the calculation ofaggregation.

aggregation_name string The name of the aggregation onthe flow metric.

visible boolean A flag to indicate whether theaggregation is visible to the useror not.

enabled boolean A flag to indicate whether theaggregation is enabled by theadministrator or not.

order_id number It indicates the sorting order ofthis list.

JSON code with visible flag set to true:

[{"aggregation": "app","aggregation_name": "Top Applications","agg_fields": "APP_NAME","visible": true,"enabled": true,"order_id": 1},{"aggregation": "app_srctos","aggregation_name": "Top Applications with Source ToS","agg_fields": "APP_NAME, SRC_TOS","visible": true,"enabled": true,"order_id": 2},{"aggregation": "srcip","aggregation_name": "Top Sources","agg_fields": "SRC_IP","visible": true,"enabled": true,"order_id": 3},{"aggregation": "srcip_app","aggregation_name": "Top Sources with Application","agg_fields": "SRC_IP, APP_NAME","visible": true,"enabled": true,"order_id": 4},{"aggregation": "dstip","aggregation_name": "Top Destinations",

2 IBM Network Performance Insight 1.3.1: Network Performance Insight References

"agg_fields": "DST_IP","visible": true,"enabled": true,"order_id": 5},{"aggregation": "dstip_app","aggregation_name": "Top Destinations with Application","agg_fields": "DST_IP, APP_NAME","visible": true,"enabled": true,"order_id": 6},{"aggregation": "conv","aggregation_name": "Top Conversations","agg_fields": "SRC_IP, DST_IP","visible": true,"enabled": true,"order_id": 7},{"aggregation": "conv_app","aggregation_name": "Top Conversations with Application","agg_fields": "SRC_IP, DST_IP, APP_NAME","visible": true,"enabled": true,"order_id": 8},{"aggregation": "conv_tos","aggregation_name": "Top Conversations with ToS","agg_fields": "SRC_IP, DST_IP, SRC_TOS","visible": true,"enabled": true,"order_id": 9},{"aggregation": "prot","aggregation_name": "Top Protocols","agg_fields": "PROTOCOL_ID","visible": true,"enabled": true,"order_id": 10},{"aggregation": "prot_app","aggregation_name": "Top Protocols with Application","agg_fields": "PROTOCOL_ID, APP_NAME","visible": true,"enabled": true,"order_id": 11},{"aggregation": "prot_srcip","aggregation_name": "Top Protocols with Source Ip","agg_fields": "PROTOCOL_ID, SRC_IP","visible": true,"enabled": true,"order_id": 12},{"aggregation": "prot_dstip","aggregation_name": "Top Protocols with Destination Ip","agg_fields": "PROTOCOL_ID, DST_IP","visible": true,"enabled": true,"order_id": 13},{"aggregation": "prot_conv","aggregation_name": "Top Protocols with Conversation","agg_fields": "PROTOCOL_ID, SRC_IP, DST_IP","visible": true,"enabled": true,"order_id": 14},{"aggregation": "srcas","aggregation_name": "Top Source Autonomous System","agg_fields": "BGP_SRC_AS_NUM","visible": true,

Reference 3

"enabled": true,"order_id": 15},{"aggregation": "dstas","aggregation_name": "Top Destination Autonomous System","agg_fields": "BGP_DST_AS_NUM","visible": true,"enabled": true,"order_id": 16},{"aggregation": "conv_as","aggregation_name": "Top Autonomous System Conversations","agg_fields": "BGP_SRC_AS_NUM, BGP_DST_AS_NUM","visible": true,"enabled": true,"order_id": 17},{"aggregation": "srctos","aggregation_name": "Top Source ToS","agg_fields": "SRC_TOS","visible": true,"enabled": true,"order_id": 18},{"aggregation": "hierarchy_queueid","aggregation_name": "Top QoS Hierarchies with Queue Id","agg_fields": "POLICY_QOS_CLASSIFICATION_HIERARCHY, POLICY_QOS_QUEUE_ID","visible": true,"enabled": true,"order_id": 19},{"aggregation": "dstipgroup","aggregation_name": "Top Destination Ip Groups","agg_fields": "DST_IP_GROUP","visible": true,"enabled": true,"order_id": 20},{"aggregation": "dstipgroup_app","aggregation_name": "Top Destination Ip Groups with Application","agg_fields": "DST_IP_GROUP, APP_NAME","visible": true,"enabled": true,"order_id": 21},{"aggregation": "dstipgroup_prot","aggregation_name": "Top Destination Ip Groups with Protocol","agg_fields": "DST_IP_GROUP, PROTOCOL_ID","visible": true,"enabled": true,"order_id": 22},{"aggregation": "dstipgroup_tos","aggregation_name": "Top Destination Ip Groups with Source ToS","agg_fields": "DST_IP_GROUP, SRC_TOS","visible": true,"enabled": true,"order_id": 23},{"aggregation": "srcipgroup","aggregation_name": "Top Source Ip Groups","agg_fields": "SRC_IP_GROUP","visible": true,"enabled": true,"order_id": 24},{"aggregation": "srcipgroup_app","aggregation_name": "Top Source Ip Groups with Application","agg_fields": "SRC_IP_GROUP, APP_NAME","visible": true,"enabled": true,"order_id": 25


},{"aggregation": "srcipgroup_prot","aggregation_name": "Top Source Ip Groups with Protocol","agg_fields": "SRC_IP_GROUP, PROTOCOL_ID","visible": true,"enabled": true,"order_id": 26},{"aggregation": "srcipgroup_tos","aggregation_name": "Top Source Ip Groups with Source ToS","agg_fields": "SRC_IP_GROUP, SRC_TOS","visible": true,"enabled": true,"order_id": 27},{"aggregation": "convgroup","aggregation_name": "Top Ip Group Conversations","agg_fields": "SRC_IP_GROUP, DST_IP_GROUP","visible": true,"enabled": true,"order_id": 28}{"aggregation": "convgroup_app","aggregation_name": "Top Ip Group Conversations with Application","agg_fields": "SRC_IP_GROUP, DST_IP_GROUP, APP_NAME","visible": true,"enabled": true,"order_id": 29}]

JSON code with visible flag set to false:

[{"aggregation": "convgroup_prot","aggregation_name": "Top Ip Group Conversations with Protocol","agg_fields": "SRC_IP_GROUP, DST_IP_GROUP, PROTOCOL_ID","visible": false,"enabled": false,"order_id": 1},{"aggregation": "convgroup_tos","aggregation_name": "Top Ip Group Conversations with Source ToS","agg_fields": "SRC_IP_GROUP, DST_IP_GROUP, SRC_TOS","visible": false,"enabled": false,"order_id": 2}]

interfaceProvides a list of all the flow interfaces that the system receives from an exporter. This API is specific forFlow data alone.

This API queries and retrieves information from FLOW_METRIC.INTERFACE table.

URL

https://[host]:[port]/service/dataset/cfg/interface

https://<myserver.ibm.com>:9443/service/dataset/cfg/interface/?fields=*

Reference 5

Method


https GEThttps POST/PUT

URL parameters

Name Required Description

fields No Fields that must be returned.

count No Number of flow interface records that must bereturned.

sort No How the records must be sorted. Prefix + or - toindicate the sort direction.

For example, +metric,-upper_limit sorts bymetric in ascending order, and then sorts byupper_limit in descending order. You can give acomma-separated list of parameters for sorting.

condition No Expression that must be used to filter specificrecords. For example, condition=name=test.

Sample URLs

List interfaces:

/service/dataset/cfg/interface/?fields=*

/service/dataset/cfg/interface/?fields=*&count=10

/service/dataset/cfg/interface/?fields=*&count=10&condition=direction=1&sort=+start_ms

/service/dataset/cfg/interface/?fields=*&count=10&condition=direction=1

Update interfaces

/service/dataset/cfg/interface/[entity_id]/service/dataset/cfg/interface/

Response



entity_id number Internal system ID for thereturned flow interface.

start_ms number Time at which the flow interfaceis first known by the system.

exporter_ip string IP address of the exporter onwhich the flow interfaces reside.

if_index number Index of the flow interface on theexporter.

direction number Direction of the flow interface (0=ingress, 1= egress).



enabled boolean Flag that indicates for interfaceenablement in the system for theflow interface.

speed number Speed of the flow interface in bitsper second (bps).

if_name string Name of the flow interface asknown by the exporter.

interface_name string The name of the flow interface.

interface_description string The description of the flowinterface.

success_count number Number of interfaces that areenabled or disabled successfullywith toggle parameter in therequest URL.

failure_count number Number of failures for interfaceenablement with toggleparameter in the request URL.

status string Status of the interfaceenablement that is retrieved withtoggle parameter in the requestURL. Default values are enabledor disabled.

JSON code to list interfaces:

[ { "entity_id":8589934636, "start_ms":1516002407478, "exporter_ip":"10.55.239.217", "if_index":3, "direction":1, "enabled":true, "interface_name":"T1 1/2", "interface_description":"T1 1/2", "speed":154400, "if_name":"10.55.239.217-T1 1/2" }, { "entity_id":8589934641, "start_ms":1516002407479, "exporter_ip":"10.55.239.217", "if_index":5, "direction":0, "enabled":true, "interface_name":"Fa0/0", "interface_description":"FastEthernet0/0", "speed":100000, "if_name":"10.55.239.217-Fa0/0" }, { "entity_id":8589934611, "start_ms":1516002399475, "exporter_ip":"10.55.239.218", "if_index":7, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-7" }, {

Reference 7

"entity_id":8589934596, "start_ms":1516002361468, "exporter_ip":"10.55.239.203", "if_index":1, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-1" }, { "entity_id":8589934606, "start_ms":1516002371470, "exporter_ip":"10.55.239.203", "if_index":7, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-7" }, { "entity_id":8589934638, "start_ms":1516002407479, "exporter_ip":"10.55.239.217", "if_index":4, "direction":1, "enabled":true, "interface_name":"T1 1/3", "interface_description":"T1 1/3", "speed":154400, "if_name":"10.55.239.217-T1 1/3" }, { "entity_id":8589934600, "start_ms":1516002361469, "exporter_ip":"10.55.239.203", "if_index":2, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-2" }, { "entity_id":8589934623, "start_ms":1516002404480, "exporter_ip":"10.55.239.236", "if_index":2, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-2" }, { "entity_id":8589934612, "start_ms":1516002399475, "exporter_ip":"10.55.239.218", "if_index":2, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-2" }, { "entity_id":8589934644, "start_ms":1516002429480, "exporter_ip":"10.55.239.218", "if_index":5, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-5"


}, { "entity_id":8589934619, "start_ms":1516002399477, "exporter_ip":"10.55.239.218", "if_index":8, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-8" }, { "entity_id":8589934628, "start_ms":1516002404483, "exporter_ip":"10.55.239.236", "if_index":5, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-5" }, { "entity_id":8589934608, "start_ms":1516002399474, "exporter_ip":"10.55.239.218", "if_index":3, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-3" }, { "entity_id":8589934633, "start_ms":1516002407477, "exporter_ip":"10.55.239.217", "if_index":1, "direction":0, "enabled":true, "interface_name":"T1 1/0_AY123", "interface_description":"T1 1/0 test AY_change", "speed":1000, "if_name":"10.55.239.217-T1 1/0_AY123" }, { "entity_id":8589934603, "start_ms":1516002361469, "exporter_ip":"10.55.239.203", "if_index":6, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-6" }, { "entity_id":8589934592, "start_ms":1516002351472, "exporter_ip":"10.55.239.203", "if_index":4, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-4" }, { "entity_id":8589934605, "start_ms":1516002371470, "exporter_ip":"10.55.239.203", "if_index":3, "direction":1, "enabled":true, "interface_name":"", "interface_description":"",

Reference 9

"speed":0, "if_name":"10.55.239.203-3" }, { "entity_id":8589934615, "start_ms":1516002399476, "exporter_ip":"10.55.239.218", "if_index":4, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-4" }, { "entity_id":8589934647, "start_ms":1516004669704, "exporter_ip":"10.55.239.218", "if_index":1, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-1" }, { "entity_id":8589934617, "start_ms":1516002399476, "exporter_ip":"10.55.239.218", "if_index":6, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-6" }, { "entity_id":8589934607, "start_ms":1516002371470, "exporter_ip":"10.55.239.203", "if_index":7, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-7" }, { "entity_id":8589934620, "start_ms":1516002404479, "exporter_ip":"10.55.239.236", "if_index":1, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-1" }, { "entity_id":8589934624, "start_ms":1516002404480, "exporter_ip":"10.55.239.236", "if_index":3, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-3" }, { "entity_id":8589934637, "start_ms":1516002407478, "exporter_ip":"10.55.239.217", "if_index":3, "direction":0, "enabled":true,


"interface_name":"T1 1/2", "interface_description":"T1 1/2", "speed":154400, "if_name":"10.55.239.217-T1 1/2" }, { "entity_id":8589934645, "start_ms":1516002429480, "exporter_ip":"10.55.239.218", "if_index":5, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-5" }, { "entity_id":8589934642, "start_ms":1516002407480, "exporter_ip":"10.55.239.217", "if_index":6, "direction":1, "enabled":true, "interface_name":"Fa0/1", "interface_description":"FastEthernet0/1", "speed":100000, "if_name":"10.55.239.217-Fa0/1" }, { "entity_id":8589934622, "start_ms":1516002404480, "exporter_ip":"10.55.239.236", "if_index":2, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-2" }, { "entity_id":8589934604, "start_ms":1516002371470, "exporter_ip":"10.55.239.203", "if_index":3, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-3" }, { "entity_id":8589934618, "start_ms":1516002399477, "exporter_ip":"10.55.239.218", "if_index":8, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-8" }, { "entity_id":8589934639, "start_ms":1516002407479, "exporter_ip":"10.55.239.217", "if_index":4, "direction":0, "enabled":true, "interface_name":"T1 1/3", "interface_description":"T1 1/3", "speed":154400, "if_name":"10.55.239.217-T1 1/3" }, { "entity_id":8589934616, "start_ms":1516002399476, "exporter_ip":"10.55.239.218", "if_index":6,

Reference 11

"direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-6" }, { "entity_id":8589934597, "start_ms":1516002361468, "exporter_ip":"10.55.239.203", "if_index":1, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-1" }, { "entity_id":8589934630, "start_ms":1516002404483, "exporter_ip":"10.55.239.236", "if_index":6, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-6" }, { "entity_id":8589934598, "start_ms":1516002361469, "exporter_ip":"10.55.239.203", "if_index":5, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-5" }, { "entity_id":8589934626, "start_ms":1516002404482, "exporter_ip":"10.55.239.236", "if_index":4, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-4" }, { "entity_id":8589934602, "start_ms":1516002361469, "exporter_ip":"10.55.239.203", "if_index":6, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-6" }, { "entity_id":8589934627, "start_ms":1516002404482, "exporter_ip":"10.55.239.236", "if_index":4, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-4" }, { "entity_id":8589934610, "start_ms":1516002399475,


"exporter_ip":"10.55.239.218", "if_index":7, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-7" }, { "entity_id":8589934629, "start_ms":1516002404483, "exporter_ip":"10.55.239.236", "if_index":5, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-5" }, { "entity_id":8589934614, "start_ms":1516002399476, "exporter_ip":"10.55.239.218", "if_index":4, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-4" }, { "entity_id":8589934599, "start_ms":1516002361469, "exporter_ip":"10.55.239.203", "if_index":5, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-5" }, { "entity_id":8589934593, "start_ms":1516002351472, "exporter_ip":"10.55.239.203", "if_index":4, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-4" }, { "entity_id":8589934613, "start_ms":1516002399475, "exporter_ip":"10.55.239.218", "if_index":2, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-2" }, { "entity_id":8589934632, "start_ms":1516002407477, "exporter_ip":"10.55.239.217", "if_index":1, "direction":1, "enabled":true, "interface_name":"T1 1/0_AY123", "interface_description":"T1 1/0 test AY_change", "speed":1000, "if_name":"10.55.239.217-T1 1/0_AY123" }, {

Reference 13

"entity_id":8589934595, "start_ms":1516002351472, "exporter_ip":"10.55.239.203", "if_index":8, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-8" }, { "entity_id":8589934643, "start_ms":1516002407480, "exporter_ip":"10.55.239.217", "if_index":6, "direction":0, "enabled":true, "interface_name":"Fa0/1", "interface_description":"FastEthernet0/1", "speed":100000, "if_name":"10.55.239.217-Fa0/1" }, { "entity_id":8589934631, "start_ms":1516002404483, "exporter_ip":"10.55.239.236", "if_index":6, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-6" }, { "entity_id":8589934634, "start_ms":1516002407477, "exporter_ip":"10.55.239.217", "if_index":2, "direction":1, "enabled":true, "interface_name":"T1 1/1_YY", "interface_description":"T1 1/1 YY", "speed":254401, "if_name":"10.55.239.217-T1 1/1_YY" }, { "entity_id":8589934601, "start_ms":1516002361469, "exporter_ip":"10.55.239.203", "if_index":2, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-2" }, { "entity_id":8589934625, "start_ms":1516002404480, "exporter_ip":"10.55.239.236", "if_index":3, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-3" }, { "entity_id":8589934594, "start_ms":1516002351472, "exporter_ip":"10.55.239.203", "if_index":8, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-8"


}, { "entity_id":8589934609, "start_ms":1516002399474, "exporter_ip":"10.55.239.218", "if_index":3, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-3" }, { "entity_id":8589934635, "start_ms":1516002407478, "exporter_ip":"10.55.239.217", "if_index":2, "direction":0, "enabled":true, "interface_name":"T1 1/1_YY", "interface_description":"T1 1/1 YY", "speed":254401, "if_name":"10.55.239.217-T1 1/1_YY" }, { "entity_id":8589934640, "start_ms":1516002407479, "exporter_ip":"10.55.239.217", "if_index":5, "direction":1, "enabled":true, "interface_name":"Fa0/0", "interface_description":"FastEthernet0/0", "speed":100000, "if_name":"10.55.239.217-Fa0/0" }, { "entity_id":8589934646, "start_ms":1516004669704, "exporter_ip":"10.55.239.218", "if_index":1, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-1" }, { "entity_id":8589934621, "start_ms":1516002404479, "exporter_ip":"10.55.239.236", "if_index":1, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-1" }]

JSON response to update interfaces

{ "entity_id":8589934640, "start_ms":1516002407479, "exporter_ip":"10.55.239.217", "if_index":5, "direction":1, "enabled":true, "interface_name":"Fa0/0", "interface_description":"FastEthernet0/0", "speed":100000, "if_name":"10.55.239.217-Fa0/0" }

Reference 15

qossummaryProvides the summary of policyQosQueueDrop flow metric that measures the QoS queue drops. ThisAPI is applicable for Flow data only.

This API queries and retrieves information from FLOW_METRIC.RAW, and other FLOW_METRIC. 1MIN/30MIN/1DAY AGGREGATION tables.

URL

https://[host]:[port]/service/dataset/aggregation/qossummary

https://<myserver.ibm.com>:9443/service/dataset/aggregation/qossummary?entity=127.0.0.1-533&start=1505887200000&end=1505888940000&count=10

Method


https GET

URL parameters

Name RequiredDefaultvalue Description

entity Yes N/A The entity ID representing the interface.

The three type of entities are:

• <FLOW_METRIC.INTERFACE.exporter_ip> -<FLOW_METRIC.INTERFACE.if_index>

• ncim-<NCIM.NETWORK_INTERFACES.entityID>

• flow-<FLOW_METRIC.INTERFACE. entityID>

start Yes N/A The start of the period for which flow data that mustbe returned.

end Yes N/A The end of the period for which flow data that mustbe returned.

time Yes N/A The name of time short cut:

• last-hour• last-day• last-week• last-month• last-year

count No -1 Number of queues to return. For example, top 10talkers of the resource.

remaining No false A flag to indicate whether a row with the total of theremaining records must be provided.

Sample URL

/service/dataset/aggregation/qossummary?entity=127.0.0.1-533&start=1505887200000&


end=1505888940000&count=10

/service/dataset/aggregation/qossummary?entity=ncim-342&time=last-hour

/service/dataset/aggregation/qossummary?entity=ncim-342&time=last-hour&remaining=true

Error responseFor example:

{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}

Response



rank number Rank (1-10) of the record that is relative to allother records. Rank 11 indicates remainingrecords in total.

QueueId number Policy QoS Queue ID

hierarchyName string The hierarchy name for the queue combinedwith policy name and class name in format<policyName>-<comma-separated-listof classNames>.

policyName string QoS policy name

classNames string QoS Class Name

droppedPackets number Sum of policyQosQueueDrop metric

droppedPacketPercent number Percent of policyQosQueueDrop for thisqueue over total policyQosQueueDrop for thisinterface

droppedPacketOverTotalPacket

number Percent of policyQosQueueDrop over totalnumber of packets that pass through thisinterface.

JSON code:

[ { "rank":1, "policyName":"Policy1", "hierarchyName":"Policy1-Class1", "droppedPacketPercent":1.169494703290522, "droppedPacketOverTotalPacket":21.169494703290522, "droppedPackets":499, "QueueId":13, "classNames":"Class1" }, { "rank":2, "policyName":"Policy2", "hierarchyName":"Policy2-Class1,Class11", "droppedPacketPercent":1.3077716321364956, "droppedPacketOverTotalPacket":21.169494703290522, "droppedPackets":558, "QueueId":8, "classNames":"Class1,Class11" }]

Reference 17

summaryProvides the top 10 values for an aggregation on a flow interface over a period. This API is specific forFlow data only.


URL

https://[host]:[port]/service/dataset/aggregation/summary

https://<myserver.ibm.com>:9443/service/dataset/aggregation/summary?aggregation=app_srctos&entity=ncim-102&time=lasthour&granularity=1-minutes

Method


https GET

URL parameters


entity Yes N/A The entity ID that represents theinterface.


• <FLOW_METRIC.INTERFACE.exporter_ip> -<FLOW_METRIC.INTERFACE.if_index>


• flow-<FLOW_METRIC.INTERFACE.entityID>

aggregation Yes N/A The aggregation ID that represents howthe data must be aggregated.

direction No Both The direction of the flow data that mustbe returned.

start Yes N/A The start time of the period for whichflow data must be returned.

end Yes N/A The end time of the period for whichflow data must be returned.


• last-hour• last-day• last-week• last-month



granularity No See Notes. The granularity for which the data mustbe aggregated. For example, 5 minutes,14000 minutes.

remaining No false A flag to indicate whether a row withthe total of the remaining records mustbe provided.

extendedAppInfo No false A flag to indicate whether app baseaggregation result contains additionalNBAR, and NBAR2 applicationinformation as follows:

• description• businessRelevance• applicationGroup• applicationCategory• applicationSubcategory• p2p_technology• tunnelTechnology• encryptedTechnology

Sample URL

/service/dataset/aggregation/summary?aggregation=app_srctos&entity=ncim-102&time=lasthour&granularity=1-minutes

/service/dataset/aggregation/summary?aggregation=app&entity=ncim-102&time=lasthour&granularity=1-minutes&extendedAppInfo=true


{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}{"errorMesg":"Missing mandatory parameter :aggregation"}

Response



rank number Rank (1-10) of the record that isrelative to all other records. Rank11 indicates remaining records intotal.

Reference 19


application string Application name as specified inthe NBAR2 Protocol Pack.

Note: Applicable only if theextendedAppInfo parameter isenabled.

description string Description of the application asspecified in the NBAR2 ProtocolPack.


srctos string Note: Applicable only if theextendedAppInfo parameter isenabled.

octets number The aggregated octets value for atime period

packets number The aggregated packets value fora time period

percentage number The relative percentage of totaloctets for a time period.

maxThroughput number The granularity wise maxthroughput(octets) for a timeperiod

avgThroughput number The granularity wise avgthroughput(octets) for a timeperiod

maxUtilization number The granularity wise maxutilization(octets) for a timeperiod

avgUtilization number The granularity wise maxutilization(octets) for a timeperiod

label string Aggregation key values that areseparated by /.

businessRelevance string Specifies whether the applicationis considered relevant to thebusiness activity of theorganization.




applicationGroup string Allows the configuration ofapplications that are groupedbased on the same networkingapplication as the match criteria.


applicationCategory string Allows you to configureapplications that are groupedbased on the first level ofcategorization for each protocolas the match criteria.


applicationSubCategory string Provides the option to configureapplications that are groupedbased on the second level ofcategorization for each protocolas the match criteria.


p2p_technology string Provides the option to indicatewhether a protocol uses p2ptechnology.


tunnelTechnology string Provides the option to configureprotocols based on whether aprotocol tunnels the traffic ofother protocols.


encryptedTechnology string Provides the option to configureapplications that are groupedbased on whether the protocol isan encrypted protocol or not asthe match criteria.


Note:

• The actual fields returned depend on the type of aggregation in the URL. The rank, octets, andpercentage values are constant for all aggregations.

Reference 21

• If granularity is not provided, it is computed as follows:

– If time range is <= 3 hours, granularity = 1 minute.– If time range is >3 hour and <=12 hour, granularity = 15 minutes.– If time range is >12 hour and <=7 days, granularity = 30 minutes.– If time range is between 7 and <90 days, granularity = 1 day.– If time range is >=90 days, granularity = 7days.

The supported aggregations are as follows:

• app – (Application)• app_srctos – (Applications, Source TOS)• conv – (Source, Destination)• conv_app – (Source, Destination, Application)• conv_as – (Source Autonomous System Conversation, Destination Autonomous System Conversation)• conv_tos – (Conversations, TOS)• convgroup – (Source IP Group, Destination IP Group)• convgroup_app – (Source IP Group, Destination IP Group, Application)• convgroup_prot – (Source IP Group, Destination IP Groups, Protocol)• convgroup_tos – (Source IP group, Destination IP Groups, Source TOS)• dstas – (Destination Autonomous System)• dstip – (Destination)• dstip_app – (Destination, Application)• dstipgroup – (Destination IP Group)• dstipgroup_app – (Destination IP Group, Application)• dstipgroup_prot – (Destination IP Group, Protocol)• dstipgroup_tos – (Destination IP Group, Source TOS)• hierarchy_queueid – (QoS Hierarchies with Classification, QoS Hierarchies with Queue ID)• prot – (Protocol)• prot_app – (Protocol, Application)• prot_conv – (Protocol, Source, Destination)• prot_dstip – (Protocol, Destination)• prot_srcip – (Protocol, Source)• srcas – (Source Autonomous System)• srcip – (Source)• srcip_app – (Source, Application)• srcipgroup – (Source IP group)• srcipgroup_app – (Source IP group, Application)• srcipgroup_prot – (Source IP group, Protocol)• srcipgroup_tos – (Source IP group, Source TOS)• srctos – (Source TOS)

JSON code:

[ { "rank":1, "application":"ftp", "srctos":"AF13",


"label":"ftp/AF13", "octets":22866690, "packets":44379, "percentage":19.43, "maxThroughput":532756.93, "avgThroughput":190555.75, "maxUtilization":0.05, "avgUtilization":0.02 }, { "rank":2, "application":"ssh", "srctos":"AF13", "label":"ssh/AF13", "octets":16502348, "packets":35801, "percentage":14.02, "maxThroughput":318072.67, "avgThroughput":137519.57, "maxUtilization":0.03, "avgUtilization":0.01 }, { "rank":3, "application":"https", "srctos":"AF13", "label":"https/AF13", "octets":16055850, "packets":38910, "percentage":13.64, "maxThroughput":370810.53, "avgThroughput":152912.86, "maxUtilization":0.04, "avgUtilization":0.02 }, { "rank":4, "application":"https", "srctos":"AF13", "label":"https/AF13", "octets":10447134, "packets":18166, "percentage":8.88, "maxThroughput":260432.53, "avgThroughput":107150.09, "maxUtilization":0.03, "avgUtilization":0.01 }, { "rank":5, "application":"bootps", "srctos":"AF13", "label":"bootps/AF13", "octets":9739971, "packets":17876, "percentage":8.28, "maxThroughput":230403.47, "avgThroughput":118060.25, "maxUtilization":0.02, "avgUtilization":0.01 }, { "rank":6, "application":"nicname", "srctos":"AF13", "label":"nicname/AF13", "octets":9577779, "packets":19000, "percentage":8.14, "maxThroughput":178783.87, "avgThroughput":91216.94, "maxUtilization":0.02, "avgUtilization":0.01 }, { "rank":7, "application":"sqlserv", "srctos":"AF13", "label":"sqlserv/AF13", "octets":9437316, "packets":26845, "percentage":8.02,

Reference 23

"maxThroughput":340232.93, "avgThroughput":125830.88, "maxUtilization":0.03, "avgUtilization":0.01 }, { "rank":8, "application":"domain", "srctos":"AF13", "label":"domain/AF13", "octets":9058840, "packets":14997, "percentage":7.70, "maxThroughput":287669.60, "avgThroughput":109804.12, "maxUtilization":0.03, "avgUtilization":0.01 }, { "rank":9, "application":"irc", "srctos":"AF13", "label":"irc/AF13", "octets":7185223, "packets":9944, "percentage":6.10, "maxThroughput":197913.07, "avgThroughput":106447.75, "maxUtilization":0.02, "avgUtilization":0.01 }, { "rank":10, "application":"bootpc", "srctos":"AF13", "label":"bootpc/AF13", "octets":6827520, "packets":9747, "percentage":5.80, "maxThroughput":159044.53, "avgThroughput":82757.82, "maxUtilization":0.02, "avgUtilization":0.01 }]

Response for the URL with extendedAppInfo flag set:

[ { "rank":1, "application":"ftp", "description":"", "businessRelevance":"", "applicationGroup":"", "applicationCategory":"", "applicationSubCategory":"", "p2p_technology":"", "tunnelTechnology":"", "encryptedTechnology":"", "label":"ftp", "octets":1627476, "packets":5392, "percentage":17.00, "maxThroughput":216996.80, "avgThroughput":216996.80, "maxUtilization":0.02, "avgUtilization":0.02 }, { "rank":2, "application":"bootps", "description":"", "businessRelevance":"", "applicationGroup":"", "applicationCategory":"", "applicationSubCategory":"", "p2p_technology":"", "tunnelTechnology":"", "encryptedTechnology":"",


"label":"bootps", "octets":1600439, "packets":3975, "percentage":16.71, "maxThroughput":213391.87, "avgThroughput":213391.87, "maxUtilization":0.02, "avgUtilization":0.02 }]

Related informationNBAR Categorization and AttributesNBAR2 Protocol Pack 33.0.0

thresholdProvides a list of all the thresholds on Flow data in the system. This API is specific for Flow data only.

This API queries and retrieves information from CFG.THRESHOLD table.

URL

http://[host]:[port]/service/dataset/cfg/threshold

http://<myserver.ibm.com>:9443/service/dataset/cfg/threshold/?fields=*

Method


HTTP GET

URL parameters


fields No Fields that must be returned.

count No Number of Flow interface records thatmust be returned.

sort No How the records must be sorted.Prefix + or - to indicate sort direction.For example, +metric,-upper_limit indicates to sort bymetric ascending, and then sort byupper_limit descending. You cangive comma-separated parametersfor sorting.

condition No Expression that must be used to filterspecific records. For example,condition=name=test.

Sample URLs

/service/dataset/flow/threshold/?fields=*

/service/dataset/flow/threshold/?fields=*&count=5

/service/dataset/flow/threshold/?fields=*&count=10&condition=direction=1&sort=+start_ms

Reference 25

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/configuration/xe-3s/qos-nbar-xe-3s-book/nbar-app-recog-mods.html?bookSearch=true

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/prot_lib/config_library/pp3300/nbar-prot-pack3300.html

/service/dataset/flow/threshold/?fields=*&count=10&condition=direction=1

Response



entity_id number The internal system ID for thereturned Flow interface

metric_id number The internal system ID for themetric

start_ms number The system time when thresholdis configured.

period_sec number The accumulated time in secondswhen the threshold is monitored.

enabled boolean Flag to indicate whetherthreshold monitoring is enabledin the system for the Flowinterface.

kind number The type of threshold monitored.0 is Static Threshold and 1 isLearned Threshold.

Note: Currently, it is notsupported and it always returns0.

limit_type number The limit type for thresholdmonitored.

• 0 is Over• 1 is Under• 2 is Band

upper_limit number The upper bound limit for thethreshold monitored

lower_limit number The lower bound limit for thethreshold monitored

num_events number The number of events that aregenerated on the Flow interface.

learning_days number The number of days for thesystem to learn the pattern.

Note: Currently, it is notsupported.

interface_id number The internal system ID for thereturned Flow interface

direction number The direction of the Flowinterface (0=ingress, 1=egress)

speed number The speed of the Flow interfacein bits per second



exporter_ip string The IP address of the exporter onwhich the Flow interfaces reside.

if_index number The index of the Flow interfaceon the exporter

if_name string The name of the Flow interfaceas known by the exporter

JSON code:

[ { "entity_id":8589934601, "metric_id":1, "start_ms":1472466812124, "period_sec":60, "enabled":false, "kind":0, "limit_type":0, "upper_limit":80923502, "lower_limit":60692626, "num_events":2, "learning_days":0, "interface_id":8589934601, "direction":0, "speed":0, "exporter_ip":"::1", "if_index":1, "if_name":"::1-1" }, { "entity_id":8589934600, "metric_id":1, "start_ms":1472466812125, "period_sec":60, "enabled":false, "kind":0, "limit_type":0, "upper_limit":62739672, "lower_limit":47054754, "num_events":2, "learning_days":0, "interface_id":8589934600, "direction":1, "speed":0, "exporter_ip":"::1", "if_index":1, "if_name":"::1-1" }]

timeseriesProvides a timeseries of data for an aggregation on a flow interface over a period. For timeseries returnwith top10 query, the utilization is only calculated if the speed information is available in NCIM database.If the information is not available, value null is returned.


URL

https://[host]:[port]/service/dataset/aggregation/timeserieshttps://[host]:[port]/service/dataset/aggregation/timeseries/top10

https://<myserver.ibm.com>:8081service/dataset/aggregation/timeseries?entity=ncim-217&direction=ingress&aggregation=conv_app&start=1466008260000&end=1466011860000&granularity=1-

Reference 27

minute&key=221.87.136.94%252F176.188.66.226%2520%252F%2520ftp-data

Method


https GET

URL parameters


entity Yes N/A The entity ID that represents the interface.


•<FLOW_METRIC.INTERFACE.exporter_ip> -<FLOW_METRIC.INTERFACE.if_index>


• flow-<FLOW_METRIC.INTERFACE.entityID>

aggregation Yes N/A The aggregation ID that represents how the datamust be aggregated.

direction No Both The direction of the flow data that must bereturned.

start Yes N/A The start time of the period for which flow datamust be returned.

end Yes N/A The end time of the period for which flow datamust be returned.

granularity No N/A The granularity for which the data must beaggregated. The default granularity can be asfollows:

• 1-minute• 15-minute• 30-minute• 1-day• 7-day

key Yes

No (For top10query)

N/A Combination of grouping keys that are separatedby /. This key must be in the same aggregationorder and support only the top 10 grouping fromaggregation summary.

The grouping key value must be same as thegrouping result of aggregation summary API. Thekey parameter is ignored for top10 where all top 10timeseries data is returned.





suppressSummary No false Output result without result summary portion.

Sample URL

/service/dataset/aggregation/timeseries?entity=ncim-217&direction=ingress&aggregation=conv_app&start=1466008260000&end=1466011860000&granularity=1-minute&key=221.87.136.94%252F176.188.66.226%2520%252F%2520ftp-data

/service/dataset/aggregation/timeseries/top10?entity=ncim-217&direction=ingress&aggregation=conv_app&start=1466008260000&end=1466011860000&granularity=1-minute

Note:

• The query supports the top 10 grouping from the aggregation summary for the provided time period.• This query runs on aggregation summary result cache and the parameter key value must be as

appeared in aggregation summary API result.• If granularity is not provided, it is computed as follows:

– If time range is <= 3 hours, granularity = 1 minute.– If time range is >3 hour and <=12 hour, granularity = 15 minutes.– If time range is >12 hour and <=7 days, granularity = 30 minutes.– If time range is between 7 and <90 days, granularity = 1 day.– If time range is >=90 days, granularity = 7days.


{"errorMesg":"Missing mandatory parameter :aggregation"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs : 1568373360000 endMs : 1468375200000"}{"errorMesg":"Key parameter must be provided"}

Response

The timeseries API query results are returned as JSON data that contains an array of the followingfields:


timestamp number The time that is associated withthe aggregated value.

Reference 29


value number The aggregated octets value forthe associated time

JSON code:

[ { "timestamp":1466008980000, "value":999771 }, { "timestamp":1466008990000, "value":999771 }, { "timestamp":1466009000000, "value":999771 }, { "timestamp":1466009100000, "value":999771 }]

The timeseries/top10 API query results are returned as JSON data that contains an array of theheader and result fields as follows:

Table 1. Header fields


interface number The interface for which top 10timeseries is calculated.

direction number The direction of the interface

exporter string The exporter IP of the interface

keysSeparator string The separator that is used forcombining the grouping keys.

keys string The grouping keys that are usedfor the aggregation.

speed long The speed of the interface.

Table 2. Result Fields


key string The grouping key value for this record,

timestamp long The time that is associated with theaggregated value.

sumOctet long The sumoctets that is calculated forthis grouping key value.

sumPacket long The sumpackets that is calculated forthis grouping key value.

throughput double The number of packets aggregated pergranularity specified.


Table 2. Result Fields (continued)


utilization string It is the throughput based on speed ofthe interface.

JSON code without timeseries/top10 query

[ { "timestamp":1466008980000, "value":999771 }, { "timestamp":1466008990000, "value":999771 }, { "timestamp":1466009000000, "value":999771 }, { "timestamp":1466009100000, "value":999771 }]

JSON code for timeseries/top10 query:

{ "interface":1, "direction":"ingress", "exporter":"127.0.0.1", "keysSeparator":"/", "speed":10000000, "keys":[ "srcIp", "dstIp", "appName" ], "timeseries":[ { "key":"56.199.177.191/40.47.23.8/https", "timestamp":1503540000000, "sumOctet":998005, "sumPacket":8457, "throughput":887.1155555555556, "utilization":0.008871155555555557 }, { "key":"192.178.122.236/61.186.117.57/https", "timestamp":1503540000000, "sumOctet":996126, "sumPacket":1617, "throughput":885.4453333333333, "utilization":0.008854453333333333 }, { "key":"132.118.233.143/212.104.175.192/nntp", "timestamp":1503540000000, "sumOctet":999710, "sumPacket":1308, "throughput":888.6311111111111, "utilization":0.00888631111111111 }, { "key":"176.3.79.144/98.139.180.149/ipv6:21", "timestamp":1503540000000, "sumOctet":996046, "sumPacket":4955, "throughput":885.3742222222222, "utilization":0.008853742222222223 }, { "key":"212.219.83.229/91.32.174.183/ftp", "timestamp":1503540000000,

Reference 31

"sumOctet":999397, "sumPacket":4714, "throughput":888.3528888888889, "utilization":0.008883528888888888 }, { "key":"143.94.84.129/89.245.62.143/ftp-data", "timestamp":1503540000000, "sumOctet":997156, "sumPacket":1959, "throughput":886.3608888888889, "utilization":0.00886360888888889 }, { "key":"149.86.219.239/5.191.66.50/ipv6:445", "timestamp":1503540000000, "sumOctet":999563, "sumPacket":962, "throughput":888.5004444444445, "utilization":0.008885004444444445 }, { "key":"232.149.79.235/18.156.162.132/sctp:68", "timestamp":1503540000000, "sumOctet":999358, "sumPacket":4781, "throughput":888.3182222222222, "utilization":0.008883182222222223 }, { "key":"remaining", "timestamp":1503540000000, "sumOctet":1096729557, "sumPacket":7823086, "throughput":9001125.84088889, "utilization":90.01125840888889 }, { "key":"127.105.91.253/251.24.126.55/ftp", "timestamp":1503540000000, "sumOctet":999579, "sumPacket":1516, "throughput":888.5146666666667, "utilization":0.008885146666666668 }, { "key":"165.147.4.136/132.106.235.232/ipv6:53", "timestamp":1503540000000, "sumOctet":999932, "sumPacket":1022, "throughput":888.8284444444445, "utilization":0.008888284444444445 } ]}

Metric APIsREST APIs that retrieve entity metric data that is collected by Network Manager Collector Service andanalyzed by Entity Analytics Service.

anomaliesProvides anomalies in timeseries entity metric data. This information is used in the Device Dashboard todisplay the network anomalies.

This API queries and retrieves information from THRESHOLD.STATE table.

URL

https://[host]:[port]/service/dataset/metric/anomalies

https://<myserver.ibm.com>:9443/service/dataset/metric/anomalies


Method


https GET

URL parameters


entities No N/A Comma-separated list of ncim entity IDs.

entityNames No N/A Comma-separated list of entity names

metrics Yes N/A Comma-separated names of the metricsand their aggregation expression.

parents No N/A Comma-separated list of main node ID.

parentNames No N/A Comma-separated list of ncim device names

searchByProperties No N/A Properties filter in this format:

"<propertyName>"<ops>'<propertyValue>'

Note: Property name and value are case-sensitive.

For example:

"IFTYPESTRING"='ethernet-csmacd'

start No N/A The start of the period for which flow datathat must be returned.

end No N/A The end of the period for which flow datathat must be returned.

time No N/A The name of time short cut used. Forexample:


excludeParent No false A flag to exclude the parent ID fromresponse.

childTypes No * Comma-separated list of entity types ofnode that must be filtered in the result.Supported childTypes filter values areinterface, device, probe, and * (All).

Reference 33


entityResourceTypes No N/A Entity Type of node that must be filtered inresult. For example:

• interface• device• probe• physicalcard• artTarget• qosQueue

site No ALL Configured site name.

bizHour No ALL Configured business hours for a site.Expected values are OFF, ON and ALL.

Sample URLs

/service/dataset/metric/anomalies?entities=ncim-59,ncim-81,ncim-86&time=lastweek&metrics=ifInDiscards

/service/dataset/metric/anomalies?entities=ncim-59&start=1466008260000&end=1466011860000&metrics=ifInDiscards

/service/dataset/metric/anomalies?entities=ncim-59&start=1466008260000&end=1466011860000&metrics=ifInDiscards,ifOutDiscards

/service/dataset/metric/anomalies?entityNames=T1 1/1,T1 1/2&start=1466008260000&end=1466011860000&metrics=ifInDiscards

/service/dataset/metric/anomalies?parents=1,2&entities=ncim-59&start=1466008260000&end=1466011860000&metrics=ifInDiscards,ifOutDiscards

/service/dataset/metric/anomalies?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&start=1466008260000&end=1466011860000&metrics=ifInDiscards

/service/dataset/metric/anomalies?start=1466008260000&end=1466011860000&metrics=ifInDiscards&searchByProperties="PHYSICALADDRESS"='30' AND "LOCATION"='KL'

/service/dataset/metric/anomalies?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device

Note:

• At least one or more of the following parameters must be provided:

– entities– parents– entityNames– parentNames– searchByProperties– entityResourceTypes

• time or a combination of start AND or OR end must be provided.• time parameter is superseded by combination of start AND or OR end if both combinations are

present and it must support last-hour and last_day only.• Supported operators for properties filter are as follows:

– ,– =


– <>– IN– LIKE– AND– OR

For example:

searchByProperties="sysName"='"10.55.239.40"' AND "If"='897'searchByProperties="sysName"='"10.55.239.40"' AND "If" IN ('897','898')searchByProperties="sysName" like '"10.55.239.%25"' AND "If"='897'

Note: "%" is reserved keyword. It must be encoded with %25.

Error Response

{"errorMesg":"Either entities, parents, entityNames, parentNames or searchByProperties should beprovided"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}

Response



entity number The entity that is associated with the time andmetric value.

parent number The parent entity ID that is associated with theentity. The value is defaulted to -1 ifenrichment fails.

entityName string The entity name. The value is defaulted tounknown if enrichment fails.

parentName string The entity’s parent name. The value isdefaulted to unknown if enrichment fails.

metric string The metric name for the associated time andmetric value.

type string The type of anomaly that is detected.

severity string The severity of the anomaly.

start number The time that is associated with the start of theanomaly.

end number The time that is associated with the end of theanomaly.

This field is available when the anomaly isended, but not when anomaly is stilloutstanding.

value number The last violation metric value for theassociated time

Reference 35


details string JSON blob that contains the details of theanomaly.

JSON code:

[ { "parent":6, "entityName":"", "parentName":"10.55.239.2", "metric":"ifInDiscards", "entity":59, "details":"{'effectiveTimeStamp':1472098732320,'limitType':0,'upperLimit':10,'lowerLimit':5,'numEvents':2}", "severity":"critical", "type":"StaticThreshold", "start":1472099473383, "value":20 }, { "parent":6, "entityName":"0", "parentName":"10.55.239.2", "metric":"ifInDiscards", "entity":81, "details":"{'effectiveTimeStamp':1472098732320,'limitType':0,'upperLimit':10,'lowerLimit':5,'numEvents':2}", "severity":"critical", "type":"StaticThreshold", "start":1472099473384, "value":10 }]

deviationComputes deviation for the current data that is compared against average value on the same day of weekover N number of weeks.

The deviation REST API is used to compare against an aggregated metric data from a specific startand end time stamp and lookBackWeek to produce a TopN resource list.

Consider the following scenario:

• You provide a start and end time from 1 AM - 2 AM Monday, 28 August 2017.• You select the lookBackWeek of 1.• You select the average value for a specific metric.

In this scenario, the deviation REST API queries all the related device types; interface, physical card,and probe, and the average value of the metric for the period of 7 days earlier, that is, Monday , 21 August2017. The API also compares the results and retrieves the top ranking list.

This API queries and retrieves information from ENTITY_METRIC.AGG_030MIN, ENTITY_METRIC.RAW,NCIM.NETWORK_INTERFACES tables.

URL

https://[host]:[port]/service/dataset/metric/deviation

https://<myserver.ibm.com>:9443/service/dataset/metric/deviation


Method


https GET

URL parameters


entities No N/A Comma-separated list of entity IDs


metrics Yes N/A Comma-separated names of the metrics.Also supports metric IDs.

parents No N/A Comma-separated list of main node IDs.

Note: Must be associated withchildTypes for ART, QoS relatedmetrics.

parentNames No N/A Comma-separated list of ncim devicenames.

Note: Must be associated withchildTypes for ART and QoS relatedmetrics.




For example:


start No N/A The start time for which flow data mustbe returned.

Note: The start and end time periods fordeviation must be minimum 30 minutesand not longer than 1 day.

end No N/A The end time for which flow data must bereturned.

Note: The start and end time periods fordeviation must be minimum 30 minutesand not longer than 1 day.

time No N/A Specific time values:

• last-hour• last-day

Note: You need either start/end ortime parameters in the URL.

Reference 37


lookBackWeek Yes N/A The number of weeks to look back.lookBackWeek for deviation is always<=4.

scope No

Yes forART/QoSmetrics

ibm-itnm

flow

cacti

Scope of the resource. Scope is requiredfor ART, QoS related metrics.

Note: For all the performance data that iscollected and analyzed from your Cactideployment scenario, scope is set tocacti.

childTypes No * Comma-separated list of entity types ofnodes that must be filtered in the result.By default, it is device and interface.Supported childTypes filter values areas follows:

• interface• device• probe• physicalcard• artTarget• qosQueue• * (All)

suppressSummary No false Output the result without the summaryportion.

count No -1 Number of entities summary that mustbe returned. Combined with sortprovides topN or bottomN functions. Thedefault value -1 returns all availablerecords.

page No 1 The index of the page with data to return.It must be supplied with countparameter to indicate the page size.

properties No N/A Comma-separated list of properties tooutput.

flowEnabled No false If set to true, the result must containthe flow enabled entities.

entityResourceTypes No N/A Entity Type of node that must be filteredin result. For example:




excludeParent No false A flag to exclude the parent IDs fromresponse.

parentChildRelation No union Set operation between result from parentID search and entity ID search. Forexample, intersection, union.





Sample URLs

/service/dataset/metric/deviation?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/deviation?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/deviation?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour/service/dataset/metric/deviation?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/deviation?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/deviation?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/deviation?metrics=snmpInBandwidth&time=lasthour&searchByProperties="PHYSICALADDRESS"='30' AND "LOCATION"='KL'

/service/dataset/metric/deviation?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device

/service/dataset/metric/deviation?parents=760&metrics=PingResult&time=last-day&lookBackWeek=4

Note:



• Supported operators for properties filter are as follows:

– ,– =– <>– IN– LIKE– AND

Reference 39

– OR

For example:


Note: "%" is reserved keyword. It must be encoded with %25.• time or a combination of start AND or OR end must be provided.• start and end range must be minimum of 30 minutes and maximum 1 day.• time parameter is superseded by combination of start AND or OR end. It must support last-hour

or last_day only.• lookBackWeek parameter must contain the value greater than 0.• count parameter must be used to get top N resources.• Data must always be sorted by deviation value.


{"errorMesg":"Either entities, parents, entityNames, parentNames or searchByProperties should be provided"}{"errorMesg":"lookBackWeek is a mandatory parameter and should contain value greater than zero"}{"errorMesg":"Time range between start and end should be minimum 30-mins to maximum 1 day"}{"errorMesg":"Metric Deviation Servlet support only 1 metric"}

Response



total number Total number of records available

page number Current page number

count number Number of records in the page

items list The list of entity metric summary

entity number The entity ID that is associated with the timeand metric value.

parent number The parent Entity ID that is associated withthe entity.

entityName string The entity name. This value is defaulted tounknown, if enrichment fails.

parentName string Parent entity name. This value is defaulted tounknown, if enrichment fails.

startTimestamp number The start time that is associated with themetric value.

endTimestamp number The end time that is associated with themetric value.



metric string The metric name for the associated time andmetric value. If metricId is used for search,this attribute returns the metric name.

rank number The rank (1-N) of the record relative to allother entities based on sort. Default is 0 ifsort parameter is not provided.

devValues number The metric deviation value for the associatedtime, entity, and metric expression.

properties map Map of properties that are given in inputparameters and their values.

inIfId number In interface IDs for given entities if enriched.

outIfId number Out interface IDs for given entities ifenriched.

JSON code without suppressSummary flag set:

{ "total":27, "page":1, "count":27, "items":[ { "entity":59, "parent":59, "entityName":"entityName", "parentName":"parentName", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":1, "devValues":100, "metricId":"MetricName", "metric":10, "inIfId":11, "outIfId":12 }, { "entity":58, "parent":58, "entityName":"entityName", "parentName":"parentName", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":2, "devValues":99, "metricId":"MetricName", "metric":10, "inIfId":11, "outIfId":12 } ]}

JSON code with suppressSummary flag set:

[ { "entity":59, "parent":59, "entityName":"entityName", "parentName":"parentName", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":1, "devValues":100, "metricId":"MetricName", "metric":10, "inIfId":11,

Reference 41

"outIfId":12 }, { "entity":60, "parent":60, "entityName":"entityName", "parentName":"parentName", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":2, "devValues":100, "metricId":"MetricName", "metric":10, "inIfId":11, "outIfId":12 }]

entityProvides a list of entities and their properties for a resource type and search conditions.

This API queries and retrieves information from NCIM.NETWORK_INTERFACES,INVENTORY.ENTITY_NAME, INVENTORY.ENTITY_PROPERTIES and ENTITY_METRIC.RAW andENTITY_METRIC aggregated tables.

URL

https://[host]:[port]/service/dataset/metric/entity

https://<myserver.ibm.com>:9443/service/dataset/metric/entity

Method


https GET

URL parameters


entityResourceTypes No N/A Comma-separated list of entity IDs

all No false Comma-separated list of entity names

properties No N/A Comma-separated list of properties tooutput.

Note: properties is not applicable inthe scenario where NetFlow only data iscollected.

See Scenario 3 - NetFlow only data fromthe Installing and Configuring IBMNetwork Performance Insight guide.





Note: Property name and value arecase-sensitive.

For example:


Note: searchByProperties is notapplicable in the scenario whereNetFlow only data is collected.


scope true ibm-itnm

flow

cacti

Scope must be set to true for ART andQoS resource types.

Note: For all the performance data thatis collected and analyzed from yourCacti deployment scenario, scope is setto cacti.

flowEnabled No false If set to true, the result must contain theflow enabled entities.

Note: flowEnabled is not applicable inthe scenario where NetFlow only data iscollected since the network topologymight have devices that are enabled forNetFlow data only.


interfaceEnabled No false This parameter is applicable forresource type interface only. If set totrue, it returns a list of interfaces forwhich data collection is enabled.

parentChildRelation No union Set operation between result fromparent ID search and entity ID search.For example, intersection, union.



Sample URLs

/service/dataset/metric/entity?entityResourceTypes=device

/service/dataset/metric/entity?entityResourceTypes=interface&flowEnabled=true

Reference 43

/service/dataset/metric/entity?entityResourceTypes=device&all=true

/service/dataset/metric/entity?entityResourceTypes=interface&flowEnabled=true

/service/dataset/metric/entity?parentNames=10.53.17.207,10.53.12.200&entityResourceTypes=interface&scope=flow&interfaceEnabled=true

Note:



• Supported operators for properties filter are as follows:

– ,– =– <>– IN– LIKE– AND– OR

For example:




{"errorMesg":"Either entities, parents, entityNames, parentNames, entityResourceTypes, or serachByProperties should be provided"}

Response



entityId number An entity ID

entityName string Name of the entity

parentId number Parent entity ID

parentName string Parent entity name

properties map Map of properties that are given in inputparameters their values.

inIfId number Inbound interface IDs for the entities if theyare enriched.



outIfId number Outbound interface IDs for the entities if theyare enriched.

JSON code without flowEnabled flag set is as follows:

[ { "entityId":-1, "entityName":"ALL", "parentId":-1, "parentName":"ALL" }, { "entityId":5, "entityName":"10.55.239.202", "parentId":5, "parentName":"10.55.239.202" }, { "entityId":1, "entityName":"10.55.239.201", "parentId":1, "parentName":"10.55.239.201" }, { "entityId":6, "entityName":"10.55.239.4", "parentId":6, "parentName":"10.55.239.4" }, { "entityId":9, "entityName":"10.55.239.221", "parentId":9, "parentName":"10.55.239.221" }, { "entityId":7, "entityName":"10.55.239.249", "parentId":7, "parentName":"10.55.239.249" }, { "entityId":3, "entityName":"10.55.239.3", "parentId":3, "parentName":"10.55.239.3" }, { "entityId":8, "entityName":"10.55.239.250", "parentId":8, "parentName":"10.55.239.250" }, { "entityId":4, "entityName":"10.55.239.203", "parentId":4, "parentName":"10.55.239.203" }]

JSON code with flowEnabled flag set is as follows:

[ { "entityId":995, "inIfId":8589936607, "entityName":"Se1/0:0", "parentName":"10.55.239.250", "outIfId":8589936606, "parentId":960 }]

Reference 45

lastValueRetrieves the last value of metric data.

This API queries and retrieves information from ENTITY_METRIC.RAW table.

URL

https://[host]:[port]/service/dataset/metric/lastValue

https://<myserver.ibm.com>:9443/service/dataset/metric/lastValue?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour

Method


https GET

URL parameters




metrics Yes N/A Comma-separated names of the metrics. Alsosupports metricIDs.


Note: Must be associated with childTypesfor ART, QoS related metrics.

parentNames No N/A Comma-separated list of ncim device names.





For example:




time No N/A Specific time values are as follows:


Note: You need either start/end or timeparameters in the URL.

start No N/A The start time for which flow data must bereturned.


excludeParent No false A flag to exclude the parent ID from response.

scope No

Yes for ART/QoSmetrics

ibm-itnm

flow

cacti

Scope of the resource. Scope is required forART, QoS related metrics.

Note: For all the performance data that iscollected and analyzed from your Cactideployment scenario, scope is set to cacti.

childTypes No * Comma-separated list of entity types of nodesthat must be filtered in the result. By default, itis device and interface. SupportedchildTypes filter values are as follows:


entityResourceTypes

No N/A Entity type of node that must be filtered inresult. For example:


parentChildRelation

No union Set operation between result from parent IDsearch and entity ID search. For example,intersection, union.


Reference 47


bizHour No ALL Configured business hours for a site. Expectedvalues are OFF, ON and ALL.

Sample URLs

/service/dataset/metric/lastValue?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/lastValue?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/lastValue?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/lastValue?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/lastValue?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/lastValue?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/lastValue?metrics=snmpInBandwidth&time=lasthour&searchByProperties="PHYSICALADDRESS"='30' AND "LOCATION"='KL'

/service/dataset/metric/lastValue?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device

Note:

• At least one or more of the following parameters must be provided as follows:



present.• Supported operators for searchByProperties filter are as follows:

– ,– =– <>– IN– LIKE– AND– OR

For example:





{"errorMesg":"Either entities, parents, entityNames, parentNames or searchByProperties should be provided"}

Response



entity number The entity that is associated with the timeand metric value

parent number The parent entity ID associated with theentity.

entityName string The entity name. This value is defaulted asunknown if enrichment fails.

parentName string The parent entity name. This value isdefaulted as unknown if enrichment fails.

MetricValue map Map of metric given in input parameters theirvalues.

JSON code:

[ { "parent":2, "entityName":"entity1", "parentName":"parent2", "health":10.0, "entity":1, "cpuUsage":10.0 }, { "parent":4, "entityName":"entity2", "parentName":"parent4", "health":10.0, "entity":2, "cpuUsage":10.0 }]

metricsProvides a list of metrics that are available for the specified entities and time frame.

This API queries and retrieves information from the ENTITY_METRIC.RAW table.

URL

https://[host]:[port]/service/dataset/metrics

https://<myserver.ibm.com>:9443/service/dataset/metrics

Reference 49

Method


https GET

URL parameters




parents No N/A Comma-separated list of main node IDs

parentNames No N/A Comma-separated list of ncim device names.


searchByProperties

No N/A Properties filter in this format:



For example:


time No N/A Specific time values are as follows:


Note: You need either start/end or timeparameters in the URL.

start No N/A The start time for which flow data must bereturned.


excludeParent No false A flag to exclude the parent ID from response.

scope No


ibm-itnm

flow

cacti

Scope of the resource. Scope is required forART, QoS related metrics.

Note: For all the performance data that iscollected and analyzed from your Cactideployment scenario, scope is set to cacti.



childTypes No * Comma-separated list of entity types of nodesthat must be filtered in the result. By default,it is device and interface. SupportedchildTypes filter values are as follows:


entityResourceTypes

No N/A Entity Type of node that must be filtered inresult. For example:


parentChildRelation

No union Set operation between result from parent IDsearch and entity ID search. For example,intersection, union.


bizHour No ALL Configured business hours for a site. Expectedvalues are OFF, ON and ALL.

Sample URLs

/service/dataset/metrics?entities=ncim-217&start=1466008260000&end=1466011860000

/service/dataset/metrics?entities=ncim-217&time=last-hour

/service/dataset/metrics?entityNames=T1 1/1,T1 1/2&time=last-hour

/service/dataset/metrics?parents=3&time=last-month

/service/dataset/metrics?parents=3,1&entities=ncim-86,ncim-217&time=last-month

/service/dataset/metrics?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&time=last-month

/service/dataset/metrics?time=last-month&="PHYSICALADDRESS"='30' AND "LOCATION"='KL'

/service/dataset/metrics?parents=3&time=last-day&childTypes=interface

Note:


– entities– parents– entityNames

Reference 51

– parentNames– entityResourceTypes


present.• Supported operators for searchByProperties filter are as follows:

– ,– =– <>– IN– LIKE– AND– OR

For example:



Response



metric string The metric name

metricID long The metric ID for the associated time andmetric value.

units string Unit of measurement for the metric. Forexample, #, %, undef

https://<myserver.ibm.com>:9443/service/dataset/metrics?entities=12,188&time=last-day&scope=ibm-itnm

JSON code:

[ { "metric":"ifInDiscards", "units":"#", "metricId":2118 }, { "metric":"health", "units":"undef", "metricId":2119 }, { "metric":"snmpInBandwidth", "units":"%", "metricId":2120 }]


summaryProvides a summary of the metric data.

This API queries and retrieves information from ENTITY_METRIC.RAW, ENTITY_METRIC.AGG_001DAY/AGG_006HR/ AGG_030MIN tables.

URL

https://[host]:[port]/service/dataset/metric/summary

https://<myserver.ibm.com>:9443/service/dataset/metric/summary

Method


https GET

URL parameters


entities No N/A Comma-separated list of entity IDs.

entityNames No N/A Comma-separated list of entity names.

metrics Yes N/A Comma-separated name of the metricexpression that includes the type ofaggregation.

For example, snmpInBandwidth,health, max(health), min(health)


parentNames No N/A Comma-separated list of ncim devicenames




For example:



end No N/A The end time for which flow data mustbe returned.

Note: start and end parameters mustbe used together.

Reference 53


time No N/A Specific time values:


Note: You need either start/end ortime parameters in the URL.

sort No N/A Metric expression that defines the sortorder of the records. Only one metric isallowed with the sort expression.Prefix + or - to indicate sort direction.

count No -1 Number of entities summary that mustbe returned. Combined with sortprovides topN or bottomN functions.

page No 1 The index of the page for data display.This parameter is supplied with countparameter to indicate page size. Bydefault, it is 1.

excludeParent No false Flag to exclude the parent ID from theresult. By default, this parameter is setto False.

scope No

Yes forART/QoSmetrics

ibm-itnm

flow

cacti





flatten No false Output of the result without nested theobjects.

suppressSummary No N/A Output of the result without thesummary portion.





parentChildRelation No union Set operation between the result fromparent identifier search and entityidentifier search.

flowEnabled No false If set to true, the result must containthe flow enabled entities.



Sample URLs

/service/dataset/metric/summary?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/summary?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/summary?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/summary?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/summary?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/summary?parents=3&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month

/service/dataset/metric/summary?parents=3,4&entities=ncim-217,ncim-218&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month

/service/dataset/metric/summary?parents=3,4&entities=ncim-217,ncim-218&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&sort=-sum(health)

/service/dataset/metric/summary?parents=3,4&entities=ncim-217,ncim-218&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&sort=-sum(health)&count=10

/service/dataset/metric/summary?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&sort=-sum(health)&count=10

/service/dataset/metric/summary?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=lasthour&page=2&count=10

/service/dataset/metric/summary?metrics=snmpInBandwidth&time=last-hour&page=2&count=10&searchByProperties="PHYSICALADDRESS"='30' AND "LOCATION"='KL'

/service/dataset/metric/summary?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,

Reference 55

device/service/dataset/metric/summary?metrics=ifInDiscards&time=last-hour&entityResourceType=interface

/service/dataset/metric/summary?entities=ncim-138&metrics=max(ifInDiscards),sum(health),count(health)&time=last-hour&flatten=true

/service/dataset/metric/summary?entities=ncim-135&metrics=count(health)&time=lasthour&suppressSummary=true

/service/dataset/metric/summary?entities=ncim-138&metrics=max(ifInDiscards),sum(snmpInBandwidth),count(ifOutErrors)&time=lasthour&suppressSummary=false

/service/dataset/metric/summary?entities=ncim-135&metrics=count(health)&time=lasthour&parentChildRelation=[union/intersection]

Note:



• time or a combination of start AND or OR end must be provided.• The start and end parameters must be used together. The time parameter supersedes start and end if

they are all present in the URL.• Supported operators for properties filter are as follows:

– ,– =– <>– IN– LIKE– AND– OR

For example:

properties="IFADMINSTATUS"='"up" AND "If"="897"properties="sysName"='"10.55.239.40" AND "If" IN ("897","898")'properties="sysName" like '"10.55.239.%25" AND "If"="897"

Note: "%" is reserved keyword. It must be encoded with %25.• count must be provided with sort.• metric used in the sort parameter must be in one of the expressions that is used in metrics

parameter.• When sort is not provided, output is sorted by entities and rank is shown as zero.


{"errorMesg":"Either entities, parents, entityNames, parentNames, entityResourceType or searchByProperties should be provided"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :


1568373360000 endMs : 1468375200000"}

Response



total number Total number of records available

page number Current page number

count number Number of records in the page

items list List of metric values. The entity that isassociated with the time and metric value.

entity number The entity that is associated with the timeand metric value.

parent number The entity that is associated with the timeand metric value.

entityName string The parent entity ID that is associated withthe entity.

parentName string Parent entity name. This value is defaulted tounknown, if enrichment fails.

scope string Scope of the resource. For example, ibm-itnm or flow.

startTimestamp number The start time that is associated with themetric value.

endTimestamp number The end time that is associated with themetric value.

rank number The rank (1-N) of the record relative to allother entities based on sort. Defaults to 0 ifsort parameter is not provided.

metricValues list The list metric names and their values.

metric string The metric expression for the associated timeand metric value.

metricId long The metric ID for the associated time andmetric value.

value number The metric value for the associated time,entity, and metric expression.

inIfId number In interface IDs for given entities if enriched.

outIfId number Out interface IDs for given entities ifenriched.

JSON code without suppressSummary flag set:

{ "total":27, "page":1, "count":27, "items":[ { "entity":59,

Reference 57

"scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":1, "metricValues":[ { "metric":"min(health)", "metricId":2118, "value":0 }, { "metric":"max(health)", "metricId":2118, "value":54 }, { "metric":"avg(health)", "metricId":2118, "value":50 }, { "metric":"avg(snmpInBandwidth)", "metricId":2119, "value":150 } ] }, { "entity":61, "scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":2, "metricValues":[ { "metric":"min(health)", "metricId":2118, "value":0 }, { "metric":"max(health)", "metricId":2118, "value":54 }, { "metric":"avg(health)", "metricId":2118, "value":50 }, { "metric":"avg(snmpInBandwidth)", "metricId":2119, "value":150 } ] } ]}

JSON code with suppressSummary flag set:

[ { "entity":59, "scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":1, "metricValues":[ { "metric":"min(health)", "metricId":2118, "value":0 }, { "metric":"max(health)", "metricId":2118, "value":54 } ]


}]

JSON code with flatten and suppressSummary flags set:

{ "total":27, "page":1, "count":27, "items":[ { "entity":59, "scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":1, "min(health)":0, "max(health)":54, "avg(health)":50, "avg(snmpInBandwidth)":150 }, { "entity":61, "scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":2, "min(health)":54, "avg(health)":50, "avg(snmpInBandwidth)":150 } ]}

JSON code with flatten and flag set:

[ { "entity":59, "scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":1, "min(health)":0, "max(health)":54 }, { "entity":61, "scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":2, "min(health)":54, "avg(health)":50, "avg(snmpInBandwidth)":150 }]

timeseriesProvides timeseries entity metric data.

This API queries and retrieves information from ENTITY_METRIC.RAW, ENTITY_METRIC.AGG_001DAY/AGG_006HR/ AGG_030MIN tables.

URL

https://[host]:[port]/service/dataset/metric/timeseries

https://<myserver.ibm.com>:9443/service/dataset/metric/timeseries?entities=ncim-348&metrics=ifInDiscards&time=last-hour

Reference 59

Method


https GET

URL parameters


entities No N/A Comma-separated list of entity IDs.

entityNames No N/A Comma-separated list of entity names.

metrics Yes N/A Comma-separated list of metrics andtheir aggregation.

For example, snmpInBandwidth,health, max(health), min(health)

parents No N/A Comma-separated list of main node ID.

parentNames No N/A Comma-separated list of ncim devicenames




For example:



end No N/A The end time for which flow data mustbe returned.

time No N/A The name of the time short cut. Forexample:


granularity No N/A The granularity for which the data mustbe aggregated. The default granularitycan be as follows:

• 1-minute• 15-minute• 30-minute• 1-day• 7-day



scope No


ibm-itnm

flow

cacti



sort No N/A An expression that defines the sortorder of the records. Prefix + or - toindicate sort direction. For example,+metric -upper_limit indicates thatthe sorting must be by metric inascending order, and then byupper_limit in descending order.



excludeParent No N/A Flag to exclude the parent ID from theresult. By default, this parameter is setto False.

flatten No false Output of the result without nested theobjects.



parentChildRelation No union Set operation between result fromparent ID search and entity ID search.For example, intersection, union.



Reference 61


properties No N/A Comma-separated list of properties thatare returned for the entities that arespecified.

Sample URLs

/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&time=lasthour&granularity=5-min

/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000&granularity=30-min

/service/dataset/metric/timeseries?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000&granularity=30-min

/service/dataset/metric/timeseries?parents=3&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&granularity=30-min

/service/dataset/metric/timeseries?parents=3&entities=ncim-86&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month

/service/dataset/metric/timeseries?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month

/service/dataset/metric/timeseries?metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&serachByProperties="PHYSICALADDRESS"='30' AND "LOCATION"='KL'

/service/dataset/metric/timeseries?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device

/service/dataset/metric/timeseries?entityResourceTypes=probe&metrics=Probe.Echo.Probe.Loss.Percent&parentNames=10.55.239.235&start=1561381980000&end=1561468379000&count=10&properties=sourceAddress,targetAddress,vendor

Note:



• time or a combination of start and end or start or end must be provided.• Sort by metric, entitities, and timestamp are only supported.• The start and end parameters must be used together. The time parameter supersedes start and end if

they are all present in the URL.• time parameter is superseded by combination of start AND or OR end.• Supported operators for properties filter are as follows:

– ,


– =– <>– IN– LIKE– AND– OR

For example:


Note: "%" is reserved keyword. It must be encoded with %25.• If granularity is not provided, it is computed as follows:

– If time range is <= 3 hours, granularity = 1 minute– If time range is >3 hour and <=12 hour, granularity = 15 minutes– If time range is >12 hour and <=7 days, granularity = 30 minutes– If time range is between 7 and <90 days, granularity = 1 day– If time range is >=90 days, granularity = 7days

• When the parents or parentNames and entities or entityNames are used in the same URL andthe parentChildRelation is equal to intersection, the result is related to the specific parent andentity. By default, the relation is union, and displays all the parents and entities.

Special behavior

When you specify a granularity period with a start and end time in your query, the API engine alwaysreturns the data from the next available round up time. For example, if you give a query as follows:

https://<myserver.ibm.com>:9443/service/dataset/metric/timeseries?entities=43064,188&metrics=ifInDiscards&start=1497052800000&end=1497117600000&granularity=18-hours

The start time is calculated based on the aggregation round up time. For 18-hrs granularity, the round upaggregation times for the start time of June 10, 2017 12:00:00 AM are:

• June 9, 2017 12:00:00 PM• June 10, 2017 6:00:00 AM• June 11, 2017 12:00:00 AM

The query returns the aggregated data from next available round up time that is June 10, 2017 6:00:00AM and not from June 10, 2017 12:00:00 AM.

Note: This behavior is noticed with timeseries API only.


{"errorMesg":"Either entities, parents, entityNames, parentNames or serachByProperties should be provided"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs : 1568373360000endMs : 1468375200000"}}

Reference 63

Response



entity number The entity that is associated withthe time and metric value.

parent number The parent entity ID that isassociated with the entity.

entityName string The entity name. The value isdefaulted to unknown ifenrichment fails.

parentName string The entity’s parent name. Thevalue is defaulted to unknown ifenrichment fails.

scope string Scope of the resource that isibm-itnm.

metric string The metric name for theassociated time and metric value

metricId long The metric ID for the associatedtime and metric value.

timestamp number The time that is associated withthe metric value.

value number The metric value for theassociated time

<property> string Values of the requestedproperties that are specified inthe request URL.

JSON code without flatten parameter set:

[ { "parent":6, "timestamp":1471503616000, "entityName":"0", "parentName":"10.55.239.2", "scope":"ibm-itnm", "metric":"ifOutErrors", "metricId":2118, "entity":86, "value":5398 }, { "parent":-1, "timestamp":1471501946000, "entityName":"unknown", "parentName":"unknown", "scope":"ibm-itnm", "metric":"ifOutErrors", "metricId":2118, "entity":134, "value":40 }, { "parent":8, "timestamp":1471501956000, "entityName":"T1 1/2", "parentName":"10.55.239.4", "scope":"ibm-itnm", "metric":"ifOutErrors", "metricId":2118,


"entity":114, "value":0 }]

JSON code with flatten parameter set:

[ { "parent":587, "timestamp":1506250800000, "scope":"ibm-itnm", "entityName":"0", "parentName":"10.55.239.31", "AVG(ifInDiscards)":6, "entity":607, "SUM(ifInDiscards)":6 }, { "parent":587, "timestamp":1506258000000, "scope":"ibm-itnm", "entityName":"0", "parentName":"10.55.239.31", "AVG(ifInDiscards)":6, "entity":607, "SUM(ifInDiscards)":6 }]

JSON code with properties

[{ "targetAddress":"4.20.45.112", "parent":3202, "timestamp":1561423380000, "scope":"ibm-itnm", "entityName":"10.55.239.235_udpEcho:<201>", "parentName":"10.55.239.235", "metric":"Probe.Echo.Probe.Loss.Percent", "sourceAddress":"20.10.11.119", "entity":3878, "vendor":"Cisco", "value":50 }, { "targetAddress":"4.10.110.47", "parent":3202, "timestamp":1561387380000, "scope":"ibm-itnm", "entityName":"10.55.239.235_echo:<106>", "parentName":"10.55.239.235", "metric":"Probe.Echo.Probe.Loss.Percent", "sourceAddress":"10.25.238.209", "entity":3852, "vendor":"Cisco", "value":100 }]

Threshold APIREST APIs that define entity metric Thresholds and stores Threshold definitions.

definitionRetrieves and stores the threshold definitions.

It performs the following functions:

• Get all the stored threshold definitions• Get a single definition based on an identifier• Stores a definition

Reference 65

With this API, information is queried and retrieved from THRESHOLD.STATIC_DEFINITION table. It canalso store a new threshold definition in the table.

URL

https://[host]:[port]/service/dataset/threshold/definition

https://<myserver.ibm.com>:9443/service/dataset/threshold/definition

Method


https GEThttps POST/PUT

URL parameters


query No Provides a query predicate, which is a filter that is applied toa where clause.

fields No Specifies the wanted fields in the response

count No Specifies the wanted maximum number of rows in theresponse

sort No How the records must be sorted. Prefix + or - to indicate sortdirection. For example, +metric, -upper_limit indicatesto sort by metric in ascending order, and then sort byupper_limit in descending order.

Sample URL

Get All


Get one (Query by an identifier)

https://<myserver.ibm.com>:9443/service/dataset/threshold/definition?query=threshold_id=2

Post or Put


Response


Name Data type Description Example

metric string The metric name snmpInBandwidth

effective_time_stamp

long Most recent time whenthe static definition isstored or updated.

UNIX epoch time withmillisecond precision


Name Data type Description Example

threshold_id long Unique identifier for thethreshold definition

2

Important: When youpost a thersholddefinition for IP SLAdata, always usethreshold_id =0.

enabled boolean Indicates whether thethreshold definition isactive or not.

true or false

limit_type int How the static thresholdranges are to be applied.

• 0 is Over• 1 is Under• 2 is Band

upper_limit long Upper range limit 1000

lower_limit long Lower range limit 100

num_events int Number of consecutiveoccurrences that arerequired to violate athreshold.

4

Get response

[ { "metric":"snmpInBandwidth", "effective_time_stamp":1469199999999, "threshold_id":1, "enabled":true, "limit_type":2, "upper_limit":400000, "lower_limit":330000, "num_events":5 }, { "metric":"snmpOutBandwidth", "effective_time_stamp":1469199999999, "threshold_id":2, "enabled":true, "limit_type":2, "upper_limit":400000, "lower_limit":330000, "num_events":5 }, { "metric":"ifInErrors", "effective_time_stamp":1469199999999, "threshold_id":3, "enabled":true, "limit_type":0, "upper_limit":1000, "lower_limit":250, "num_events":2 }, { "metric":"ifOutErrors", "effective_time_stamp":1469199999999, "threshold_id":4, "enabled":true, "limit_type":0, "upper_limit":200, "lower_limit":50, "num_events":2 }]

Reference 67

Payload for Post

{ "metric":"snmpInBandwidth", "effective_time_stamp":1469199999999, "threshold_id":2, "enabled":true, "limit_type":2, "upper_limit":400000, "lower_limit":330000, "num_events":6}

Payload for Post for IP SLA data

{"metric":"httpRtt, "effective_time_stamp":1470275112000, "threshold_id":0, "enabled":true, "limit_type":2, "upper_limit":50, "lower_limit":10, "num_events":2}

Attention: The threshold_id must be a unique number for that metric. Check theTHRESHOLD.STATIC_DEFINITION table for the existing threshold IDs. If you do not specify aunique ID the existing metric with the same ID is updated and the new threshold definition is notcreated for the metric.

Command line interfaceProvide command-line interfaces that are available in IBM Network Performance Insight to supportinstallation, configuration, administration, and other tasks.

A list of commands available for Network Performance Insight users and administrators.

basecamp-manager-cmd command referenceUsage for the basecamp-manager-cmd command. Run the basecamp-manager-cmd command tostart, stop, and check the status of Network Performance Insight services.

Location

Note: basecamp-manager-cmd command can be run as root, netcool or a non-root user with sudopermissions to control Network Performance Insight services.

<basecamp_Home>/basecamp-manager/bin

<basecamp_Home> is the location where the generic basecamp packages are installed. Forexample, /opt/IBM/basecamp.


basecamp-manager-cmd command syntaxbasecamp-manager-cmd action stop

start

status

service npi-cacti-collector

npi-dns

npi-event

npi-formula

npi-flow-collector

npi-flow-analytics

npi-itnm-collector

npi-snmp-collector

npi-snmp-discovery

npi-threshold

basecamp-exporter

basecamp-manager

basecamp-storage

basecamp-timeseries

basecamp-ui

host

basecamp-manager-cmd {action [stop|start|status] | -service <service_name> | -host<hostname>}

Parametersservice

Specify the name of the service.

• npi-cacti-collector• npi-dns• npi-event• npi-formula• npi-flow-collector• npi-flow-analytics• npi-itnm-collector• npi-snmp-collector• npi-snmp-discovery• npi-threshold• basecamp-exporter• basecamp-manager• basecamp-storage• basecamp-timeseries• basecamp-ui

hostFully qualified host name (FQDN) where the service is located.

actionstop

Stops the specified service.

Reference 69

start

Start the specified service.

status

Checks the status of the specified service.

Note: You can check the status only when the Manager Service is up and running.

For example:

To start the Flow Collector Service:

/opt/IBM/basecamp/basecamp-manager/bin/basecamp-manager-cmd -service npi-flow-collector -host <myserver.ibm.com> start

To display the status of all services on all hosts:

/opt/IBM/basecamp/basecamp-manager/bin/basecamp-manager-cmd status

To display the status of all services on a particular host as non-root user:

sudo /opt/IBM/basecamp/basecamp-manager/bin/basecamp-manager-cmd -host <myserver.ibm.com> status

backup command referenceUsage for the backup command. Run the backup command to back up Network Performance Insightstorage database. Starting from Fix Pack 1, the backup command location is changed.

Location

Note: backup command can be run as root or netcool user with sudo permissions to control NetworkPerformance Insight services.

<basecamp_Home>/basecamp-storage/bin

<basecamp_Home> is the location where the basecamp packages are installed. For example, /opt/IBM/basecamp.

backup command syntaxbackup ?

path

?

help

?

?

tool

backup {-path <local directory>|-tool <backup tool script location> |-help}

Parameterspath

The directory path of where the backup tar files are stored.tool

The full path of where the Customized_script is located. For example: <basecamp_Home>/basecamp-storage/bin/directory/Customized_scriptBy default, this option uses the <basecamp_Home>/basecamp-storage/bin/backup-tool scriptto create tar files to the path specified in -path.

helpDisplays the usage for backup command.


restore command referenceUsage for the restore command. Run the restore command to restore Network Performance Insightstorage database. Starting from Fix Pack 1, the restore command location is changed.

Location

Note: restore command can be run as root or netcool user with sudo permissions to controlNetwork Performance Insight services.

<basecamp_Home>/basecamp-storage/bin

<basecamp_Home> is the location where Network Performance Insight is installed. Forexample, /opt/IBM/basecamp.

restore command syntaxrestore ?

localBackup

help

restore {-localBackup <backup tarball location> | -help}

Parameters-localBackup

The directory path of where the backup tar files to be restored from.-help

Displays the usage for restore command.

pack-tool command usageUse this information to understand the usage of some command line options that are available inTechnology Pack Development Tool.

pack_tool

pack-tool command can be run as root user. The script is available in /<pack_dev_tool>/bindirectory. Where, <pack_dev_tool> is the directory where Technology Pack Development Tool is extracted.

UsageRun the following command as root user:

$ bin/pack-tool

-------------------------- Pack Development Tool v1.0 --------------------------

Usage: pack-tool [command] [options]

commands: new <pack> - creates a new pack project build [<pack>] - builds the specified pack project otherwise all projects clean [<pack>] - cleans the specified pack project otherwise all projects validate [<pack>] - validates the specified pack project otherwise all projects help - displays help

Parameters

newCreates a project workspace to contain the Technology Packs that are developed.

Reference 71

buildBuilds and packages the Technology Pack after the development is completed.

cleancleans the specified Technology Pack project. If a project name is not specified, it cleans allprojects.

validateValidates that content with in the Technology Packs after the development is complete.

helpProvides the usage of the pack-tool command.

device-discovery-tool

The device-discovery-tool command is used to run the discovery formulas that are created for yourcustom Technology Pack. The script is available in /<pack_dev_tool>/bin directory. Where,<pack_dev_tool> is the directory where Technology Pack Development Tool is extracted.Usage

Run the following command as root user:

$ bin/device-discovery-tool --------------------------------Discovery Device Tool v0.4.0.2--------------------------------

discovery-device-tool [pack] snmp://[credential]@[host]:[port]?[options]

credential: version 1/2c - [read community string]:[write community string] version 3 - [user name]:[authentication]:[encryption]:[context]authentication: md5(password) - MD5 password sha1(password) - SHA1 password none - No authenticationencryption: des(password) - DES key aes(password) - AES key aes128(password) - AES 128-bit key aes192(password) - AES 192-bit key aes256(password) - AES 256-bit key none - No encryptionoptions: version - SNMP Version (2,3). Default is auto-detect timeout - SNMP timeout in milisecond. Default is 5 seconds retries - Number of retries before giving up. Default is 3 times

Parameterspack

Name of the Technology Pack.credential

Credentials for two the SNMP versions:

• version 1/2c - [read community string]:[write community string]

– read community string: name of the SNMP read community.– write community string: name of the SNMP write community.

• version 3 - [user name]:[authentication]:[encryption]:[context]

– user name: the user name to be used for this SNMP V3 community name.– authentication: the password to be used for authentication (MD5 or SHA1) for this SNMP

V3 element.– encryption: the type of encryption for the privacy password. The following types of

encryption are available:


- 3-DES- AES 128- AES 192- AES 256

– context: the context name to be used for this SNMP V3 community name.

HostHost name of the device associated with this SNMP configuration.

portThe port associated with this SNMP configuration. By default, it is 161.

optionsProvide the additional information as follows:

• version - the SNMP Version (2 or 3) associated with this SNMP configuration.• timeout - the length of time (in seconds) to wait for a response from a request. Default is 5

seconds.• retries - the number of times that a request is tried again if a request failure. Default is 3

times

NetFlow versionsNetFlow technology can collect IP network traffic as it enters or exits an interface.

NetFlow enabled devices can export IP traffic statistics from all interfaces as NetFlow records to becollected by one or more associated NetFlow collectors.

The device emits a flow record when it determines that the Flow is finished by using Flow aging, that is,when the device sees new traffic for an existing Flow, it resets the aging counter. The aging counter isdetermined by Flow active and inactive timeout. Typically, NetFlow records are exported by using UDP.Some modern implementations of NetFlow use the Stream Control Transmission Protocol (SCTP) toexport packets to provide some protection against packet loss, and to make sure that NetFlow v9templates are received before any related record is exported.

The different Flow versions that are supported in Netcool Operations Insight such as:

• NetFlow V1

First implementation of Cisco, which is now obsolete, and restricted to IPv4 only.• NetFlow V5

Most common version, available on many routers from different brands.• NetFlow V9

Template-based Flow. Mostly used to report Flows like IPv6, MPLS, or even plain IPv4 with BGPnexthop.

• IPFIX

Based on the NetFlow Version 9 implementation, IPFIX is on the IETF standards and can beimplemented by multiple vendors.

Reference 73

NetFlow V1 formatsV1 format is the original format that is supported in the initial NetFlow releases.

V1 header format

Bytes Contents Description

0-1 version NetFlow export format versionnumber

2-3 count Number of flows that areexported in this packet (1-24)

4-7 SysUptime Current time in millisecondssince the export device is started

8-11 unix_secs Current count of seconds since0000 Coordinated Universal Time1970

12-16 unix_nsecs Residual nanoseconds since0000 Coordinated Universal Time1970

V1 Flow record format


0-3 srcaddr Source IP address

4-7 dstaddr Destination IP address

8-11 nexthop IP address of next hop router

12-13 input SNMP index of input interface

14-15 output SNMP index of output interface

16-19 dPkts Packets in the flow

20-23 dOctets Total number of Layer 3 bytes inthe packets of the flow

24-27 First SysUptime at start of flow

28-31 Last SysUptime at the time the lastpacket of the flow was received

32-33 srcport TCP/UDP source port number orequivalent

34-35 dstport TCP/UDP destination portnumber or equivalent

36-37 pad1 Unused (zero) byte

38 prot IP protocol type (for example,TCP = 6; UDP = 17)

39 tos IP type of service (ToS)

40 flags Cumulative OR of TCP flags



41-43 pad1pad2pad3

Unused (zero) bytes

44-48 Reserved Unused (zero) bytes

Related informationNetFlow Export Datagram Format

NetFlow V5 formatsV5 format is an enhancement that adds Border Gateway Protocol (BGP) autonomous system informationand flow sequence numbers.

V5 header format

Bytes Fields Description

0-1 version NetFlow export format versionnumber

2-3 count Number of flows that areexported in this packet (1-30)

4-7 SysUptime Current time in millisecondssince the export device started

8-11 unix_secs Current count of seconds since0000 Coordinated Universal Time1970

12-15 unix_nsecs Residual nanoseconds since0000 Coordinated Universal Time1970

16-19 flow_sequence Sequence counter of total flowsseen

20 engine_type Type of flow-switching engine

21 engine_id Slot number of the flow-switching engine

22-23 sampling_interval First two bits hold the samplingmode; remaining 14 bits holdvalue of sampling interval

V5 Flow record format


0-3 srcaddr Source IP address

4-7 dstaddr Destination IP address

8-11 nexthop IP address of next hop router

12-13 input SNMP index of input interface

14-15 output SNMP index of output interface

Reference 75

http://www.cisco.com/c/en/us/td/docs/net_mgmt/netflow_collection_engine/3-6/user/guide/format.html


16-19 dPkts Packets in the flow

20-23 dOctets Total number of Layer 3 bytes inthe packets of the flow

24-27 First SysUptime at start of flow

28-31 Last SysUptime at the time the lastpacket of the flow was received

32-33 srcport TCP/UDP source port number orequivalent

34-35 dstport TCP/UDP destination portnumber or equivalent

36 pad1 Unused (zero) byte

37 tcp_flags Cumulative OR of TCP flags

38 prot IP protocol type (for example,TCP = 6; UDP = 17)

39 tos IP type of service (ToS)

40-41 src_as Autonomous system number ofthe source, either origin or peer

42-43 dst_as Autonomous system number ofthe destination, either origin orpeer

44 src_mask Source address prefix mask bits

45 dst_mask Destination address prefix maskbits

46-47 pad2 Unused (zero) bytes

Related informationNetFlow Export Datagram Format

V9 field type definitionsWhen extensibility is required, the new field types can be added to the list. The new field types must beupdated on the Exporter and Collector but the NetFlow export format remains unchanged.

Field Type Value Length (bytes) Description

IN_BYTES 1 N (default is 4)Incoming counter with length N x 8 bitsfor number of bytes associated with anIP Flow.

IN_PKTS 2 N (default is 4)Incoming counter with length N x 8 bitsfor the number of packets that areassociated with an IP Flow

FLOWS 3 N Number of flows that are aggregated;default for N is 4

PROTOCOL 4 1 IP protocol byte

SRC_TOS 5 1 Type of Service byte setting when thereis an incoming interface


http://www.cisco.com/c/en/us/td/docs/net_mgmt/netflow_collection_engine/3-6/user/guide/format.html


TCP_FLAGS 6 1 Cumulative of all the TCP flags seen forthis flow

L4_SRC_PORT 7 2 TCP/UDP source port number. That is,FTP, Telnet, or equivalent

IPV4_SRC_ADDR 8 4 IPv4 source address

SRC_MASK 9 1The number of contiguous bits in thesource address subnet mask. That is,the submask in slash notation

INPUT_SNMP 10 N Input interface index; default for N is 2but higher values might be used

L4_DST_PORT 11 2 TCP/UDP destination port number. Thatis, FTP, Telnet, or equivalent

IPV4_DST_ADDR 12 4 IPv4 destination address

DST_MASK 13 1The number of contiguous bits in thedestination address subnet mask. Thatis, the submask in slash notation.

OUTPUT_SNMP 14 N Output interface index; default for N is 2but higher values might be used

IPV4_NEXT_HOP 15 4 IPv4 address of next-hop router

SRC_AS 16 N (default is 2) Source BGP autonomous systemnumber where N might be 2 or 4

DST_AS 17 N (default is 2) Destination BGP autonomous systemnumber where N might be 2 or 4

BGP_IPV4_NEXT_HOP 18 4 Next-hop router's IP in the BGP domain

MUL_DST_PKTS 19 N (default is 4)IP multicast outgoing packet counterwith length N x 8 bits for packets thatare associated with the IP Flow

MUL_DST_BYTES 20 N (default is 4)IP multicast outgoing byte counter withlength N x 8 bits for bytes associatedwith the IP Flow

LAST_SWITCHED 21 4 System uptime at which the last packetof this flow was switched

FIRST_SWITCHED 22 4 System uptime at which the first packetof this flow was switched

OUT_BYTES 23 N (default is 4)Outgoing counter with length N x 8 bitsfor the number of bytes associated withan IP Flow

OUT_PKTS 24 N (default is 4)Outgoing counter with length N x 8 bitsfor the number of packets that areassociated with an IP Flow.

MIN_PKT_LNGTH 25 2 Minimum IP packet length on incomingpackets of the flow

MAX_PKT_LNGTH 26 2 Maximum IP packet length on incomingpackets of the flow

Reference 77


IPV6_SRC_ADDR 27 16 IPv6 Source Address

IPV6_DST_ADDR 28 16 IPv6 Destination Address

IPV6_SRC_MASK 29 1 Length of the IPv6 source mask incontiguous bits

IPV6_DST_MASK 30 1 Length of the IPv6 destination mask incontiguous bits

IPV6_FLOW_LABEL 31 3 IPv6 flow label as in RFC 2460 definition

ICMP_TYPE 32 2Internet Control Message Protocol(ICMP) packet type; reported as ((ICMPType*256) + ICMP code)

MUL_IGMP_TYPE 33 1 Internet Group Management Protocol(IGMP) packet type

SAMPLING_INTERVAL 34 4

During the use of sampled NetFlow, therate at which packets are sampled. Thatis, a value of 100 indicates that one ofevery 100 packets is sampled

SAMPLING_ALGORITHM 35 1The type of algorithm that is used forsampled NetFlow: 0x01 DeterministicSampling, 0x02 Random Sampling

FLOW_ACTIVE_TIMEOUT 36 2 Timeout value (in seconds) for activeflow entries in the NetFlow cache

FLOW_INACTIVE_TIMEOUT 37 2 Timeout value (in seconds) for inactiveflow entries in the NetFlow cache

ENGINE_TYPE 38 1 Type of flow switching engine: RP = 0,VIP/Linecard = 1

ENGINE_ID 39 1 ID number of the flow switching engine

TOTAL_BYTES_EXP 40 N (default is 4)Counter with length N x 8 bits for bytesfor the number of bytes exported by theObservation Domain

TOTAL_PKTS_EXP 41 N (default is 4)Counter with length N x 8 bits for bytesfor the number of packets that areexported by the Observation Domain

TOTAL_FLOWS_EXP 42 N (default is 4)Counter with length N x 8 bits for bytesfor the number of flows that areexported by the Observation Domain

*Vendor Proprietary* 43

IPV4_SRC_PREFIX 44 4 IPv4 source address prefix (specific forCatalyst architecture)

IPV4_DST_PREFIX 45 4 IPv4 destination address prefix (specificfor Catalyst architecture)

MPLS_TOP_LABEL_TYPE 46 1MPLS Top Label Type: 0x00 UNKNOWN0x01 TE-MIDPT 0x02 ATOM 0x03 VPN0x04 BGP 0x05 LDP



MPLS_TOP_LABEL_IP_ADDR 47 4 Forwarding Equivalent Classcorresponding to the MPLS Top Label

FLOW_SAMPLER_ID 48 1 Identifier that is shown in "show flow-sampler"

FLOW_SAMPLER_MODE 49 1The type of algorithm that is used forsampling data: 0x02 random sampling.Use with FLOW_SAMPLER_MODE

FLOW_SAMPLER_RANDOM_INTERVAL 50 4 Packet interval at which to sample. Use

with FLOW_SAMPLER_MODE

*Vendor Proprietary* 51

MIN_TTL 52 1 Minimum TTL on incoming packets ofthe flow

MAX_TTL 53 1 Maximum TTL on incoming packets ofthe flow

IPV4_IDENT 54 2 The IP v4 that identifies field

DST_TOS 55 1 Type of Service byte setting whenexiting outgoing interface

IN_SRC_MAC 56 6 Incoming source MAC address

OUT_DST_MAC 57 6 Outgoing destination MAC address

SRC_VLAN 58 2 Virtual LAN identifier that is associatedwith ingress interface

DST_VLAN 59 2 Virtual LAN identifier that is associatedwith egress interface

IP_PROTOCOL_VERSION 60 1

Internet Protocol version is set to 4 forIPv4, and set to 6 for IPv6. If notpresent in the template, then version 4is assumed.

DIRECTION 61 1 Flow direction: 0 - ingress flow, 1 -egress flow

IPV6_NEXT_HOP 62 16 IPv6 address of the next-hop router

BPG_IPV6_NEXT_HOP 63 16 Next-hop router in the BGP domain

IPV6_OPTION_HEADERS 64 4 Bit-encoded field that identifies IPv6option headers found in the flow

Vendor Proprietary 65





MPLS_LABEL_1 70 3

MPLS label at position 1 in the stack. Itcomprises 20 bits of MPLS label, 3 EXP(experimental) bits and 1 S (end-of-stack) bit.

Reference 79


MPLS_LABEL_2 71 3


MPLS_LABEL_3 72 3


MPLS_LABEL_4 73 3


MPLS_LABEL_5 74 3


MPLS_LABEL_6 75 3


MPLS_LABEL_7 76 3


MPLS_LABEL_8 77 3


MPLS_LABEL_9 78 3


MPLS_LABEL_10 79 3


IN_DST_MAC 80 6 Incoming destination MAC address

OUT_SRC_MAC 81 6 Outgoing source MAC address

IF_NAME 82

N

Shortened interface name, FE1/0(default that isspecified intemplate)

IF_DESC 83N (default that isspecified intemplate)

Full interface name, FastEthernet 1/0



SAMPLER_NAME 84N (default that isspecified intemplate)

Name of the flow sampler

IN_ PERMANENT _BYTES 85 N (default is 4) Running byte counter for a permanentflow

IN_ PERMANENT _PKTS 86 N (default is 4) Running packet counter for a permanentflow

* Vendor Proprietary* 87

FRAGMENT_OFFSET 88 2 The fragment-offset value fromfragmented IP packets

Reference 81


FORWARDING STATUS 89 1

Forwarding status is encoded on 1 bytewith the 2 left bits giving the status andthe 6 remaining bits giving the reasoncode.

Status is either unknown (00),Forwarded (10), Dropped (10) orConsumed (11). List of forwardingstatus values with their meanings:

• Unknown

– 0• Forwarded

– Unknown 64– Forwarded Fragmented 65– Forwarded not Fragmented 66

• Dropped

– Unknown 128– Drop ACL Deny 129– Drop ACL drop 130– Drop Unroutable 131– Drop Adjacency 132– Drop Fragmentation and DF set 133– Drop Bad header checksum 134– Drop Bad total Length 135– Drop Bad Header Length 136– Drop bad TTL 137– Drop Policer 138– Drop WRED 139– Drop RPF 140– Drop For us 141– Drop Bad output interface 142– Drop Hardware 143

• Consumed

– Unknown 192– Terminate Punt Adjacency 193– Terminate Incomplete Adjacency

194– Terminate For us 195



MPLS PAL RD 90 8 (array) MPLS PAL Route Distinguisher.

MPLS PREFIX LEN 91 1 Number of consecutive bits in the MPLSprefix length.

SRC TRAFFIC INDEX 92 4 BGP Policy Accounting Source TrafficIndex

DST TRAFFIC INDEX 93 4 BGP Policy Accounting DestinationTraffic Index

APPLICATION DESCRIPTION 94 N Application description.

APPLICATION TAG 95 1+n 8 bits of engine ID, followed by n bits ofclassification.

APPLICATION NAME 96 N Name that is associated with aclassification.

postipDiffServCodePoint 98 1

The value of a Differentiated ServicesCode Point (DSCP) encoded in theDifferentiated Services field aftermodification.

replication factor 99 4 Multicast replication factor.

DEPRECATED 100 N DEPRECATED

layer2packetSectionOffset 102 Layer 2 packet section offset. Potentially

a generic offset.

layer2packetSectionSize 103 Layer 2 packet section size. Potentially ageneric size.

layer2packetSectionData 104 Layer 2 packet section data.

105 - 127 Reserved for future use by cisco

Related informationNetFlow Version 9 Flow-Record Format

IPFIX Information ElementsIPFIX is an IETF standard based on NetFlow v9.

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

0Re

serv

ed

1oc

tetD

elta

Coun

tTh

e nu

mbe

r of

octe

ts s

ince

the

prev

ious

repo

rt (i

fan

y) in

inco

min

gpa

cket

s fo

r thi

sFl

ow a

t the

Obs

erva

tion

Poin

t.Th

e nu

mbe

r of

octe

ts in

clud

es IP

head

er(s

) and

IPpa

yloa

d.

oct

ets

2pa

cket

Del

taCo

unt

The

num

ber o

fin

com

ing

pack

ets

sinc

e th

e pr

evio

usre

port

(if a

ny) f

orth

is F

low

at t

heO

bser

vatio

n Po

int.

pac

ket

s

3de

ltaFl

ow

Coun

tTh

e co

nser

vativ

eco

unt o

f Orig

inal

Flow

s co

ntrib

utin

gto

this

Agg

rega

ted

Flow

; may

be

dist

ribut

ed v

ia a

nyof

the

met

hods

expr

esse

d by

the

valu

eDis

trib

utio

nMet

hod

Info

rmat

ion

Elem

ent.

flo ws

Reference 83

http://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

4pr

otoc

olId

entifi

er

The

valu

e of

the

prot

ocol

num

ber i

nth

e IP

pac

ket

head

er. T

hepr

otoc

ol n

umbe

riden

tifies

the

IPpa

cket

pay

load

type

. Pro

toco

lnu

mbe

rs a

rede

fined

in th

e IA

NA

Prot

ocol

Num

bers

regi

stry

.

In In

tern

etPr

otoc

ol v

ersi

on 4

(IPv

4), t

his

isca

rrie

d in

the

Prot

ocol

field.

InIn

tern

et P

roto

col

vers

ion

6 (I

Pv6)

,th

is is

car

ried

in th

eN

ext H

eade

r field

in th

e la

stex

tens

ion

head

erof

the

pack

et.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

5ip

Clas

sOfS

ervi

ceFo

r IPv

4 pa

cket

s,th

is is

the

valu

e of

the

TOS fie

ld in

the

IPv4

pac

ket

head

er. F

or IP

v6pa

cket

s, th

is is

the

valu

e of

the Traffic

Clas

s fie

ld in

the

IPv6

pac

ket

head

er.

Reference 85

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

6tc

pCon

trol

Bits

TCP

cont

rol b

itsob

serv

ed fo

r the

pack

ets

of th

isFl

ow. T

his

info

rmat

ion

isen

code

d as

a b

itfie

ld; f

or e

ach

TCP

cont

rol b

it, th

ere

isa

bit i

n th

is s

et. T

hebi

t is

set t

o 1

if an

yob

serv

ed p

acke

t of

this

Flo

w h

as th

eco

rres

pond

ing

TCP

cont

rol b

it se

t to

1.Th

e bi

t is

clea

red

to0

othe

rwis

e.

The

valu

es o

f eac

hbi

t are

sho

wn

belo

w, p

er th

ede

finition

of t

hebi

ts in

the

TCP

head

er [R

FC79

3][R

FC31

68]

[RFC

3540

]:

MSb

LSb

0 1 2 3 4 5

6 7 8 9 10 11 12

13 14 15

+---+---+---+---+---+---+---

+---+---+---+---+---+---+---

+---+---+

| |

| N | C | E | U | A | P | R

| S | F |

| Zero | Future

| S | W | C | R | C | S | S

| Y | I |

| (Data Offset) | Use

| | R | E | G | K | H | T

| N | N |

+---+---+---+---+---+---+---

+---+---+---+---+---+---+---

+---+---+

bit flag

value name description

------+-----

+----------------------------

---------

0x8000 Zero (see

tcpHeaderLength)

0x4000 Zero (see

tcpHeaderLength)

0x2000 Zero (see

tcpHeaderLength)

0x1000 Zero (see

tcpHeaderLength)

0x0800 Future Use

0x0400 Future Use

0x0200 Future Use

0x0100 NS ECN Nonce Sum

0x0080 CWR Congestion

Window Reduced

0x0040 ECE ECN Echo

0x0020 URG Urgent Pointer

field significant

0x0010 ACK Acknowledgment

field significant

0x0008 PSH Push Function

0x0004 RST Reset the

connection

0x0002 SYN Synchronize

sequence numbers

0x0001 FIN No more data

from sender

As th

e m

ost

sign

ifica

nt 4

bits

of

octe

ts 1

2 an

d 13

(cou

ntin

g fr

omze

ro) o

f the

TCP

head

er [R

FC79

3]ar

e us

ed to

enc

ode

the

TCP

data

offs

et(h

eade

r len

gth)

,th

e co

rres

pond

ing

bits

in th

isIn

form

atio

nEl

emen

t mus

t be

expo

rted

as

zero

and

mus

t be

igno

red

by th

eco

llect

or. U

se th

etc

pHea

derL

engt

hIn

form

atio

nEl

emen

t to

enco

deth

is v

alue

.

Each

of t

he 3

bits

(0x8

00, 0

x400

,an

d 0x

200)

, whi

char

e re

serv

ed fo

rfu

ture

use

in[R

FC79

3], m

ust b

eex

port

ed a

sob

serv

ed in

the

TCP

head

ers

of th

epa

cket

s of

this

Flow

.

If e

xpor

ted

as a

sing

le o

ctet

with

redu

ced-

size

enco

ding

, thi

sIn

form

atio

nEl

emen

t cov

ers

the

low

-ord

er o

ctet

of

this

field

(i.e,

bits

0x80

to 0

x01)

,om

ittin

g th

e EC

NN

once

Sum

and

the

thre

e Fu

ture

Use

bits

. A c

olle

ctor

rece

ivin

g th

isIn

form

atio

nEl

emen

t with

redu

ced-

size

enco

ding

mus

t not

assu

me

anyt

hing

abou

t the

con

tent

of th

ese

four

bits

.

Expo

rtin

gPr

oces

ses

expo

rtin

g th

isIn

form

atio

nEl

emen

t on

beha

lfof

a M

eter

ing

Proc

ess

that

is n

otca

pabl

e of

obse

rvin

g an

y of

the

ECN

Non

ceSu

m o

r Fut

ure

Use

bits

mus

t use

redu

ced-

size

enco

ding

, and

onl

yex

port

the

leas

tsign

ifica

nt 8

bits

of

this

Info

rmat

ion

Elem

ent.

Not

e th

at p

revi

ous

revi

sion

s of

this

Info

rmat

ion

Elem

ent's

defin

ition

spe

cifie

dth

at th

e CW

R an

dEC

E bi

ts m

ust b

eex

port

ed a

s ze

ro,

even

if o

bser

ved.

Colle

ctor

s m

ust

ther

efor

e no

tas

sum

e th

at a

valu

e of

zer

o fo

rth

ese

bits

in th

isIn

form

atio

nEl

emen

t ind

icat

esth

e bi

ts w

ere

neve

rse

t in

the

obse

rved

traffic

, esp

ecia

lly if

thes

e bi

ts a

re z

ero

in e

very

Flo

wRe

cord

sen

t by

agi

ven

expo

rter

.


http://www.iana.org/go/rfc793





Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

7so

urce

Tran

spor

tPor

t

The

sour

ce p

ort

iden

tifier

in th

etr

ansp

ort h

eade

r.Fo

r the

tran

spor

tpr

otoc

ols

UDP,

TCP

,an

d SC

TP, t

his

isth

e so

urce

por

tnu

mbe

r giv

en in

the

resp

ectiv

ehe

ader

. Thi

s fie

ldM

AY a

lso

be u

sed

for f

utur

e tr

ansp

ort

prot

ocol

s th

at h

ave

16-b

it so

urce

por

tiden

tifiers.

8so

urce

IPv4

Addr

ess

The

IPv4

sou

rce

addr

ess

in th

e IP

pack

et h

eade

r.

9so

urce

IPv4

Prefi

xLe

ngth

The

num

ber o

fco

ntig

uous

bits

that

are

rele

vant

inth

eso

urce

IPv4

Prefi

xIn

form

atio

nEl

emen

t.

bits

Reference 87

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

10in

gres

sInt

erfa

ceTh

e in

dex

of th

e IP

inte

rfac

e w

here

pack

ets

of th

isFl

ow a

re b

eing

rece

ived

. The

val

uem

atch

es th

e va

lue

of m

anag

ed o

bjec

t'if

Inde

x' a

s de

fined

in [R

FC28

63].

Not

eth

at if

Inde

x va

lues

are

not a

ssig

ned

stat

ical

ly to

an

inte

rfac

e an

d th

atth

e in

terf

aces

may

be re

num

bere

dev

ery

time

the

devi

ce's

man

agem

ent

syst

em is

re-

initi

aliz

ed, a

ssp

ecified

in[R

FC28

63].


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

11de

stin

ati

onTr

ans

port

Port

The

dest

inat

ion

port

iden

tifier

inth

e tr

ansp

ort

head

er. F

or th

etr

ansp

ort p

roto

cols

UDP,

TCP

, and

SCTP

, thi

s is

the

dest

inat

ion

port

num

ber g

iven

inth

e re

spec

tive

head

er. T

his fie

ldM

AY a

lso

be u

sed

for f

utur

e tr

ansp

ort

prot

ocol

s th

at h

ave

16-b

it de

stin

atio

npo

rt id

entifi

ers.

12de

stin

ati

onIP

v4A

ddre

ss

The

IPv4

dest

inat

ion

addr

ess

in th

e IP

pack

et h

eade

r.

13de

stinati

onIP

v4P

refix

Len

gth

The

num

ber o

fco

ntig

uous

bits

that

are

rele

vant

inth

ede

stin

atio

nIPv

4Pre

fix

Info

rmat

ion

Elem

ent.

bits

Reference 89

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

14eg

ress

Inte

rfac

eTh

e in

dex

of th

e IP

inte

rfac

e w

here

pack

ets

of th

isFl

ow a

re b

eing

sent

. The

val

uem

atch

es th

e va

lue

of m

anag

ed o

bjec

t'if

Inde

x' a

s de

fined

in [R

FC28

63].

Not

eth

at if

Inde

x va

lues

are

not a

ssig

ned

stat

ical

ly to

an

inte

rfac

e an

d th

atth

e in

terf

aces

may

be re

num

bere

dev

ery

time

the

devi

ce's

man

agem

ent

syst

em is

re-

initi

aliz

ed, a

ssp

ecified

in[R

FC28

63].

15ip

Nex

tHop

IPv4

Add

ress

The

IPv4

add

ress

of th

e ne

xt IP

v4ho

p.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

16bg

pSou

rce

AsN

um

ber

The

auto

nom

ous

syst

em (A

S)nu

mbe

r of t

heso

urce

IP a

ddre

ss.

If A

S pa

thin

form

atio

n fo

r thi

sFl

ow is

onl

yav

aila

ble

as a

nun

orde

red

AS s

et(a

nd n

ot a

s an

orde

red

ASse

quen

ce),

then

the

valu

e of

this

Info

rmat

ion

Elem

ent i

s 0.

17bg

pDes

tina

tionA

sN

umbe

r

The

auto

nom

ous

syst

em (A

S)nu

mbe

r of t

hede

stin

atio

n IP

addr

ess.

If A

S pa

thin

form

atio

n fo

r thi

sFl

ow is

onl

yav

aila

ble

as a

nun

orde

red

AS s

et(a

nd n

ot a

s an

orde

red

ASse

quen

ce),

then

the

valu

e of

this

Info

rmat

ion

Elem

ent i

s 0.

Reference 91

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

18bg

pNex

tH

opIP

v4Ad

dres

s

The

IPv4

add

ress

of th

e ne

xt(a

djac

ent)

BG

Pho

p.

19po

stM

Cast

Pack

etDe

ltaCo

unt

The

num

ber o

fou

tgoi

ng m

ultic

ast

pack

ets

sinc

e th

epr

evio

us re

port

(if

any)

sen

t for

pack

ets

of th

isFl

ow b

y a

mul

ticas

tda

emon

with

in th

eO

bser

vatio

nDo

mai

n. T

his

prop

erty

can

not

nece

ssar

ily b

eob

serv

ed a

t the

Obs

erva

tion

Poin

t,bu

t may

be

retr

ieve

d by

oth

erm

eans

.

pac

ket

s


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

20po

stM

Cast

Oct

etD

elta

Coun

t

The

num

ber o

foc

tets

sin

ce th

epr

evio

us re

port

(if

any)

in o

utgo

ing

mul

ticas

t pac

kets

sent

for p

acke

ts o

fth

is F

low

by

am

ultic

ast d

aem

onw

ithin

the

Obs

erva

tion

Dom

ain.

Thi

spr

oper

ty c

anno

tne

cess

arily

be

obse

rved

at t

heO

bser

vatio

n Po

int,

but m

ay b

ere

trie

ved

by o

ther

mea

ns. T

henu

mbe

r of o

ctet

sin

clud

es IP

head

er(s

) and

IPpa

yloa

d.

oct

ets

Reference 93

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

21flo

wEn

dSy

sUpT

im

e

The

rela

tive

times

tam

p of

the

last

pac

ket o

f thi

sFl

ow. I

t ind

icat

esth

e nu

mbe

r of

mill

isec

onds

sin

ceth

e la

st(r

e-)in

itial

izat

ion

ofth

e IP

FIX

Devi

ce(s

ysUp

Tim

e).

sysU

pTim

e ca

n be

calc

ulat

ed fr

omsy

stem

InitT

imeM

illis

econ

ds.

mill

ise

con

ds

22flo

wSt

artS

ysUp

Tim

e

The

rela

tive

times

tam

p of

the

first

pac

ket o

f thi

sFl

ow. I

t ind

icat

esth

e nu

mbe

r of

mill

isec

onds

sin

ceth

e la

st(r

e-)in

itial

izat

ion

ofth

e IP

FIX

Devi

ce(s

ysUp

Tim

e).

sysU

pTim

e ca

n be

calc

ulat

ed fr

omsy

stem

InitT

imeM

illis

econ

ds.

mill

ise

con

ds


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

23po

stO

ctet

Delta

Cou

nt

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'oct

etDe

ltaCo

unt',

exce

pt th

at it

repo

rts

apo

tent

ially

mod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

oct

ets

Reference 95

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

24po

stPa

cke

tDel

taCo

unt

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'pac

ketD

elta

Coun

t',ex

cept

that

itre

port

s a

pote

ntia

llymod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

pac

ket

s

25m

inim

um

IpTo

tal

Leng

th

Leng

th o

f the

smal

lest

pac

ket

obse

rved

for t

his

Flow

. The

pac

ket

leng

th in

clud

es th

eIP

hea

der(

s) le

ngth

and

the

IP p

aylo

adle

ngth

.

oct

ets


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

26m

axim

um

IpTo

tal

Leng

th

Leng

th o

f the

larg

est p

acke

tob

serv

ed fo

r thi

sFl

ow. T

he p

acke

tle

ngth

incl

udes

the

IP h

eade

r(s)

leng

than

d th

e IP

pay

load

leng

th.

oct

ets

27so

urce

IPv6

Addr

ess

The

IPv6

sou

rce

addr

ess

in th

e IP

pack

et h

eade

r.

28de

stin

ati

onIP

v6A

ddre

ss

The

IPv6

dest

inat

ion

addr

ess

in th

e IP

pack

et h

eade

r.

29so

urce

IPv6

Prefi

xLe

ngth

The

num

ber o

fco

ntig

uous

bits

that

are

rele

vant

inth

eso

urce

IPv6

Prefi

xIn

form

atio

nEl

emen

t.

bits

30de

stinati

onIP

v6P

refix

Len

gth

The

num

ber o

fco

ntig

uous

bits

that

are

rele

vant

inth

ede

stin

atio

nIPv

6Pre

fix

Info

rmat

ion

Elem

ent.

bits

Reference 97

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

31flo

wLa

bel

IPv6

The

valu

e of

the

IPv6

Flo

w L

abel

field

in th

e IP

pack

et h

eade

r.

32ic

mpT

ypeC

odeI

Pv4

Type

and

Cod

e of

the

IPv4

ICM

Pm

essa

ge. T

heco

mbi

natio

n of

both

val

ues

isre

port

ed a

s (I

CMP

type

* 2

56) +

ICM

Pco

de.

33ig

mpT

ype

The

type

field

ofth

e IG

MP

mes

sage

.

34sa

mpl

ingI

nter

val

Depr

ecat

ed in

favo

rof

305

sam

plin

gPac

ketI

nter

val.

Whe

n us

ing

sam

pled

Net

Flow

,th

e ra

te a

t whi

chpa

cket

s ar

esa

mpl

ed --

e.g

., a

valu

e of

100

indi

cate

s th

at o

neof

eve

ry 1

00pa

cket

s is

sam

pled

.

pac

ket

s


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

35sa

mpl

ingA

lgor

ithm

Depr

ecat

ed in

favo

rof

304

sele

ctor

Algo

rithm

.Th

e ty

pe o

fal

gorit

hm u

sed

for

sam

pled

Net

Flow

:

1 - D

eter

min

istic

Sam

plin

g,

2 - R

ando

mSa

mpl

ing.

The

valu

es a

re n

otco

mpa

tible

with

the

sele

ctor

Algo

rithm

IE, w

here

"Det

erm

inis

tic" h

asbe

en re

plac

ed b

y"S

yste

mat

ic c

ount

-ba

sed"

(1) o

r"S

yste

mat

ic ti

me-

base

d" (2

), an

d"R

ando

m" i

s (3

).Co

nver

sion

isre

quire

d; s

ee[P

acke

t Sam

plin

g(P

SAM

P)Pa

ram

eter

s.]

Reference 99

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

36flo

wAc

tive

Tim

eout

The

num

ber o

fse

cond

s af

ter

whi

ch a

n ac

tive

Flow

is ti

med

out

anyw

ay, e

ven

ifth

ere

is s

till a

cont

inuo

us fl

ow o

fpa

cket

s.

sec

on ds

37flo

wId

leTi

meo

utA

Flow

isco

nsid

ered

to b

etim

ed o

ut if

no

pack

ets

belo

ngin

gto

the

Flow

hav

ebe

en o

bser

ved

for

the

num

ber o

fse

cond

s sp

ecified

by th

is field.

sec

on ds

38en

gine

Type

Type

of f

low

switc

hing

eng

ine

ina

rout

er/s

witc

h:

RP =

0,

VIP/

Line

car

d =

1,

PFC/

DFC

= 2.

Rese

rved

for

inte

rnal

use

on

the

Colle

ctor

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

39en

gine

IdVe

rsat

ile In

terf

ace

Proc

esso

r (VI

P) o

rlin

e ca

rd s

lot

num

ber o

f the

flow

switc

hing

eng

ine

ina

rout

er/s

witc

h.Re

serv

ed fo

rin

tern

al u

se o

n th

eCo

llect

or.

Reference 101

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

40ex

port

edO

ctet

Tot

alCo

unt

The

tota

l num

ber

of o

ctet

s th

at th

eEx

port

ing

Proc

ess

has

sent

sin

ce th

eEx

port

ing

Proc

ess

(re-

)initi

aliz

atio

n to

a pa

rtic

ular

Colle

ctin

g Pr

oces

s.Th

e va

lue

of th

isIn

form

atio

nEl

emen

t is

calc

ulat

ed b

ysu

mm

ing

up th

eIP

FIX

Mes

sage

Hea

der l

engt

hva

lues

of a

ll IP

FIX

Mes

sage

s th

atw

ere

succ

essf

ully

sent

to th

eCo

llect

ing

Proc

ess.

The

repo

rted

num

ber e

xclu

des

octe

ts in

the

IPFI

XM

essa

ge th

atca

rrie

s th

e co

unte

rva

lue.

If th

isIn

form

atio

nEl

emen

t is

sent

to a

part

icul

arCo

llect

ing

Proc

ess,

then

by

defa

ult i

tsp

ecifies

the

num

ber o

f oct

ets

sent

to th

isCo

llect

ing

Proc

ess.

oct

ets


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

41ex

port

edM

essa

geTo

talC

ount

The

tota

l num

ber

of IP

FIX

Mes

sage

sth

at th

e Ex

port

ing

Proc

ess

has

sent

sinc

e th

e Ex

port

ing

Proc

ess

(re-

)initi

aliz

atio

n to

a pa

rtic

ular

Colle

ctin

g Pr

oces

s.Th

e re

port

ednu

mbe

r exc

lude

sth

e IP

FIX

Mes

sage

that

car

ries

the

coun

ter v

alue

. If

this

Info

rmat

ion

Elem

ent i

s se

nt to

apa

rtic

ular

Colle

ctin

g Pr

oces

s,th

en b

y de

faul

t it

spec

ifies

the

num

ber o

f IPF

IXM

essa

ges

sent

toth

is C

olle

ctin

gPr

oces

s.

me

ssa

ges

Reference 103

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

42ex

port

edFl

owRe

cor

dTot

alCo

unt

The

tota

l num

ber

of F

low

Rec

ords

that

the

Expo

rtin

gPr

oces

s ha

s se

nt a

sDa

ta R

ecor

ds s

ince

the

Expo

rtin

gPr

oces

s(r

e-)in

itial

izat

ion

toa

part

icul

arCo

llect

ing

Proc

ess.

The

repo

rted

num

ber e

xclu

des

Flow

Rec

ords

in th

eIP

FIX

Mes

sage

that

carr

ies

the

coun

ter

valu

e. If

this

Info

rmat

ion

Elem

ent i

s se

nt to

apa

rtic

ular

Colle

ctin

g Pr

oces

s,th

en b

y de

faul

t it

spec

ifies

the

num

ber o

f Flo

wRe

cord

s se

nt to

this

pro

cess

.

flo ws


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

43ip

v4Ro

uter

ScTh

is is

a platfo

rm-

spec

ific fie

ld fo

r the

Cata

lyst

500

0/Ca

taly

st 6

000

fam

ily. I

t is

used

tost

ore

the

addr

ess

of a

rout

er th

at is

bein

g sh

ortc

utw

hen

perf

orm

ing

Mul

tiLay

erSw

itchi

ng.

44so

urce

IPv4

Prefi

xIP

v4 s

ourc

ead

dres

s pr

efix.

45de

stinati

onIP

v4P

refix

IPv4

des

tinat

ion

addr

ess pr

efix.

46m

plsT

opLa

belT

ype

This

field iden

tifies

the

cont

rol

prot

ocol

that

allo

cate

d th

e to

p-of

-sta

ck la

bel.

Valu

es fo

r thi

s fie

ldar

e lis

ted

in th

eM

PLS

labe

l typ

ere

gist

ry.

Reference 105

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

47m

plsT

opLa

belIP

v4A

ddre

ss

The

IPv4

add

ress

of th

e sy

stem

that

the

MPL

S to

p la

bel

will

cau

se th

is F

low

to b

e fo

rwar

ded

to.

48sa

mpl

erI

dDe

prec

ated

in fa

vor

of 3

02 s

elec

torI

d.Th

e un

ique

iden

tifier

asso

ciat

ed w

ithsa

mpl

erN

ame.

49sa

mpl

erM

ode

Depr

ecat

ed in

favo

rof

304

sele

ctor

Algo

rithm

.Th

e va

lues

are

not

com

patib

le:

sele

ctor

Algo

rithm

=3

is ra

ndom

sam

plin

g. T

he ty

peof

alg

orith

m u

sed

for s

ampl

ing

data

:1

- Det

erm

inis

tic, 2

- Ran

dom

Sam

plin

g. U

se w

ithsa

mpl

erRa

ndom

Int

erva

l.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

50sa

mpl

erRa

ndom

Inte

rval

Depr

ecat

ed in

favo

rof

305

sam

plin

gPac

ketI

nter

val.

Pack

etin

terv

al a

t whi

ch to

sam

ple

-- in

cas

e of

rand

om s

ampl

ing.

Used

in c

onne

ctio

nw

ith th

esa

mpl

erM

ode

0x02

(ran

dom

sam

plin

g)va

lue.

51cl

assI

dDe

prec

ated

in fa

vor

of 3

02 s

elec

torI

d.Ch

arac

teriz

es th

etraffic

cla

ss, t

hat i

s,Q

oS tr

eatm

ent.

52m

inim

um

TTL

Min

imum

TTL

val

ueob

serv

ed fo

r any

pack

et in

this

Flo

w.

ho ps

53m

axim

um

TTL

Max

imum

TTL

valu

e ob

serv

ed fo

ran

y pa

cket

in th

isFl

ow.

ho ps

Reference 107

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

54frag

men

tIde

ntifi

catio

n

The

valu

e of

the

Iden

tifica

tion fie

ldin

the

IPv4

pac

ket

head

er o

r in

the

IPv6

Fra

gmen

the

ader

,re

spec

tivel

y. T

heva

lue

is 0

for I

Pv6

if th

ere

is n

ofr

agm

ent h

eade

r.

55po

stIp

Clas

sOfS

ervi

ce

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'ipCl

assO

fSer

vice

',ex

cept

that

itre

port

s a

pote

ntia

llymod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

56so

urce

Mac

Addr

ess

The

IEEE

802

sour

ce M

ACad

dres

s fie

ld.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

57po

stDe

stin

atio

nMac

Addr

ess

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'des

tinat

ionM

acAd

dres

s', e

xcep

t tha

tit

repo

rts

apo

tent

ially

mod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

58vl

anId

Virt

ual L

ANiden

tifier

asso

ciat

ed w

ithin

gres

s in

terf

ace.

For d

ot1q

vla

ns,

see

243

dot1

qVla

nId.

59po

stVl

anId

Virt

ual L

ANiden

tifier

asso

ciat

ed w

itheg

ress

inte

rfac

e.Fo

r pos

tdot

1qvl

ans,

see

254

,po

stDo

t1qV

lanI

d.

Reference 109

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

60ip

Vers

ion

The

IP v

ersi

on field

in th

e IP

pac

ket

head

er.

61flo

wDi

rect

ion

The

dire

ctio

n of

the

Flow

obs

erve

d at

the

Obs

erva

tion

Poin

t. Th

ere

are

only

two

valu

esde

fined

.

0x00

: ing

ress

flow

0x01

: egr

ess

flow

62ip

Nex

tHop

IPv6

Add

ress

The

IPv6

add

ress

of th

e ne

xt IP

v6ho

p.

63bg

pNex

tH

opIP

v6Ad

dres

s

The

IPv6

add

ress

of th

e ne

xt(a

djac

ent)

BG

Pho

p.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

64ip

v6Ex

tens

ionH

ead

ers

IPv6

ext

ensi

onhe

ader

s ob

serv

edin

pac

kets

of t

his

Flow

. The

info

rmat

ion

isen

code

d in

a s

et o

fbi

t fields

. For

eac

hIP

v6 o

ptio

n he

ader

,th

ere

is a

bit

in th

isse

t. Th

e bi

t is

set t

o1

if an

y ob

serv

edpa

cket

of t

his

Flow

cont

ains

the

corr

espo

ndin

g IP

v6ex

tens

ion

head

er.

Oth

erw

ise,

if n

oob

serv

ed p

acke

t of

this

Flo

w c

onta

ined

the

resp

ectiv

e IP

v6ex

tens

ion

head

er,

the

valu

e of

the

corr

espo

ndin

g bi

tis

0.

0 1 2 3

4 5 6 7

+-----+-----+-----+-----

+-----+-----+-----+-----+

| DST | HOP | Res | UNK |

FRA0 | RH |FRA1 | Res | ...

+-----+-----+-----+-----

+-----+-----+-----+-----+

8 9 10 11 12

13 14 15

+-----+-----+-----+-----

+-----+-----+-----+-----+

... | Reserved

| MOB | ESP | AH | PAY |

+-----+-----+-----+-----

+-----+-----+-----+-----+

16 17 18 19

20 21 22 23

+-----+-----+-----+-----

+-----+-----+-----+-----+

... |

Reserved

| ...

+-----+-----+-----+-----

+-----+-----+-----+-----+

24 25 26 27

28 29 30 31

+-----+-----+-----+-----

+-----+-----+-----+-----+

... |

Reserved

| +-----+-----+-----+-----

+-----+-----+-----+-----+

Bit IPv6 Option

Description

0, DST 60

Destination option header

1, HOP 0 Hop-by-

hop option header

2, Res Reserved

3, UNK Unknown

Layer 4 header

(compressed, encrypted, not

supported)

4, FRA0 44

Fragment header - first

fragment

5, RH 43 Routing

header

6, FRA1 44

Fragmentation header - not

first fragment

7, Res Reserved

8 to 11

Reserved

12, MOB 135 IPv6

mobility [RFC3775]

13, ESP 50

Encrypted security payload

14, AH 51

Authentication Header

15, PAY 108

Payload compression header

16 to 31

Reserved

Reference 111

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

65-

69As

sign

ed

for

Net

Flow

v9 com

pati

bilit

y

70m

plsT

opLa

belS

tack

Sect

ion

The

Labe

l, Ex

p, a

ndS fie

lds

from

the

top

MPL

S la

bel

stac

k en

try,

that

is,

from

the

last

labe

lth

at is

pus

hed.

The

size

of t

his

Info

rmat

ion

Elem

ent i

s 3

octe

ts.

0

1 2

0 1 2 3 4 5 6 7 8 9 0 1 2 3

4 5 6 7 8 9 0 1 2 3

+-+-+-+-+-+-+-+-+-+-+-+-+-+-

+-+-+-+-+-+-+-+-+-+-+

|

Label | Exp

|S|

+-+-+-+-+-+-+-+-+-+-+-+-+-+-

+-+-+-+-+-+-+-+-+-+-+

Label: Label Value, 20 bits

Exp: Experimental Use, 3

bits

S: Bottom of Stack, 1

bit


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

71m

plsL

abel

Stac

kSec

tion2

The

Labe

l, Ex

p, a

ndS fie

lds

from

the

labe

l sta

ck e

ntry

that

is p

ushe

dim

med

iate

ly b

efor

eth

e la

bel s

tack

entr

y th

at w

ould

be

repo

rted

by

mpl

sTop

Labe

lSta

ckSe

ctio

n. S

ee th

ede

finition

of

mpl

sTop

Labe

lSta

ckSe

ctio

n fo

r fur

ther

deta

ils.

The

size

of t

his

Info

rmat

ion

Elem

ent i

s 3

octe

ts.

Reference 113

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

72m

plsL

abel

Stac

kSec

tion3

The

Labe

l, Ex

p, a

ndS fie

lds

from

the

labe

l sta

ck e

ntry

that

is p

ushe

dim

med

iate

ly b

efor

eth

e la

bel s

tack

entr

y th

at w

ould

be

repo

rted

by

mpl

sLab

elSt

ackS

ectio

n2. S

ee th

ede

finition

of

mpl

sTop

Labe

lSta

ckSe

ctio

n fo

r fur

ther

deta

ils.

The

size

of t

his

Info

rmat

ion

Elem

ent i

s 3

octe

ts.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

73m

plsL

abel

Stac

kSec

tion4

The

Labe

l, Ex

p, a

ndS fie

lds

from

the

labe

l sta

ck e

ntry

that

is p

ushe

dim

med

iate

ly b

efor

eth

e la

bel s

tack

entr

y th

at w

ould

be

repo

rted

by

mpl

sLab

elSt

ackS

ectio

n3. S

ee th

ede

finition

of

mpl

sTop

Labe

lSta

ckSe

ctio

n fo

r fur

ther

deta

ils.

The

size

of t

his

Info

rmat

ion

Elem

ent i

s 3

octe

ts.

Reference 115

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

74m

plsL

abel

Stac

kSec

tion5

The

Labe

l, Ex

p, a

ndS fie

lds

from

the

labe

l sta

ck e

ntry

that

is p

ushe

dim

med

iate

ly b

efor

eth

e la

bel s

tack

entr

y th

at w

ould

be

repo

rted

by

mpl

sLab

elSt

ackS

ectio

n4. S

ee th

ede

finition

of

mpl

sTop

Labe

lSta

ckSe

ctio

n fo

r fur

ther

deta

ils.

The

size

of t

his

Info

rmat

ion

Elem

ent i

s 3

octe

ts.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

75m

plsL

abel

Stac

kSec

tion6

The

Labe

l, Ex

p, a

ndS fie

lds

from

the

labe

l sta

ck e

ntry

that

is p

ushe

dim

med

iate

ly b

efor

eth

e la

bel s

tack

entr

y th

at w

ould

be

repo

rted

by

mpl

sLab

elSt

ackS

ectio

n5. S

ee th

ede

finition

of

mpl

sTop

Labe

lSta

ckSe

ctio

n fo

r fur

ther

deta

ils.

The

size

of t

his

Info

rmat

ion

Elem

ent i

s 3

octe

ts.

Reference 117

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

76m

plsL

abel

Stac

kSec

tion7

The

Labe

l, Ex

p, a

ndS fie

lds

from

the

labe

l sta

ck e

ntry

that

is p

ushe

dim

med

iate

ly b

efor

eth

e la

bel s

tack

entr

y th

at w

ould

be

repo

rted

by

mpl

sLab

elSt

ackS

ectio

n6. S

ee th

ede

finition

of

mpl

sTop

Labe

lSta

ckSe

ctio

n fo

r fur

ther

deta

ils.

The

size

of t

his

Info

rmat

ion

Elem

ent i

s 3

octe

ts.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

77m

plsL

abel

Stac

kSec

tion8

The

Labe

l, Ex

p, a

ndS fie

lds

from

the

labe

l sta

ck e

ntry

that

is p

ushe

dim

med

iate

ly b

efor

eth

e la

bel s

tack

entr

y th

at w

ould

be

repo

rted

by

mpl

sLab

elSt

ackS

ectio

n7. S

ee th

ede

finition

of

mpl

sTop

Labe

lSta

ckSe

ctio

n fo

r fur

ther

deta

ils.

The

size

of t

his

Info

rmat

ion

Elem

ent i

s 3

octe

ts.

Reference 119

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

78m

plsL

abel

Stac

kSec

tion9

The

Labe

l, Ex

p, a

ndS fie

lds

from

the

labe

l sta

ck e

ntry

that

is p

ushe

dim

med

iate

ly b

efor

eth

e la

bel s

tack

entr

y th

at w

ould

be

repo

rted

by

mpl

sLab

elSt

ackS

ectio

n8. S

ee th

ede

finition

of

mpl

sTop

Labe

lSta

ckSe

ctio

n fo

r fur

ther

deta

ils.

The

size

of t

his

Info

rmat

ion

Elem

ent i

s 3

octe

ts.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

79m

plsL

abel

Stac

kSec

tion1

0

The

Labe

l, Ex

p, a

ndS fie

lds

from

the

labe

l sta

ck e

ntry

that

is p

ushe

dim

med

iate

ly b

efor

eth

e la

bel s

tack

entr

y th

at w

ould

be

repo

rted

by

mpl

sLab

elSt

ackS

ectio

n9. S

ee th

ede

finition

of

mpl

sTop

Labe

lSta

ckSe

ctio

n fo

r fur

ther

deta

ils.

The

size

of t

his

Info

rmat

ion

Elem

ent i

s 3

octe

ts.

80de

stin

ati

onM

acA

ddre

ss

The

IEEE

802

dest

inat

ion

MAC

addr

ess fie

ld.

Reference 121

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

81po

stSo

urce

Mac

Add

ress

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'sou

rceM

acAd

dres

s', e

xcep

t tha

t it

repo

rts

apo

tent

ially

mod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

82in

terf

ace

Nam

eA

shor

t nam

eun

ique

ly d

escr

ibin

gan

inte

rfac

e, e

g"E

th1/

0".

83in

terf

ace

Desc

ripti

on

The

desc

riptio

n of

an in

terf

ace,

eg

"Fas

tEth

erne

t 1/0

"or

"ISP

conn

ectio

n".

84sa

mpl

erN

ame

Depr

ecat

ed in

favo

rof

335

sele

ctor

Nam

e.N

ame

of th

e flo

wsa

mpl

er.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

85oc

tetT

otal

Coun

tTh

e to

tal n

umbe

rof

oct

ets

inin

com

ing

pack

ets

for t

his

Flow

at t

heO

bser

vatio

n Po

int

sinc

e th

e M

eter

ing

Proc

ess

(re-

)initi

aliz

atio

nfo

r thi

s O

bser

vatio

nPo

int.

The

num

ber

of o

ctet

s in

clud

esIP

hea

der(

s) a

nd IP

payl

oad.

oct

ets

86pa

cket

Tot

alCo

unt

The

tota

l num

ber

of in

com

ing

pack

ets

for t

his

Flow

at t

heO

bser

vatio

n Po

int

sinc

e th

e M

eter

ing

Proc

ess

(re-

)initi

aliz

atio

nfo

r thi

s O

bser

vatio

nPo

int.

pac

ket

s

Reference 123

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

87fla

gsAn

dSa

mpl

erId

Flow

flag

s an

d th

eva

lue

of th

esa

mpl

er ID

(sam

pler

Id)

com

bine

d in

one

bitm

appe

d fie

ld.

Rese

rved

for

inte

rnal

use

on

the

Colle

ctor

.

88fr

agm

entO

ffset

The

valu

e of

the

IPfr

agm

ent o

ffset

field

in th

e IP

v4pa

cket

hea

der o

rth

e IP

v6 F

ragm

ent

head

er,

resp

ectiv

ely.

The

valu

e is

0 fo

r IPv

6if

ther

e is

no

frag

men

t hea

der.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

89fo

rwar

ding

Stat

usTh

is In

form

atio

nEl

emen

t des

crib

esth

e fo

rwar

ding

stat

us o

f the

flow

and

any

atta

ched

reas

ons.

The

redu

ced-

size

enco

ding

rule

s as

per [

RFC7

011]

appl

y.

The

basi

c en

codi

ngis

8 b

its. T

he fu

ture

exte

nsio

ns c

ould

add

one

or th

ree

byte

s. T

he la

yout

of

the

basi

c en

codi

ngis

as

follo

ws:

MSB - 0 1 2 3 4

5 6 7 - LSB

+---+---+---+---+---

+---+---+---+

| Status| Reason

code or flags |

+---+---+---+---+---

+---+---+---+

Status:

00b = Unknown

01b = Forwarded

10b = Dropped

11b = Consumed

Reason Code (status = 01b,

Forwarded)

01 000000b = 64 = Unknown

01 000001b = 65 = Fragmented

01 000010b = 66 = Not

Fragmented


Dropped)

10 000000b = 128 = Unknown

10 000001b = 129 = ACL deny

10 000010b = 130 = ACL drop

10 000011b = 131 = Unroutable

10 000100b = 132 = Adjacency

10 000101b = 133 =

Fragmentation and DF set

10 000110b = 134 = Bad

header checksum

10 000111b = 135 = Bad total

Length

10 001000b = 136 = Bad

header length

10 001001b = 137 = bad TTL

10 001010b = 138 = Policer

10 001011b = 139 = WRED

10 001100b = 140 = RPF

10 001101b = 141 = For us

10 001110b = 142 = Bad

output interface

10 001111b = 143 = Hardware


Consumed)

11 000000b = 192 = Unknown

11 000001b = 193 = Punt

Adjacency

11 000010b = 194 =

Incomplete Adjacency

11 000011b = 195 = For us

Examples:

value : 0x40 = 64

binary: 01000000

decode: 01 ->

Forward

000000 -> No

further information

value : 0x89 = 137

binary: 10001001

decode: 10 -> Drop

001001 ->

Fragmentation and DF set

Reference 125


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

90m

plsV

pnRo

uteD

istin

guis

her

The

valu

e of

the

VPN

rout

edi

stin

guis

her o

f aco

rres

pond

ing

entr

y in

a V

PNro

utin

g an

dfo

rwar

ding

tabl

e.Ro

ute

dist

ingu

ishe

ren

sure

s th

at th

esa

me

addr

ess

can

be u

sed

in s

ever

aldi

ffere

nt M

PLS

VPN

s an

d th

at it

ispo

ssib

le fo

r BG

P to

carr

y se

vera

lco

mpl

etel

ydi

ffere

nt ro

utes

toth

at a

ddre

ss, o

nefo

r eac

h VP

N.

Acco

rdin

g to

[RFC

4364

], th

e si

zeof m

plsV

pnRo

uteD

isti

ngui

sher

is 8

octe

ts. H

owev

er, i

n[R

FC43

82] a

n oc

tet

strin

g w

ith fl

exib

lele

ngth

is c

hose

n fo

rre

pres

entin

g a

VPN

rout

e di

stin

guis

her

by o

bjec

tM

plsL

3Vpn

Rout

eDi

stin

guis

her.

This

choi

ce is

mad

e in

orde

r to

be o

pen

tofu

ture

cha

nges

of

the

size

. Thi

s id

eais

ado

pted

whe

nch

oosi

ngoc

tetA

rray

as

abst

ract

dat

a ty

pefo

r thi

s In

form

atio

nEl

emen

t. Th

em

axim

um le

ngth

of

this

Info

rmat

ion

Elem

ent i

s 25

6oc

tets

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

91mplsT

opLa

belP

ref

ixLe

ngth

The pr

efix

leng

th o

fth

e su

bnet

of t

hem

plsT

opLa

belIP

v4Ad

dres

s th

at th

eM

PLS

top

labe

l will

caus

e th

e Fl

ow to

be fo

rwar

ded

to.

bits

92srcT

raffi

cInd

exBG

P Po

licy

Acco

untin

g So

urce

Traffic

Inde

x.

93ds

tTraffi

cInd

exBG

P Po

licy

Acco

untin

gDe

stin

atio

n Traffic

Inde

x.

94ap

plic

ati

onDe

scri

ptio

n

Spec

ifies

the

desc

riptio

n of

an

appl

icat

ion.

95ap

plic

ati

onId

Spec

ifies

an

Appl

icat

ion

ID p

er[R

FC67

59].

96ap

plic

ati

onN

ame

Spec

ifies

the

nam

eof

an

appl

icat

ion.

Reference 127

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

98po

stIp

DiffS

ervC

ode

Poin

t

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'ipDi

ffSer

vCod

ePoi

nt', e

xcep

t tha

t it

repo

rts

apo

tent

ially

mod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

99m

ultic

astR

eplic

atio

nFac

tor

The

amou

nt o

fm

ultic

ast

repl

icat

ion

that

'sap

plie

d to

a tr

affic

stre

am.

10 0cl

assN

am

eDe

prec

ated

in fa

vor

of 3

35se

lect

orN

ame.

Traffic

Cla

ss N

ame,

asso

ciat

ed w

ith th

ecl

assI

dIn

form

atio

nEl

emen

t.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

10 1clas

sific

ationE

ngineI

d

A un

ique

iden

tifier

for t

he e

ngin

e th

atde

term

ined

the

Sele

ctor

ID. T

hus,

the Clas

sific

ation

Engi

ne ID

defi

nes

the

cont

ext f

or th

eSe

lect

or ID

. The

Clas

sific

ation

Engi

ne c

an b

eco

nsid

ered

asp

ecific

regi

stry

for

appl

icat

ion

assi

gnm

ents

.

Valu

es fo

r thi

s fie

ldar

e lis

ted

in th

eClas

sific

ation

Engi

ne ID

s re

gist

ry.

10 2la

yer2

pack

etSe

ctio

nOffs

et

Depr

ecat

ed in

favo

rof

409

sect

ionO

ffset

.La

yer 2

pac

ket

sect

ion

offs

et.

Pote

ntia

lly a

gene

ric p

acke

tse

ctio

n of

fset

.

Reference 129

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

10 3la

yer2

pack

etSe

ctio

nSiz

e

Depr

ecat

ed in

favo

rof

312

data

Link

Fram

eSiz

e.La

yer 2

pac

ket

sect

ion

size

.Po

tent

ially

age

neric

pac

ket

sect

ion

size

.

10 4la

yer2

pack

etSe

ctio

nDat

a

Depr

ecat

ed in

favo

rof

315

data

Link

Fram

eSec

tio

n. L

ayer

2 p

acke

tse

ctio

n da

ta.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

12 8bg

pNex

tAd

jace

ntAs

Num

ber

The

auto

nom

ous

syst

em (A

S)nu

mbe

r of t

he first

AS in

the

AS p

ath

to th

e de

stin

atio

nIP

add

ress

. The

path

is d

educ

ed b

ylo

okin

g up

the

dest

inat

ion

IPad

dres

s of

the

Flow

in th

e BG

P ro

utin

gin

form

atio

n ba

se. I

fAS

pat

hin

form

atio

n fo

r thi

sFl

ow is

onl

yav

aila

ble

as a

nun

orde

red

AS s

et(a

nd n

ot a

s an

orde

red

ASse

quen

ce),

then

the

valu

e of

this

Info

rmat

ion

Elem

ent i

s 0.

Reference 131

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

12 9bg

pPre

vAd

jace

ntAs

Num

ber

The

auto

nom

ous

syst

em (A

S)nu

mbe

r of t

he la

stAS

in th

e AS

pat

hfr

om th

e so

urce

IPad

dres

s. T

he p

ath

is d

educ

ed b

ylo

okin

g up

the

sour

ce IP

add

ress

of th

e Fl

ow in

the

BGP

rout

ing

info

rmat

ion

base

. If

AS p

ath

info

rmat

ion

for t

his

Flow

is o

nly

avai

labl

e as

an

unor

dere

d AS

set

(and

not

as

anor

dere

d AS

sequ

ence

), th

enth

e va

lue

of th

isIn

form

atio

nEl

emen

t is

0. In

case

of B

GP

asym

met

ry, t

hebg

pPre

vAdj

acen

tAs

Num

ber m

ight

not

be a

ble

to re

port

the

corr

ect v

alue

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

13 0ex

port

erIP

v4Ad

dre

ss

The

IPv4

add

ress

used

by

the

Expo

rtin

g Pr

oces

s.Th

is is

use

d by

the

Colle

ctor

to id

entif

yth

e Ex

port

er in

case

s w

here

the

iden

tity

of th

eEx

port

er m

ay h

ave

been

obs

cure

d by

the

use

of a

pro

xy.

13 1ex

port

erIP

v6Ad

dre

ss

The

IPv6

add

ress

used

by

the

Expo

rtin

g Pr

oces

s.Th

is is

use

d by

the

Colle

ctor

to id

entif

yth

e Ex

port

er in

case

s w

here

the

iden

tity

of th

eEx

port

er m

ay h

ave

been

obs

cure

d by

the

use

of a

pro

xy.

Reference 133

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

13 2dr

oppe

dO

ctet

Del

taCo

unt

The

num

ber o

foc

tets

sin

ce th

epr

evio

us re

port

(if

any)

in p

acke

ts o

fth

is F

low

dro

pped

by p

acke

ttr

eatm

ent.

The

num

ber o

f oct

ets

incl

udes

IPhe

ader

(s) a

nd IP

payl

oad.

oct

ets

13 3dr

oppe

dPa

cket

Del

taCo

unt

The

num

ber o

fpa

cket

s si

nce

the

prev

ious

repo

rt (i

fan

y) o

f thi

s Fl

owdr

oppe

d by

pac

ket

trea

tmen

t.

pac

ket

s

13 4dr

oppe

dO

ctet

Tot

alCo

unt

The

tota

l num

ber

of o

ctet

s in

pac

kets

of th

is F

low

drop

ped

by p

acke

ttr

eatm

ent s

ince

the

Met

erin

g Pr

oces

s(r

e-)in

itial

izat

ion

for t

his

Obs

erva

tion

Poin

t. Th

e nu

mbe

rof

oct

ets

incl

udes

IP h

eade

r(s)

and

IPpa

yloa

d.

oct

ets


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

13 5dr

oppe

dPa

cket

Tot

alCo

unt

The

num

ber o

fpa

cket

s of

this

Flow

dro

pped

by

pack

et tr

eatm

ent

sinc

e th

e M

eter

ing

Proc

ess

(re-

)initi

aliz

atio

nfo

r thi

s O

bser

vatio

nPo

int.

pac

ket

s

Reference 135

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

13 6flo

wEn

dRe

ason

The

reas

on fo

rFl

ow te

rmin

atio

n.Th

e ra

nge

of v

alue

sin

clud

es th

efo

llow

ing:

0x01: idle timeout

The Flow is terminated

because it is considered to

be idle.

0x02: active timeout

The Flow is terminated for

reporting purposes while it

is still active, for example,

after the maximum lifetime of

unreported Flows is reached.

0x03: end of Flow detected


because the Metering Process

detected signals indicating

the end of the Flow,

for example, the TCP FIN

flag.

0x04: forced end


because of some external

event,

for example, a shutdown of

the Metering Process

initiated

by a network management

application.

0x05: lack of resources


because of lack of resources

available to the Metering

Process and/or the Exporting

Process.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

13 7co

mm

onPr

oper

ties

Id

An id

entifi

er o

f ase

t of c

omm

onpr

oper

ties

that

isun

ique

per

Obs

erva

tion

Dom

ain

and

Tran

spor

t Ses

sion

.Ty

pica

lly, t

his

Info

rmat

ion

Elem

ent i

s us

ed to

link

to in

form

atio

nre

port

ed in

sepa

rate

Dat

aRe

cord

s.

13 8ob

serv

atio

nPoi

ntId

An id

entifi

er o

f an

Obs

erva

tion

Poin

tth

at is

uni

que

per

Obs

erva

tion

Dom

ain.

It is

RECO

MM

ENDE

Dth

at th

is id

entifi

eris

als

o un

ique

per

IPFI

X De

vice

.Ty

pica

lly, t

his

Info

rmat

ion

Elem

ent i

s us

ed fo

rlim

iting

the

scop

eof

oth

erIn

form

atio

nEl

emen

ts.

Reference 137

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

13 9ic

mpT

ypeC

odeI

Pv6

Type

and

Cod

e of

the

IPv6

ICM

Pm

essa

ge. T

heco

mbi

natio

n of

both

val

ues

isre

port

ed a

s (I

CMP

type

* 2

56) +

ICM

Pco

de.

14 0m

plsT

opLa

belIP

v6A

ddre

ss

The

IPv6

add

ress

of th

e sy

stem

that

the

MPL

S to

p la

bel

will

cau

se th

is F

low

to b

e fo

rwar

ded

to.

14 1lin

eCar

dId

An id

entifi

er o

f alin

e ca

rd th

at is

uniq

ue p

er IP

FIX

Devi

ce h

ostin

g an

Obs

erva

tion

Poin

t.Ty

pica

lly, t

his

Info

rmat

ion

Elem

ent i

s us

ed fo

rlim

iting

the

scop

eof

oth

erIn

form

atio

nEl

emen

ts.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

14 2po

rtId

An id

entifi

er o

f alin

e po

rt th

at is

uniq

ue p

er IP

FIX

Devi

ce h

ostin

g an

Obs

erva

tion

Poin

t.Ty

pica

lly, t

his

Info

rmat

ion

Elem

ent i

s us

ed fo

rlim

iting

the

scop

eof

oth

erIn

form

atio

nEl

emen

ts.

14 3m

eter

ing

Proc

essI

d

An id

entifi

er o

f aM

eter

ing

Proc

ess

that

is u

niqu

e pe

rIP

FIX

Devi

ce.

Typi

cally

, thi

sIn

form

atio

nEl

emen

t is

used

for

limiti

ng th

e sc

ope

of o

ther

Info

rmat

ion

Elem

ents

. Not

eth

at p

roce

ssiden

tifiers

are

typi

cally

ass

igne

ddy

nam

ical

ly. T

heM

eter

ing

Proc

ess

may

be

re-s

tart

edw

ith a

diff

eren

t ID.

Reference 139

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

14 4ex

port

ingP

roce

ssId

An id

entifi

er o

f an

Expo

rtin

g Pr

oces

sth

at is

uni

que

per

IPFI

X De

vice

.Ty

pica

lly, t

his

Info

rmat

ion

Elem

ent i

s us

ed fo

rlim

iting

the

scop

eof

oth

erIn

form

atio

nEl

emen

ts. N

ote

that

pro

cess

iden

tifiers

are

typi

cally

ass

igne

ddy

nam

ical

ly. T

heEx

port

ing

Proc

ess

may

be

re-s

tart

edw

ith a

diff

eren

t ID.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

14 5te

mpl

ate

IdAn

iden

tifier

of a

Tem

plat

e th

at is

loca

lly u

niqu

ew

ithin

aco

mbi

natio

n of

aTr

ansp

ort s

essi

onan

d an

Obs

erva

tion

Dom

ain.

Tem

plat

e ID

s0-

255

are

rese

rved

for T

empl

ate

Sets

,O

ptio

ns T

empl

ate

Sets

, and

oth

erre

serv

ed S

ets

yet

to b

e cr

eate

d.Te

mpl

ate

IDs

ofDa

ta S

ets

are

num

bere

d fr

om25

6 to

655

35.

Typi

cally

, thi

sIn

form

atio

nEl

emen

t is

used

for

limiti

ng th

e sc

ope

of o

ther

Info

rmat

ion

Elem

ents

. Not

eth

at a

fter a

re-s

tart

of th

e Ex

port

ing

Proc

ess

Tem

plat

eiden

tifiers

may

be

re-a

ssig

ned.

Reference 141

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

14 6w

lanC

hann

elId

The iden

tifier

of t

he80

2.11

(Wi-F

i)ch

anne

l use

d.

14 7w

lanS

SID

The

Serv

ice

Set

IDen

tifier

(SSI

D)id

entif

ying

an

802.

11 (W

i-Fi)

netw

ork

used

.Ac

cord

ing

toIE

EE.8

02-1

1.19

99,

the

SSID

isen

code

d in

to a

strin

g of

up

to 3

2ch

arac

ters

.

14 8flo

wId

An id

entifi

er o

f aFl

ow th

at is

uni

que

with

in a

nO

bser

vatio

nDo

mai

n. T

his

Info

rmat

ion

Elem

ent c

an b

eus

ed to

dis

tingu

ish

betw

een

diffe

rent

Flow

s if

Flow

Key

ssu

ch a

s IP

addr

esse

s an

d po

rtnu

mbe

rs a

re n

otre

port

ed o

r are

repo

rted

inse

para

te re

cord

s.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

14 9ob

serv

atio

nDom

ain

Id

An id

entifi

er o

f an

Obs

erva

tion

Dom

ain

that

islo

cally

uni

que

to a

nEx

port

ing

Proc

ess.

The

Expo

rtin

gPr

oces

s us

es th

eO

bser

vatio

nDo

mai

n ID

toun

ique

ly id

entif

y to

the

Colle

ctin

gPr

oces

s th

eO

bser

vatio

nDo

mai

n w

here

Flow

s w

ere

met

ered

. It i

sRE

COM

MEN

DED

that

this

iden

tifier

is a

lso

uniq

ue p

erIP

FIX

Devi

ce.

A va

lue

of 0

indi

cate

s th

at n

osp

ecific

Obs

erva

tion

Dom

ain

isiden

tified

by

this

Info

rmat

ion

Elem

ent.

Typi

cally

, thi

sIn

form

atio

nEl

emen

t is

used

for

limiti

ng th

e sc

ope

of o

ther

Info

rmat

ion

Elem

ents

.

Reference 143

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

15 0flo

wSt

artS

econ

ds

The

abso

lute

times

tam

p of

the

first

pac

ket o

f thi

sFl

ow.

sec

on ds

15 1flo

wEn

dSe

cond

sTh

e ab

solu

tetim

esta

mp

of th

ela

st p

acke

t of t

his

Flow

.

sec

on ds

15 2flo

wSt

artM

illis

econ

ds

The

abso

lute

times

tam

p of

the

first

pac

ket o

f thi

sFl

ow.

mill

ise

con

ds

15 3flo

wEn

dM

illis

eco

nds

The

abso

lute

times

tam

p of

the

last

pac

ket o

f thi

sFl

ow.

mill

ise

con

ds

15 4flo

wSt

artM

icro

seco

nds

The

abso

lute

times

tam

p of

the

first

pac

ket o

f thi

sFl

ow.

mic

ros

eco

nds

15 5flo

wEn

dM

icro

sec

onds

The

abso

lute

times

tam

p of

the

last

pac

ket o

f thi

sFl

ow.

mic

ros

eco

nds

15 6flo

wSt

artN

anos

eco

nds

The

abso

lute

times

tam

p of

the

first

pac

ket o

f thi

sFl

ow.

nan

ose

con

ds


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

15 7flo

wEn

dN

anos

econ

ds

The

abso

lute

times

tam

p of

the

last

pac

ket o

f thi

sFl

ow.

nan

ose

con

ds

15 8flo

wSt

artD

elta

Mi

cros

eco

nds

This

is a

rela

tive

times

tam

p on

lyva

lid w

ithin

the

scop

e of

a s

ingl

eIP

FIX

Mes

sage

. It

cont

ains

the

nega

tive

time

offs

et o

f the

first

obse

rved

pac

ket o

fth

is F

low

rela

tive

toth

e ex

port

tim

esp

ecified

in th

eIP

FIX

Mes

sage

Hea

der.

mic

ros

eco

nds

Reference 145

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

15 9flo

wEn

dDe

ltaM

icro

seco

nds

This

is a

rela

tive

times

tam

p on

lyva

lid w

ithin

the

scop

e of

a s

ingl

eIP

FIX

Mes

sage

. It

cont

ains

the

nega

tive

time

offs

et o

f the

last

obse

rved

pac

ket o

fth

is F

low

rela

tive

toth

e ex

port

tim

esp

ecified

in th

eIP

FIX

Mes

sage

Hea

der.

mic

ros

eco

nds

16 0sy

stem

Ini

tTim

eM

illis

eco

nds

The

abso

lute

times

tam

p of

the

last

(re-

)initi

aliz

atio

n of

the

IPFI

X De

vice

.

mill

ise

con

ds

16 1flo

wDu

ratio

nMill

ise

cond

s

The

diffe

renc

e in

time

betw

een

the

first

obs

erve

dpa

cket

of t

his

Flow

and

the

last

obse

rved

pac

ket o

fth

is F

low

.

mill

ise

con

ds


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

16 2flo

wDu

ratio

nMic

ros

econ

ds

The

diffe

renc

e in

time

betw

een

the

first

obs

erve

dpa

cket

of t

his

Flow

and

the

last

obse

rved

pac

ket o

fth

is F

low

.

mic

ros

eco

nds

16 3ob

serv

edF

low

Tota

lCou

nt

The

tota

l num

ber

of F

low

s ob

serv

edin

the

Obs

erva

tion

Dom

ain

sinc

e th

eM

eter

ing

Proc

ess

(re-

)initi

aliz

atio

nfo

r thi

s O

bser

vatio

nPo

int.

flo ws

16 4ig

nore

dPac

ketT

otal

Coun

t

The

tota

l num

ber

of o

bser

ved

IPpa

cket

s th

at th

eM

eter

ing

Proc

ess

did

not p

roce

sssi

nce

the

(re-

)initi

aliz

atio

n of

the

Met

erin

gPr

oces

s.

pac

ket

s

Reference 147

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

16 5ig

nore

dO

ctet

Tot

alCo

unt

The

tota

l num

ber

of o

ctet

s in

obse

rved

IPpa

cket

s (in

clud

ing

the

IP h

eade

r) th

atth

e M

eter

ing

Proc

ess

did

not

proc

ess

sinc

e th

e(r

e-)in

itial

izat

ion

ofth

e M

eter

ing

Proc

ess.

oct

ets

16 6no

tSen

tFl

owTo

tal

Coun

t

The

tota

l num

ber

of F

low

Rec

ords

that

wer

ege

nera

ted

by th

eM

eter

ing

Proc

ess

and

drop

ped

by th

eM

eter

ing

Proc

ess

or b

y th

e Ex

port

ing

Proc

ess

inst

ead

ofbe

ing

sent

to th

eCo

llect

ing

Proc

ess.

Ther

e ar

e se

vera

lpo

tent

ial r

easo

nsfo

r thi

s in

clud

ing

reso

urce

sho

rtag

ean

d sp

ecia

l Flo

wex

port

pol

icie

s.

flo ws


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

16 7no

tSen

tPa

cket

Tot

alCo

unt

The

tota

l num

ber

of p

acke

ts in

Flo

wRe

cord

s th

at w

ere

gene

rate

d by

the

Met

erin

g Pr

oces

san

d dr

oppe

d by

the

Met

erin

g Pr

oces

sor

by

the

Expo

rtin

gPr

oces

s in

stea

d of

bein

g se

nt to

the

Colle

ctin

g Pr

oces

s.Th

ere

are

seve

ral

pote

ntia

l rea

sons

for t

his

incl

udin

gre

sour

ce s

hort

age

and

spec

ial F

low

expo

rt p

olic

ies.

pac

ket

s

Reference 149

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

16 8no

tSen

tO

ctet

Tot

alCo

unt

The

tota

l num

ber

of o

ctet

s in

pac

kets

in F

low

Rec

ords

that

wer

ege

nera

ted

by th

eM

eter

ing

Proc

ess

and

drop

ped

by th

eM

eter

ing

Proc

ess

or b

y th

e Ex

port

ing

Proc

ess

inst

ead

ofbe

ing

sent

to th

eCo

llect

ing

Proc

ess.

Ther

e ar

e se

vera

lpo

tent

ial r

easo

nsfo

r thi

s in

clud

ing

reso

urce

sho

rtag

ean

d sp

ecia

l Flo

wex

port

pol

icie

s.

oct

ets

16 9de

stinati

onIP

v6P

refix

IPv6

des

tinat

ion

addr

ess pr

efix.

17 0so

urce

IPv6

Prefi

xIP

v6 s

ourc

ead

dres

s pr

efix.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

17 1po

stO

ctet

Tota

lCou

nt

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'oct

etTo

talC

ount

',ex

cept

that

itre

port

s a

pote

ntia

llymod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

oct

ets

Reference 151

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

17 2po

stPa

cke

tTot

alCo

unt

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'pac

ketT

otal

Coun

t',ex

cept

that

itre

port

s a

pote

ntia

llymod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

pac

ket

s


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

17 3flo

wKe

yInd

icat

orTh

is s

et o

f bit fie

lds

is u

sed

for m

arki

ngth

e In

form

atio

nEl

emen

ts o

f a D

ata

Reco

rd th

at s

erve

as F

low

Key

. Eac

hbi

t rep

rese

nts

anIn

form

atio

nEl

emen

t in

the

Data

Reco

rd, w

ith th

e n-

th le

ast s

ignific

ant

bit r

epre

sent

ing

the

n-th

Info

rmat

ion

Elem

ent.

A bi

t set

to v

alue

1 in

dica

tes

that

the

corr

espo

ndin

gIn

form

atio

nEl

emen

t is

a Fl

owKe

y of

the

repo

rted

Flow

. A b

it se

t to

valu

e 0

indi

cate

sth

at th

is is

not

the

case

.

If th

e Da

ta R

ecor

dco

ntai

ns m

ore

than

64 In

form

atio

nEl

emen

ts, t

heco

rres

pond

ing

Tem

plat

e m

ust b

ede

sign

ed s

uch

that

all F

low

Key

s ar

eam

ong

the fir

st 6

4In

form

atio

nEl

emen

ts, b

ecau

seth

eflo

wKe

yInd

icat

oron

ly c

onta

ins

64bi

ts. I

f the

Dat

aRe

cord

con

tain

sle

ss th

an 6

4In

form

atio

nEl

emen

ts, t

hen

the

bits

in th

eflo

wKe

yInd

icat

orfo

r whi

ch n

oco

rres

pond

ing

Info

rmat

ion

Elem

ent e

xist

sm

ust h

ave

the

valu

e 0.

Reference 153

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

17 4po

stM

Cast

Pack

etTo

talC

ount

The

tota

l num

ber

of o

utgo

ing

mul

ticas

t pac

kets

sent

for p

acke

ts o

fth

is F

low

by

am

ultic

ast d

aem

onw

ithin

the

Obs

erva

tion

Dom

ain

sinc

e th

eM

eter

ing

Proc

ess

(re-

)initi

aliz

atio

n.Th

is p

rope

rty

cann

ot n

eces

saril

ybe

obs

erve

d at

the

Obs

erva

tion

Poin

t,bu

t may

be

retr

ieve

d by

oth

erm

eans

.

pac

ket

s


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

17 5po

stM

Cast

Oct

etT

otal

Coun

t

The

tota

l num

ber

of o

ctet

s in

outg

oing

mul

ticas

tpa

cket

s se

nt fo

rpa

cket

s of

this

Flow

by

a m

ultic

ast

daem

on in

the

Obs

erva

tion

Dom

ain

sinc

e th

eM

eter

ing

Proc

ess

(re-

)initi

aliz

atio

n.Th

is p

rope

rty

cann

ot n

eces

saril

ybe

obs

erve

d at

the

Obs

erva

tion

Poin

t,bu

t may

be

retr

ieve

d by

oth

erm

eans

. The

num

ber o

f oct

ets

incl

udes

IPhe

ader

(s) a

nd IP

payl

oad.

oct

ets

17 6ic

mpT

ypeI

Pv4

Type

of t

he IP

v4IC

MP

mes

sage

.

17 7ic

mpC

odeI

Pv4

Code

of t

he IP

v4IC

MP

mes

sage

.

17 8ic

mpT

ypeI

Pv6

Type

of t

he IP

v6IC

MP

mes

sage

.

Reference 155

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

17 9ic

mpC

odeI

Pv6

Code

of t

he IP

v6IC

MP

mes

sage

.

18 0ud

pSou

rce

Port

The

sour

ce p

ort

iden

tifier

in th

eUD

P he

ader

.

18 1ud

pDes

tina

tionP

ort

The

dest

inat

ion

port

iden

tifier

inth

e UD

P he

ader

.

18 2tc

pSou

rceP

ort

The

sour

ce p

ort

iden

tifier

in th

e TC

Phe

ader

.

18 3tc

pDes

tina

tionP

ort

The

dest

inat

ion

port

iden

tifier

inth

e TC

P he

ader

.

18 4tc

pSeq

uen

ceN

um

ber

The

sequ

ence

num

ber i

n th

e TC

Phe

ader

.

18 5tc

pAck

now

ledg

em

entN

um

ber

The

ackn

owle

dgem

ent

num

ber i

n th

e TC

Phe

ader

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

18 6tc

pWin

dow

Size

The

win

dow

field

inth

e TC

P he

ader

. If

the

TCP

win

dow

scal

e is

sup

port

ed,

then

TCP

win

dow

scal

e m

ust b

ekn

own

to fu

llyin

terp

ret t

he v

alue

of th

is in

form

atio

n.

18 7tc

pUrg

ent

Poin

ter

The

urge

nt p

oint

erin

the

TCP

head

er.

Reference 157

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

18 8tc

pHea

der

Leng

thTh

e le

ngth

of t

heTC

P he

ader

. Not

eth

at th

e va

lue

ofth

is In

form

atio

nEl

emen

t is

diffe

rent

from

the

valu

e of

the

Data

Offs

etfie

ld in

the

TCP

head

er. T

he D

ata

Offs

et field

indi

cate

s th

ele

ngth

of t

he T

CPhe

ader

in u

nits

of 4

octe

ts. T

his

Info

rmat

ion

Elem

ents

spe

cifie

sth

e le

ngth

of t

heTC

P he

ader

in u

nits

of o

ctet

s.

oct

ets

18 9ip

Hea

derL

engt

hTh

e le

ngth

of t

he IP

head

er. F

or IP

v6,

the

valu

e of

this

Info

rmat

ion

Elem

ent i

s 40

.

oct

ets

19 0to

talL

engt

hIPv

4Th

e to

tal l

engt

h of

the

IPv4

pac

ket.

oct

ets


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

19 1pa

yloa

dLen

gthI

Pv6

This

Info

rmat

ion

Elem

ent r

epor

tsth

e va

lue

of th

ePa

yloa

d Le

ngth

field

in th

e IP

v6he

ader

. Not

e th

atIP

v6 e

xten

sion

head

ers

belo

ng to

the

payl

oad.

Als

ono

te th

at in

cas

e of

a ju

mbo

pay

load

optio

n th

e va

lue

ofth

e Pa

yloa

d Le

ngth

field

in th

e IP

v6he

ader

is z

ero

and

so w

ill b

e th

e va

lue

repo

rted

by

this

Info

rmat

ion

Elem

ent.

oct

ets

Reference 159

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

19 2ip

TTL

For I

Pv4,

the

valu

eof

the

Info

rmat

ion

Elem

ent m

atch

esth

e va

lue

of th

eTi

me

to L

ive

(TTL

)fie

ld in

the

IPv4

pack

et h

eade

r. Fo

rIP

v6, t

he v

alue

of

the

Info

rmat

ion

Elem

ent m

atch

esth

e va

lue

of th

eH

op L

imit fie

ld in

the

IPv6

pac

ket

head

er.

ho ps

19 3ne

xtH

eade

rIPv

6Th

e va

lue

of th

eN

ext H

eade

r field

of th

e IP

v6 h

eade

r.Th

e va

lue iden

tifies

the

type

of t

hefo

llow

ing

IPv6

exte

nsio

n he

ader

or o

f the

follo

win

gIP

pay

load

. Val

idva

lues

are

defi

ned

in th

e IA

NA

Prot

ocol

Num

bers

regi

stry

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

19 4m

plsP

aylo

adLe

ngt

h

The

size

of t

heM

PLS

pack

etw

ithou

t the

labe

lst

ack.

oct

ets

19 5ip

DiffS

ervC

odeP

oin

t

The

valu

e of

aDi

ffere

ntia

ted

Serv

ices

Cod

ePo

int (

DSCP

)en

code

d in

the

Diffe

rent

iate

dSe

rvic

es field.

The

Diffe

rent

iate

dSe

rvic

es field

span

s th

e m

ost

sign

ifica

nt 6

bits

of

the

IPv4

TO

S fie

ldor

the

IPv6

Traffic

Clas

s fie

ld,

resp

ectiv

ely.

This

Info

rmat

ion

Elem

ent e

ncod

eson

ly th

e 6

bits

of

the

Diffe

rent

iate

dSe

rvic

es field.

Ther

efor

e, it

s va

lue

may

rang

e fr

om 0

to 6

3.

Reference 161

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

19 6ip

Prec

eden

ceTh

e va

lue

of th

e IP

Prec

eden

ce. T

he IP

Prec

eden

ce v

alue

is e

ncod

ed in

the

first

3 b

its o

f the

IPv4

TO

S fie

ld o

rth

e IP

v6 Traffic

Clas

s fie

ld,

resp

ectiv

ely.

This

Info

rmat

ion

Elem

ent e

ncod

eson

ly th

ese

3 bi

ts.

Ther

efor

e, it

s va

lue

may

rang

e fr

om 0

to 7

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

19 7fr

agm

entF

lags

Frag

men

tatio

npr

oper

ties

indi

cate

d by

flag

sin

the

IPv4

pac

ket

head

er o

r the

IPv6

Frag

men

t hea

der,

resp

ectiv

ely.

Bit 0: (RS) Reserved.

The value of this bit must

be 0 until specified

otherwise.

Bit 1: (DF) 0 = May

Fragment, 1 = Don't

Fragment.

Corresponds to the value of

the DF flag in the

IPv4 header. Will always be

0 for IPv6 unless

a "don't fragment" feature

is introduced to IPv6.

Bit 2: (MF) 0 = Last

Fragment, 1 = More Fragments.

Corresponds to the MF flag

in the IPv4 header

or to the M flag in the IPv6

Fragment header,

respectively. The value is

0 for IPv6 if there

is no fragment header.

Bits 3-7: (DC) Don't Care.

The values of these bits are

irrelevant.

0 1 2 3 4 5 6 7

+---+---+---+---+---+---+---

+---+

| R | D | M | D | D | D | D

| D |

| S | F | F | C | C | C | C

| C |

+---+---+---+---+---+---+---

+---+

Reference 163

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

19 8oc

tetD

elta

Sum

Of

Squa

res

The

sum

of t

hesq

uare

d nu

mbe

rsof

oct

ets

per

inco

min

g pa

cket

sinc

e th

e pr

evio

usre

port

(if a

ny) f

orth

is F

low

at t

heO

bser

vatio

n Po

int.

The

num

ber o

foc

tets

incl

udes

IPhe

ader

(s) a

nd IP

payl

oad.

19 9oc

tetT

otal

Sum

Of

Squa

res

The

tota

l sum

of

the

squa

red

num

bers

of o

ctet

sin

inco

min

gpa

cket

s fo

r thi

sFl

ow a

t the

Obs

erva

tion

Poin

tsi

nce

the

Met

erin

gPr

oces

s(r

e-)in

itial

izat

ion

for t

his

Obs

erva

tion

Poin

t. Th

e nu

mbe

rof

oct

ets

incl

udes

IP h

eade

r(s)

and

IPpa

yloa

d.

oct

ets


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

20 0m

plsT

opLa

belT

TL

The

TTL fie

ld fr

omth

e to

p M

PLS

labe

lst

ack

entr

y, th

at is

,th

e la

st la

bel t

hat i

spu

shed

.

ho ps

20 1m

plsL

abel

Stac

kLen

gth

The

leng

th o

f the

MPL

S la

bel s

tack

inun

its o

f oct

ets.

oct

ets

20 2m

plsL

abel

Stac

kDep

th

The

num

ber o

fla

bels

in th

e M

PLS

labe

l sta

ck.

lab

el sta

ck ent

ries

20 3m

plsT

opLa

belE

xp

The

Exp fie

ld fr

omth

e to

p M

PLS

labe

lst

ack

entr

y, th

at is

,th

e la

st la

bel t

hat i

spu

shed

.

Bits 0-4: Don't Care, value

is irrelevant.

Bits 5-7: MPLS Exp field.

0 1 2 3 4 5 6 7

+---+---+---+---+---+---+---

+---+

| don't care |

Exp |

+---+---+---+---+---+---+---

+---+

Reference 165

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

20 4ip

Payl

oadL

engt

hTh

e ef

fect

ive

leng

th o

f the

IPpa

yloa

d.

oct

ets

For I

Pv4

pack

ets,

the

valu

e of

this

Info

rmat

ion

Elem

ent i

s th

edi

ffere

nce

betw

een

the

tota

l len

gth

ofth

e IP

v4 p

acke

t (as

repo

rted

by

Info

rmat

ion

Elem

ent

tota

lLen

gthI

Pv4)

and

the

leng

th o

fth

e IP

v4 h

eade

r (as

repo

rted

by

Info

rmat

ion

Elem

ent

head

erLe

ngth

IPv4

). Fo

r IPv

6, th

e va

lue

of th

e Pa

yloa

dLe

ngth

field

in th

eIP

v6 h

eade

r is

repo

rted

exc

ept i

nth

e ca

se th

at th

eva

lue

of th

is field

isze

ro a

nd th

at th

ere

is a

val

id ju

mbo

payl

oad

optio

n. In

this

cas

e, th

e va

lue

of th

e Ju

mbo

Payl

oad

Leng

thfie

ld in

the

jum

bopa

yloa

d op

tion

isre

port

ed.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

20 5ud

pMes

sag

eLen

gth

The

valu

e of

the

Leng

th field

in th

eUD

P he

ader

.

oct

ets

Reference 167

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

20 6is

Mul

tica

stIf

the

IPde

stin

atio

nad

dres

s is

not

are

serv

ed m

ultic

ast

addr

ess,

then

the

valu

e of

all

bits

of

the

octe

t (in

clud

ing

the

rese

rved

one

s)is

zer

o.

The fir

st b

it of

this

octe

t is

set t

o 1

ifth

e Ve

rsio

n fie

ld o

fth

e IP

hea

der h

asth

e va

lue

4 an

d if

the

Dest

inat

ion

Addr

ess fie

ldco

ntai

ns a

rese

rved

mul

ticas

t add

ress

in th

e ra

nge

from

224.

0.0.

0 to

239.

255.

255.

255.

Oth

erw

ise,

this

bit

is s

et to

0.

The

seco

nd a

ndth

ird b

its o

f thi

soc

tet a

re re

serv

edfo

r fut

ure

use.

The

rem

aini

ng b

itsof

the

octe

t are

only

set

to v

alue

sot

her t

han

zero

ifth

e IP

Des

tinat

ion

Addr

ess

is a

rese

rved

IPv6

mul

ticas

t add

ress

.Th

en th

e fo

urth

bit

of th

e oc

tet i

s se

tto

the

valu

e of

the

T fla

g in

the

IPv6

mul

ticas

t add

ress

and

the

rem

aini

ngfo

ur b

its a

re s

et to

the

valu

e of

the

scop

e fie

ld in

the

IPv6

mul

ticas

tad

dres

s.

0 1 2 3

4 5 6 7

+------+------+------+------

+------+------+------+------+

| IPv6 multicast scope

| T | RES. | RES. | MCv4 |

+------+------+------+------

+------+------+------+------+

Bits 0-3: set to value of

multicast scope if IPv6

multicast

Bit 4: set to value of T

flag, if IPv6 multicast

Bits 5-6: reserved for

future use

Bit 7: set to 1 if IPv4

multicast


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

20 7ip

v4IH

LTh

e va

lue

of th

eIn

tern

et H

eade

rLe

ngth

(IH

L) field

inth

e IP

v4 h

eade

r. It

spec

ifies

the

leng

thof

the

head

er in

units

of 4

oct

ets.

Plea

se n

ote

that

its

unit

is d

iffer

ent

from

mos

t of t

heot

her I

nfor

mat

ion

Elem

ents

repo

rtin

gle

ngth

val

ues.

4 oct

ets

Reference 169

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

20 8ip

v4O

pti

ons

IPv4

opt

ions

inpa

cket

s of

this

Flow

. The

info

rmat

ion

isen

code

d in

a s

et o

fbi

t fields

. For

eac

hva

lid IP

v4 o

ptio

nty

pe, t

here

is a

bit

in th

is s

et. T

he b

itis

set

to 1

if a

nyob

serv

ed p

acke

t of

this

Flo

w c

onta

ins

the

corr

espo

ndin

gIP

v4 o

ptio

n ty

pe.

Oth

erw

ise,

if n

oob

serv

ed p

acke

t of

this

Flo

w c

onta

ined

the

resp

ectiv

e IP

v4op

tion

type

, the

valu

e of

the

corr

espo

ndin

g bi

tis

0.

The

list o

f val

idIP

v4 o

ptio

ns is

mai

ntai

ned

byIA

NA.

Not

e th

at fo

rid

entif

ying

an

optio

n no

t jus

t the

5-bi

t Opt

ion

Num

ber,

but a

ll 8

bits

of t

he O

ptio

nTy

pe n

eed

tom

atch

one

of t

heIP

v4 o

ptio

nssp

ecified

at h

ttp:

//w

ww

.iana

.org

/as

sign

men

ts/ip

-pa

ram

eter

s.

Opt

ions

are

map

ped

to b

itsac

cord

ing

to th

eir

optio

n nu

mbe

rs.

Opt

ion

num

ber X

ism

appe

d to

bit

X.Th

e m

appi

ng is

illus

trat

ed b

y th

efig

ure

belo

w.

0 1 2 3

4 5 6 7

+------+------+------+------

+------+------+------+------+

... | RR |CIPSO |E-SEC |

TS | LSR | SEC | NOP |

EOOL |

+------+------+------+------

+------+------+------+------+

8 9 10 11

12 13 14 15

+------+------+------+------

+------+------+------+------+

... |ENCODE| VISA | FINN |

MTUR | MTUP | ZSU | SSR |

SID | ...

+------+------+------+------

+------+------+------+------+

16 17 18 19

20 21 22 23

+------+------+------+------

+------+------+------+------+

... | DPS |NSAPA | SDB |

RTRALT|ADDEXT| TR | EIP |

IMITD | ...

+------+------+------+------

+------+------+------+------+

24 25 26 27

28 29 30 31

+------+------+------+------

+------+------+------+------+

| | EXP | to be

assigned by IANA | QS |

UMP | ...

+------+------+------+------

+------+------+------+------+

Type Option

Bit Value Name Reference

---+-----+-------

+----------------------------

--------

0 7 RR Record

Route, RFC 791

1 134 CIPSO Commercial

Security

2 133 E-SEC Extended

Security, RFC 1108

3 68 TS Time

Stamp, RFC 791

4 131 LSR Loose

Source Route, RFC791

5 130 SEC Security,

RFC 1108

6 1 NOP No

Operation, RFC 791

7 0 EOOL End of

Options List, RFC 791

8 15 ENCODE

9 142 VISA

Experimental Access Control

10 205 FINN

Experimental Flow Control

11 12 MTUR

(obsoleted) MTU Reply, RFC

1191

12 11 MTUP

(obsoleted) MTU Probe, RFC

1191

13 10 ZSU

Experimental Measurement

14 137 SSR Strict

Source Route, RFC 791

15 136 SID Stream

ID, RFC 791

16 151 DPS Dynamic

Packet State

17 150 NSAPA NSAP

Address

18 149 SDB Selective

Directed Broadcast

19 147 ADDEXT Address

Extension

20 148 RTRALT Router

Alert, RFC 2113

21 82 TR

Traceroute, RFC 3193

22 145 EIP Extended

Internet Protocol, RFC 1385

23 144 IMITD IMI

Traffic Descriptor

25 30 EXP RFC3692-

style Experiment

25 94 EXP RFC3692-

style Experiment

25 158 EXP RFC3692-

style Experiment

25 222 EXP RFC3692-

style Experiment

30 25 QS Quick-

Start

31 152 UMP Upstream

Multicast Pkt.

... ... ... Further

options numbers

may be assigned by IANA


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

20 9tc

pOpt

ions

TCP

optio

ns in

pack

ets

of th

isFl

ow. T

hein

form

atio

n is

enco

ded

in a

set

of

bit fi

elds

. For

eac

hTC

P op

tion,

ther

e is

a bi

t in

this

set

. The

bit i

s se

t to

1 if

any

obse

rved

pac

ket o

fth

is F

low

con

tain

sth

e co

rres

pond

ing

TCP

optio

n.O

ther

wis

e, if

no

obse

rved

pac

ket o

fth

is F

low

con

tain

edth

e re

spec

tive

TCP

optio

n, th

e va

lue

ofth

e co

rres

pond

ing

bit i

s 0.

Opt

ions

are

map

ped

to b

itsac

cord

ing

to th

eir

optio

n nu

mbe

rs.

Opt

ion

num

ber X

ism

appe

d to

bit

X.TC

P op

tion

num

bers

are

mai

ntai

ned

byIA

NA.

0 1 2 3

4 5 6 7

+-----+-----+-----+-----

+-----+-----+-----+-----+

| 7 | 6 | 5 | 4 |

3 | 2 | 1 | 0 | ...

+-----+-----+-----+-----

+-----+-----+-----+-----+

8 9 10 11 12

13 14 15

+-----+-----+-----+-----

+-----+-----+-----+-----+

... | 15 | 14 | 13 | 12

| 11 | 10 | 9 | 8 |...

+-----+-----+-----+-----

+-----+-----+-----+-----+

16 17 18 19

20 21 22 23

+-----+-----+-----+-----

+-----+-----+-----+-----+

... | 23 | 22 | 21 | 20

| 19 | 18 | 17 | 16 |...

+-----+-----+-----+-----

+-----+-----+-----+-----+

. . .

56 57 58 59

60 61 62 63

+-----+-----+-----+-----

+-----+-----+-----+-----+

... | 63 | 62 | 61 | 60

| 59 | 58 | 57 | 56 |

+-----+-----+-----+-----

+-----+-----+-----+-----+

Reference 171

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

21 0pa

ddin

gO

ctet

sTh

e va

lue

of th

isIn

form

atio

nEl

emen

t is

alw

ays

ase

quen

ce o

f 0x0

0va

lues

.

21 1co

llect

orIP

v4Ad

dre

ss

An IP

v4 a

ddre

ss to

whi

ch th

eEx

port

ing

Proc

ess

send

s Fl

owin

form

atio

n.

21 2co

llect

orIP

v6Ad

dre

ss

An IP

v6 a

ddre

ss to

whi

ch th

eEx

port

ing

Proc

ess

send

s Fl

owin

form

atio

n.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

21 3ex

port

Inte

rfac

eTh

e in

dex

of th

ein

terf

ace

from

whi

ch IP

FIX

Mes

sage

s se

nt b

yth

e Ex

port

ing

Proc

ess

to a

Colle

ctor

leav

e th

eIP

FIX

Devi

ce. T

heva

lue

mat

ches

the

valu

e of

man

aged

obje

ct 'i

fInd

ex' a

sde

fined

in[R

FC28

63].

Not

eth

at if

Inde

x va

lues

are

not a

ssig

ned

stat

ical

ly to

an

inte

rfac

e an

d th

atth

e in

terf

aces

may

be re

num

bere

dev

ery

time

the

devi

ce's

man

agem

ent

syst

em is

re-

initi

aliz

ed, a

ssp

ecified

in[R

FC28

63].

Reference 173

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

21 4ex

port

Prot

ocol

Vers

ion

The

prot

ocol

vers

ion

used

by

the

Expo

rtin

g Pr

oces

sfo

r sen

ding

Flo

win

form

atio

n. T

hepr

otoc

ol v

ersi

on is

give

n by

the

valu

eof

the

Vers

ion

Num

ber fi

eld

in th

eM

essa

ge H

eade

r.

The

prot

ocol

vers

ion

is 1

0 fo

rIP

FIX

and

9 fo

rN

etFl

ow v

ersi

on 9

.A

valu

e of

0in

dica

tes

that

no

expo

rt p

roto

col i

sin

use

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

21 5ex

port

Tran

spor

tPro

toco

l

The

valu

e of

the

prot

ocol

num

ber

used

by

the

Expo

rtin

g Pr

oces

sfo

r sen

ding

Flo

win

form

atio

n. T

hepr

otoc

ol n

umbe

riden

tifies

the

IPpa

cket

pay

load

type

. Pro

toco

lnu

mbe

rs a

rede

fined

in th

e IA

NA

Prot

ocol

Num

bers

regi

stry

.

In In

tern

etPr

otoc

ol v

ersi

on 4

(IPv

4), t

his

isca

rrie

d in

the

Prot

ocol

field.

InIn

tern

et P

roto

col

vers

ion

6 (I

Pv6)

,th

is is

car

ried

in th

eN

ext H

eade

r field

in th

e la

stex

tens

ion

head

erof

the

pack

et.

Reference 175

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

21 6co

llect

orTr

ansp

ortP

ort

The

dest

inat

ion

port

iden

tifier

tow

hich

the

Expo

rtin

g Pr

oces

sse

nds

Flow

info

rmat

ion.

For

the

tran

spor

tpr

otoc

ols

UDP,

TCP

,an

d SC

TP, t

his

isth

e de

stin

atio

npo

rt n

umbe

r. Th

isfie

ld M

AY a

lso

beus

ed fo

r fut

ure

tran

spor

t pro

toco

lsth

at h

ave

16-b

itso

urce

por

tiden

tifiers.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

21 7ex

port

erTr

ansp

ortP

ort

The

sour

ce p

ort

iden

tifier

from

whi

ch th

eEx

port

ing

Proc

ess

send

s Fl

owin

form

atio

n. F

orth

e tr

ansp

ort

prot

ocol

s UD

P, T

CP,

and

SCTP

, thi

s is

the

sour

ce p

ort

num

ber.

This

field

MAY

als

o be

use

dfo

r fut

ure

tran

spor

tpr

otoc

ols

that

hav

e16

-bit

sour

ce p

ort

iden

tifiers.

Thi

sfie

ld m

ay b

e us

eful

for d

istin

guis

hing

mul

tiple

Exp

ortin

gPr

oces

ses

that

use

the

sam

e IP

addr

ess.

21 8tc

pSyn

Tot

alCo

unt

The

tota

l num

ber

of p

acke

ts o

f thi

sFl

ow w

ith T

CP"S

ynch

roni

zese

quen

cenu

mbe

rs" (

SYN

)fla

g se

t.

pac

ket

s

Reference 177

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

21 9tc

pFin

Tota

lCou

ntTh

e to

tal n

umbe

rof

pac

kets

of t

his

Flow

with

TCP

"No

mor

e da

ta fr

omse

nder

" (FI

N) f

lag

set.

pac

ket

s

22 0tc

pRst

Tota

lCou

ntTh

e to

tal n

umbe

rof

pac

kets

of t

his

Flow

with

TCP

"Res

et th

eco

nnec

tion"

(RST

)fla

g se

t.

pac

ket

s

22 1tc

pPsh

Tot

alCo

unt

The

tota

l num

ber

of p

acke

ts o

f thi

sFl

ow w

ith T

CP"P

ush

Func

tion"

(PSH

) fla

g se

t.

pac

ket

s

22 2tc

pAck

Tot

alCo

unt

The

tota

l num

ber

of p

acke

ts o

f thi

sFl

ow w

ith T

CP"A

ckno

wle

dgm

ent

field

signific

ant"

(ACK

) fla

g se

t.

pac

ket

s

22 3tc

pUrg

Tota

lCou

ntTh

e to

tal n

umbe

rof

pac

kets

of t

his

Flow

with

TCP

"Urg

ent P

oint

erfie

ld signific

ant"

(URG

) fla

g se

t.

pac

ket

s


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

22 4ip

Tota

lLe

ngth

The

tota

l len

gth

ofth

e IP

pac

ket.

oct

ets

22 5po

stN

ATSo

urce

IPv

4Add

res

s

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'sou

rceI

Pv4A

ddre

ss',

exc

ept t

hat i

tre

port

s a mod

ified

valu

e ca

used

by

aN

AT m

iddl

ebox

func

tion

afte

r the

pack

et p

asse

d th

eO

bser

vatio

n Po

int.

Reference 179

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

22 6po

stN

ATDe

stin

ati

onIP

v4A

ddre

ss

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'des

tinat

ionI

Pv4A

ddr

ess',

exc

ept t

hat

it re

port

s a

mod

ified

val

ueca

used

by

a N

ATm

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

22 7po

stN

APTS

ourc

eTr

ansp

ortP

ort

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'sou

rceT

rans

port

Port

', exc

ept t

hat i

tre

port

s a mod

ified

valu

e ca

used

by

aN

etw

ork

Addr

ess

Port

Tra

nsla

tion

(NAP

T) m

iddl

ebox

func

tion

afte

r the

pack

et p

asse

d th

eO

bser

vatio

n Po

int.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

22 8po

stN

APTD

estin

atio

nTra

nsp

ortP

ort

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'des

tinat

ionT

rans

port

Port

', exc

ept t

hat

it re

port

s a

mod

ified

val

ueca

used

by

aN

etw

ork

Addr

ess

Port

Tra

nsla

tion

(NAP

T) m

iddl

ebox

func

tion

afte

r the

pack

et p

asse

d th

eO

bser

vatio

n Po

int.

Reference 181

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

22 9na

tOrig

ina

tingA

ddr

essR

eal

m

Indi

cate

s w

heth

erth

e se

ssio

n is

crea

ted

beca

use

traffic

orig

inat

ed in

the

priv

ate

orpu

blic

add

ress

real

m.

post

NAT

Sour

ceIP

v4A

ddre

ss,

post

NAT

Dest

inat

ionI

Pv4A

ddre

ss,

post

NAP

TSou

rceT

ran

spor

tPor

t, an

dpo

stN

APTD

estin

ati

onTr

ansp

ortP

ort

are qu

alified

with

the

addr

ess

real

min

per

spec

tive.

The

allo

wed

val

ues

are:

Priv

ate:

1

Publ

ic: 2


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

23 0na

tEve

ntTh

is In

form

atio

nEl

emen

t ide

ntifies

a N

AT e

vent

. Thi

sIE

iden

tifies

the

type

of a

NAT

even

t. Ex

ampl

es o

fN

AT e

vent

sin

clud

e, b

ut a

re n

otlim

ited

to, N

ATtr

ansl

atio

n cr

eate

,N

AT tr

ansl

atio

nde

lete

, Thr

esho

ldRe

ache

d, o

rTh

resh

old

Exce

eded

, etc

.Va

lues

for t

his

Info

rmat

ion

Elem

ent a

re li

sted

in th

e N

AT E

vent

Type

regi

stry

, see

[http://

www.ia

na.org/

assign

men

ts/ip

fix/

ipfix

.xml#

ipfix

-nat-

even

t-type

]. N

ewas

sign

men

ts o

fva

lues

will

be

adm

inis

tere

d by

IAN

A an

d ar

esu

bjec

t to

Expe

rtRe

view

[RFC

8126

].Ex

pert

s ne

ed to

chec

k de

finition

s of

new

val

ues

for

com

plet

enes

s,ac

cura

cy, a

ndre

dund

ancy

.

Reference 183

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

23 1in

itiat

orO

ctet

sTh

e to

tal n

umbe

rof

laye

r 4 p

aylo

adby

tes

in a

flow

from

the

initi

ator

. The

initi

ator

is th

ede

vice

whi

chtr

igge

red

the

sess

ion

crea

tion,

and

rem

ains

the

sam

e fo

r the

life

of

the

sess

ion.

oct

ets

23 2re

spon

der

Oct

ets

The

tota

l num

ber

of la

yer 4

pay

load

byte

s in

a fl

ow fr

omth

e re

spon

der.

The

resp

onde

r is

the

devi

ce w

hich

repl

ies

to th

ein

itiat

or, a

ndre

mai

ns th

e sa

me

for t

he li

fe o

f the

sess

ion.

oct

ets


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

23 3fir

ewallE

vent

Indi

cate

s a fir

ewall

even

t. Th

e al

low

edva

lues

are

:

0 - I

gnor

e (in

valid

)

1 - F

low

Cre

ated

2 - F

low

Del

eted

3 - F

low

Den

ied

4 - F

low

Ale

rt

5 - F

low

Upd

ate

23 4in

gres

sVRF

IDAn

uni

que iden

tifier

of th

e VR

Fnam

ew

here

the

pack

ets

of th

is fl

ow a

rebe

ing

rece

ived

.Th

is id

entifi

er is

uniq

ue p

erM

eter

ing

Proc

ess

23 5eg

ress

VRF

IDAn

uni

que iden

tifier

of th

e VR

Fnam

ew

here

the

pack

ets

of th

is fl

ow a

rebe

ing

sent

. Thi

siden

tifier

is u

niqu

epe

r Met

erin

gPr

oces

s

Reference 185

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

23 6VR

Fnam

eTh

e na

me

of a

VPN

Rout

ing

and

Forw

ardi

ng ta

ble

(VRF

).

23 7po

stM

plsT

opLa

bel

Exp

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'mpl

sTop

Labe

lExp

',ex

cept

that

itre

port

s a

pote

ntia

llymod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

23 8tc

pWin

dow

Scal

eTh

e sc

ale

of th

ew

indo

w field

in th

eTC

P he

ader

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

23 9bi

flow

Dir

ectio

nA

desc

riptio

n of

the

dire

ctio

nas

sign

men

tm

etho

d us

ed to

assi

gn th

e Bi

flow

Sour

ce a

ndDe

stin

atio

n. T

his

Info

rmat

ion

Elem

ent M

AY b

epr

esen

t in

a Fl

owDa

ta R

ecor

d, o

rap

plie

d to

all

flow

sex

port

ed fr

om a

nEx

port

ing

Proc

ess

or O

bser

vatio

nDo

mai

n us

ing

IPFI

X O

ptio

ns. I

fth

is In

form

atio

nEl

emen

t is

not

pres

ent i

n a

Flow

Reco

rd o

ras

soci

ated

with

aBi

flow

via

sco

pe, i

tis

ass

umed

that

the

confi

guratio

n of

the

dire

ctio

nas

sign

men

tm

etho

d is

don

eou

t-of

-ban

d. N

ote

that

whe

n us

ing

IPFI

X O

ptio

ns to

appl

y th

isIn

form

atio

nEl

emen

t to

all

flow

s w

ithin

an

Obs

erva

tion

Dom

ain

or fr

om a

nEx

port

ing

Proc

ess,

the

Opt

ion

mus

t be

sent

relia

bly.

Ifre

liabl

e tr

ansp

ort i

sno

t ava

ilabl

e (t

hat

is, w

hen

usin

gUD

P), t

his

Info

rmat

ion

Elem

ent m

ust

appe

ar in

eac

hFl

ow R

ecor

d. T

his

field

may

take

the

follo

win

g va

lues

:

+-------+------------------

+----------------------------

------------+

| Value | Name |

Description

|

+-------+------------------

+----------------------------

------------+

| 0x00 | arbitrary |

Direction is assigned

arbitrarily. |

| 0x01 | initiator |

The Biflow Source is the

flow |

| | |

initiator, as determined by

the |

| | |

Metering Process' best

effort to |

| | |

detect the

initiator. |

| 0x02 | reverseInitiator |

The Biflow Destination is

the flow |

| | |

initiator, as determined by

the |

| | |

Metering Process' best

effort to |

| | |

detect the initiator. This

value is |

| | |

provided for the convenience

of |

| | |

Exporting Processes to

revise an |

| | |

initiator estimate without

re-encoding |

| | |

the Biflow

Record. |

| 0x03 | perimeter |

The Biflow Source is the

endpoint |

| | |

outside of a defined

perimeter. The |

| | |

perimeter's definition is

implicit in |

| | |

the set of Biflow Source and

Biflow |

| | |

Destination addresses

exported in the |

| | |

Biflow

Records.

|

+-------+------------------

+----------------------------

------------+

Reference 187

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

24 0et

hern

etH

eade

rLen

gth

The

diffe

renc

ebe

twee

n th

e le

ngth

of a

n Et

hern

etfr

ame

(min

us th

eFC

S) a

nd th

e le

ngth

of it

s M

AC C

lient

Data

sec

tion

(incl

udin

g an

ypa

ddin

g) a

sde

fined

in s

ectio

n3.

1 of

[IEE

E.80

2-3.

2005

].It

doe

s no

t inc

lude

the

Prea

mbl

e, S

FDan

d Ex

tens

ion fie

ldle

ngth

s.

oct

ets

24 1et

hern

etPa

yloa

dLe

ngth

The

leng

th o

f the

MAC

Clie

nt D

ata

sect

ion

(incl

udin

gan

y pa

ddin

g) o

f afr

ame

as defi

ned

inse

ctio

n 3.

1 of

[IEE

E.80

2-3.

2005

].

oct

ets


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

24 2et

hern

etTo

talL

engt

h

The

tota

l len

gth

ofth

e Et

hern

et fr

ame

(exc

ludi

ng th

ePr

eam

ble,

SFD

,Ex

tens

ion

and

FCS

fields)

as

desc

ribed

in s

ectio

n 3.

1 of

[IEE

E.80

2-3.

2005

].

oct

ets

Reference 189

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

24 3do

t1qV

lanI

dTh

e va

lue

of th

e12

-bit

VLAN

Iden

tifier

por

tion

ofth

e Ta

g Co

ntro

lIn

form

atio

n fie

ld o

fan

Eth

erne

t fra

me.

The

stru

ctur

e an

dse

man

tics

with

inth

e Ta

g Co

ntro

lIn

form

atio

n fie

ldar

e de

fined

in[I

EEE8

02.1

Q].

InPr

ovid

er B

ridge

dN

etw

orks

, it

repr

esen

ts th

eSe

rvic

e VL

ANiden

tifier

in th

eSe

rvic

e VL

AN T

ag(S

-TAG

) Tag

Con

trol

Info

rmat

ion

(TCI

)fie

ld o

r the

Cust

omer

VLA

Niden

tifier

in th

eCu

stom

er V

LAN

Tag

(C-T

AG) T

agCo

ntro

lIn

form

atio

n (T

CI)

field

as

desc

ribed

in [I

EEE8

02.1

Q].

InPr

ovid

er B

ackb

one

Brid

ged

Net

wor

ks,

it re

pres

ents

the

Back

bone

VLA

Niden

tifier

in th

eBa

ckbo

ne V

LAN

Tag

(B-T

AG) T

agCo

ntro

lIn

form

atio

n (T

CI)

field

as

desc

ribed

in [I

EEE8

02.1

Q].

Ina

virt

ual l

ink

betw

een

a ho

stsy

stem

and

EVB

brid

ge, i

tre

pres

ents

the

Serv

ice

VLAN

iden

tifier

indi

catin

gS-

chan

nel.

In th

e ca

se o

f am

ulti-

tagg

edfr

ame,

it re

pres

ents

the

oute

r tag

'sVL

AN id

entifi

er,

exce

pt fo

r I-T

AG.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

24 4do

t1qP

rior

ityTh

e va

lue

of th

e 3-

bit U

ser P

riorit

ypo

rtio

n of

the

Tag

Cont

rol

Info

rmat

ion fie

ld o

fan

Eth

erne

t fra

me.

The

stru

ctur

e an

dse

man

tics

with

inth

e Ta

g Co

ntro

lIn

form

atio

n fie

ldar

e de

fined

in[I

EEE8

02.1

Q].

Inth

e ca

se o

f mul

ti-ta

gged

fram

e, it

repr

esen

ts th

e 3-

bit P

riorit

y Co

dePo

int (

PCP)

por

tion

of th

e ou

ter t

ag's

Tag

Cont

rol

Info

rmat

ion

(TCI

)fie

ld.

24 5do

t1qC

ust

omer

Vlan

Id

The

valu

ere

pres

ents

the

Cust

omer

VLA

Niden

tifier

in th

eCu

stom

er V

LAN

Tag

(C-T

AG) T

agCo

ntro

lIn

form

atio

n (T

CI)

field.

Reference 191

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

24 6do

t1qC

ust

omer

Prio

rity

The

valu

ere

pres

ents

the

3-bi

t Prio

rity

Code

Poin

t (PC

P) p

ortio

nof

the

Cust

omer

VLAN

Tag

(C-T

AG)

Tag

Cont

rol

Info

rmat

ion

(TCI

)fie

ld.

24 7m

etro

EvcI

dTh

e EV

C Se

rvic

eAt

trib

ute

whi

chun

ique

ly id

entifi

esth

e Et

hern

et V

irtua

lCo

nnec

tion

(EVC

)w

ithin

a M

etro

Ethe

rnet

Net

wor

k,as

defi

ned

inse

ctio

n 6.

2 of

MEF

10.1

. The

Met

roEV

CID

isen

code

d in

a s

trin

gof

up

to 1

00ch

arac

ters

.

24 8m

etro

EvcT

ype

The

3-bi

t EVC

Serv

ice

Attr

ibut

ew

hich

iden

tifies

the

type

of s

ervi

cepr

ovid

ed b

y an

EVC.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

24 9ps

eudo

Wire

IdA

32-b

it no

n-ze

roco

nnec

tion

iden

tifier, w

hich

toge

ther

with

the

pseu

doW

ireTy

pe,

iden

tifies

the

Pseu

do W

ire (P

W)

as defi

ned

in[R

FC80

77].

25 0ps

eudo

Wire

Typ

e

The

valu

e of

this

info

rmat

ion

elem

ent ide

ntifies

the

type

of M

PLS

Pseu

do W

ire (P

W).

25 1ps

eudo

Wire

Con

trol

Wor

d

The

32-b

itPr

efer

red

Pseu

doW

ire (P

W) M

PLS

Cont

rol W

ord

25 2in

gres

sPhy

sica

lInt

erfa

ce

The

inde

x of

ane

twor

king

devi

ce's

phy

sica

lin

terf

ace

(exa

mpl

e,a

switc

h po

rt)

whe

re p

acke

ts o

fth

is fl

ow a

re b

eing

rece

ived

.

Reference 193

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

25 3eg

ress

Phy

sica

lInt

erfa

ce

The

inde

x of

ane

twor

king

devi

ce's

phy

sica

lin

terf

ace

(exa

mpl

e,a

switc

h po

rt)

whe

re p

acke

ts o

fth

is fl

ow a

re b

eing

sent

.

25 4po

stDo

t1q

Vlan

Id

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'dot

1qVl

anId

',ex

cept

that

itre

port

s a

pote

ntia

llymod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

25 5po

stDo

t1q

Cust

om

erVl

anId

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'dot

1qCu

stom

erVl

anI

d', e

xcep

t tha

t it

repo

rts

apo

tent

ially

mod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

25 6et

hern

etTy

peTh

e Et

hern

et ty

pefie

ld o

f an

Ethe

rnet

fram

e th

atiden

tifies

the

MAC

clie

nt p

roto

col

carr

ied

in th

epa

yloa

d.

Reference 195

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

25 7po

stIp

Prec

eden

ce

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'ipPr

eced

ence

',ex

cept

that

itre

port

s a

pote

ntia

llymod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

25 8co

llect

ionT

imeM

illi

seco

nds

The

abso

lute

times

tam

p at

whi

ch th

e da

taw

ithin

the

scop

eco

ntai

ning

this

Info

rmat

ion

Elem

ent i

s re

ceiv

edby

a C

olle

ctin

gPr

oces

s. T

his

Info

rmat

ion

Elem

ent m

ust b

ebo

und

to it

sco

ntai

ning

IPFI

XM

essa

ge v

ia IP

FIX

Opt

ions

and

the

mes

sage

Scop

eIn

form

atio

nEl

emen

t, as

defin

ed b

elow

.

mill

ise

con

ds

Reference 197

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

25 9ex

port

Sctp

Stre

am

Id

The

valu

e of

the

SCTP

Str

eam

Iden

tifier

use

d by

the

Expo

rtin

gPr

oces

s fo

rex

port

ing

IPFI

XM

essa

ge d

ata.

Thi

sis

car

ried

in th

eSt

ream

Iden

tifier

field

of t

he h

eade

rof

the

SCTP

DAT

Ach

unk

cont

aini

ngth

e IP

FIX

Mes

sage

(s).

26 0m

axEx

por

tSec

onds

The

abso

lute

Expo

rt T

ime

of th

ela

test

IPFI

XM

essa

ge w

ithin

the

scop

e co

ntai

ning

this

Info

rmat

ion

Elem

ent.

This

Info

rmat

ion

Elem

ent m

ust b

ebo

und

to it

sco

ntai

ning

IPFI

XTr

ansp

ort S

essi

onvi

a IP

FIX

Opt

ions

and

the

sess

ionS

cope

Info

rmat

ion

Elem

ent.

sec

on ds


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

26 1m

axFl

ow

EndS

eco

nds

The

late

st a

bsol

ute

times

tam

p of

the

last

pac

ket w

ithin

any

Flow

with

in th

esc

ope

cont

aini

ngth

is In

form

atio

nEl

emen

t, ro

unde

dup

to th

e se

cond

ifne

cess

ary.

Thi

sIn

form

atio

nEl

emen

t mus

t be

boun

d to

its

cont

aini

ng IP

FIX

Tran

spor

t Ses

sion

via

IPFI

X O

ptio

nsan

d th

ese

ssio

nSco

peIn

form

atio

nEl

emen

t.

sec

on ds

Reference 199

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

26 2m

essa

geM

D5Ch

eck

sum

The

MD5

che

cksu

mof

the

IPFI

XM

essa

geco

ntai

ning

this

reco

rd. T

his

Info

rmat

ion

Elem

ent m

ust b

ebo

und

to it

sco

ntai

ning

IPFI

XM

essa

ge v

ia a

nop

tions

reco

rd a

ndth

e m

essa

geSc

ope

Info

rmat

ion

Elem

ent,

asde

fined

bel

ow, a

ndm

ust a

ppea

r onl

yon

ce in

a g

iven

IPFI

X M

essa

ge. T

oca

lcul

ate

the

valu

eof

this

Info

rmat

ion

Elem

ent, fir

stbu

ffer t

heco

ntai

ning

IPFI

XM

essa

ge, s

ettin

gth

e va

lue

of th

isIn

form

atio

nEl

emen

t to

all

zero

es. T

hen

calc

ulat

e th

e M

D5ch

ecks

um o

f the

resu

lting

buf

fer a

sde

fined

in[R

FC13

21],

plac

eth

e re

sulti

ng v

alue

in th

is In

form

atio

nEl

emen

t, an

dex

port

the

buffe

red

mes

sage

. Thi

sIn

form

atio

nEl

emen

t is

inte

nded

as

asi

mpl

e ch

ecks

umon

ly; t

here

fore

colli

sion

resi

stan

cean

d al

gorit

hmag

ility

are

not

requ

ired,

and

MD5

is a

n ap

prop

riate

mes

sage

dig

est.

This

Info

rmat

ion

Elem

ent h

as a

fixe

dle

ngth

of 1

6 oc

tets

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

26 3m

essa

geSc

ope

The

pres

ence

of

this

Info

rmat

ion

Elem

ent a

s sc

ope

in a

n O

ptio

nsTe

mpl

ate sign

ifies

that

the

optio

nsde

scrib

ed b

y th

eTe

mpl

ate

appl

y to

the

IPFI

X M

essa

geth

at c

onta

ins

them

.It

is defi

ned

for

gene

ral p

urpo

sem

essa

ge s

copi

ng o

fop

tions

, and

prop

osed

spec

ifica

lly to

allo

wth

e at

tach

men

t ach

ecks

um to

am

essa

ge v

ia IP

FIX

Opt

ions

. The

val

ueof

this

Info

rmat

ion

Elem

ent m

ust b

ew

ritte

n as

0 b

y th

eFi

le W

riter

or

Expo

rtin

g Pr

oces

s.Th

e va

lue

of th

isIn

form

atio

nEl

emen

t mus

t be

igno

red

by th

e Fi

leRe

ader

or t

heCo

llect

ing

Proc

ess.

Reference 201

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

26 4m

inEx

port

Seco

nds

The

abso

lute

Expo

rt T

ime

of th

eea

rlies

t IPF

IXM

essa

ge w

ithin

the

scop

e co

ntai

ning

this

Info

rmat

ion

Elem

ent.

This

Info

rmat

ion

Elem

ent m

ust b

ebo

und

to it

sco

ntai

ning

IPFI

XTr

ansp

ort S

essi

onvi

a an

opt

ions

reco

rd a

nd th

ese

ssio

nSco

peIn

form

atio

nEl

emen

t.

sec

on ds


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

26 5m

inFl

owSt

artS

econ

ds

The

earli

est

abso

lute

times

tam

p of

the

first

pac

ket w

ithin

any

Flow

with

in th

esc

ope

cont

aini

ngth

is In

form

atio

nEl

emen

t, ro

unde

ddo

wn

to th

e se

cond

if ne

cess

ary.

Thi

sIn

form

atio

nEl

emen

t mus

t be

boun

d to

its

cont

aini

ng IP

FIX

Tran

spor

t Ses

sion

via

an o

ptio

nsre

cord

and

the

sess

ionS

cope

Info

rmat

ion

Elem

ent.

sec

on ds

Reference 203

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

26 6op

aque

Oct

ets

This

Info

rmat

ion

Elem

ent i

s us

ed to

enca

psul

ate

non-

IPFI

X da

ta in

to a

nIP

FIX

Mes

sage

stre

am, f

or th

epu

rpos

e of

allo

win

ga

non-

IPFI

X da

tapr

oces

sor t

o st

ore

a da

ta s

trea

min

line

with

in a

nIP

FIX

File

. ACo

llect

ing

Proc

ess

or F

ile W

riter

mus

tN

OT

try

to in

terp

ret

this

bin

ary

data

.Th

is In

form

atio

nEl

emen

t diff

ers

from

padd

ingO

ctet

s as

its c

onte

nts

are

mea

ning

ful i

n so

me

non-

IPFI

X co

ntex

t,w

hile

the

cont

ents

of p

addi

ngO

ctet

sm

ust b

e 0x

00 a

ndar

e in

tend

ed o

nly

for I

nfor

mat

ion

Elem

ent a

lignm

ent.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

26 7se

ssio

nSco

peTh

e pr

esen

ce o

fth

is In

form

atio

nEl

emen

t as

scop

ein

an

Opt

ions

Tem

plat

e sign

ifies

that

the

optio

nsde

scrib

ed b

y th

eTe

mpl

ate

appl

y to

the

IPFI

XTr

ansp

ort S

essi

onth

at c

onta

ins

them

.N

ote

that

as

all

optio

ns a

reim

plic

itly

scop

ed to

Tran

spor

t Ses

sion

and

Obs

erva

tion

Dom

ain,

this

Info

rmat

ion

Elem

ent i

seq

uiva

lent

to a

"nul

l" s

cope

. It i

sde

fined

for g

ener

alpu

rpos

e se

ssio

nsc

opin

g of

opt

ions

,an

d pr

opos

edsp

ecifica

lly to

allo

wth

e at

tach

men

t of

time

win

dow

to a

nIP

FIX

File

via

IPFI

XO

ptio

ns. T

he v

alue

of th

is In

form

atio

nEl

emen

t mus

t be

writ

ten

as 0

by

the

File

Writ

er o

rEx

port

ing

Proc

ess.

The

valu

e of

this

Info

rmat

ion

Elem

ent m

ust b

eig

nore

d by

the

File

Read

er o

r the

Colle

ctin

g Pr

oces

s.

Reference 205

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

26 8m

axFl

ow

EndM

icro

seco

nds

The

late

st a

bsol

ute

times

tam

p of

the

last

pac

ket w

ithin

any

Flow

with

in th

esc

ope

cont

aini

ngth

is In

form

atio

nEl

emen

t, ro

unde

dup

to th

em

icro

seco

nd if

nece

ssar

y. T

his

Info

rmat

ion

Elem

ent m

ust b

ebo

und

to it

sco

ntai

ning

IPFI

XTr

ansp

ort S

essi

onvi

a IP

FIX

Opt

ions

and

the

sess

ionS

cope

Info

rmat

ion

Elem

ent.

This

Info

rmat

ion

Elem

ent m

ust b

eus

ed o

nly

inTr

ansp

ort S

essi

ons

cont

aini

ng F

low

Reco

rds

with

mic

rose

cond

-pr

ecis

ion

(or

bett

er) t

imes

tam

pIn

form

atio

nEl

emen

ts.

mic

ros

eco

nds


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

26 9m

axFl

ow

EndM

illis

econ

ds

The

late

st a

bsol

ute

times

tam

p of

the

last

pac

ket w

ithin

any

Flow

with

in th

esc

ope

cont

aini

ngth

is In

form

atio

nEl

emen

t, ro

unde

dup

to th

em

illis

econ

d if

nece

ssar

y. T

his

Info

rmat

ion

Elem

ent m

ust b

ebo

und

to it

sco

ntai

ning

IPFI

XTr

ansp

ort S

essi

onvi

a IP

FIX

Opt

ions

and

the

sess

ionS

cope

Info

rmat

ion

Elem

ent.

This

Info

rmat

ion

Elem

ent m

ust b

eus

ed o

nly

inTr

ansp

ort S

essi

ons

cont

aini

ng F

low

Reco

rds

with

mill

isec

ond-

prec

isio

n (o

rbe

tter

) tim

esta

mp

Info

rmat

ion

Elem

ents

.

mill

ise

con

ds

Reference 207

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

27 0m

axFl

ow

EndN

ano

seco

nds

The

late

st a

bsol

ute

times

tam

p of

the

last

pac

ket w

ithin

any

Flow

with

in th

esc

ope

cont

aini

ngth

is In

form

atio

nEl

emen

t. Th

isIn

form

atio

nEl

emen

t mus

t be

boun

d to

its

cont

aini

ng IP

FIX

Tran

spor

t Ses

sion

via

IPFI

X O

ptio

nsan

d th

ese

ssio

nSco

peIn

form

atio

nEl

emen

t. Th

isIn

form

atio

nEl

emen

t mus

t be

used

onl

y in

Tran

spor

t Ses

sion

sco

ntai

ning

Flo

wRe

cord

s w

ithna

nose

cond

-pr

ecis

ion

times

tam

pIn

form

atio

nEl

emen

ts.

nan

ose

con

ds


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

27 1m

inFl

owSt

artM

icro

seco

nds

The

earli

est

abso

lute

times

tam

p of

the

first

pac

ket w

ithin

any

Flow

with

in th

esc

ope

cont

aini

ngth

is In

form

atio

nEl

emen

t, ro

unde

ddo

wn

to th

em

icro

seco

nd if

nece

ssar

y. T

his

Info

rmat

ion

Elem

ent m

ust b

ebo

und

to it

sco

ntai

ning

IPFI

XTr

ansp

ort S

essi

onvi

a an

opt

ions

reco

rd a

nd th

ese

ssio

nSco

peIn

form

atio

nEl

emen

t. Th

isIn

form

atio

nEl

emen

t mus

t be

used

onl

y in

Tran

spor

t Ses

sion

sco

ntai

ning

Flo

wRe

cord

s w

ithm

icro

seco

nd-

prec

isio

n (o

rbe

tter

) tim

esta

mp

Info

rmat

ion

Elem

ents

.

mic

ros

eco

nds

Reference 209

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

27 2m

inFl

owSt

artM

illi

seco

nds

The

earli

est

abso

lute

times

tam

p of

the

first

pac

ket w

ithin

any

Flow

with

in th

esc

ope

cont

aini

ngth

is In

form

atio

nEl

emen

t, ro

unde

ddo

wn

to th

em

illis

econ

d if

nece

ssar

y. T

his

Info

rmat

ion

Elem

ent m

ust b

ebo

und

to it

sco

ntai

ning

IPFI

XTr

ansp

ort S

essi

onvi

a an

opt

ions

reco

rd a

nd th

ese

ssio

nSco

peIn

form

atio

nEl

emen

t. Th

isIn

form

atio

nEl

emen

t mus

t be

used

onl

y in

Tran

spor

t Ses

sion

sco

ntai

ning

Flo

wRe

cord

s w

ithm

illis

econ

d-pr

ecis

ion

(or

bett

er) t

imes

tam

pIn

form

atio

nEl

emen

ts.

mill

ise

con

ds


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

27 3m

inFl

owSt

artN

anos

econ

ds

The

earli

est

abso

lute

times

tam

p of

the

first

pac

ket w

ithin

any

Flow

with

in th

esc

ope

cont

aini

ngth

is In

form

atio

nEl

emen

t. Th

isIn

form

atio

nEl

emen

t mus

t be

boun

d to

its

cont

aini

ng IP

FIX

Tran

spor

t Ses

sion

via

an o

ptio

nsre

cord

and

the

sess

ionS

cope

Info

rmat

ion

Elem

ent.

This

Info

rmat

ion

Elem

ent m

ust b

eus

ed o

nly

inTr

ansp

ort S

essi

ons

cont

aini

ng F

low

Reco

rds

with

nano

seco

nd-

prec

isio

ntim

esta

mp

Info

rmat

ion

Elem

ents

.

nan

ose

con

ds

Reference 211

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

27 4co

llector

Certifica

te

The

full

X.50

9ce

rtifica

te,

enco

ded

in A

SN.1

DER

form

at, u

sed

by th

e Co

llect

orw

hen

IPFI

XM

essa

ges

wer

etr

ansm

itted

usi

ngTL

S or

DTL

S. T

his

Info

rmat

ion

Elem

ent m

ust b

ebo

und

to it

sco

ntai

ning

IPFI

XTr

ansp

ort S

essi

onvi

a an

opt

ions

reco

rd a

nd th

ese

ssio

nSco

peIn

form

atio

nEl

emen

t, or

to it

sco

ntai

ning

IPFI

XM

essa

ge v

ia a

nop

tions

reco

rd a

ndth

e m

essa

geSc

ope

Info

rmat

ion

Elem

ent.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

27 5ex

porter

Certifica

te

The

full

X.50

9ce

rtifica

te,

enco

ded

in A

SN.1

DER

form

at, u

sed

by th

e Co

llect

orw

hen

IPFI

XM

essa

ges

wer

etr

ansm

itted

usi

ngTL

S or

DTL

S. T

his

Info

rmat

ion

Elem

ent m

ust b

ebo

und

to it

sco

ntai

ning

IPFI

XTr

ansp

ort S

essi

onvi

a an

opt

ions

reco

rd a

nd th

ese

ssio

nSco

peIn

form

atio

nEl

emen

t, or

to it

sco

ntai

ning

IPFI

XM

essa

ge v

ia a

nop

tions

reco

rd a

ndth

e m

essa

geSc

ope

Info

rmat

ion

Elem

ent.

Reference 213

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

27 6da

taRe

cor

dsRe

liab

ility

The

expo

rtre

liabi

lity

of D

ata

Reco

rds,

with

in th

isSC

TP s

trea

m, f

orth

e el

emen

t(s)

inth

e O

ptio

nsTe

mpl

ate

scop

e. A

typi

cal e

xam

ple

ofan

ele

men

t for

whi

ch th

e ex

port

relia

bilit

y w

ill b

ere

port

ed is

the

tem

plat

eID,

as

spec

ified

in th

eDa

ta R

ecor

dsRe

liabi

lity

Opt

ions

Tem

plat

e. A

val

ueof

'Tru

e' m

eans

that

the

Expo

rtin

gPr

oces

s m

ust s

end

any

Data

Rec

ords

asso

ciat

ed w

ith th

eel

emen

t(s)

relia

bly

with

in th

is S

CTP

stre

am. A

val

ue o

f'F

alse

' mea

ns th

atth

e Ex

port

ing

Proc

ess

MAY

sen

dan

y Da

ta R

ecor

dsas

soci

ated

with

the

elem

ent(

s)un

relia

bly

with

inth

is S

CTP

stre

am.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

27 7ob

serv

atio

nPoi

ntTy

pe

Type

of o

bser

vatio

npo

int.

Valu

esas

sign

ed to

dat

ear

e:

1. P

hysi

cal p

ort

2. P

ort c

hann

el

3. V

lan.

27 8ne

wCo

nne

ctio

nDel

taCo

unt

This

info

rmat

ion

elem

ent c

ount

s th

enu

mbe

r of T

CP o

rUD

P co

nnec

tions

whi

ch w

ere

open

eddu

ring

the

obse

rvat

ion

perio

d.Th

e ob

serv

atio

npe

riod

may

be

spec

ified

by

the

flow

sta

rt a

nd e

ndtim

esta

mps

.

Reference 215

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

27 9co

nnec

tion

Sum

Dur

atio

nSec

onds

This

info

rmat

ion

elem

ent

aggr

egat

es th

eto

tal t

ime

inse

cond

s fo

r all

ofth

e TC

P or

UDP

conn

ectio

ns w

hich

wer

e in

use

dur

ing

the

obse

rvat

ion

perio

d. F

orex

ampl

e if

ther

ear

e 5

conc

urre

ntco

nnec

tions

eac

hfo

r 10

seco

nds,

the

valu

e w

ould

be

50s.

sec

on ds


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

28 0co

nnec

tion

Tran

sac

tionI

d

This

info

rmat

ion

elem

ent ide

ntifies

a tr

ansa

ctio

n w

ithin

a co

nnec

tion.

Atr

ansa

ctio

n is

am

eani

ngfu

lex

chan

ge o

fap

plic

atio

n da

tabe

twee

n tw

one

twor

k de

vice

s or

a cl

ient

and

ser

ver.

A tr

ansa

ctio

nId

isas

sign

ed th

e fir

sttim

e a

flow

isre

port

ed, s

o th

atla

ter r

epor

ts fo

r the

sam

e flo

w w

ill h

ave

the

sam

etr

ansa

ctio

nId.

Adi

ffere

nttr

ansa

ctio

nId

isus

ed fo

r eac

htr

ansa

ctio

n w

ithin

aTC

P or

UDP

conn

ectio

n. T

heiden

tifiers

need

not

be s

eque

ntia

l.

Reference 217

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

28 1po

stN

ATSo

urce

IPv

6Add

res

s

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'sou

rceI

Pv6A

ddre

ss',

exc

ept t

hat i

tre

port

s a mod

ified

valu

e ca

used

by

aN

AT64

mid

dleb

oxfu

nctio

n af

ter t

hepa

cket

pas

sed

the

Obs

erva

tion

Poin

t.

28 2po

stN

ATDe

stin

ati

onIP

v6A

ddre

ss

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

Info

rmat

ion

Elem

ent

'des

tinat

ionI

Pv6A

ddr

ess',

exc

ept t

hat

it re

port

s a

mod

ified

val

ueca

used

by

a N

AT64

mid

dleb

ox fu

nctio

naf

ter t

he p

acke

tpa

ssed

the

Obs

erva

tion

Poin

t.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

28 3na

tPoo

lId

Loca

lly u

niqu

eiden

tifier

of a

NAT

pool

.

28 4na

tPoo

lN

ame

The

nam

e of

a N

ATpo

ol id

entifi

ed b

y a

natP

oolID

.

Reference 219

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

28 5an

onym

iza

tionF

lag

s

A fla

g w

ord

desc

ribin

gsp

ecia

lized

mod

ifica

tions

toth

e an

onym

izat

ion

polic

y in

effe

ct fo

rth

e an

onym

izat

ion

tech

niqu

e ap

plie

dto

a re

fere

nced

Info

rmat

ion

Elem

ent w

ithin

are

fere

nced

Tem

plat

e. W

hen

flags

are

cle

ar (0

),th

e no

rmal

pol

icy

(as

desc

ribed

by

anon

ymiz

atio

nTec

hni

que)

app

lies

with

out

mod

ifica

tion.

MSB 14 13 12 11 10

9 8 7 6 5 4 3

2 1 LSB

+---+---+---+---+---+---+---

+---+---+---+---+---+---+---

+---+---+

|

Reserved

|LOR|PmA| SC |

+---+---+---+---+---+---+---

+---+---+---+---+---+---+---

+---+---+

anonymizationFlags IE

+--------+----------

+----------------------------

-------------------+

| bit(s) | name |

description

|

| (LSB = |

|

|

| 0) |

|

|

+--------+----------

+----------------------------

-------------------+

| 0-1 | SC |

Stability Class: see the

Stability Class |

| | | table

below, and section Section

5.1. |

| 2 | PmA |

Perimeter Anonymization:

when set (1), |

| | |

source- Information Elements

as described in |

| | |

[RFC5103] are interpreted as

external |

| | |

addresses, and destination-

Information |

| | |

Elements as described in

[RFC5103] are |

| | |

interpreted as internal

addresses, for the |

| | |

purposes of

associating

|

| | |

anonymizationTechnique to

Information |

| | |

Elements only; see Section

7.2.2 for details. |

| | | This

bit must NOT be set when

associated with |

| | | a non-

endpoint (that is, source-

or |

| | |

destination-) Information

Element. must be |

| | |

consistent within a record

(that is, if a |

| | |

source- Information Element

has this flag |

| | | set,

the corresponding

destination- element |

| | | must

have this flag set, and vice-

versa.) |

| 3 | LOR | Low-

Order Unchanged: when set

(1), the |

| | | low-

order bits of the anonymized

Information |

| | |

Element contain real data.

This modification |

| | | is

intended for the

anonymization of |

| | |

network-level addresses

while leaving |

| | | host-

level addresses intact in

order to |

| | |

preserve host level-

structure, which could |

| | |

otherwise be used to reverse

anonymization. |

| | | must

NOT be set when associated

with a |

| | |

truncation-based

anonymizationTechnique.

| | 4-15 | Reserved |

Reserved for future use:

must be cleared |

| | | (0) by

the Exporting Process and

must be |

| | |

ignored by the Collecting

Process. |

+--------+----------

+----------------------------

-------------------+

The

Stab

ility

Cla

sspo

rtio

n of

this

flag

sw

ord

desc

ribes

the

stab

ility

cla

ss o

fth

e an

onym

izat

ion

tech

niqu

e ap

plie

dto

a re

fere

nced

Info

rmat

ion

Elem

ent w

ithin

are

fere

nced

Tem

plat

e. S

tabi

lity

clas

ses

refe

r to

the

stab

ility

of t

hepa

ram

eter

s of

the

anon

ymiz

atio

nte

chni

que,

and

ther

efor

e th

eco

mpa

rabi

lity

ofth

e m

appi

ngbe

twee

n th

e re

alan

d an

onym

ized

valu

es o

ver t

ime.

This

det

erm

ines

whi

ch a

nony

miz

edda

tase

ts m

ay b

eco

mpa

red

with

each

oth

er. V

alue

sar

e as

follo

ws:

+-----+-----

+----------------------------

---------------------------+

| Bit | Bit |

Description

|

| 1 | 0

|

|

+-----+-----

+----------------------------

---------------------------+

| 0 | 0 | Undefined: the

Exporting Process makes

no |

| | | representation

as to how stable the mapping

is, or |

| | | over what time

period values of this field

will |

| | | remain

comparable; while the

Collecting Process MAY |

| | | assume Session

level stability, Session

level |

| | | stability is

not guaranteed. Processes

must assume |

| | | this is the

case in the absence of

stability class |

| | | information;

this is the default

stability class. |

| 0 | 1 | Session: the

Exporting Process will

ensure that the |

| | | parameters of

the anonymization technique

are stable |

| | | during the

Transport Session. All the

values of the |

| | | described

Information Element for each

Record |

| | | described by

the referenced Template

within the |

| | | Transport

Session are comparable. The

Exporting |

| | | Process must

endeavour to ensure at least

this |

| | | stability

class.

|

| 1 | 0 | Exporter-

Collector Pair: the

Exporting Process will |

| | | ensure that

the parameters of the

anonymization |

| | | technique are

stable across Transport

Sessions over |

| | | time with the

given Collecting Process,

but may use |

| | | different

parameters for different

Collecting |

| | | Processes.

Data exported to different

Collecting |

| | | Processes are

not

comparable.

|

| 1 | 1 | Stable: the

Exporting Process will

ensure that the |

| | | parameters of

the anonymization technique

are stable |

| | | across

Transport Sessions over

time, regardless of |

| | | the Collecting

Process to which it is

sent. |

+-----+-----

+----------------------------

---------------------------+


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

28 7in

form

atio

nEle

men

tInd

ex

A ze

ro-b

ased

inde

xof

an

Info

rmat

ion

Elem

ent

refe

renc

ed b

yin

form

atio

nEle

men

tId

with

in a

Tem

plat

ere

fere

nced

by

tem

plat

eId;

use

dto

dis

ambi

guat

esc

ope

for

tem

plat

esco

ntai

ning

mul

tiple

iden

tical

Info

rmat

ion

Elem

ents

.

28 8p2

pTec

hno

logy

Spec

ifies

if th

eAp

plic

atio

n ID

isba

sed

on p

eer-

to-

peer

tech

nolo

gy.

Poss

ible

val

ues

are:

{ "y

es",

"y",

1 },

{ "no

", "n

", 2

} and

{ "un

assi

gned

", "u

",0

}.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

28 9tu

nnel

Tech

nolo

gySp

ecifies

if th

eAp

plic

atio

n ID

isus

ed a

s a

tunn

elte

chno

logy

.

Poss

ible

val

ues

are:

{ "y

es",

"y",

1 },

{ "no

", "n

", 2

} and

{ "un

assi

gned

", "u

",0

}.

29 0en

cryp

tedT

echn

olo

gy

Spec

ifies

if th

eAp

plic

atio

n ID

is a

nen

cryp

ted

netw

orki

ngpr

otoc

ol.

Poss

ible

val

ues

are:

{ "y

es",

"y",

1 },

{ "no

", "n

", 2

} and

{ "un

assi

gned

", "u

",0

}.

29 1ba

sicL

ist

Spec

ifies

a g

ener

icIn

form

atio

nEl

emen

t with

aba

sicL

ist a

bstr

act

data

type

. For

exam

ple,

a li

st o

fpo

rt n

umbe

rs, a

list

of in

terf

ace

inde

xes,

etc

.

Reference 223

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

29 2su

bTem

plat

eLis

tSp

ecifies

a g

ener

icIn

form

atio

nEl

emen

t with

asu

bTem

plat

eLis

tab

stra

ct d

ata

type

.

29 3su

bTem

plat

eMul

tiLis

t

Spec

ifies

a g

ener

icIn

form

atio

nEl

emen

t with

asu

bTem

plat

eMul

tiLi

st a

bstr

act d

ata

type

.

29 4bg

pVal

idity

Stat

eTh

is e

lem

ent

desc

ribes

the

"val

idity

sta

te" o

fth

e BG

P ro

ute

corr

espo

nden

tso

urce

or

dest

inat

ion

IPad

dres

s. If

the

"val

idity

sta

te" f

orth

is F

low

is o

nly

avai

labl

e, th

en th

eva

lue

of th

isIn

form

atio

nEl

emen

t is

255.

29 5IP

SecS

PI

IPSe

c Se

curit

yPa

ram

eter

s In

dex

(SPI

).


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

29 6na

tTyp

eTh

e ty

pe o

f NAT

trea

tmen

t:

0 un

know

n

1 N

AT44

tran

slat

ed

2 N

AT64

tran

slat

ed

3 N

AT46

tran

slat

ed

4 IP

v4--

>IPv

4 (n

oN

AT)

5 N

AT66

tran

slat

ed

6 IP

v6--

>IPv

6 (n

oN

AT)

GR

E key

, whi

ch is use

d for

ide

ntif

yin

g an indi

vid

ual

traf

fic flo w w

ithi

na tu

nne

l.

29 7Th

e ty

pe o

f NAT

trea

tmen

t:

Reference 225

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

29 8in

itiat

orPa

cket

sTh

e to

tal n

umbe

rof

laye

r 4 p

acke

tsin

a fl

ow fr

om th

ein

itiat

or. T

hein

itiat

or is

the

devi

ce w

hich

trig

gere

d th

ese

ssio

n cr

eatio

n,an

d re

mai

ns th

esa

me

for t

he li

fe o

fth

e se

ssio

n.

pac

ket

s

29 9re

spon

der

Pack

ets

The

tota

l num

ber

of la

yer 4

pac

kets

in a

flow

from

the

resp

onde

r. Th

ere

spon

der i

s th

ede

vice

whi

chre

plie

s to

the

initi

ator

, and

rem

ains

the

sam

efo

r the

life

of t

hese

ssio

n.

pac

ket

s

30 0ob

serv

atio

nDom

ain

Nam

e

The

nam

e of

an

obse

rvat

ion

dom

ain iden

tified

by a

nob

serv

atio

nDom

ain

Id.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

30 1se

lect

ionS

eque

nce

Id

From

all

the

pack

ets

obse

rved

at a

n O

bser

vatio

nPo

int,

a su

bset

of

the

pack

ets

isse

lect

ed b

y a

sequ

ence

of o

ne o

rm

ore

Sele

ctor

s.Th

ese

lect

ionS

eque

nce

Id is

a u

niqu

e va

lue

per O

bser

vatio

nDo

mai

n, s

peci

fyin

gth

e O

bser

vatio

nPo

int a

nd th

ese

quen

ce o

fSe

lect

ors

thro

ugh

whi

ch th

e pa

cket

sar

e se

lect

ed.

30 2se

lect

orI

dTh

e Se

lect

or ID

isth

e un

ique

IDid

entif

ying

aPr

imiti

ve S

elec

tor.

Each

Prim

itive

Sele

ctor

mus

t hav

ea

uniq

ue ID

in th

eO

bser

vatio

nDo

mai

n.

Reference 227

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

30 3in

form

atio

nEle

men

tId

This

Info

rmat

ion

Elem

ent c

onta

ins

the

ID o

f ano

ther

Info

rmat

ion

Elem

ent.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

30 4se

lect

orAl

gorit

hm

This

Info

rmat

ion

Elem

ent ide

ntifies

the

pack

etse

lect

ion

met

hods

(e.g

., Fi

lterin

g,Sa

mpl

ing)

that

are

appl

ied

by th

eSe

lect

ion

Proc

ess.

Mos

t of t

hese

met

hods

hav

epa

ram

eter

s.Fu

rthe

rIn

form

atio

nEl

emen

ts a

rene

eded

to fu

llysp

ecify

pac

ket

sele

ctio

n w

ithth

ese

met

hods

and

all t

heir

para

met

ers.

The

met

hods

list

edbe

low

are

defi

ned

in [R

FC54

75].

For

thei

r par

amet

ers,

Info

rmat

ion

Elem

ents

are

defin

ed in

the

info

rmat

ion

mod

eldo

cum

ent.

The

nam

es o

f the

seIn

form

atio

nEl

emen

ts a

re li

sted

for e

ach

met

hod

iden

tifier.

Furt

her m

etho

diden

tifiers

may

be

adde

d to

the

list

belo

w. I

t mig

ht b

ene

cess

ary

to defi

nene

w In

form

atio

nEl

emen

ts to

spe

cify

thei

r par

amet

ers.

The

sele

ctor

Algo

rithm

regi

stry

ism

aint

aine

d by

IAN

A. N

ewas

sign

men

ts fo

rth

e re

gist

ry w

ill b

ead

min

iste

red

byIA

NA,

and

are

subj

ect t

o Ex

pert

Revi

ew [R

FC81

26].

The

regi

stry

can

be

upda

ted

whe

nsp

ecifica

tions

of

the

new

met

hod(

s)an

d an

y ne

wIn

form

atio

nEl

emen

ts a

repr

ovid

ed.

The

grou

p of

expe

rts

mus

tdo

uble

che

ck th

ese

lect

orAl

gorit

hmde

finition

s an

dIn

form

atio

nEl

emen

ts w

ithal

read

y de

fined

sele

ctor

Algo

rithm

san

d In

form

atio

nEl

emen

ts fo

rco

mpl

eten

ess,

accu

racy

, and

redu

ndan

cy. T

hose

expe

rts

will

initi

ally

be d

raw

n fr

om th

eW

orki

ng G

roup

Chai

rs a

nddo

cum

ent e

dito

rsof

the

IPFI

X an

dPS

AMP

Wor

king

Gro

ups.

The

follo

win

gpa

cket

sel

ectio

nm

etho

ds id

entifi

ers

are de

fined

her

e:

Ther

e is

a b

road

varie

ty o

f pos

sibl

epa

ram

eter

s th

atco

uld

be u

sed

for

Prop

erty

mat

chFi

lterin

g (5

) but

curr

ently

ther

e ar

eno

agr

eed

para

met

ers

spec

ified

.

Reference 229



Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

30 5sa

mpl

ingP

acke

tInt

erva

l

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e nu

mbe

r of

pack

ets

that

are

cons

ecut

ivel

ysa

mpl

ed. A

val

ue o

f10

0 m

eans

that

100

cons

ecut

ive

pack

ets

are

sam

pled

.

pac

ket

s

For e

xam

ple,

this

Info

rmat

ion

Elem

ent m

ay b

eus

ed to

des

crib

eth

e co

nfigu

ratio

n of

a sy

stem

atic

cou

nt-

base

d Sa

mpl

ing

Sele

ctor

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

30 6sa

mpl

ingP

acke

tSp

ace

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e nu

mbe

r of

pack

ets

betw

een

two

"sam

plin

gPac

ketI

nte

rval

"s. A

val

ue o

f10

0 m

eans

that

the

next

inte

rval

sta

rts

100

pack

ets

(whi

char

e no

t sam

pled

)af

ter t

he c

urre

nt"s

ampl

ingP

acke

tIn

terv

al" i

s ov

er.

pac

ket

s

For e

xam

ple,

this

Info

rmat

ion

Elem

ent m

ay b

eus

ed to

des

crib

eth

e co

nfigu

ratio

n of

a sy

stem

atic

cou

nt-

base

d Sa

mpl

ing

Sele

ctor

.

Reference 231

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

30 7sa

mpl

ingT

imeI

nte

rval

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e tim

e in

terv

al in

mic

rose

cond

sdu

ring

whi

ch a

llar

rivin

g pa

cket

s ar

esa

mpl

ed.

mic

ros

eco

nds

For e

xam

ple,

this

Info

rmat

ion

Elem

ent m

ay b

eus

ed to

des

crib

eth

e co

nfigu

ratio

n of

a sy

stem

atic

tim

e-ba

sed

Sam

plin

gSe

lect

or.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

30 8sa

mpl

ingT

imeS

pac

e

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e tim

e in

terv

al in

mic

rose

cond

sbe

twee

n tw

o"s

ampl

ingT

imeI

nte

rval

"s. A

val

ue o

f10

0 m

eans

that

the

next

inte

rval

sta

rts

100

mic

rose

cond

s(d

urin

g w

hich

no

pack

ets

are

sam

pled

) afte

r the

curr

ent

"sam

plin

gTim

eInt

erv

al" i

s ov

er.

mic

ros

eco

nds

For e

xam

ple,

this

Info

rmat

ion

Elem

ent m

ay u

sed

to d

escr

ibe

the

confi

guratio

n of

asy

stem

atic

tim

e-ba

sed

Sam

plin

gSe

lect

or.

Reference 233

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

30 9sa

mpl

ingS

ize

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e nu

mbe

r of

elem

ents

take

nfr

om th

e pa

rent

Popu

latio

n fo

rra

ndom

Sam

plin

gm

etho

ds.

pac

ket

s

For e

xam

ple,

this

Info

rmat

ion

Elem

ent m

ay b

eus

ed to

des

crib

eth

e co

nfigu

ratio

n of

a ra

ndom

n-o

ut-o

f-N

Sam

plin

gSe

lect

or.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

31 0sa

mpl

ingP

opul

atio

n

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e nu

mbe

r of

elem

ents

in th

epa

rent

Pop

ulat

ion

for r

ando

mSa

mpl

ing

met

hods

.

pac

ket

s

For e

xam

ple,

this

Info

rmat

ion

Elem

ent m

ay b

eus

ed to

des

crib

eth

e co

nfigu

ratio

n of

a ra

ndom

n-o

ut-o

f-N

Sam

plin

gSe

lect

or.

Reference 235

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

31 1sa

mpl

ingP

roba

bilit

y

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e pr

obab

ility

that

a pa

cket

issa

mpl

ed,

expr

esse

d as

ava

lue

betw

een

0an

d 1.

The

prob

abili

ty is

equ

alfo

r eve

ry p

acke

t. A

valu

e of

0 m

eans

no p

acke

t is

sam

pled

sin

ce th

epr

obab

ility

is 0

.

For e

xam

ple,

this

Info

rmat

ion

Elem

ent m

ay b

eus

ed to

des

crib

eth

e co

nfigu

ratio

n of

a un

iform

prob

abili

stic

Sam

plin

g Se

lect

or.

31 2da

taLi

nkFr

ameS

ize

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e le

ngth

of t

hese

lect

ed d

ata

link

fram

e.

The

data

link

laye

ris

defi

ned

in [I

SO/

IEC.

7498

-1:1

994]

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

31 3ip

Hea

derP

acke

tSec

tion

This

Info

rmat

ion

Elem

ent c

arrie

s a

serie

s of

n o

ctet

sfr

om th

e IP

hea

der

of a

sam

pled

pack

et, s

tart

ing

sect

ionO

ffset

octe

ts in

to th

e IP

head

er.

How

ever

, if n

ose

ctio

nOffs

et field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent i

s pr

esen

t,th

en a

sect

ionO

ffset

of

zero

app

lies,

and

the

octe

ts m

ust b

efr

om th

e st

art o

fth

e IP

hea

der.

With

suffic

ient

leng

th, t

his

elem

ent a

lso

repo

rts

octe

ts fr

omth

e IP

pay

load

.H

owev

er, f

ull

pack

et c

aptu

re o

far

bitr

ary

pack

etst

ream

s is

expl

icitl

y ou

t of

scop

e pe

r the

Secu

rity

Cons

ider

atio

nsse

ctio

ns o

f[R

FC54

77] a

nd[R

FC28

04].

The

sect

ionE

xpor

tedO

cte

ts e

xpre

sses

how

muc

h da

ta is

expo

rted

, whi

le th

ere

mai

nder

ispa

ddin

g.

Whe

n th

ese

ctio

nExp

orte

dOc

tets

field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent e

xist

s, th

isIn

form

atio

nEl

emen

t MAY

hav

ea fix

ed le

ngth

and

MAY

be

padd

ed, o

rit

MAY

hav

e a

varia

ble

leng

th.

Whe

n th

ese

ctio

nExp

orte

dOc

tets

field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent d

oes

not

exis

t, th

isIn

form

atio

nEl

emen

t mus

t hav

ea

varia

ble

leng

than

d m

ust N

OT

bepa

dded

. In

this

case

, the

siz

e of

the

expo

rted

sec

tion

may

be

cons

trai

ned

due

to li

mita

tions

in th

e IP

FIX

prot

ocol

.

Reference 237

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

31 4ip

Payl

oadP

acke

tSe

ctio

n

This

Info

rmat

ion

Elem

ent c

arrie

s a

serie

s of

n o

ctet

sfr

om th

e IP

payl

oad

of a

sam

pled

pac

ket,

star

ting

sect

ionO

ffset

octe

ts in

to th

e IP

payl

oad.

How

ever

, if n

ose

ctio

nOffs

et field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent i

s pr

esen

t,th

en a

sect

ionO

ffset

of

zero

app

lies,

and

the

octe

ts m

ust b

efr

om th

e st

art o

fth

e IP

pay

load

.

The

IPv4

pay

load

isth

at p

art o

f the

pack

et th

at fo

llow

sth

e IP

v4 h

eade

ran

d an

y op

tions

,w

hich

[RFC

791]

refe

rs to

as

"dat

a"or

"dat

a oc

tets

".Fo

r exa

mpl

e, s

eeth

e ex

ampl

es in

[RFC

791]

,Ap

pend

ix A

.

The

IPv6

pay

load

isth

e re

st o

f the

pack

et fo

llow

ing

the

40-o

ctet

IPv6

head

er. N

ote

that

any

exte

nsio

nhe

ader

s pr

esen

tar

e co

nsid

ered

par

tof

the

payl

oad.

The

sect

ionE

xpor

tedO

cte

ts e

xpre

sses

how

muc

h da

ta is

obse

rved

, whi

le th

ere

mai

nder

ispa

ddin

g.

Whe

n th

ese

ctio

nExp

orte

dOc

tets

field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent e

xist

s, th

isIn

form

atio

nEl

emen

t MAY

hav

ea fix

ed le

ngth

and

MAY

be

padd

ed, o

rM

AY h

ave

ava

riabl

e le

ngth

.

Whe

n th

ese

ctio

nExp

orte

dOc

tets

field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent d

oes

not

exis

t, th

isIn

form

atio

nEl

emen

t mus

t hav

ea

varia

ble

leng

than

d m

ust N

OT

bepa

dded

. In

this

case

, the

siz

e of

the

expo

rted

sec

tion

may

be

cons

trai

ned

due

to li

mita

tions

in th

e IP

FIX

prot

ocol

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

31 5da

taLi

nkFr

ameS

ect

ion

This

Info

rmat

ion

Elem

ent c

arrie

s n

octe

ts fr

om th

eda

ta li

nk fr

ame

of a

sele

cted

fram

e,st

artin

gse

ctio

nOffs

etoc

tets

into

the

fram

e.

How

ever

, if n

ose

ctio

nOffs

et field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent i

s pr

esen

t,th

en a

sect

ionO

ffset

of

zero

app

lies,

and

the

octe

ts m

ust b

efr

om th

e st

art o

fth

e da

ta li

nk fr

ame.

The

sect

ionE

xpor

tedO

cte

ts e

xpre

sses

how

muc

h da

ta is

obse

rved

, whi

le th

ere

mai

nder

ispa

ddin

g.

Whe

n th

ese

ctio

nExp

orte

dOc

tets

field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent e

xist

s, th

isIn

form

atio

nEl

emen

t MAY

hav

ea fix

ed le

ngth

and

MAY

be

padd

ed, o

rM

AY h

ave

ava

riabl

e le

ngth

.

Whe

n th

ese

ctio

nExp

orte

dOc

tets

field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent d

oes

not

exis

t, th

isIn

form

atio

nEl

emen

t mus

t hav

ea

varia

ble

leng

than

d m

ust N

OT

bepa

dded

. In

this

case

, the

siz

e of

the

expo

rted

sec

tion

may

be

cons

trai

ned

due

to li

mita

tions

in th

e IP

FIX

prot

ocol

.

Furt

her

Info

rmat

ion

Elem

ents

, tha

t is,

data

Link

Fram

eTyp

ean

dda

taLi

nkFr

ameS

ize,

are

need

ed to

spec

ify th

e da

talin

k ty

pe a

nd th

esi

ze o

f the

dat

a lin

kfr

ame

of th

isIn

form

atio

nEl

emen

t. A

set o

fth

ese

Info

rmat

ion

Elem

ents

MAY

be

cont

aine

d in

ast

ruct

ured

dat

aty

pe, a

s ex

pres

sed

in [R

FC63

13].

Or a

set o

f the

seIn

form

atio

nEl

emen

ts M

AY b

eco

ntai

ned

in o

neFl

ow R

ecor

d as

show

n in

App

endi

xB

of [R

FC71

33].

The

data

link

laye

ris

defi

ned

in [I

SO/

IEC.

7498

-1:1

994]

.

Reference 239

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

31 6m

plsL

abel

Stac

kSec

tion

This

Info

rmat

ion

Elem

ent c

arrie

s a

serie

s of

n o

ctet

sfr

om th

e M

PLS

labe

l sta

ck o

f asa

mpl

ed p

acke

t,st

artin

gse

ctio

nOffs

etoc

tets

into

the

MPL

S la

bel s

tack

.

How

ever

, if n

ose

ctio

nOffs

et field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent i

s pr

esen

t,th

en a

sect

ionO

ffset

of

zero

app

lies,

and

the

octe

ts m

ust b

efr

om th

e he

ad o

fth

e M

PLS

labe

lst

ack.

With

suffic

ient

leng

th, t

his

elem

ent a

lso

repo

rts

octe

ts fr

omth

e M

PLS

payl

oad.

How

ever

, ful

lpa

cket

cap

ture

of

arbi

trar

y pa

cket

stre

ams

isex

plic

itly

out o

fsc

ope.

See

[RFC

3031

] for

the sp

ecifica

tion

ofM

PLS

pack

ets.

See

[RFC

3032

] for

the sp

ecifica

tion

ofth

e M

PLS

labe

lst

ack.

The

sect

ionE

xpor

tedO

cte

ts e

xpre

sses

how

muc

h da

ta is

obse

rved

, whi

le th

ere

mai

nder

ispa

ddin

g.

Whe

n th

ese

ctio

nExp

orte

dOc

tets

field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent e

xist

s, th

isIn

form

atio

nEl

emen

t MAY

hav

ea fix

ed le

ngth

and

MAY

be

padd

ed, o

rM

AY h

ave

ava

riabl

e le

ngth

.

Whe

n th

ese

ctio

nExp

orte

dOc

tets

field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent d

oes

not

exis

t, th

isIn

form

atio

nEl

emen

t mus

t hav

ea

varia

ble

leng

than

d m

ust N

OT

bepa

dded

. In

this

case

, the

siz

e of

the

expo

rted

sec

tion

may

be

cons

trai

ned

due

to li

mita

tions

in th

e IP

FIX

prot

ocol

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

31 7m

plsP

aylo

adPa

cke

tSec

tion

The

mpl

sPay

load

Pack

etSe

ctio

n ca

rrie

s a

serie

s of

n o

ctet

sfr

om th

e M

PLS

payl

oad

of a

sam

pled

pac

ket,

star

ting

sect

ionO

ffset

octe

ts in

to th

eM

PLS

payl

oad,

as

itis

dat

a th

at fo

llow

sim

med

iate

ly a

fter

the

MPL

S la

bel

stac

k.

How

ever

, if n

ose

ctio

nOffs

et field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent i

s pr

esen

t,th

en a

sect

ionO

ffset

of

zero

app

lies,

and

the

octe

ts m

ust b

efr

om th

e st

art o

fth

e M

PLS

payl

oad.

See

[RFC

3031

] for

the sp

ecifica

tion

ofM

PLS

pack

ets.

See

[RFC

3032

] for

the sp

ecifica

tion

ofth

e M

PLS

labe

lst

ack.

The

sect

ionE

xpor

tedO

cte

ts e

xpre

sses

how

muc

h da

ta is

obse

rved

, whi

le th

ere

mai

nder

ispa

ddin

g.

Whe

n th

ese

ctio

nExp

orte

dOc

tets

field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent e

xist

s, th

isIn

form

atio

nEl

emen

t MAY

hav

ea fix

ed le

ngth

and

MAY

be

padd

ed, o

rit

MAY

hav

e a

varia

ble

leng

th.

Whe

n th

ese

ctio

nExp

orte

dOc

tets

field

corr

espo

ndin

g to

this

Info

rmat

ion

Elem

ent d

oes

not

exis

t, th

isIn

form

atio

nEl

emen

t mus

t hav

ea

varia

ble

leng

than

d m

ust N

OT

bepa

dded

. In

this

case

, the

siz

e of

the

expo

rted

sec

tion

may

be

cons

trai

ned

due

to li

mita

tions

in th

e IP

FIX

prot

ocol

.

Reference 241

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

31 8se

lect

orI

dTot

alPk

tsO

bser

ved

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e to

tal n

umbe

r of

pack

ets

obse

rved

by a

Sel

ecto

r, fo

r asp

ecific

valu

e of

Sele

ctor

Id.

pac

ket

s

This

Info

rmat

ion

Elem

ent m

ust b

eus

ed in

an

Opt

ions

Tem

plat

e sc

oped

to th

e ob

serv

atio

nto

whi

ch it

refe

rs

31 9se

lect

orI

dTot

alPk

tsSe

lect

ed

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e to

tal n

umbe

r of

pack

ets

sele

cted

by a

Sel

ecto

r, fo

r asp

ecific

valu

e of

Sele

ctor

Id.

pac

ket

s

This

Info

rmat

ion

Elem

ent m

ust b

eus

ed in

an

Opt

ions

Tem

plat

e sc

oped

to th

e ob

serv

atio

nto

whi

ch it

refe

rs.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

32 0ab

solu

teEr

ror

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e m

axim

umpo

ssib

lem

easu

rem

ent e

rror

of th

e re

port

edva

lue

for a

giv

enIn

form

atio

nEl

emen

t. Th

eab

solu

teEr

ror h

asth

e sa

me

unit

asth

e In

form

atio

nEl

emen

t with

whi

chit

is a

ssoc

iate

d.Th

e re

al v

alue

of

the

met

ric c

andi

ffer b

yab

solu

teEr

ror

(pos

itive

or

nega

tive)

from

the

mea

sure

d va

lue.

This

Info

rmat

ion

Elem

ent p

rovi

des

only

the

erro

r for

mea

sure

d va

lues

.If

an

Info

rmat

ion

Elem

ent c

onta

ins

an e

stim

ated

val

ue(fr

om S

ampl

ing)

,th

e co

nfide

nce

boun

darie

s an

dco

nfide

nce

leve

lha

ve to

be

prov

ided

inst

ead,

usi

ng th

eup

perC

ILim

it,lo

wer

CILi

mit,

and

confi

denc

eLev

elIn

form

atio

nEl

emen

ts.

This

Info

rmat

ion

Elem

ent m

ust b

eus

ed in

an

Opt

ions

Tem

plat

e sc

oped

to th

e ob

serv

atio

nto

whi

ch it

refe

rs.

Th e uni

ts of the

Inf

or ma

tio n Ele

me

nt for

whi

ch the

err

or is spe

cifi

ed.

Reference 243

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

32 1re

lativ

eErr

orTh

is In

form

atio

nEl

emen

t spe

cifie

sth

e m

axim

umpo

ssib

le p

ositi

ve o

rne

gativ

e er

ror r

atio

for t

he re

port

edva

lue

for a

giv

enIn

form

atio

nEl

emen

t as

perc

enta

ge o

f the

mea

sure

d va

lue.

The

real

val

ue o

fth

e m

etric

can

diffe

r by

rela

tiveE

rror

perc

ent (

posi

tive

orne

gativ

e) fr

om th

em

easu

red

valu

e.

This

Info

rmat

ion

Elem

ent p

rovi

des

only

the

erro

r for

mea

sure

d va

lues

.If

an

Info

rmat

ion

Elem

ent c

onta

ins

an e

stim

ated

val

ue(fr

om S

ampl

ing)

,th

e co

nfide

nce

boun

darie

s an

dco

nfide

nce

leve

lha

ve to

be

prov

ided

inst

ead,

usi

ng th

eup

perC

ILim

it,lo

wer

CILi

mit,

and

confi

denc

eLev

elIn

form

atio

nEl

emen

ts.

This

Info

rmat

ion

Elem

ent m

ust b

eus

ed in

an

Opt

ions

Tem

plat

e sc

oped

to th

e ob

serv

atio

nto

whi

ch it

refe

rs.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

32 2ob

serv

atio

nTim

eSe

cond

s

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e ab

solu

te ti

me

in s

econ

ds o

f an

obse

rvat

ion.

sec

on ds

32 3ob

serv

atio

nTim

eM

illis

eco

nds

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e ab

solu

te ti

me

in m

illis

econ

ds o

fan

obs

erva

tion.

mill

ise

con

ds

32 4ob

serv

atio

nTim

eM

icro

sec

onds

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e ab

solu

te ti

me

in m

icro

seco

nds

ofan

obs

erva

tion.

mic

ros

eco

nds

32 5ob

serv

atio

nTim

eN

anos

econ

ds

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e ab

solu

te ti

me

in n

anos

econ

ds o

fan

obs

erva

tion.

nan

ose

con

ds

32 6di

gest

Ha

shVa

lue

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e va

lue

from

the

dige

st h

ash

func

tion.

Reference 245

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

32 7ha

shIP

Pay

load

Of

fset

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e IP

pay

load

offs

et u

sed

by a

Has

h-ba

sed

Sele

ctio

n Se

lect

or.

32 8ha

shIP

Pay

load

Size

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e IP

pay

load

siz

eus

ed b

y a

Has

h-ba

sed

Sele

ctio

nSe

lect

or.

32 9ha

shO

utpu

tRan

geM

in

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e va

lue

for t

hebe

ginn

ing

of a

has

hfu

nctio

n's

pote

ntia

lou

tput

rang

e.

See

also

Sec

tions

6.2,

3.8

and

7.1

of

[RFC

5475

].


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

33 0ha

shO

utpu

tRan

geM

ax

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e va

lue

for t

heen

d of

a h

ash

func

tion'

s po

tent

ial

outp

ut ra

nge.

See

also

Sec

tions

6.2,

3.8

and

7.1

of

[RFC

5475

].

33 1ha

shSe

lec

tedR

ang

eMin

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e va

lue

for t

hebe

ginn

ing

of a

has

hfu

nctio

n's

sele

cted

rang

e.

See

also

Sec

tions

6.2,

3.8

and

7.1

of

[RFC

5475

].

33 2ha

shSe

lec

tedR

ang

eMax

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e va

lue

for t

heen

d of

a h

ash

func

tion'

s se

lect

edra

nge.

See

also

Sec

tions

6.2,

3.8

and

7.1

of

[RFC

5475

].

Reference 247

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

33 3ha

shDi

ges

tOut

put

This

Info

rmat

ion

Elem

ent c

onta

ins

abo

olea

n va

lue

that

is T

RUE

if th

eou

tput

from

this

hash

Sel

ecto

r has

been

con

figur

ed to

be in

clud

ed in

the

pack

et re

port

as

apa

cket

dig

est,

else

FALS

E.

See

also

Sec

tions

6.2,

3.8

and

7.1

of

[RFC

5475

].

33 4ha

shIn

itial

iser

Val

ue

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e in

itial

iser

val

ueto

the

hash

func

tion.

See

also

Sec

tions

6.2,

3.8

and

7.1

of

[RFC

5475

].

33 5se

lect

orN

ame

The

nam

e of

ase

lect

or id

entifi

edby

a s

elec

torI

D.G

loba

lly u

niqu

e pe

rM

eter

ing

Proc

ess.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

33 6up

perC

ILi

mit

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e up

per l

imit

of a

confi

denc

ein

terv

al. I

t is

used

to p

rovi

de a

nac

cura

cyst

atem

ent f

or a

nes

timat

ed v

alue

.Th

e co

nfide

nce

limits

defi

ne th

era

nge

in w

hich

the

real

val

ue is

assu

med

to b

e w

itha

cert

ain

prob

abili

ty p

.Co

nfide

nce

limits

alw

ays

need

to b

eas

soci

ated

with

aco

nfide

nce

leve

lth

at defi

nes

this

prob

abili

ty p

.Pl

ease

not

e th

at a

confi

denc

e in

terv

alon

ly p

rovi

des

apr

obab

ility

that

the

real

val

ue li

esw

ithin

the

limits

.Th

at m

eans

the

real

val

ue c

an li

eou

tsid

e th

eco

nfide

nce

limits

.

The

uppe

rCIL

imit,

low

erCI

Lim

it, a

ndco

nfide

nceL

evel

Info

rmat

ion

Elem

ents

mus

t all

be u

sed

in a

nO

ptio

ns T

empl

ate

scop

ed to

the

obse

rvat

ion

tow

hich

they

refe

r.

Not

e th

at th

eup

perC

ILim

it,lo

wer

CILi

mit,

and

confi

denc

eLev

elar

e al

l req

uire

d to

spec

ify con

fiden

ce,

and

mus

t be

disr

egar

ded

unle

ssal

l thr

ee a

resp

ecified

toge

ther

.

Reference 249

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

33 7lo

wer

CIL

imit

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e lo

wer

lim

it of

aco

nfide

nce

inte

rval

. For

furt

her

info

rmat

ion,

see

the

desc

riptio

n of

uppe

rCIL

imit.

The

uppe

rCIL

imit,

low

erCI

Lim

it, a

ndco

nfide

nceL

evel

Info

rmat

ion

Elem

ents

mus

t all

be u

sed

in a

nO

ptio

ns T

empl

ate

scop

ed to

the

obse

rvat

ion

tow

hich

they

refe

r.

Not

e th

at th

eup

perC

ILim

it,lo

wer

CILi

mit,

and

confi

denc

eLev

elar

e al

l req

uire

d to

spec

ify con

fiden

ce,

and

mus

t be

disr

egar

ded

unle

ssal

l thr

ee a

resp

ecified

toge

ther

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

33 8co

nfide

nce

Leve

lTh

is In

form

atio

nEl

emen

t spe

cifie

sth

e co

nfide

nce

leve

l. It

is u

sed

topr

ovid

e an

accu

racy

stat

emen

t for

estim

ated

val

ues.

The co

nfide

nce

leve

l pro

vide

s th

epr

obab

ility

p w

ithw

hich

the

real

valu

e lie

s w

ithin

agi

ven

rang

e. A

confi

denc

e le

vel

alw

ays

need

s to

be

asso

ciat

ed w

ithco

nfide

nce

limits

that

defi

ne th

era

nge

in w

hich

the

real

val

ue is

assu

med

to b

e.

The

uppe

rCIL

imit,

low

erCI

Lim

it, a

ndco

nfide

nceL

evel

Info

rmat

ion

Elem

ents

mus

t all

be u

sed

in a

nO

ptio

ns T

empl

ate

scop

ed to

the

obse

rvat

ion

tow

hich

they

refe

r.

Not

e th

at th

eup

perC

ILim

it,lo

wer

CILi

mit,

and

confi

denc

eLev

elar

e al

l req

uire

d to

spec

ify con

fiden

ce,

and

mus

t be

disr

egar

ded

unle

ssal

l thr

ee a

resp

ecified

toge

ther

.

Reference 251

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

33 9in

form

atio

nEle

men

tDat

aTyp

e

A de

scrip

tion

of th

eab

stra

ct d

ata

type

of a

n IP

FIX

info

rmat

ion

elem

ent.

Thes

e ty

pes

are

regi

ster

ed in

the

IAN

A IP

FIX

Info

rmat

ion

Elem

ent D

ata

Type

subr

egis

try.

Thi

ssu

breg

istr

y is

inte

nded

to a

ssig

nnu

mbe

rs fo

r typ

ena

mes

, not

topr

ovid

e a

mec

hani

sm fo

rad

ding

dat

a ty

pes

to th

e IP

FIX

Prot

ocol

, and

as

such

requ

ires

aSt

anda

rds

Actio

n to

mod

ify.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

34 0in

form

atio

nEle

men

tDes

crip

tion

A UT

F-8

[RFC

3629

]en

code

d Un

icod

est

ring

cont

aini

ng a

hum

an-r

eada

ble

desc

riptio

n of

an

Info

rmat

ion

Elem

ent.

The

cont

ent o

f the

info

rmat

ionE

lem

entD

escr

iptio

n M

AYbe

ann

otat

ed w

ithon

e or

mor

ela

ngua

ge ta

gs[R

FC46

46],

enco

ded

in-li

ne[R

FC24

82] w

ithin

the

UTF-

8 st

ring,

inor

der t

o sp

ecify

the

lang

uage

in w

hich

the

desc

riptio

n is

writ

ten.

Des

crip

tion

text

in m

ultip

lela

ngua

ges

MAY

tag

each

sec

tion

with

its o

wn

lang

uage

tag;

in th

is c

ase,

the

desc

riptio

nin

form

atio

n in

eac

hla

ngua

ge m

ust

have

equ

ival

ent

mea

ning

. In

the

abse

nce

of a

nyla

ngua

ge ta

g, th

e"i-

defa

ult"

[RFC

2277

]la

ngua

ge m

ust b

eas

sum

ed. S

ee th

eSe

curit

yCo

nsid

erat

ions

sect

ion

for n

otes

on s

trin

g ha

ndlin

gfo

r Inf

orm

atio

nEl

emen

t typ

ere

cord

s.

Reference 253

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

34 1in

form

atio

nEle

men

tNam

e

A UT

F-8

[RFC

3629

]en

code

d Un

icod

est

ring

cont

aini

ngth

e na

me

of a

nIn

form

atio

nEl

emen

t, in

tend

edas

a s

impl

eiden

tifier. S

ee th

eSe

curit

yCo

nsid

erat

ions

sect

ion

for n

otes

on s

trin

g ha

ndlin

gfo

r Inf

orm

atio

nEl

emen

t typ

ere

cord

s

34 2in

form

atio

nEle

men

tRan

geB

egin

Cont

ains

the

incl

usiv

e lo

w e

nd o

fth

e ra

nge

ofac

cept

able

val

ues

for a

n In

form

atio

nEl

emen

t.

34 3in

form

atio

nEle

men

tRan

geE

nd

Cont

ains

the

incl

usiv

e hi

gh e

ndof

the

rang

e of

acce

ptab

le v

alue

sfo

r an

Info

rmat

ion

Elem

ent.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

34 4in

form

atio

nEle

men

tSem

ant

ics

A de

scrip

tion

of th

ese

man

tics

of a

nIP

FIX

Info

rmat

ion

Elem

ent.

Thes

e ar

eta

ken

from

the

data

type

sem

antic

sde

fined

in s

ectio

n3.

2 of

the

IPFI

XIn

form

atio

n M

odel

[RFC

5102

]; se

eth

at s

ectio

n fo

rm

ore

info

rmat

ion

on th

e ty

pes

defin

ed in

the

info

rmat

ionE

lem

entS

eman

tics

sub-

regi

stry

. Thi

s fie

ldm

ay ta

ke th

eva

lues

in T

able

;th

e sp

ecia

l val

ue0x

00 (d

efau

lt) is

used

to n

ote

that

no s

eman

tics

appl

yto

the fie

ld; i

tca

nnot

be

man

ipul

ated

by

aCo

llect

ing

Proc

ess

or F

ile R

eade

r tha

tdo

es n

otun

ders

tand

it a

prio

rity

Thes

e se

man

tics

are

regi

ster

ed in

the

IAN

A IP

FIX

Info

rmat

ion

Elem

ent S

eman

tics

subr

egis

try.

Thi

ssu

breg

istr

y is

inte

nded

to a

ssig

nnu

mbe

rs fo

rse

man

tics

nam

es,

not t

o pr

ovid

e a

mec

hani

sm fo

rad

ding

sem

antic

sto

the

IPFI

XPr

otoc

ol, a

nd a

ssu

ch re

quire

s a

Stan

dard

s Ac

tion

[RFC

8126

] to

mod

ify.

Reference 255

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

34 5in

form

atio

nEle

men

tUni

ts

A de

scrip

tion

of th

eun

its o

f an

IPFI

XIn

form

atio

nEl

emen

t. Th

ese

corr

espo

nd to

the

units

impl

icitl

yde

fined

in th

eIn

form

atio

nEl

emen

t defi

nitio

nsin

sec

tion

5 of

the

IPFI

X In

form

atio

nM

odel

[RFC

5102

];se

e th

at s

ectio

n fo

rm

ore

info

rmat

ion

on th

e ty

pes

desc

ribed

in th

ein

form

atio

nEle

men

tsUn

its s

ub-

regi

stry

. Thi

s fie

ldm

ay ta

ke th

eva

lues

in T

able

3be

low

; the

spe

cial

valu

e 0x

00 (n

one)

is u

sed

to n

ote

that

the fie

ld is

uni

tless

.

Thes

e ty

pes

are

regi

ster

ed in

the

IAN

A IP

FIX

Info

rmat

ion

Elem

ent U

nits

subr

egis

try;

new

type

s m

ay b

ead

ded

on a

Firs

tCo

me

Firs

t Ser

ved

[RFC

8126

] bas

is.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

34 6pr

ivat

eEnt

erpr

ise

Num

ber

A pr

ivat

een

terp

rise

num

ber,

as a

ssig

ned

byIA

NA.

With

in th

eco

ntex

t of a

nIn

form

atio

nEl

emen

t Typ

ere

cord

, thi

sel

emen

t can

be

used

alo

ng w

ith th

ein

form

atio

nEle

men

tId

elem

ent t

osc

ope

prop

ertie

s to

a sp

ecific

Info

rmat

ion

Elem

ent.

To e

xpor

tty

pe in

form

atio

nab

out a

n IA

NA-

assi

gned

Info

rmat

ion

Elem

ent,

set t

hepr

ivat

eEnt

erpr

iseN

umbe

r to

0, o

r do

not e

xpor

t the

priv

ateE

nter

pris

eNum

ber i

n th

e ty

pere

cord

. To

expo

rtty

pe in

form

atio

nab

out a

nen

terp

rise-

spec

ific

Info

rmat

ion

Elem

ent,

expo

rtth

e en

terp

rise

num

ber i

npr

ivat

eEnt

erpr

iseN

umbe

r, an

d ex

port

the

Info

rmat

ion

Elem

ent n

umbe

rw

ith th

e En

terp

rise

bit c

lear

ed in

info

rmat

ionE

lem

entI

d. T

he E

nter

pris

ebi

t in

the

asso

ciat

edin

form

atio

nEle

men

tId

Info

rmat

ion

Elem

ent m

ust b

eig

nore

d by

the

Colle

ctin

g Pr

oces

s.Reference 257

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

34 7vi

rtua

lSt

atio

nInt

erfa

ceId

Inst

ance

Iden

tifier

of th

e in

terf

ace

to a

Virt

ual S

tatio

n. A

Virt

ual S

tatio

n is

an

end

stat

ion

inst

ance

: it c

an b

ea

virt

ual m

achi

neor

a p

hysi

cal h

ost.

34 8vi

rtua

lSt

atio

nInt

erfa

ceN

am

e

Nam

e of

the

inte

rfac

e to

aVi

rtua

l Sta

tion.

AVi

rtua

l Sta

tion

is a

nen

d st

atio

nin

stan

ce: i

t can

be

a vi

rtua

l mac

hine

or a

phy

sica

l hos

t.

34 9vi

rtua

lSt

atio

nUUI

D

Uniq

ue Id

entifi

er o

fa

Virt

ual S

tatio

n. A

Virt

ual S

tatio

n is

an

end

stat

ion

inst

ance

: it c

an b

ea

virt

ual m

achi

neor

a p

hysi

cal h

ost.

35 0vi

rtua

lSt

atio

nNa

me

Nam

e of

a V

irtua

lSt

atio

n. A

Virt

ual

Stat

ion

is a

n en

dst

atio

n in

stan

ce: i

tca

n be

a v

irtua

lm

achi

ne o

r aph

ysic

al h

ost.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

35 1la

yer2

Segm

entI

dId

entifi

er o

f a la

yer

2 ne

twor

k se

gmen

tin

an

over

lay

netw

ork.

The

mos

tsign

ifica

nt b

yte

iden

tifies

the

laye

r2

netw

ork

over

lay

netw

ork

enca

psul

atio

nty

pe:

0x00

rese

rved

0x01

VxL

AN

0x02

NVG

RE

The

thre

e lo

wes

tsign

ifica

nt b

ytes

hold

the

valu

e of

the

laye

r 2 o

verla

yne

twor

k se

gmen

tiden

tifier.

For e

xam

ple:

- a 2

4 bi

t seg

men

tID

VXL

AN N

etw

ork

Iden

tifier

(VN

I)

- a 2

4 bi

t Ten

ant

Net

wor

k Id

entifi

er(T

NI)

for N

VGRE

Reference 259

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

35 2la

yer2

Oc

tetD

elta

Coun

t

The

num

ber o

fla

yer 2

oct

ets

sinc

eth

e pr

evio

us re

port

(if a

ny) i

n in

com

ing

pack

ets

for t

his

Flow

at t

heO

bser

vatio

n Po

int.

The

num

ber o

foc

tets

incl

udes

laye

r 2 h

eade

r(s)

and

laye

r 2pa

yloa

d. #

mem

o:la

yer 2

ver

sion

of

octe

tDel

taCo

unt

(field

#1)

oct

ets


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

35 3la

yer2

Oc

tetT

otal

Coun

t

The

tota

l num

ber

of la

yer 2

oct

ets

inin

com

ing

pack

ets

for t

his

Flow

at t

heO

bser

vatio

n Po

int

sinc

e th

e M

eter

ing

Proc

ess

(re-

)initi

aliz

atio

nfo

r thi

s O

bser

vatio

nPo

int.

The

num

ber

of o

ctet

s in

clud

esla

yer 2

hea

der(

s)an

d la

yer 2

payl

oad.

# m

emo:

laye

r 2 v

ersi

on o

foc

tetT

otal

Coun

t(field

#85

)

oct

ets

35 4in

gres

sUni

cast

Pack

etTo

talC

ount

The

tota

l num

ber

of in

com

ing

unic

ast

pack

ets

met

ered

at

the

Obs

erva

tion

Poin

t sin

ce th

eM

eter

ing

Proc

ess

(re-

)initi

aliz

atio

nfo

r thi

s O

bser

vatio

nPo

int.

pac

ket

s

Reference 261

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

35 5in

gres

sMul

ticas

tPac

ketT

otal

Coun

t

The

tota

l num

ber

of in

com

ing

mul

ticas

t pac

kets

met

ered

at t

heO

bser

vatio

n Po

int

sinc

e th

e M

eter

ing

Proc

ess

(re-

)initi

aliz

atio

nfo

r thi

s O

bser

vatio

nPo

int.

pac

ket

s

35 6in

gres

sBro

adca

stPa

cket

Tot

alCo

unt

The

tota

l num

ber

of in

com

ing

broa

dcas

t pac

kets

met

ered

at t

heO

bser

vatio

n Po

int

sinc

e th

e M

eter

ing

Proc

ess

(re-

)initi

aliz

atio

nfo

r thi

s O

bser

vatio

nPo

int.

pac

ket

s

35 7eg

ress

Uni

cast

Pack

etTo

talC

ount

The

tota

l num

ber

of in

com

ing

unic

ast

pack

ets

met

ered

at

the

Obs

erva

tion

Poin

t sin

ce th

eM

eter

ing

Proc

ess

(re-

)initi

aliz

atio

nfo

r thi

s O

bser

vatio

nPo

int.

pac

ket

s


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

35 8eg

ress

Broa

dcas

tPa

cket

Tot

alCo

unt

The

tota

l num

ber

of in

com

ing

broa

dcas

t pac

kets

met

ered

at t

heO

bser

vatio

n Po

int

sinc

e th

e M

eter

ing

Proc

ess

(re-

)initi

aliz

atio

nfo

r thi

s O

bser

vatio

nPo

int.

pac

ket

s

35 9m

onito

ring

Inte

rval

Star

tMi

lli Seco

nds

The

abso

lute

times

tam

p at

whi

ch th

em

onito

ring

inte

rval

star

ted.

AM

onito

ring

inte

rval

is th

e pe

riod

oftim

e du

ring

whi

chth

e M

eter

ing

Proc

ess

is ru

nnin

g.

mill

ise

con

ds

36 0m

onito

ring

Inte

rval

EndM

illi Se

cond

s

The

abso

lute

times

tam

p at

whi

ch th

em

onito

ring

inte

rval

ende

d. A

Mon

itorin

g in

terv

alis

the

perio

d of

time

durin

g w

hich

the

Met

erin

gPr

oces

s is

runn

ing.

mill

ise

con

ds

Reference 263

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

36 1po

rtRa

nge

Star

tTh

e po

rt n

umbe

rid

entif

ying

the

star

tof

a ra

nge

of p

orts

.A

valu

e of

zer

oin

dica

tes

that

the

rang

e st

art i

s no

tsp

ecified

, ie

the

rang

e is

defi

ned

inso

me

othe

r way

.

Addi

tiona

lin

form

atio

n on

defin

ed T

CP p

ort

num

bers

can

be

foun

d at

[IAN

Are

gist

ry s

ervi

ce-

nam

es-p

ort-

num

bers

].


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

36 2po

rtRa

nge

End

The

port

num

ber

iden

tifyi

ng th

e en

dof

a ra

nge

of p

orts

.A

valu

e of

zer

oin

dica

tes

that

the

rang

e en

d is

not

spec

ified

, ie

the

rang

e is

defi

ned

inso

me

othe

r way

.

Addi

tiona

lin

form

atio

n on

defin

ed T

CP p

ort

num

bers

can

be

foun

d at

[IAN

Are

gist

ry s

ervi

ce-

nam

es-p

ort-

num

bers

].

36 3po

rtRa

nge

Step

Size

The

step

siz

e in

apo

rt ra

nge.

The

defa

ult s

tep

size

is1,

whi

ch in

dica

tes

cont

iguo

us p

orts

. Ava

lue

of z

ero

indi

cate

s th

at th

est

ep s

ize

is n

otsp

ecified

, ie

the

rang

e is

defi

ned

inso

me

othe

r way

.

Reference 265

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

36 4po

rtRa

nge

Num

Por

ts

The

num

ber o

fpo

rts

in a

por

tra

nge.

A v

alue

of

zero

indi

cate

s th

atth

e nu

mbe

r of

port

s is

not

spec

ified

, ie

the

rang

e is

defi

ned

inso

me

othe

r way

.

36 5st

aMac

Add

ress

The

IEEE

802

MAC

addr

ess

of a

wire

less

sta

tion

(STA

).

36 6st

aIPv

4Ad

dres

sTh

e IP

v4 a

ddre

ssof

a w

irele

ssst

atio

n (S

TA).

36 7w

tpM

acAd

dres

sTh

e IE

EE 8

02 M

ACad

dres

s of

aw

irele

ss a

cces

spo

int (

WTP

).


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

36 8in

gres

sInt

erfa

ceTy

pe

The

type

of

inte

rfac

e w

here

pack

ets

of th

isFl

ow a

re b

eing

rece

ived

. The

val

uem

atch

es th

e va

lue

of m

anag

ed o

bjec

t'if

Type

' as de

fined

in [I

ANA

regi

stry

iana

iftyp

e-m

ib].

36 9eg

ress

Inte

rfac

eTyp

e

The

type

of

inte

rfac

e w

here

pack

ets

of th

isFl

ow a

re b

eing

sent

. The

val

uem

atch

es th

e va

lue

of m

anag

ed o

bjec

t'if

Type

' as de

fined

in [I

ANA

regi

stry

iana

iftyp

e-m

ib].

37 0rt

pSeq

uen

ceN

um

ber

RTP

sequ

ence

num

ber p

er[R

FC35

50].

37 1us

erN

am

eUs

er n

ame

asso

ciat

ed w

ith th

eflo

w.

Reference 267

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

37 2ap

plic

ati

onCa

teg

oryN

ame

An a

ttrib

ute

that

prov

ides

a first

leve

l cat

egor

izat

ion

for e

ach

Appl

icat

ion

ID.

37 3ap

plic

ati

onSu

bCa

tego

ryN

ame

An a

ttrib

ute

that

prov

ides

a s

econ

dle

vel c

ateg

oriz

atio

nfo

r eac

hAp

plic

atio

n ID

.

37 4ap

plic

ati

onG

roup

Nam

e

An a

ttrib

ute

that

grou

ps m

ultip

leAp

plic

atio

n ID

sth

at b

elon

g to

the

sam

e ne

twor

king

appl

icat

ion.

37 5or

igin

alF

low

sPre

sent

The

non-

cons

erva

tive

coun

tof

Orig

inal

Flo

ws

cont

ribut

ing

to th

isAg

greg

ated

Flo

w.

Non

-con

serv

ativ

eco

unts

nee

d no

tsu

m to

the

orig

inal

coun

t on

re-

aggr

egat

ion.

flo ws


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

37 6or

igin

alF

low

sIni

tiat

ed

The

cons

erva

tive

coun

t of O

rigin

alFl

ows

who

se first

pack

et is

repr

esen

ted

with

inth

is A

ggre

gate

dFl

ow. C

onse

rvat

ive

coun

ts m

ust s

umto

the

orig

inal

coun

t on

re-

aggr

egat

ion.

flo ws

37 7or

igin

alF

low

sCo

mpl

eted

The

cons

erva

tive

coun

t of O

rigin

alFl

ows

who

se la

stpa

cket

isre

pres

ente

d w

ithin

this

Agg

rega

ted

Flow

. Con

serv

ativ

eco

unts

mus

t sum

to th

e or

igin

alco

unt o

n re

-ag

greg

atio

n.

flo ws

Reference 269

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

37 8di

stin

ctC

ount

OfS

ourc

eIP

Addr

ess

The

coun

t of

dist

inct

sou

rce

IPad

dres

s va

lues

for

Orig

inal

Flo

ws

cont

ribut

ing

to th

isAg

greg

ated

Flo

w,

with

out r

egar

d to

IP v

ersi

on. T

his

Info

rmat

ion

Elem

ent i

spr

efer

red

to th

e IP

-ve

rsion-

spec

ific

coun

ters

, unl

ess

itis

impo

rtan

t to

sepa

rate

the

coun

ts b

y ve

rsio

n.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

37 9di

stin

ctC

ount

OfD

estin

atio

nIP

Addr

ess

The

coun

t of

dist

inct

des

tinat

ion

IP a

ddre

ss v

alue

sfo

r Orig

inal

Flo

ws

cont

ribut

ing

to th

isAg

greg

ated

Flo

w,

with

out r

egar

d to

IP v

ersi

on. T

his

Info

rmat

ion

Elem

ent i

spr

efer

red

to th

eve

rsion-

spec

ific

coun

ters

bel

ow,

unle

ss it

isim

port

ant t

ose

para

te th

eco

unts

by

vers

ion.

38 0di

stin

ctC

ount

OfS

ourc

eIPv

4 Addr

ess

The

coun

t of

dist

inct

sou

rce

IPv4

add

ress

valu

es fo

r Orig

inal

Flow

s co

ntrib

utin

gto

this

Agg

rega

ted

Flow

.

Reference 271

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

38 1di

stin

ctC

ount

OfD

estin

atio

nIPv

4Ad

dres

s

The

coun

t of

dist

inct

des

tinat

ion

IPv4

add

ress

valu

es fo

r Orig

inal

Flow

s co

ntrib

utin

gto

this

Agg

rega

ted

Flow

.

38 2di

stin

ctC

ount

OfS

ourc

eIPv

6 Addr

ess

The

coun

t of

dist

inct

sou

rce

IPv6

add

ress

valu

es fo

r Orig

inal

Flow

s co

ntrib

utin

gto

this

Agg

rega

ted

Flow

.

38 3di

stin

ctC

ount

OfD

estin

atio

nIPv

6Ad

dres

s

The

coun

t of

dist

inct

des

tinat

ion

IPv6

add

ress

valu

es fo

r Orig

inal

Flow

s co

ntrib

utin

gto

this

Agg

rega

ted

Flow

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

38 4va

lueD

istr

ibut

ion

Met

hod

A de

scrip

tion

of th

em

etho

d us

ed to

dist

ribut

e th

eco

unte

rs fr

omCo

ntrib

utin

g Fl

ows

into

the

Aggr

egat

edFl

ow re

cord

sde

scrib

ed b

y an

asso

ciat

ed s

cope

,ge

nera

lly a

Tem

plat

e. T

hem

etho

d is

dee

med

to a

pply

to a

ll th

eno

n-ke

yIn

form

atio

nEl

emen

ts in

the

refe

renc

ed s

cope

for w

hich

val

uedi

strib

utio

n is

ava

lid o

pera

tion;

ifth

eor

igin

alFl

owsI

nitia

ted

and

/or

orig

inal

Flow

sCom

ple

ted

Info

rmat

ion

Elem

ents

app

ear i

nth

e Te

mpl

ate,

they

are

not s

ubje

ct to

this

dis

trib

utio

nm

etho

d, a

s th

eyea

ch in

fer t

heir

own

dist

ribut

ion

met

hod.

Thi

s is

inte

nded

to b

e a

com

plet

e se

t of

poss

ible

val

uedi

strib

utio

nm

etho

ds; i

t is

enco

ded

asfo

llow

s:

+-------

+----------------------------

-----------------------------

--+

| Value |

Description

| +-------

+----------------------------

-----------------------------

--+

| 0 | Unspecified: The

counters for an Original

Flow are |

| | explicitly not

distributed according to any

other method |

| | defined for this

Information Element; use for

arbitrary |

| | distribution, or

distribution algorithms not

described by |

| | any other

codepoint.

|

| |

-----------------------------

----------------------------

| |

|

|

| 1 | Start Interval:

The counters for an Original

Flow are |

| | added to the

counters of the appropriate

Aggregated Flow |

| | containing the

start time of the Original

Flow. This |

| | must be assumed

the default if value

distribution |

| | information is not

available at a Collecting

Process for |

| | an Aggregated

Flow.

|

| |

-----------------------------

----------------------------

| |

|

|

| 2 | End Interval: The


Flow are added |

| | to the counters of

the appropriate Aggregated

Flow |

| | containing the end

time of the Original

Flow. |

| |

-----------------------------

----------------------------

| |

|

|

| 3 | Mid Interval: The


Flow are added |

| | to the counters of

a single appropriate

Aggregated Flow |

| | containing some

timestamp between start and

end time of |

| | the Original

Flow.

|

| |

-----------------------------

----------------------------

| |

|

|

| 4 | Simple Uniform

Distribution: Each counter

for an Original |

| | Flow is divided by

the number of time intervals

the |

| | Original Flow

covers (that is, of

appropriate Aggregated |

| | Flows sharing the

same Flow Key), and this

number is |

| | added to each

corresponding counter in

each Aggregated |

| |

Flow.

| | |

-----------------------------

----------------------------

| |

|

|

| 5 | Proportional

Uniform Distribution: Each

counter for an |

| | Original Flow is

divided by the number of

time units the |

| | Original Flow

covers, to derive a mean

count rate. This |

| | mean count rate is

then multiplied by the

number of time |

| | units in the

intersection of the duration

of the Original |

| | Flow and the time

interval of each Aggregated

Flow. This |

| | is like simple

uniform distribution, but

accounts for the |

| | fractional

portions of a time interval

covered by an |

| | Original Flow in

the first and last time

interval. |

| |

-----------------------------

----------------------------

| |

|

|

| 6 | Simulated Process:

Each counter of the Original

Flow is |

| | distributed among

the intervals of the

Aggregated Flows |

| | according to some

function the Intermediate

Aggregation |

| | Process uses based

upon properties of Flows

presumed to |

| | be like the

Original Flow. This is

essentially an |

| | assertion that the

Intermediate Aggregation

Process has |

| | no direct packet

timing information but is

nevertheless |

| | not using one of

the other simpler

distribution methods. |

| | The Intermediate

Aggregation Process

specifically makes |

| | no assertion as to

the correctness of the

simulation. |

| |

-----------------------------

----------------------------

| |

|

|

| 7 | Direct: The

Intermediate Aggregation

Process has access |

| | to the original

packet timings from the

packets making up |

| | the Original Flow,

and uses these to distribute

or |

| | recalculate the

counters.

|

+-------

+----------------------------

-----------------------------

--+

Reference 273

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

38 5rf

c355

0Ji

tter

Mill

isec

onds

Inte

rarr

ival

jitt

er a

sde

fined

in s

ectio

n6.

4.1

of [R

FC35

50],

mea

sure

d in

mill

isec

onds

.

mill

ise

con

ds

38 6rf

c355

0Ji

tter

Mic

rose

con

ds

Inte

rarr

ival

jitt

er a

sde

fined

in s

ectio

n6.

4.1

of [R

FC35

50],

mea

sure

d in

mic

rose

cond

s.

mic

ros

eco

nds

38 7rf

c355

0Ji

tter

Na

nose

con

ds

Inte

rarr

ival

jitt

er a

sde

fined

in s

ectio

n6.

4.1

of [R

FC35

50],

mea

sure

d in

nano

seco

nds.

nan

ose

con

ds


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

38 8do

t1qD

EI

The

valu

e of

the

1-bi

t Dro

p El

igib

leIn

dica

tor (

DEI)

field

of t

he V

LAN

tag

as d

escr

ibed

in80

2.1Q

-201

1su

bcla

use

9.6.

Inca

se o

f a Q

inQ

fram

e, it

repr

esen

tsth

e ou

ter t

ag's

DEI

field

and

in c

ase

ofan

IEEE

802

.1ad

fram

e it

repr

esen

tsth

e DE

I field

of th

eS-

TAG

. Not

e: in

earli

er v

ersi

ons

of80

2.1Q

the

sam

ebi

t field

in th

ein

com

ing

pack

et is

occu

pied

by

the

Cano

nica

l For

mat

Indi

cato

r (CF

I)fie

ld, e

xcep

t for

S-

TAG

s.

Reference 275

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

38 9do

t1qC

ust

omer

DEI

In c

ase

of a

Qin

Qfr

ame,

it re

pres

ents

the

inne

r tag

's D

rop

Elig

ible

Indi

cato

r(D

EI) fi

eld

and

inca

se o

f an

IEEE

802.

1ad

fram

e it

repr

esen

ts th

e DE

Ifie

ld o

f the

C-T

AG.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

39 0flo

wSe

lect

orAl

gorit

hm

This

Info

rmat

ion

Elem

ent ide

ntifies

the

Inte

rmed

iate

Flow

Sel

ectio

nPr

oces

s te

chni

que

(e.g

., Fi

lterin

g,Sa

mpl

ing)

that

isap

plie

d by

the

Inte

rmed

iate

Flo

wSe

lect

ion

Proc

ess.

Mos

t of t

hese

tech

niqu

es h

ave

para

met

ers.

Its

confi

guratio

npa

ram

eter

(s) m

ust

be c

lear

lysp

ecified

. Fur

ther

Info

rmat

ion

Elem

ents

are

need

ed to

fully

spec

ify p

acke

tse

lect

ion

with

thes

e m

etho

ds a

ndal

l the

irpa

ram

eter

s.Fu

rthe

r met

hod

iden

tifiers

may

be

adde

d to

the

flow

Sele

ctor

Algo

rithm

regi

stry

. It

mig

ht b

e ne

cess

ary

to defi

ne n

ewIn

form

atio

nEl

emen

ts to

spe

cify

thei

r par

amet

ers.

The

flow

Sele

ctor

Algo

rithm

regi

stry

ism

aint

aine

d by

IAN

A. N

ewas

sign

men

ts fo

rth

e re

gist

ry w

ill b

ead

min

iste

red

byIA

NA,

on

a Fi

rst

Com

e Fi

rst S

erve

dba

sis

[RFC

8126

],su

bjec

t to

Expe

rtRe

view

[RFC

8126

].Pl

ease

not

e th

atth

e pu

rpos

e of

the

flow

sel

ectio

nte

chni

ques

desc

ribed

in th

isdo

cum

ent i

s th

eim

prov

emen

t of

mea

sure

men

tfu

nctio

ns a

sde

fined

in th

eSc

ope

(Sec

tion

1).

Befo

re a

ddin

g ne

wflo

w s

elec

tor

algo

rithm

s it

mus

tbe

che

cked

wha

t is

thei

r int

ende

dpu

rpos

e an

des

peci

ally

if th

ose

cont

radi

ct w

ithpo

licie

s de

fined

in[R

FC28

04].

The

desi

gnat

edex

pert

(s) m

ust

cons

ult w

ith th

eco

mm

unity

if a

requ

est i

s re

ceiv

edth

at ru

ns c

ount

erto

[RFC

2804

]. Th

ere

gist

ry c

an b

eup

date

d w

hen

spec

ifica

tions

of

the

new

met

hod(

s)an

d an

y ne

wIn

form

atio

nEl

emen

ts a

repr

ovid

ed. T

hegr

oup

of e

xper

tsm

ust d

oubl

e ch

eck

the

flow

Sele

ctor

Algo

rithm

defi

nitio

ns a

ndIn

form

atio

nEl

emen

ts w

ithal

read

y de

fined

flow

Sele

ctor

Algo

rithm

and

Info

rmat

ion

Elem

ents

for

com

plet

enes

s,ac

cura

cy, a

ndre

dund

ancy

. Tho

seex

pert

s w

ill in

itial

lybe

dra

wn

from

the

Wor

king

Gro

upCh

airs

and

docu

men

t edi

tors

of th

e IP

FIX

and

PSAM

P W

orki

ngG

roup

s. T

heIn

term

edia

te F

low

Sele

ctio

n Pr

oces

sTe

chni

ques

iden

tifiers

are

defin

ed a

t [http

://www.ia

na.org/

assign

men

ts/ip

fix/

ipfix

.xml#

ipfix

-flo

wse

lectoralgo

rithm

].

Reference 277

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

39 1flo

wSe

lect

edO

ctet

Delta

Cou

nt

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e vo

lum

e in

octe

ts o

f all

Flow

sth

at a

re s

elec

ted

inth

e In

term

edia

teFl

ow S

elec

tion

Proc

ess

sinc

e th

epr

evio

us re

port

.

oct

ets

39 2flo

wSe

lect

edPa

cke

tDel

taCo

unt

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e vo

lum

e in

pack

ets

of a

ll Fl

ows

that

wer

e se

lect

edin

the

Inte

rmed

iate

Flow

Sel

ectio

nPr

oces

s si

nce

the

prev

ious

repo

rt.

pac

ket

s

39 3flo

wSe

lect

edFl

ow

Delta

Cou

nt

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e nu

mbe

r of

Flow

s th

at w

ere

sele

cted

in th

eIn

term

edia

te F

low

Sele

ctio

n Pr

oces

ssi

nce

the

last

repo

rt.

flo ws


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

39 4se

lect

orI

DTot

alFl

owsO

bser

ved

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e to

tal n

umbe

r of

Flow

s ob

serv

ed b

ya

Sele

ctor

, for

asp

ecific

valu

e of

Sele

ctor

Id. T

his

Info

rmat

ion

Elem

ent m

ust b

eus

ed in

an

Opt

ions

Tem

plat

e sc

oped

to th

e ob

serv

atio

nto

whi

ch it

refe

rs.

See

Sect

ion

3.4.

2.1

of th

e IP

FIX

prot

ocol

doc

umen

t[R

FC70

11].

flo ws

Reference 279

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

39 5se

lect

orI

DTot

alFl

owsS

ele

cted

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e to

tal n

umbe

r of

Flow

s se

lect

ed b

y a

Sele

ctor

, for

asp

ecific

valu

e of

Sele

ctor

Id. T

his

Info

rmat

ion

Elem

ent m

ust b

eus

ed in

an

Opt

ions

Tem

plat

e sc

oped

to th

e ob

serv

atio

nto

whi

ch it

refe

rs.

See

Sect

ion

3.4.

2.1

of th

e IP

FIX

prot

ocol

doc

umen

t[R

FC70

11].

flo ws


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

39 6sa

mpl

ingF

low

Int

erva

l

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e nu

mbe

r of

Flow

s th

at a

reco

nsec

utiv

ely

sam

pled

. A v

alue

of

100

mea

ns th

at10

0 co

nsec

utiv

eFl

ows

are

sam

pled

.Fo

r exa

mpl

e, th

isIn

form

atio

nEl

emen

t may

be

used

to d

escr

ibe

the co

nfigu

ratio

n of

a sy

stem

atic

cou

nt-

base

d Sa

mpl

ing

Sele

ctor

.

flo ws

Reference 281

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

39 7sa

mpl

ingF

low

Spac

ing

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e nu

mbe

r of

Flow

s be

twee

n tw

o"s

ampl

ingF

low

Inte

rval

"s. A

val

ue o

f10

0 m

eans

that

the

next

inte

rval

sta

rts

100

Flow

s (w

hich

are

not s

ampl

ed)

afte

r the

cur

rent

"sam

plin

gFlo

wIn

terv

al" i

s ov

er. F

orex

ampl

e, th

isIn

form

atio

nEl

emen

t may

be

used

to d

escr

ibe

the co

nfigu

ratio

n of

a sy

stem

atic

cou

nt-

base

d Sa

mpl

ing

Sele

ctor

.

flo ws


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

39 8flo

wSa

mpl

ingT

imeI

nter

val

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e tim

e in

terv

al in

mic

rose

cond

sdu

ring

whi

ch a

llar

rivin

g Fl

ows

are

sam

pled

. For

exam

ple,

this

Info

rmat

ion

Elem

ent m

ay b

eus

ed to

des

crib

eth

e co

nfigu

ratio

n of

a sy

stem

atic

tim

e-ba

sed

Sam

plin

gSe

lect

or.

mic

ros

eco

nds

Reference 283

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

39 9flo

wSa

mpl

ingT

imeS

paci

ng

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e tim

e in

terv

al in

mic

rose

cond

sbe

twee

n tw

o"f

low

Sam

plin

gTim

eIn

terv

al"s

. A v

alue

of 1

00 m

eans

that

the

next

inte

rval

star

ts 1

00m

icro

seco

nds

(dur

ing

whi

ch n

oFl

ows

are

sam

pled

)af

ter t

he c

urre

nt"f

low

sam

plin

gTim

eIn

terv

al" i

s ov

er.

For e

xam

ple,

this

Info

rmat

ion

Elem

ent m

ay u

sed

to d

escr

ibe

the

confi

guratio

n of

asy

stem

atic

tim

e-ba

sed

Sam

plin

gSe

lect

or.

mic

ros

eco

nds


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

40 0ha

shFl

ow

Dom

ain

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e In

form

atio

nEl

emen

ts th

at a

reus

ed b

y th

e H

ash-

base

d Fl

owSe

lect

or a

s th

eH

ash

Dom

ain.

40 1tr

ansp

ortO

ctet

Delta

Coun

t

The

num

ber o

foc

tets

, exc

ludi

ngIP

hea

der(

s) a

ndLa

yer 4

tran

spor

tpr

otoc

ol h

eade

r(s)

,ob

serv

ed fo

r thi

sFl

ow a

t the

Obs

erva

tion

Poin

tsi

nce

the

prev

ious

repo

rt (i

f any

).

oct

ets

40 2tr

ansp

ortP

acke

tDel

taCo

unt

The

num

ber o

fpa

cket

s co

ntai

ning

at le

ast o

ne o

ctet

beyo

nd th

e IP

head

er(s

) and

Laye

r 4 tr

ansp

ort

prot

ocol

hea

der(

s),

obse

rved

for t

his

Flow

at t

heO

bser

vatio

n Po

int

sinc

e th

e pr

evio

usre

port

(if a

ny).

pac

ket

s

Reference 285

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

40 3or

igin

alE

xpor

terI

Pv4A

ddr

ess

The

IPv4

add

ress

used

by

the

Expo

rtin

g Pr

oces

son

an

Orig

inal

Expo

rter

, as

seen

by th

e Co

llect

ing

Proc

ess

on a

nIP

FIX

Med

iato

r.Us

ed to

pro

vide

info

rmat

ion

abou

tth

e O

rigin

alO

bser

vatio

n Po

ints

to a

dow

nstr

eam

Colle

ctor

.

40 4or

igin

alE

xpor

terI

Pv6A

ddr

ess

The

IPv6

add

ress

used

by

the

Expo

rtin

g Pr

oces

son

an

Orig

inal

Expo

rter

, as

seen

by th

e Co

llect

ing

Proc

ess

on a

nIP

FIX

Med

iato

r.Us

ed to

pro

vide

info

rmat

ion

abou

tth

e O

rigin

alO

bser

vatio

n Po

ints

to a

dow

nstr

eam

Colle

ctor

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

40 5or

igin

alO

bser

vati

onDo

mai

nId

The

Obs

erva

tion

Dom

ain

IDre

port

ed b

y th

eEx

port

ing

Proc

ess

on a

n O

rigin

alEx

port

er, a

s se

enby

the

Colle

ctin

gPr

oces

s on

an

IPFI

X M

edia

tor.

Used

to p

rovi

dein

form

atio

n ab

out

the

Orig

inal

Obs

erva

tion

Dom

ain

to a

dow

nstr

eam

Colle

ctor

. Whe

nca

scad

ing

thro

ugh

mul

tiple

Med

iato

rs,

this

iden

tifies

the

initi

al O

bser

vatio

nDo

mai

n in

the

casc

ade.

Reference 287

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

40 6in

term

edi

ateP

roce

ssId

Desc

riptio

n: A

niden

tifier

of a

nIn

term

edia

tePr

oces

s th

at is

uniq

ue p

er IP

FIX

Devi

ce. T

ypic

ally

,th

is In

form

atio

nEl

emen

t is

used

for

limiti

ng th

e sc

ope

of o

ther

Info

rmat

ion

Elem

ents

. Not

eth

at p

roce

ssiden

tifiers

may

be

assi

gned

dyna

mic

ally

; tha

tis

, an

Inte

rmed

iate

Proc

ess

may

be

rest

arte

d w

ith a

diffe

rent

ID.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

40 7ig

nore

dDa

taRe

cor

dTot

alCo

unt

Desc

riptio

n: T

heto

tal n

umbe

r of

rece

ived

Dat

aRe

cord

s th

at th

eIn

term

edia

tePr

oces

s di

d no

tpr

oces

s si

nce

the

(re-

)initi

aliz

atio

n of

the

Inte

rmed

iate

Proc

ess;

incl

udes

only

Dat

a Re

cord

sno

t exa

min

ed o

rot

herw

ise

hand

led

by th

eIn

term

edia

tePr

oces

s du

e to

reso

urce

cons

trai

nts,

not

Data

Rec

ords

that

wer

e ex

amin

ed o

rot

herw

ise

hand

led

by th

eIn

term

edia

tePr

oces

s bu

t tho

seth

at m

erel

y do

not

cont

ribut

e to

any

expo

rted

Dat

aRe

cord

due

to th

eop

erat

ions

perf

orm

ed b

y th

eIn

term

edia

tePr

oces

s.

Reference 289

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

40 8da

taLi

nkFr

ameT

ype

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e ty

pe o

f the

sele

cted

dat

a lin

kfr

ame.

The

follo

win

g da

talin

k ty

pes

are

defin

ed h

ere:

•0x

01 IE

EE80

2.3

ETH

ERN

ET[I

EEE8

02.3

]•

0x02

IEEE

802.

11M

AC F

ram

efo

rmat

[IEE

E802

.11]

Furt

her v

alue

s m

aybe

ass

igne

d by

IAN

A. N

ote

that

the

assi

gned

val

ues

are

bits

so

that

mul

tiple

obse

rvat

ions

can

be O

R'd

toge

ther

.

The

data

link

laye

ris

defi

ned

in [I

SO/

IEC.

7498

-1:1

994]

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

40 9se

ctio

nOffs

etTh

is In

form

atio

nEl

emen

t spe

cifie

sth

e of

fset

of t

hepa

cket

sec

tion

(e.g

.,da

taLi

nkFr

ameS

ect

ion,

ipH

eade

rPac

ketS

ectio

n,ip

Payl

oadP

acke

tSe

ctio

n,m

plsL

abel

Stac

kSec

tion,

and

mpl

sPay

load

Pack

etSe

ctio

n). I

f thi

sIn

form

atio

nEl

emen

t is

omitt

ed,

it de

faul

ts to

zer

o(t

hat i

s, n

o of

fset

).

If m

ultip

lese

ctio

nOffs

etIn

form

atio

nEl

emen

ts a

resp

ecified

with

in a

sing

le T

empl

ate,

then

they

app

ly to

the

pack

et s

ectio

nIn

form

atio

nEl

emen

ts in

ord

er:

the fir

stse

ctio

nOffs

etap

plie

s to

the fir

stpa

cket

sec

tion,

the

seco

nd to

the

seco

nd, a

nd s

o on

.N

ote

that

the

"clo

sest

"se

ctio

nOffs

et a

ndpa

cket

sec

tion

Info

rmat

ion

Elem

ents

with

in a

give

n Te

mpl

ate

are

not n

eces

saril

yre

late

d. If

ther

e ar

efe

wer

sec

tionO

ffset

Info

rmat

ion

Elem

ents

than

pack

et s

ectio

nIn

form

atio

nEl

emen

ts, t

hen

subs

eque

nt p

acke

tse

ctio

nIn

form

atio

nEl

emen

ts h

ave

noof

fset

, tha

t is,

ase

ctio

nOffs

et o

fze

ro a

pplie

s to

thos

e pa

cket

sect

ion

Info

rmat

ion

Elem

ents

. If t

here

are

mor

ese

ctio

nOffs

etIn

form

atio

nEl

emen

ts th

an th

enu

mbe

r of p

acke

tse

ctio

nIn

form

atio

nEl

emen

ts, t

hen

the

addi

tiona

lse

ctio

nOffs

etIn

form

atio

nEl

emen

ts a

rem

eani

ngle

ss.

Reference 291

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

41 0se

ctio

nExp

orte

dO

ctet

s

This

Info

rmat

ion

Elem

ent s

pecifie

sth

e ob

serv

edle

ngth

of t

hepa

cket

sec

tion

(e.g

.,da

taLi

nkFr

ameS

ect

ion,

ipH

eade

rPac

ketS

ectio

n,ip

Payl

oadP

acke

tSe

ctio

n,m

plsL

abel

Stac

kSec

tion,

and

mpl

sPay

load

Pack

etSe

ctio

n) w

hen

padd

ing

is u

sed.

The

pack

et s

ectio

nm

ay b

e of

a fixe

dsi

ze la

rger

than

the

sect

ionE

xpor

tedO

cte

ts. I

n th

is c

ase,

octe

ts in

the

pack

etse

ctio

n be

yond

the

sect

ionE

xpor

tedO

cte

ts m

ust f

ollo

wth

e [R

FC70

11]

rule

s fo

r pad

ding

(tha

t is,

be

com

pose

d of

zer

o(0

) val

ued

octe

ts).


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

41 1do

t1qS

erv

iceI

nst

ance

Tag

This

Info

rmat

ion

Elem

ent,

whi

ch is

16 o

ctet

s lo

ng,

repr

esen

ts th

eBa

ckbo

ne S

ervi

ceIn

stan

ce T

ag (I

-TA

G) T

ag C

ontr

olIn

form

atio

n (T

CI)

field

of a

n Et

hern

etfr

ame

as d

escr

ibed

in [I

EEE8

02.1

Q].

Iten

code

s th

eBa

ckbo

ne S

ervi

ceIn

stan

ce P

riorit

yCo

de P

oint

(I-P

CP),

Back

bone

Ser

vice

Inst

ance

Dro

pEl

igib

le In

dica

tor

(I-D

EI),

Use

Cust

omer

Addr

esse

s (U

CAs)

,Ba

ckbo

ne S

ervi

ceIn

stan

ce Id

entifi

er(I

-SID

),En

caps

ulat

edCu

stom

erDe

stin

atio

nAd

dres

s (C

-DA)

,En

caps

ulat

edCu

stom

er S

ourc

eAd

dres

s (C

-SA)

,an

d re

serv

ed fields

.Th

e st

ruct

ure

and

sem

antic

s w

ithin

the

Tag

Cont

rol

Info

rmat

ion fie

ldar

e de

fined

in[I

EEE8

02.1

Q].

Reference 293

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

41 2do

t1qS

erv

iceI

nst

ance

Id

The

valu

e of

the

24-b

it Ba

ckbo

neSe

rvic

e In

stan

ceId

entifi

er (I

-SID

)po

rtio

n of

the

Back

bone

Ser

vice

Inst

ance

Tag

(I-

TAG

) Tag

Con

trol

Info

rmat

ion

(TCI

)fie

ld o

f an

Ethe

rnet

fram

e as

des

crib

edin

[IEE

E802

.1Q

].

41 3do

t1qS

erv

iceI

nst

ance

Prio

rity

The

valu

e of

the

3-bi

t Bac

kbon

eSe

rvic

e In

stan

cePr

iorit

y Co

de P

oint

(I-P

CP) p

ortio

n of

the

Back

bone

Serv

ice

Inst

ance

Tag

(I-T

AG) T

agCo

ntro

lIn

form

atio

n (T

CI)

field

of a

n Et

hern

etfr

ame

as d

escr

ibed

in [I

EEE8

02.1

Q].


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

41 4do

t1qC

ust

omer

Sou

rceM

acA

ddre

ss

The

valu

e of

the

Enca

psul

ated

Cust

omer

Sou

rce

Addr

ess

(C-S

A)po

rtio

n of

the

Back

bone

Ser

vice

Inst

ance

Tag

(I-

TAG

) Tag

Con

trol

Info

rmat

ion

(TCI

)fie

ld o

f an

Ethe

rnet

fram

e as

des

crib

edin

[IEE

E802

.1Q

].

41 5do

t1qC

ust

omer

Des

tinat

ionM

acAd

dres

s

The

valu

e of

the

Enca

psul

ated

Cust

omer

Dest

inat

ion

Addr

ess

(C-D

A)po

rtio

n of

the

Back

bone

Ser

vice

Inst

ance

Tag

(I-

TAG

) Tag

Con

trol

Info

rmat

ion

(TCI

)fie

ld o

f an

Ethe

rnet

fram

e as

des

crib

edin

[IEE

E802

.1Q

].

41 6Du

plic

ate

ofIn

form

atio

nEl

emen

t ID

352,

laye

r2O

ctet

Delta

Coun

t.

Reference 295

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

41 7po

stLa

yer2

Oct

etDe

ltaCo

unt

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

the

laye

r2O

ctet

Delta

Coun

t Inf

orm

atio

nEl

emen

t, ex

cept

that

it re

port

s a

pote

ntia

llymod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

This

Info

rmat

ion

Elem

ent i

s th

ela

yer 2

ver

sion

of

post

Oct

etDe

ltaCo

unt

(Ele

men

tId

#23

).

oct

ets


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

41 8po

stM

Cast

Laye

r2O

ctet

Del

taCo

unt

The

num

ber o

fla

yer 2

oct

ets

sinc

eth

e pr

evio

us re

port

(if a

ny) i

n ou

tgoi

ngm

ultic

ast p

acke

tsse

nt fo

r pac

kets

of

this

Flo

w b

y a

mul

ticas

t dae

mon

with

in th

eO

bser

vatio

nDo

mai

n. T

his

prop

erty

can

not

nece

ssar

ily b

eob

serv

ed a

t the

Obs

erva

tion

Poin

tbu

t may

be

retr

ieve

d by

oth

erm

eans

. The

num

ber o

f oct

ets

incl

udes

laye

r 2he

ader

(s) a

nd la

yer

2 pa

yloa

d.

This

Info

rmat

ion

Elem

ent i

s th

ela

yer 2

ver

sion

of

post

MCa

stO

ctet

Del

taCo

unt

(Ele

men

tId

#20

).

oct

ets

Reference 297

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

41 9Du

plic

ate

ofIn

form

atio

nEl

emen

t ID

353,

laye

r2O

ctet

Tota

lCo

unt.

42 0po

stLa

yer2

Oct

etT

otal

Coun

t

The de

finition

of

this

Info

rmat

ion

Elem

ent i

s id

entic

alto

the de

finition

of

the

laye

r2O

ctet

Tota

lCo

unt I

nfor

mat

ion

Elem

ent,

exce

ptth

at it

repo

rts

apo

tent

ially

mod

ified

val

ueca

used

by

am

iddl

ebox

func

tion

afte

r the

pac

ket

pass

ed th

eO

bser

vatio

n Po

int.

This

Info

rmat

ion

Elem

ent i

s th

ela

yer 2

ver

sion

of

post

Oct

etTo

talC

ount

(Ele

men

tId

#17

1).

oct

ets


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

42 1po

stM

Cast

Laye

r2O

ctet

Tot

alCo

unt

The

tota

l num

ber

of la

yer 2

oct

ets

inou

tgoi

ng m

ultic

ast

pack

ets

sent

for

pack

ets

of th

isFl

ow b

y a

mul

ticas

tda

emon

in th

eO

bser

vatio

nDo

mai

n si

nce

the

Met

erin

g Pr

oces

s(r

e-)in

itial

izat

ion.

This

pro

pert

yca

nnot

nec

essa

rily

be o

bser

ved

at th

eO

bser

vatio

n Po

int

but m

ay b

ere

trie

ved

by o

ther

mea

ns. T

henu

mbe

r of o

ctet

sin

clud

es la

yer 2

head

er(s

) and

laye

r2

payl

oad.

This

Info

rmat

ion

Elem

ent i

s th

ela

yer 2

ver

sion

of

post

MCa

stO

ctet

Tot

alCo

unt (

Elem

entI

d#

175)

.

oct

ets

Reference 299

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

42 2m

inim

um

Laye

r2To

talL

engt

h

Laye

r 2 le

ngth

of

the

smal

lest

pac

ket

obse

rved

for t

his

Flow

. The

pac

ket

leng

th in

clud

es th

ele

ngth

of t

he la

yer

2 he

ader

(s) a

nd th

ele

ngth

of t

he la

yer

2 pa

yloa

d.

This

Info

rmat

ion

Elem

ent i

s th

ela

yer 2

ver

sion

of

min

imum

IpTo

talL

eng

th (E

lem

entI

d#

25).

oct

ets


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

42 3m

axim

um

Laye

r2To

talL

engt

h

Laye

r 2 le

ngth

of

the

larg

est p

acke

tob

serv

ed fo

r thi

sFl

ow. T

he p

acke

tle

ngth

incl

udes

the

leng

th o

f the

laye

r2

head

er(s

) and

the

leng

th o

f the

laye

r2

payl

oad.

This

Info

rmat

ion

Elem

ent i

s th

ela

yer 2

ver

sion

of

max

imum

IpTo

talL

eng

th (E

lem

entI

d#

26).

oct

ets

Reference 301

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

42 4dr

oppe

dLa

yer2

Oct

etDe

ltaC

ount

The

num

ber o

fla

yer 2

oct

ets

sinc

eth

e pr

evio

us re

port

(if a

ny) i

n pa

cket

sof

this

Flo

wdr

oppe

d by

pac

ket

trea

tmen

t. Th

enu

mbe

r of o

ctet

sin

clud

es la

yer 2

head

er(s

) and

laye

r2

payl

oad.

oct

ets

This

Info

rmat

ion

Elem

ent i

s th

ela

yer 2

ver

sion

of

drop

pedO

ctet

Delta

Coun

t (El

emen

tId

#13

2).


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

42 5dr

oppe

dLa

yer2

Oct

etTo

tal

Coun

t

The

tota

l num

ber

of o

ctet

s in

obse

rved

laye

r 2pa

cket

s (in

clud

ing

the

laye

r 2 h

eade

r)th

at w

ere

drop

ped

by p

acke

ttr

eatm

ent s

ince

the

(re-

)initi

aliz

atio

n of

the

Met

erin

gPr

oces

s.

This

Info

rmat

ion

Elem

ent i

s th

ela

yer 2

ver

sion

of

drop

pedO

ctet

Tota

lCo

unt (

Elem

entI

d#

134)

.

oct

ets

Reference 303

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

42 6ig

nore

dLay

er2O

cte

tTot

alCo

unt

The

tota

l num

ber

of o

ctet

s in

obse

rved

laye

r 2pa

cket

s (in

clud

ing

the

laye

r 2 h

eade

r)th

at th

e M

eter

ing

Proc

ess

did

not

proc

ess

sinc

e th

e(r

e-)in

itial

izat

ion

ofth

e M

eter

ing

Proc

ess.

oct

ets

This

Info

rmat

ion

Elem

ent i

s th

ela

yer 2

ver

sion

of

igno

redO

ctet

Tota

lCou

nt (E

lem

entI

d#

165)

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

42 7no

tSen

tLay

er2O

cte

tTot

alCo

unt

The

tota

l num

ber

of o

ctet

s in

obse

rved

laye

r 2pa

cket

s (in

clud

ing

the

laye

r 2 h

eade

r)th

at th

e M

eter

ing

Proc

ess

did

not

proc

ess

sinc

e th

e(r

e-)in

itial

izat

ion

ofth

e M

eter

ing

Proc

ess.

oct

ets

This

Info

rmat

ion

Elem

ent i

s th

ela

yer 2

ver

sion

of

notS

entO

ctet

Tota

lCou

nt (E

lem

entI

d#

168)

.

Reference 305

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

42 8la

yer2

Oc

tetD

elta

Sum

OfS

quar

es

The

sum

of t

hesq

uare

d nu

mbe

rsof

laye

r 2 o

ctet

spe

r inc

omin

gpa

cket

sin

ce th

epr

evio

us re

port

(if

any)

for t

his

Flow

at

the

Obs

erva

tion

Poin

t. Th

e nu

mbe

rof

oct

ets

incl

udes

laye

r 2 h

eade

r(s)

and

laye

r 2pa

yloa

d.

oct

ets

This

Info

rmat

ion

Elem

ent i

s th

ela

yer 2

ver

sion

of

octe

tDel

taSu

mO

fSqu

ares

(Ele

men

tId

#19

8).


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

42 9la

yer2

Oc

tetT

otal

Sum

OfS

qua

res

The

tota

l sum

of

the

squa

red

num

bers

of l

ayer

2oc

tets

in in

com

ing

pack

ets

for t

his

Flow

at t

heO

bser

vatio

n Po

int

sinc

e th

e M

eter

ing

Proc

ess

(re-

)initi

aliz

atio

nfo

r thi

s O

bser

vatio

nPo

int.

The

num

ber

of o

ctet

s in

clud

esla

yer 2

hea

der(

s)an

d la

yer 2

payl

oad.

oct

ets

This

Info

rmat

ion

Elem

ent i

s th

ela

yer 2

ver

sion

of

octe

tTot

alSu

mO

fSq

uare

s (E

lem

entI

d#

199)

.

43 0la

yer2

Fram

eDel

taC

ount

The

num

ber o

fin

com

ing

laye

r 2fr

ames

sin

ce th

epr

evio

us re

port

(if

any)

for t

his

Flow

at

the

Obs

erva

tion

Poin

t.

fra

me

s

Reference 307

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

43 1la

yer2

Fram

eTot

alC

ount

The

tota

l num

ber

of in

com

ing

laye

r 2fr

ames

for t

his

Flow

at t

heO

bser

vatio

n Po

int

sinc

e th

e M

eter

ing

Proc

ess

(re-

)initi

aliz

atio

nfo

r thi

s O

bser

vatio

nPo

int.

fra

me

s

43 2ps

eudo

Wire

Des

tinat

ionI

Pv4A

ddr

ess

The

dest

inat

ion

IPv4

add

ress

of t

hePS

N tu

nnel

carr

ying

the

pseu

dow

ire.

43 3ig

nore

dLay

er2F

ram

eTot

alCo

unt

The

tota

l num

ber

of o

bser

ved

laye

r 2fr

ames

that

the

Met

erin

g Pr

oces

sdi

d no

t pro

cess

sinc

e th

e(r

e-)in

itial

izat

ion

ofth

e M

eter

ing

Proc

ess.

Thi

sIn

form

atio

nEl

emen

t is

the

laye

r 2 v

ersi

on o

fig

nore

dPac

ketT

otal

Coun

t (El

emen

tId

#16

4).

fra

me

s


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

43 4m

ibO

bje

ctVa

lueI

nteg

er

An IP

FIX

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

the

inte

ger v

alue

of a

MIB

obj

ect w

ill b

eex

port

ed. T

he M

IBO

bjec

t Ide

ntifier

("mibObjec

tIde

ntifi

er")

for t

his fie

ldm

ust b

e ex

port

edin

a M

IB F

ield

Opt

ion

or v

iaan

othe

r mea

ns.

This

Info

rmat

ion

Elem

ent i

s us

ed fo

rM

IB o

bjec

ts w

ithth

e Ba

se s

ynta

x of

Inte

ger3

2 an

dIN

TEG

ER w

ithIP

FIX

redu

ced-

size

enco

ding

use

d as

requ

ired.

The

val

ueis

enc

oded

as

per

the

stan

dard

IPFI

XAb

stra

ct D

ata

Type

of s

igne

d32.

Reference 309

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

43 5m

ibO

bje

ctVa

lueO

ctet

Strin

g

An IP

FIX

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

an

Oct

et S

trin

g or

Opa

que

valu

e of

aM

IB o

bjec

t will

be

expo

rted

. The

MIB

Obj

ect I

dentifier

("mibObjec

tIde

ntifi

er")

for t

his fie

ldm

ust b

e ex

port

edin

a M

IB F

ield

Opt

ion

or v

iaan

othe

r mea

ns.

This

Info

rmat

ion

Elem

ent i

s us

ed fo

rM

IB o

bjec

ts w

ithth

e Ba

se s

ynta

x of

OCT

ET S

TRIN

G a

ndO

paqu

e. T

he v

alue

is e

ncod

ed a

s pe

rth

e st

anda

rd IP

FIX

Abst

ract

Dat

a Ty

peof

oct

etAr

ray.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

43 6m

ibO

bje

ctVa

lueO

ID

An IP

FIX

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

an

Obj

ect I

dentifier

or

OID

val

ue o

f a M

IBob

ject

will

be

expo

rted

. The

MIB

Obj

ect I

dentifier

("mibObjec

tIde

ntifi

er")

for t

his fie

ldm

ust b

e ex

port

edin

a M

IB F

ield

Opt

ion

or v

iaan

othe

r mea

ns.

This

Info

rmat

ion

Elem

ent i

s us

ed fo

rM

IB o

bjec

ts w

ithth

e Ba

se s

ynta

x of

OBJ

ECT

IDEN

TIFI

ER. N

ote:

In th

is c

ase,

the

"mibObjec

tIde

ntifi

er" d

efine

s w

hich

MIB

obj

ect i

s be

ing

expo

rted

, and

the

"mib

Obj

ectV

alue

OI

D" field

will

con

tain

the

OID

val

ue o

fth

at M

IB o

bjec

t.Th

em

ibO

bjec

tVal

ueO

ID

Info

rmat

ion

Elem

ent i

sen

code

d as

ASN

.1/B

ER [X

.690

]in

an

octe

tArr

ay.

Reference 311

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

43 7m

ibO

bje

ctVa

lueB

its

An IP

FIX

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

a s

etof

Enu

mer

ated

flags

or b

its fr

om a

MIB

obj

ect w

ill b

eex

port

ed. T

he M

IBO

bjec

t Ide

ntifier

("mibObjec

tIde

ntifi

er")

for t

his fie

ldm

ust b

e ex

port

edin

a M

IB F

ield

Opt

ion

or v

iaan

othe

r mea

ns.

This

Info

rmat

ion

Elem

ent i

s us

ed fo

rM

IB o

bjec

ts w

ithth

e Ba

se s

ynta

x of

BITS

. The

flag

s or

bits

are

enc

oded

as

per t

he s

tand

ard

IPFI

X Ab

stra

ctDa

ta T

ype

ofoc

tetA

rray

, with

sufficien

t len

gth

toac

com

mod

ate

the

requ

ired

num

ber o

fbi

ts. I

f the

num

ber

of b

its is

not

an

inte

ger m

ultip

le o

foc

tets

, the

n th

em

ost s

ignific

ant

bits

at t

he e

nd o

fth

e oc

tetA

rray

mus

t be

set t

o 0.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

43 8m

ibO

bje

ctVa

lueI

PAdd

res

s

An IP

FIX

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

the

IPv4

add

ress

val

ueof

a M

IB o

bjec

t will

be e

xpor

ted.

The

MIB

Obj

ect

Iden

tifier

("mibObjec

tIde

ntifi

er")

for t

his fie

ldm

ust b

e ex

port

edin

a M

IB F

ield

Opt

ion

or v

iaan

othe

r mea

ns.

This

Info

rmat

ion

Elem

ent i

s us

ed fo

rM

IB o

bjec

ts w

ithth

e Ba

se s

ynta

x of

IpAd

dres

s. T

heva

lue

is e

ncod

ed a

spe

r the

sta

ndar

dIP

FIX

Abst

ract

Data

Typ

e of

ipv4

Addr

ess.

Reference 313

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

43 9m

ibO

bje

ctVa

lueC

ount

er

An IP

FIX

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

the

coun

ter v

alue

of a

MIB

obj

ect w

ill b

eex

port

ed. T

he M

IBO

bjec

t Ide

ntifier

("mibObjec

tIde

ntifi

er")

for t

his fie

ldm

ust b

e ex

port

edin

a M

IB F

ield

Opt

ion

or v

iaan

othe

r mea

ns.

This

Info

rmat

ion

Elem

ent i

s us

ed fo

rM

IB o

bjec

ts w

ithth

e Ba

se s

ynta

x of

Coun

ter3

2 or

Coun

ter6

4 w

ithIP

FIX

redu

ced-

size

enco

ding

use

d as

requ

ired.

The

val

ueis

enc

oded

as

per

the

stan

dard

IPFI

XAb

stra

ct D

ata

Type

of u

nsig

ned6

4.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

44 0m

ibO

bje

ctVa

lueG

auge

An IP

FIX

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

the

Gau

ge v

alue

of a

MIB

obj

ect w

ill b

eex

port

ed. T

he M

IBO

bjec

t Ide

ntifier

("mibObjec

tIde

ntifi

er")

for t

his fie

ldm

ust b

e ex

port

edin

a M

IB F

ield

Opt

ion

or v

iaan

othe

r mea

ns.

This

Info

rmat

ion

Elem

ent i

s us

ed fo

rM

IB o

bjec

ts w

ithth

e Ba

se s

ynta

x of

Gau

ge32

. The

valu

e is

enc

oded

as

per t

he s

tand

ard

IPFI

X Ab

stra

ctDa

ta T

ype

ofun

sign

ed32

. Thi

sva

lue

repr

esen

ts a

non-

nega

tive

inte

ger t

hat m

ayin

crea

se o

rde

crea

se b

ut th

atsh

all n

ever

exc

eed

a m

axim

um v

alue

or fa

ll be

low

am

inim

um v

alue

.

Reference 315

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

44 1m

ibO

bje

ctVa

lueT

imeT

icks

An IP

FIX

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

the

Tim

eTic

ks v

alue

of

a M

IB o

bjec

t will

be

expo

rted

. The

MIB

Obj

ect I

dentifier

("mibObjec

tIde

ntifi

er")

for t

his fie

ldm

ust b

e ex

port

edin

a M

IB F

ield

Opt

ion

or v

iaan

othe

r mea

ns.

This

Info

rmat

ion

Elem

ent i

s us

ed fo

rM

IB o

bjec

ts w

ithth

e Ba

se s

ynta

x of

Tim

eTic

ks. T

heva

lue

is e

ncod

ed a

spe

r the

sta

ndar

dIP

FIX

Abst

ract

Data

Typ

e of

unsi

gned

32.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

44 2m

ibO

bje

ctVa

lueU

nsig

ned

An IP

FIX

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

an

unsi

gned

inte

ger

valu

e of

a M

IBob

ject

will

be

expo

rted

. The

MIB

Obj

ect I

dentifier

("mibObjec

tIde

ntifi

er")

for t

his fie

ldm

ust b

e ex

port

edin

a M

IB F

ield

Opt

ion

or v

iaan

othe

r mea

ns.

This

Info

rmat

ion

Elem

ent i

s us

ed fo

rM

IB o

bjec

ts w

ithth

e Ba

se s

ynta

x of

unsi

gned

32 w

ithIP

FIX

redu

ced-

size

enco

ding

use

d as

requ

ired.

The

val

ueis

enc

oded

as

per

the

stan

dard

IPFI

XAb

stra

ct D

ata

Type

of u

nsig

ned3

2.

Reference 317

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

44 3m

ibO

bje

ctVa

lueT

able

An IP

FIX

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

aco

mpl

ete

or p

artia

lco

ncep

tual

tabl

ew

ill b

e ex

port

ed.

The

MIB

Obj

ect

Iden

tifier

("mibObjec

tIde

ntifi

er")

for t

his fie

ldm

ust b

e ex

port

edin

a M

IB F

ield

Opt

ion

or v

iaan

othe

r mea

ns.

This

Info

rmat

ion

Elem

ent i

s us

ed fo

rM

IB o

bjec

ts w

ith a

synt

ax o

fSE

QUE

NCE

OF.

This

is e

ncod

ed a

sa

subT

empl

ateL

ist

of m

ibO

bjec

tVal

ueIn

form

atio

nEl

emen

ts. T

heTe

mpl

ate sp

ecified

in th

esu

bTem

plat

eLis

tm

ust b

e an

Opt

ions

Tem

plat

e an

d m

ust

incl

ude

all t

heob

ject

s lis

ted

in th

eIN

DEX

clau

se a

sSc

ope

Fiel

ds.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

44 4m

ibO

bje

ctVa

lueR

ow

An IP

FIX

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

asi

ngle

row

of a

conc

eptu

al ta

ble

will

be

expo

rted

.Th

e M

IB O

bjec

tId

entifi

er("mibObjec

tIde

ntifi

er")

for t

his fie

ldm

ust b

e ex

port

edin

a M

IB F

ield

Opt

ion

or v

iaan

othe

r mea

ns.

This

Info

rmat

ion

Elem

ent i

s us

ed fo

rM

IB o

bjec

ts w

ith a

synt

ax o

fSE

QUE

NCE

. Thi

s is

enco

ded

as a

subT

empl

ateL

ist o

fm

ibO

bjec

tVal

ueIn

form

atio

nEl

emen

ts. T

hesu

bTem

plat

eLis

tex

port

ed m

ust

cont

ain

exac

tly o

nero

w (t

hat i

s, o

nein

stan

ce o

f the

subT

empl

ate)

. The

Tem

plat

e sp

ecified

in th

esu

bTem

plat

eLis

tm

ust b

e an

Opt

ions

Tem

plat

e an

d m

ust

incl

ude

all t

heob

ject

s lis

ted

in th

eIN

DEX

clau

se a

sSc

ope

Fiel

ds.

Reference 319

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

44 5mibObje

ctId

entif

ier

An IP

FIX

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

a M

IBO

bjec

t Ide

ntifier

(MIB

OID

) is

expo

rted

in th

e(O

ptio

ns) T

empl

ate

Reco

rd. T

hemibObjec

tIde

ntifier

Info

rmat

ion

Elem

ent c

onta

ins

the

OID

ass

igne

dto

the

MIB

obj

ect

type

defi

nitio

nen

code

d as

ASN

.1/B

ER[X

.690

].

44 6mibSu

bIde

ntifier

A no

n-ne

gativ

esu

b-iden

tifier

of a

nO

bjec

t Ide

ntifier

(OID

).


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

44 7m

ibIn

dexI

ndic

ator

A se

t of b

it fie

lds

that

is u

sed

for

mar

king

the

Info

rmat

ion

Elem

ents

of a

Dat

aRe

cord

that

ser

veas

INDE

X M

IBob

ject

s fo

r an

inde

xed

colu

mna

rM

IB o

bjec

t. Ea

chbi

t rep

rese

nts

anIn

form

atio

nEl

emen

t in

the

Data

Reco

rd, w

ith th

e n-

th le

ast s

ignific

ant

bit r

epre

sent

ing

the

n-th

Info

rmat

ion

Elem

ent.

A bi

t set

to 1

indi

cate

s th

atth

e co

rres

pond

ing

Info

rmat

ion

Elem

ent i

s an

inde

xof

the

colu

mna

rob

ject

repr

esen

ted

by th

em

ibO

bjec

tVal

ue. A

bit s

et to

0in

dica

tes

that

this

is n

ot th

e ca

se.

If th

e Da

ta R

ecor

dco

ntai

ns m

ore

than

64 In

form

atio

nEl

emen

ts, t

heco

rres

pond

ing

Tem

plat

e m

ust b

ede

sign

ed s

uch

that

all i

ndex

fields

are

amon

g th

e fir

st 6

4In

form

atio

nEl

emen

ts, b

ecau

seth

em

ibIn

dexI

ndic

ator

only

con

tain

s 64

bits

. If t

he D

ata

Reco

rd c

onta

ins

less

than

64

Info

rmat

ion

Elem

ents

, the

n th

eex

tra

bits

in th

em

ibIn

dexI

ndic

ator

for w

hich

no

corr

espo

ndin

gIn

form

atio

nEl

emen

t exi

sts

mus

t hav

e th

eva

lue

0 an

d m

ust

be d

isre

gard

ed b

yth

e Co

llect

or. T

his

Info

rmat

ion

Elem

ent m

ay b

eex

port

ed w

ithIP

FIX

redu

ced-

size

enco

ding

.

Reference 321

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

44 8m

ibCa

ptur

eTim

eSe

man

tics

Indi

cate

s w

hen

inth

e lif

etim

e of

the

Flow

the

MIB

val

ueis

retr

ieve

d fr

omth

e M

IB fo

r amibObjec

tIde

ntifier

. Thi

s is

use

d to

indi

cate

if th

e va

lue

expo

rted

isco

llect

ed fr

om th

eM

IB c

lose

r to

Flow

crea

tion

or F

low

expo

rt ti

me

and

refe

rs to

the

Tim

esta

mp fie

lds

incl

uded

in th

esa

me

Data

Rec

ord.

This

field

mus

t be

used

whe

nex

port

ing

am

ibO

bjec

tVal

ueth

at spe

cifie

sco

unte

rs o

rst

atis

tics.

If th

e M

IB v

alue

issa

mpl

ed b

y SN

MP

prio

r to

the

IPFI

XM

eter

ing

Proc

ess

or E

xpor

ting

Proc

ess

retr

ievi

ngth

e va

lue

(tha

t is,

the

data

is a

lread

yst

ale)

and

it is

impo

rtan

t to

know

the

exac

t sam

plin

gtim

e, th

en a

nad

ditio

nal

obse

rvat

ionT

ime*

elem

ent m

ust b

epa

ired

with

the

OID

usin

g IP

FIX

Stru

ctur

ed D

ata

[RFC

6313

].Si

mila

rly, i

fdi

ffere

nt M

IBca

ptur

e tim

esap

ply

to d

iffer

ent

mib

Obj

ectV

alue

elem

ents

with

inth

e Da

ta R

ecor

d,th

en in

divi

dual

mib

Capt

ureT

imeS

em

antic

sIn

form

atio

nEl

emen

ts m

ust b

epa

ired

with

eac

hO

ID u

sing

IPFI

XSt

ruct

ured

Dat

a.

Valu

es:

•0 un

defin

ed•

1 be

gin

- The

valu

e fo

r the

MIB

obje

ct is

capt

ured

from

the

MIB

whe

n th

eFl

ow is

first

obse

rved

•2

end

- The

val

uefo

r the

MIB

obje

ct is

capt

ured

from

the

MIB

whe

n th

eFl

ow e

nds

•3

expo

rt -

The

valu

e fo

r the

MIB

obje

ct is

capt

ured

from

the

MIB

at e

xpor

ttim

e•

4 av

erag

e - T

heva

lue

for t

he M

IBob

ject

is a

nav

erag

e of

mul

tiple

cap

ture

sfr

om th

e M

IBov

er th

eob

serv

ed li

fe o

fth

e Fl

ow


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

44 9m

ibCo

ntex

tEng

ineI

D

A mib

Cont

extE

ngin

eID

that

spe

cifie

s th

eSN

MP

engi

ne ID

for

a M

IB field

bein

gex

port

ed o

ver

IPFI

X. Defi

nitio

n.

45 0m

ibCo

ntex

tNam

eAn

Info

rmat

ion

Elem

ent t

hat

deno

tes

that

a M

IBco

ntex

t nam

e is

spec

ified

for a

MIB

field

bei

ngex

port

ed o

ver

IPFI

X.

45 1m

ibO

bje

ctN

ame

The

nam

e (c

alle

d a

desc

ripto

r in

[RFC

2578

] of a

nob

ject

type

defin

ition

.

45 2m

ibO

bje

ctDe

scri

ptio

n

The

valu

e of

the

DESC

RIPT

ION

clau

se o

f a M

IBob

ject

type

defin

ition

.

Reference 323

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

45 3m

ibO

bje

ctSy

ntax

The

valu

e of

the

SYN

TAX

clau

se o

f aM

IB o

bjec

t typ

ede

finition

, whi

chm

ay in

clud

e a

text

ual c

onve

ntio

nor

sub

-typ

ing.

45 4m

ibM

odul

eNam

eTh

e te

xtua

l nam

eof

the

MIB

mod

ule

that

defi

nes

a M

IBob

ject

.

45 5m

obile

IM

SITh

e In

tern

atio

nal

Mob

ileSu

bscr

iptio

nId

entit

y (I

MSI

).Th

e IM

SI is

ade

cim

al d

igit

strin

gw

ith u

p to

am

axim

um o

f 15

ASCI

I/UT

F-8

enco

ded

digi

ts(0

x30

- 0x3

9).


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

45 6m

obile

MSI

SDN

The

Mob

ile S

tatio

nIn

tern

atio

nal

Subs

crib

erDi

rect

ory

Num

ber

(MSI

SDN

). Th

eM

SISD

N is

ade

cim

al d

igit

strin

gw

ith u

p to

am

axim

um o

f 15

ASCI

I/UT

F-8

enco

ded

digi

ts(0

x30

- 0x3

9).

45 7ht

tpSt

atus

Code

The

HTT

PRe

spon

se S

tatu

sCo

de, a

s de

fined

inse

ctio

n 6

of[R

FC72

31],

asso

ciat

ed w

ith a

flow

. Im

plie

s th

atth

e flo

w re

cord

repr

esen

ts a

flow

cont

aini

ng a

n H

TTP

Resp

onse

.

Reference 325

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

45 8so

urce

Tran

spor

tPor

tsLi

mit

This

Info

rmat

ion

Elem

ent c

onta

ins

the

max

imum

num

ber o

f IP

sour

ce tr

ansp

ort

port

s th

at c

an b

eus

ed b

y an

end

user

whe

n se

ndin

gIP

pac

kets

; eac

hus

er is

ass

ocia

ted

with

one

or m

ore

(sou

rce)

IPv4

or

IPv6

add

ress

es.

This

Info

rmat

ion

Elem

ent i

spa

rtic

ular

ly u

sefu

lin

add

ress

-sha

ring

depl

oym

ents

that

adhe

re to

REQ

-4 o

f[R

FC68

88].

Lim

iting

the

num

ber o

f por

tsas

sign

ed to

eac

hus

er e

nsur

esfa

irnes

s am

ong

user

s an

d m

itiga

tes

the

deni

al-o

f-se

rvic

e at

tack

that

a us

er c

ould

laun

chag

ains

t oth

er u

sers

thro

ugh

the

addr

ess-

shar

ing

devi

ce in

ord

er to

grab

mor

e po

rts.

por

ts


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

45 9ht

tpRe

que

stM

etho

d

The

HTT

P re

ques

tm

etho

d, a

s de

fined

in s

ectio

n 4

of[R

FC72

31],

asso

ciat

ed w

ith a

flow

. Str

ing

with

up

to 8

UTF

-8ch

arac

ters

.

46 0ht

tpRe

que

stH

ost

The

HTT

P re

ques

tho

st, a

s de

fined

inse

ctio

n 5.

4 of

[RFC

7230

] or,

inth

e ca

se o

f HTT

P/2,

the

cont

ent o

fth

e :a

utho

rity

pseu

do-h

eade

rfie

ld a

s de

fined

inse

ctio

n 8.

1.2.

3 of

[RFC

7240

].En

code

d in

UTF

-8.

Reference 327

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

46 1ht

tpRe

que

stTa

rget

The

HTT

P re

ques

tta

rget

, as de

fined

in s

ectio

n 2

of[R

FC72

31] a

nd in

sect

ion

5.3

of[R

FC72

30],

asso

ciat

ed w

ith a

flow

. Or t

he H

TTP/

2":

path

" pse

udo-

head

er field

asde

fined

in s

ectio

n8.

1.2.

3 of

[RFC

7240

].En

code

d in

UTF

-8.

46 2ht

tpM

essa

geVe

rsio

n

The

vers

ion

of a

nH

TTP/

1.1

mes

sage

as in

dica

ted

by th

eH

TTP-

vers

ion fie

ld,

defin

ed in

sec

tion

2.6

of [R

FC72

30],

or th

e ve

rsio

niden

tifica

tion

of a

nH

TTP/

2 fr

ame

asde

fined

in[R

FC72

40] s

ectio

n3.

1. T

he le

ngth

of

this

field

is li

mite

dto

10

char

acte

rs,

UTF-

8 en

code

d.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

46 3na

tIns

tanc

eID

This

Info

rmat

ion

Elem

ent u

niqu

ely

iden

tifies

an

Inst

ance

of t

heN

AT th

at ru

ns o

n a

NAT

mid

dleb

oxfu

nctio

n af

ter t

hepa

cket

pas

ses

the

Obs

erva

tion

Poin

t.na

tIns

tanc

eID

isde

fined

in[R

FC76

59]

Reference 329

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

46 4in

tern

alAd

dres

sRe

alm

This

Info

rmat

ion

Elem

ent r

epre

sent

sth

e in

tern

alad

dres

s re

alm

whe

re th

e pa

cket

isor

igin

ated

from

or

dest

ined

to. B

yde

finition

, a N

ATm

appi

ng c

an b

ecr

eate

d fr

om tw

oad

dres

s re

alm

s,on

e fr

om in

tern

alan

d on

e fr

omex

tern

al. R

ealm

sar

e im

plem

enta

tion

depe

nden

t and

can

repr

esen

t a V

irtua

lRo

utin

g an

dFo

rwar

ding

(VRF

)ID

, a V

LAN

ID, o

rso

me

uniq

ueiden

tifier. R

ealm

sar

e op

tiona

l, an

dw

hen

left

unsp

ecified

, wou

ldm

ean

that

the

exte

rnal

and

inte

rnal

real

ms

are

the

sam

e.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

46 5ex

tern

alAd

dres

sRe

alm

This

Info

rmat

ion

Elem

ent r

epre

sent

sth

e ex

tern

alad

dres

s re

alm

whe

re th

e pa

cket

isor

igin

ated

from

or

dest

ined

to. T

hede

taile

d de

finition

is in

the

inte

rnal

addr

ess

real

m a

ssp

ecified

abo

ve.

Reference 331

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

46 6na

tQuo

taE

xcee

ded

Even

t

This

Info

rmat

ion

Elem

ent ide

ntifies

the

type

of a

NAT

Quo

ta E

xcee

ded

even

t. Va

lues

for

this

Info

rmat

ion

Elem

ent a

re li

sted

in th

e N

AT Q

uota

Exce

eded

Eve

ntTy

pe re

gist

ry, s

ee[http://

www.ia

na.org/

assign

men

ts/ip

fix/

ipfix

.xhtml#

ipfix

-na

t-qu

ota-

exce

eded

-eve

nt].

New

ass

ignm

ents

of v

alue

s w

ill b

ead

min

iste

red

byIA

NA

and

are

subj

ect t

o Ex

pert

Revi

ew [R

FC81

26].

Expe

rts

need

toch

eck de

finition

s of

new

val

ues

for

com

plet

enes

s,ac

cura

cy, a

ndre

dund

ancy

.


Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

46 7na

tThr

esho

ldEv

ent

This

Info

rmat

ion

Elem

ent ide

ntifies

a ty

pe o

f a N

ATTh

resh

old

even

t.Va

lues

for t

his

Info

rmat

ion

Elem

ent a

re li

sted

in th

e N

ATTh

resh

old

Even

tTy

pe re

gist

ry, s

ee[http://

www.ia

na.org/

assign

men

ts/ip

fix/

ipfix

.xhtml#

ipfix

-na

t-thresh

old-

even

t]. N

ewas

sign

men

ts o

fva

lues

will

be

adm

inis

tere

d by

IAN

A an

d ar

esu

bjec

t to

Expe

rtRe

view

[RFC

8126

].Ex

pert

s ne

ed to

chec

k de

finition

s of

new

val

ues

for

com

plet

enes

s,ac

cura

cy, a

ndre

dund

ancy

.

Reference 333

Tabl

e 3.

IPFI

X In

form

atio

n El

emen

ts(c

ontin

ued)

Ele

me

ntI

D

Nam

eDe

scrip

tion

Uni

ts

46 8ht

tpUs

erAg

ent

The

HTT

P Us

er-

Agen

t hea

der fi

eld

as defi

ned

inse

ctio

n 5.

5.3

of[R

FC72

31].

Enco

ded

in U

TF-8

.

46 9ht

tpCo

nten

tTyp

eTh

e H

TTP

Cont

ent-

Type

hea

der fi

eld

as defi

ned

inse

ctio

n 3.

1.1.

5 of

[RFC

7231

].En

code

d in

UTF

-8.

47 0ht

tpRe

ason

Phra

se

The

HTT

P re

ason

phra

se a

s de

fined

in s

ectio

n 6.

1 of

of

[RFC

7231

].

Related informationIP Flow Information Export (IPFIX) EntitiesSpecification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information

SNMP formulasDetailed information about the SNMP formulas and their structure in Network Performance Insight.

This information is intended for Network Administrators who must understand the metrics and formulasand their structure that are available in the technology packs. You can see the discovery formulas,collection formulas, metrics, and the required MIB files in the installation directories for the technologypacks that are installed in your environment.

For more information about them, see Installing the Technology Packs section in Installing and ConfiguringIBM Network Performance Insight.

The administrators can modify the formulas or use this information for data validation and interpretation.

SNMP formula languageDetailed information about the SNMP formula language that can be used to create custom collectionformulas, discovery formulas, and metrics.

Technology Pack Development Tool can be used to craft these formulas and metrics.

All the custom content can be validated, bundled, and installed in Network Performance Insight systemaccording to your requirements.

Language basicsSpecific formula language that is supported in Network Performance Insight. This formula language canbe used by application engineers who need to create the custom content for new devices in network.

Formulas

A formula is a calculation that is performed against an SNMP data. It is written in a proprietary language.You can use a formula to customize the information collected by Network Performance Insight.

Two types of formulas:


https://www.iana.org/assignments/ipfix/ipfix.xhtml

https://tools.ietf.org/html/rfc7011

Discovery formulas

Discovery formulas are used against managed nodes or hosts and their resources. These formulas aredesigned to return a list of resources from a device. You can write a new discovery formula to includea device that does not have an in-built support in Network Performance Insight.

Collection formulas

It is a collection of OID functions, and standard mathematical operations that are applied to aresource type to perform a computation.

Collection formulas are used to collect metrics about the status of the devices in your network duringpolling. These formulas are applied against a resource or managed item in the host to produce a result(numeric). The result is saved in the timeseries database. A resource type can be a physical or logicalobject such as port, interface, virtual circuit, or DLCI.

Network Performance Insight has many predefined collection formulas in Technology Packs that areavailable in the media. However, you can write additional formulas for a customized collectionprocess.

Metrics

Collected data values. From the database perspective, a metric is a single data value that can beidentified by a resource. From the reporting perspective, a metric is a data value shown in a report. It is aset of database metrics, pre-aggregated over time by using a statistical function like average or maximum.A report metric can be aggregated across a set of resources and their types.

MIB files

Management Information Base (MIB) is a collection of information that is organized hierarchically. MIBsprovide definitions for the properties of a managed object within a device.

Writing custom discovery formulasDiscovery formulas are used against devices and their resources during discovery and are designed toreturn a list of resources from a device.

Discovery process

The discovery process consists of several steps.

• Tivoli Network Manager performs the first-level discovery and returns the following information:

– Devices– SNMP credentials for the devices

• During the second-level discovery, Network Performance Insight runs discovery to get a list of resourcesfrom the discovered devices based on the applicable discovery formulas.

• If a new device is added to Tivoli Network Manager system, the ad hoc discovery is run. Resources arediscovered on the device and updated in the database.

Note: Network Performance Insight comes with predefined vendor-specific discovery formulas and theirrequired MIB files. All the discovery files and their MIB files are available in /opt/IBM/npi/npi-itnm-collector/discovery/content directory.

You can use the Technology Pack Development Tool to create, validate, package your own discoveryformulas.

Reference 335

Discovery formula structureAll the discovery formula files must have the file extension as .discovery.

when clause

Specifies the resource types that are appropriate for executing a specific discovery formula. Thecomponents of when clause are as follows:

• resource.type

resource.type = 'device'

Resource type device is discovered by Tivoli Network Manager in first-level discovery. Currently, onlythe device resource type is supported by Tivoli Network Manager and resources from the discovereddevices are discovered by Network Performance Insight in second-level discovery.

Note: The value for resource.type must be in single quotation marks.• resource.sysobjectid

You can narrow the discovery to a specific vendor type by specifying the sysobjectid. Thesysobjectid represents the type of device and can also indicate the model number in a dotteddecimal format. For example:

Table 4. Vendor and model identification numbers

Vendor OID

Cisco 1.3.6.1.4.1.9

Huawei 1.3.6.1.4.1.2011

Juniper 1.3.6.1.4.1.2636

Juniper Networks/Unisphere 1.3.6.1.4.1.4874

For more information about the vendor and model identification numbers, see IANA-registered PrivateEnterprise Numbers.

All the discovery files that have the same sysobjectid as that is returned from system-objectid.discovery are run to obtain the resources from those devices.

• name.<IP_address>

It is the IP address of an interface or device.

Example

when resource.type = 'device' and resource.sysobjectid like '1.3.6.1.4.1.9'

Note: The value for sysobjectid must be in single quotation marks.

select statement

In Network Performance Insight discovery, MIB tables are represented as relational database tables.Hence you can write the discovery definitions in SQL.

Selects data from a table or multiple tables. An SQL statement that retrieves resource properties from thetables that are available in the associated vendor-specific MIB file. The select statement has thefollowing components:

property namesA list of property names and their aliases.


https://www.alvestrand.no/objectid/1.3.6.1.4.1.html

https://www.alvestrand.no/objectid/1.3.6.1.4.1.html

from table expressionSelects data from a table or multiple tables. In this case, it is <MIB _file_name.MIB_table_name>. Forexample:

when resource.type = 'device' and resource.sysobjectid like '1.3.6.1.4.1.9'select index, ciscomemorypooltype as memoryPoolType, ciscomemorypoolname as memoryPoolName, ciscomemorypoolvalid as memoryPoolValid from CiscoMemoryPoolMib.ciscoMemoryPoolTable where ciscomemorypoolvalid = 1set type = 'memory'set vendor = 'Cisco'set name = context.host + '_MemoryPool<' + resource.index + '>'

• CiscoMemoryPoolMib is the code representation of the MIB file CISCO-MEMORY-POOL-MIB.

You can get these details by running the bin/snmp-mib-tool pack-demo list command fromthe Technology Pack Development Tool installation directory.

• ciscoMemoryPoolTable is MIB table from CISCO-MEMORY-POOL-MIB file.

You can get these details by running the bin/snmp-mib-tool pack-demo show CISCO-MEMORY-POOL-MIB command from the Technology Pack Development Tool installation directory.

join table expressionJoins tables to combine rows from two or more tables, based on a related column between them. Thedifferent types of joins in SQL are as follows:

• inner join

Returns records that have matching values in both tables.• left join

Returns all records from the left table, and the matched records from the right table. It is alsoknown as outer join.

• right join

Returns all records from the right table, and the matched records from the left table. It is alsoknown as outer join.

• full join

Returns all records when there is a match in either left or right table.

Note:

• The index column is a special column that discovery adds automatically to the MIB tables. Itcontains the MIB index details.

• If the select statement contains joins with multiple tables and the column name is not unique for atable, then you must add the MIB table name to qualify the column name. For example,ciscoMemoryPoolTable.index.

• In V1.3.1, there is no support for scalar MIBs.

where conditionThe where condition is used to extract only those records that fulfill a specified condition.

Operators

You can use all the SQL supported operators in the select statements. Typically, the followingoperators are used in the predefined discovery formulas.like

The like operator is used in a where clause to search for a specified pattern in a column.IN

The IN operator allows you to specify multiple values in a where clause.ON

ON represents one or more JOIN conditions by which to match the records from one table toanother.

Reference 337

Example

select hwEntityStateTable.index, hwEntityAdminStatus, hwEntityOperStatus, hwEntityStandbyStatus, hwEntityTemperature, entPhysicalTable.index, entPhysicalIndex, entPhysicalDescr, entPhysicalVendorType, entPhysicalName, entPhysicalClass from HuaweiEntityExtentMib.hwEntityStateTable left join EntityMib.entPhysicalTable on hwEntityStateTable.index = entPhysicalTable.index where entPhysicalClass = 6

Note: You can use complex nested select statements to create your discovery formulas by using theTechnology Pack Development Tool.

set definitions

Discovery formulas provide an additional way to add resource properties. The set definition can contain aliteral string, or combination of discovered properties, or special placeholder called context. For example:

set type = '<resource_type>'set vendor = '<vendor>'set id = context.host + '_<resource_name>:<' + resource.index + '>'

The expressions in the set definitions are as follows:

• context

context is the special place holder that is used in the discovery formulas. It contains the following twocomponents:

– host

The context.host string returns the host name of the device. In this case, it is the IP address of thedevice that is returned from Tivoli Network Manager.

– port

The context.port string returns the SNMP port number of the device.

The expression, set name = context.host + '_Huawei_PowerSupply:<' + resource.index+ '>' results in the name as:

10.55.239.56_Huawei_PowerSupply:<1835017>

Example

set type = 'card'set vendor = 'Huawei'set id = context.host + '_Huawei_PowerSupply:<' + resource.index + '>'

unset definitions

Unset removes or deletes the specified set values.

Example

unset jnxfilleddescrunset jnxoperatingcontentsindexunset jnxoperatingl1indexunset jnxoperatingl2indexunset jnxoperatingl3index

Note: The set and unset definitions support JavaScript expressions.

Required properties

• type


Resource type to which the resource that is discovered belongs to. The resource types can beconfigured from Resource Types page in System Configuration on Dashboard Application Services Hubportal.

In Cisco devices, it can be memory, environment, temperature, fan, cpu, and others.

For more information, see Configuring resource types in Installing and Configuring IBM NetworkPerformance Insight.

• vendor

Vendor device to which the discovery formula is applicable.• id

The resource on the device for which the discovery is to be done.• index

Index number of the resource.

Stitch definitions

Create a discovery file with stitch definitions. The format of the syntax is as follows:

RELATE <source_resource_type> TO <target_resource_type> AS <relation_type> WHEN <filtering and joining conditions>

Note:

• You can specify multiple releate conditions.• The when clause meant for two purposes; condition for joining source and target resources and filtering

unrelated relate rules for a device's resources.• The definition file must not be shared with the discovery definitions above.

For example:

Relate interface To channel AS contain when source.AP_Name == target.AP_Name && source.ap_slot_Id == target.ap_slot_Id && source.vendor == 'Cisco'

SNMP bulk get

Packs such as Huawei NQA requires to get stats values from tables that have dynamic or running indexes.It is not possible to obtain these indexes during discovery.

During discovery, the index property must have static indexes only and for dynamic indexes, it must bereplaced with *. For example:

when resource.type = 'device' and resource.sysobjectid like '1.3.6.1.4.1.2011'select * from NqaMib.nqaAdminCtrlTableset vendor='Huawei'set type='probe'set id='HuaweiNQA<'+resource.index+'>'set index=resource.index+'.*'

Note: set index = resource.index + '.*' appends '*' to the end of index property.

ExamplesSome vendor-specific discovery formula examples:

Reference 339

Ciscocisco-powersupply.discovery

when resource.type = 'device' and resource.sysobjectid like '1.3.6.1.4.1.9'select index, ciscoenvmonsupplystatusdescr as envPowerSupplyStatusDescription, ciscoenvmonsupplystate as envPowerSupplyState, ciscoenvmonsupplysource as envPowerSupplySource from CiscoEnvmonMib.ciscoEnvMonSupplyStatusTable where ciscoenvmonsupplystate!=5set type = 'environment'set vendor = 'Cisco'set id = context.host + '_PowerSupply:<' + resource.index + '>'

Juniperjuniper-chassis.discovery

when resource.type = 'device' and resource.sysobjectid like '1.3.6.1.4.1.2636'SELECT jnxContentsTable.index, jnxOperatingContentsIndex, jnxOperatingL1Index, jnxOperatingL2Index, jnxOperatingL3Index, jnxOperatingDescr as jnxOperatingDescription, jnxContainersIndex, jnxContainersView, jnxContainersLevel, jnxContainersDescr as jnxContainersDescription, jnxFilledState, jnxFilledDescr as jnxFilledDescription, jnxFilledContainerIndex, jnxContentsContainerIndex, jnxContentsSerialNo, jnxContentsRevision, jnxContentsPartNo FROM JuniperMib.jnxContentsTable INNER JOIN JuniperMib.jnxContainersTable ON jnxContentsTable.jnxContentsContainerIndex = jnxContainersTable.jnxContainersIndex INNER JOIN JuniperMib.jnxFilledTable ON jnxContentsTable.index = jnxFilledTable.index INNER JOIN JuniperMib.jnxOperatingTable ON jnxContentsTable.index = jnxOperatingTable.indexWHERE jnxOperatingDescr NOT LIKE '%temp sensor%' AND (jnxOperatingDescr LIKE '%SSB%' OR jnxOperatingDescr LIKE '%SCB%' OR jnxOperatingDescr LIKE '%SFM%' OR jnxOperatingDescr LIKE '%FEB%' OR jnxOperatingDescr LIKE '%FPC%' OR jnxOperatingDescr LIKE '%PIC%' OR jnxOperatingDescr LIKE '%midplane%')AND jnxContainersLevel = 0set type = 'chassis'set vendor = 'Juniper'set id = context.host + '_Chassis:<' + resource.jnxoperatingcontentsindex + '><' + resource.jnxoperatingl1index + '><' + resource.jnxoperatingl2index + '><' + resource.jnxoperatingl3index + '>'

Juniper ERXjunipererx-module.discovery

when resource.type = "device" and resource.sysobjectid like "1.3.6.1.4.1.4874"select 'module' as type,juniSystemSlotTable.index,junisystemslotstatus,junisystemslottype, juniSystemModuleTable.index,junisystemmoduleoperstatus as ModuleOperStatus, junisystemmodulecurrenttype as ModuleType from JuniperSystemMib.juniSystemSlotTable LEFT JOIN JuniperSystemMib.juniSystemModuleTable ON JuniperSystemMib.juniSystemSlotTable.index = JuniperSystemMib.juniSystemModuleTable.index where junisystemslotstatus =4 and junisystemslottype IN(1,2,16,17,18) and junisystemmodulecurrenttype IS NOT NULLset vendor = "Juniper"set CLASSNAME = "JuniperERX"set id = context.host + "_JuniperERXModule:<" + resource.index + ">"

Huaweihuawei-powersupply.discovery

when resource.type = 'device' and resource.sysobjectid like '1.3.6.1.4.1.2011'select hwEntityStateTable.index, hwEntityAdminStatus, hwEntityOperStatus, hwEntityStandbyStatus, hwEntityTemperature, entPhysicalTable.index, entPhysicalIndex, entPhysicalDescr, entPhysicalVendorType, entPhysicalName, entPhysicalClass from HuaweiEntityExtentMib.hwEntityStateTable LEFT JOIN EntityMib.entPhysicalTable ON hwEntityStateTable.index = entPhysicalTable.index where entPhysicalClass = 6set type = 'card'set vendor = 'Huawei'set id = context.host + '_Huawei_PowerSupply:<' + resource.index + '>'

Related informationH2 SQL Grammar


http://www.h2database.com/html/grammar.html

Writing custom collection formulasA collection formula is applied against a resource to produce a result that is always a number. The result isthen saved to the timeseries database. The collection formulas are executed regularly based on thepolling interval and applied on a larger scale than discovery formulas. These collection formulas must beas simple as possible.

About this taskExplains how to create custom collection formulas.

Collection formula structureUse this information to understand the syntax for writing the collection formulas easily. A collectionformula is a calculation that is performed against raw SNMP data. It is a combination of functions,conditions, and standard mathematical operations.

Collection formula structure

All collection formulas must have the extension .formula. If a formula file has more than one formula,save it with the extension .formulas.

Name of the formulaTypically, formula names follow a dot notation that includes the following structure:

<resource_group>.<metric_name>.<units>.formula

For example:

• Environment.Temperature.Level.Celcius.formula• Network.Outbound.Broadcast.pps.formulas

functionBuilt-in functions that can be used in the collection formula language that can perform a calculationon the metrics and return a value. See “Common functions” on page 343.

when clauseFilter condition to pick from the specified values or to compare the expression to determine the value.It contains a set of key value pairs.

when resource.type == 'card' && resource.vendor =='Huawei'

Note: All string values must be in single quotation marks.

resource typeTypically, the when condition must specify the resource type from which to poll that is followed byother conditions. For example:

when resource.type == 'interface' && number(resource.ifSpeed)>429496729

SNMP bulk get

In collection formulas, for those OIDs that return arrays of values, append 'Array' as suffix. For example:

nqaJitterStatsAvgJitterDS.octets = average(value(NQA_MIB.nqaJitterStatsAvgJitterDSArray)) when resource.vendor == 'Huawei'

Where, NQA_MIB.nqaJitterStatsAvgJitterDS is the OID. When bulk get is used on the OID, thenuse the suffix Array as NQA_MIB.nqaJitterStatsAvgJitterDSArray.

• The expression, value(NQA_MIB.nqaJitterStatsAvgJitterDSArray) returns an array of values.• To access the first element in the list, use value(NQA_MIB.nqaJitterStatsAvgJitterDSArray)[0].

Reference 341

• You can also use more advanced JavaScript array methods such as .reduce() can be used onJava.from(value(NQA_MIB.nqaJitterStatsAvgJitterDSArray)).

• Predefined functions such as max, min, sum, count, and average can also be used with these arrays.

• CPU.Utilization.Percent.formula

CPU.Utilization.Percent = value(CISCO_PROCESS_MIB.cpmCPUTotal5minRev) when resource.type == 'cpu' && resource.vendor =='Cisco'

• Network.Inbound.Broadcast.pps.formulas

Network.Inbound.Broadcast.pps = positive(delta(IF_MIB.ifHCInBroadcastPkts))/duration(IF_MIB.ifHCInBroadcastPkts)*100 when resource.type == 'interface' && number(resource.ifSpeed)>4294967295Network.Inbound.Broadcast.pps = positive(delta(IF_MIB.ifInBroadcastPkts))/duration(IF_MIB.ifInBroadcastPkts)*100 when resource.type == 'interface' && number(resource.ifSpeed)<4294967295

OperatorsThe operators supported by the formula language.

Mathematical conventions

The formula language uses standard priority rules between operators. Expressions are evaluated from leftto right, respecting parentheses and mathematical precedence rules. You can use parentheses to alterpriority or to increase readability.

Binary Operators

A list of the mathematical operators supported by the formula language.

Table 5. Mathematical Operators

Symbol Definition Comments

+ Addition When used between numbers,this is mathematical addition.When used between strings, thisis the concatenation operator.

- Subtraction or negation This symbol is used either as asubtraction operator, or in frontof an expression to negate thevalue of the expression.

* Multiplication

/ Division

% Modulo Returns the remainder. Forexample, 155 % 10 -> 5.

b& Binary AND Converts numbers to binary andperforms an AND operation.

For example:

252 b& 63 = 60

11111100 b& 00111111 = 00111100


Table 5. Mathematical Operators (continued)


b| Binary OR Converts numbers to binary andperforms an OR operation.

For example:

127 b| 128 = 255

01111111 b| 10000000 = 11111111

The result of a Boolean operation is an integer value: 0 for False , 1 for True . The value is considered to beFalse if it is 0, or True for any value other than 0.

Boolean Operators

Table 6. Boolean Operators


> Greater than

>= Greater than or equal

< Less than

<= Less than or equal

== Equal

!= Not equal

Like Like This is a string comparison tool.The right argument is a string thatcan contain wildcard characters.The wildcard characters are asfollows:

* -- Replaces 0 or morecharacters

? -- Replaces one character.

&& Logical AND

|| Logical OR

Common functionsThe common functions supported in collection formulas.

deltaPurpose

Returns the difference between the current value of binding x and its previous value. If delta()of a MIB object with counter syntax is negative, it is not considered a problem.

Reference 343

Syntax

delta (x)

x The value whose delta value you want to find.

Example

•positive(delta(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit))

Which is equal to:

positive(currentValue(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit) – previousValue(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit))

valuePurpose

Returns the value of a binding x. The value function is same as the currentValue function.

Syntax

value (x)

x The binding whose value you want to find.

Examples

•value(CISCO_ENVMON_MIB.ciscoEnvMonSupplyState)

valuesPurpose

Returns an array of values of a binding x that is stored in current state.Syntax

values(x)

x The binding whose values from its storedcurrent state that you want to find.

Example

positive(values(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit)[0])

durationPurpose

Returns the difference of the current value collection time and the previous value collection timeof a binding x.

Syntax

duration (x, ['seconds'])



seconds Optional argument that indicates the unit oftime. By default, it returns the value inmilliseconds. If you want the function to returnseconds, an argument 'second' must beadded to the formula. It can be given as any ofthe following formats in single quotationmarks:

• 's'• 'sec'• 'secs'• 'second'• 'seconds'

Example

•positive(delta(IF_MIB.ifHCOutUcastPkts)/duration(IF_MIB.ifHCOutUcastPkts))

Which is equal to:

positive(currentTime(IF_MIB.ifHCOutUcastPkts) – previousTime(IF_MIB.ifHCOutUcastPkts))

timePurpose

Returns the collection time of the current value of a binding x. The time function is same as thecurrentTime function.

Syntax

time (x, ['seconds'])




Example

positive(time(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit))

Reference 345

timesPurpose

Returns an array of collection times of all the values of a binding x that is stored in the currentstate.

Syntax

times(x, ['seconds'])




Example

positive(times(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit)[0])

currentTimePurpose

Returns the collection time of the current value of a binding x.Syntax

currentTime (x, ['seconds'])




Example

positive(currentTime(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit))


previousTimePurpose

Returns the collection time of the previous value of a binding.Syntax

previousTime (x, ['seconds'])




Example

previousTime(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit)

ratePurpose

Returns the rate of change between the current value and previous value of a binding.Syntax

rate (x, ['seconds'])




Example

positive(rate(IF_MIB.ifHCOutUcastPkts, 'second'))

Which is equal to:

Reference 347

positive(delta(IF_MIB.ifHCOutUcastPkts)/duration(IF_MIB.ifHCOutUcastPkts, 'second'))

currentValuePurpose

Returns the value of a binding x.Syntax

currentValue (x)

x The value whose currentValue value youwant to find.

Example

currentValue(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit)

previousValuePurpose

Returns the previous value of a binding.Syntax

previousValue (x)

x The value whose previousValue value youwant to find.

Example

previousValue(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit)

positivePurpose

Returns the value of the expression as follows:

• If the value of the binding is positive, it returns the value.• If the value of the binding is negative, it returns null. You can provide a default value to be

returned. For example, positive(-1, 10), it returns 10.• When you write a custom formula that uses positive function, enclose the function within the

expression so it returns a null value instead of zero. For example:

positive(value(RFC1213_MIB.ifOutOctets) * 8000)

returns null as intended Whereas:

positive(value(RFC1213_MIB.ifOutOctets)) * 8000

returns zero, which is incorrect.

Syntax

posistive (x, [default_value])


x The binding whose value is returned. If thebinding is positive, then the value is returned. Ifit is negative, then null is returned. If thebinding is a negative value, provide a defaultvalue. Then, the default value is returned.

[default_value] An optional argument. Value that must bereturned for a negative result from theexpression.

Example

positive(rate(IF_MIB.ifHCOutOctets, 'second')*8 / value(IF_MIB.ifHighSpeed)/10000)

Writing custom metricsA metric is a single collected data value that is identified by its generic name, timestamp, and value. Fromthe reporting perspective, a metric is a data value that is shown in a report. Metric files contain metadatasuch as metric name, description, and alias. For every collection formula, a corresponding metric file mustbe created.

About this taskExplains how to create custom metrics and use them in creating custom collection formulas. Allperformance metrics in Network Performance Insight are stored in timeseries database. These metricscan be displayed in real-time on Timeseries Data dashboard.

Metric structureTypical structure of a metric that is used in a collection formula. A metric has these components. Metricsstructure follows HOCON format, which is derived from JSON.

name

It is the normalized metric name for the same metric across all supported vendors. For example, the built-in metrics that are available in Technology Packs has the following structure:

<resource_group>-<metric_name>-<units>.metric

Note: All metrics must have an extension .metric.

description

Provide a simple description of what SNMP data that the metric returns. The data type for description isstring.

Note: Description must be in double quotation marks.

units

Provide an applicable unit for the metric based on the information that it represents and its result. Forexample:

• Number (count,type)• Percent• Bytes• Volt• Celsius• Milliseconds

Reference 349

aliases

An array of comma-separated vendor-specific formula names by which the metric can be identified. Itmust match the formula name that can be mapped to the metric name.

properties

It contains the resource types that are associated with this metric. This field can be left blank with openand closed braces.

Some examples of metrics are as follows:

• Environment-Voltage-Level-Volts.metric

name=Environment.Voltage.Level.Voltsdescription="The voltage of entity"units=voltaliases=[CiscoDevice Voltage Level,Huawei Voltage Level]properties={ resource-types="powerSupply,card"}

• CPU-Utilization-Percent.metric

name=CPU.Utilization.Percentdescription="The percentage of CPU utilization"units=Percentaliases=[cpuBusy,JuniperERX CPU Utilization,JuniperChassis CPU Utilization avg last 5min,Huawei CPU Utilization,CiscoDevice System CPU Utilization CPM]properties={ resource-types="cpu,card,device"}

• IP-Fragment-Failure-pps.metric

name=IP.Fragment.Failure.ppsdescription="The number of IP datagrams that is discarded because they needed to be fragmented at this entity but might not be."units=ppsaliases=[RFCMIBII Fragmentation Failures]properties={ resource-types="device"}

Related informationUsing HOCON, the JSON Superset

Dashboard referenceUse this reference to understand the Flow or entity metrics that are displayed on each dashboard, andother properties of the dashboard. The aggregations that are used on the NetFlow dashboards are alsospecified as applicable.

The following types of metrics are stored in Network Performance Insight database:

• Flow metrics

The raw metrics from Flow records are aggregated and stored FLOW_METRIC schema tables.• Entity metrics

The raw metrics that are discovered and polled from Tivoli Network Manager are aggregated and storedin ENTITY_METRIC schema tables.

These individual metrics and a combination of the metrics are displayed in various dashboards andwidgets. The data is queried and retrieved from the database with the help of REST APIs.


https://github.com/lightbend/config#using-hocon-the-json-superset

REST (REpresentational State Transfer) APIs rely on a stateless, client/server, cacheable communicationsprotocol. REST applications use HTTP requests to post data (create and update), read data (such asrunning queries), and delete data. REST is a lightweight alternative to mechanisms like RPC (RemoteProcedure Calls) and Web Services (such as SOAP and WSDL). Much like Web Services, a REST service is:

• Platform-independent• Language-independent• Standards-based (runs on top of HTTP)• Able to be used in the presence of firewalls.

Properties of the summary-level dashboardsSummary-level dashboards are strategic dashboards for organizational decisions that provide thesignificant overview about your network health and performance. These dashboards improve visibility bydisplaying metrics with birds-eye-view visualizations and to consolidate the insights.

Properties of the Network Performance Overview dashboardThis information provides the properties of the Network Performance Overview and its associatedwidgets.

Data flow to Network Performance Overview dashboard and its widgets

Widget name Metrics Type of data Technology Pack

Top 10 OutboundPacket Discard(Packets)

Network.Outbound.Discards.Count

Entity metric network-health-extension

Total Packet Drops PerQueue (Packets)

policyQosQueueDrop Flow metric N/A

Top 10 Inbound PacketDiscard (Packets)

Network.Inbound.Discards.Count


Top 10 Applications byTotal Delay (ms)

max(maxTotalRespTime)

Flow metric N/A

Top 10 Round-Trip Time(ms)

Probe.Echo.RTT.ms Entity metric • network-probe-cisco

• network-probe-huawei

• network-probe-juniper

Top 10 Probe Loss (%) Probe.Echo.Probe.Loss.Percent

Entity metric • network-probe-cisco



Top 10 VoIP InboundJitter (ms)

Probe.Jitter.Inbound.Avg.ms

Entity metric network-probe-cisco

Top 10 VoIP OutboundJitter (ms)

Probe.Jitter.Outbound.Avg.ms


Reference 351

Widget name Metrics Type of data Technology Pack

VoIP Voice Quality Probe.VOIP.MOS Entity metric network-probe-cisco

Probe.VOIP.ICPIF Entity metric network-probe-cisco

Top 10 OutboundUtilization (%)

Network.Outbound.Utilization.Percent


Top 10 Applications byTotal Volume (Octets)

APP_NAME Flow metric N/A

Top 10 InboundUtilization (%)

Network.Inbound.Utilization.Percent


Top 10 Applications byAverage Utilization (%)


Top 10 CPU Load (%) CPU.Utilization.Percent

Entity metrics • network-probe-cisco



Top 10 Memory Load(%)

Memory.Utilization.Percent




Related informationCreating simple poll policies

Properties of the Network Performance Overview by Deviation dashboardThis information provides the properties of the Network Performance Overview and its associatedwidgets.

Data flow to Network Performance Overview by Deviation dashboard and its widgets

Widget name Metrics Type of data Technology pack

Top 10 OutboundPacket DiscardDeviation (%)

Network.Outbound.Discards.Count


Total Packet Drops PerQueue (Packets)

policyQosQueueDrop Flow metric N/A

Top 10 Inbound PacketDiscard Deviation (%)

Network.Inbound.Discards.Count


Top 10 Applications byTotal Delay (ms)

max(maxTotalRespTime)

Flow metric N/A


https://www.ibm.com/support/knowledgecenter/SSSHRK_4.2.0/itnm/ip/wip/poll/task/nmip_poll_creatingpollswithsinglepolldefinition.html

Widget name Metrics Type of data Technology pack

Top 10 Round-Trip TimeDeviation (%)

Probe.Echo.RTT.ms Entity metric • network-probe-cisco



Top 10 Probe LossDeviation (%)

Probe.Echo.Probe.Loss.Percent

Entity metric • network-probe-cisco



Top 10 VoIP InboundJitter Deviation (%)

Probe.Jitter.Inbound.Avg.ms


Top 10 VoIP OutboundJitter Deviation (%)

Probe.Jitter.Outbound.Avg.ms


VoIP Voice Quality Probe.VOIP.MOS Entity metric network-probe-cisco

Probe.VOIP.ICPIF Entity metric network-probe-cisco

Top 10 OutboundUtilization Deviation (%)



Top 10 Applications byTotal Volume (Octets)


Top 10 InboundUtilization Deviation (%)



Top 10 Applications byAverage Utilization (%)


Top 10 CPU LoadDeviation (%)

CPU.Utilization.Percent




Top 10 Memory LoadDeviation (%)

Memory.Utilization.Percent




Related informationCreating simple poll policies

Reference 353

https://www.ibm.com/support/knowledgecenter/SSSHRK_4.2.0/itnm/ip/wip/poll/task/nmip_poll_creatingpollswithsinglepolldefinition.html

Properties of the WiFi Overview dashboardThis information provides the properties of the WiFi Overview and its associated widgets.

Data flow to WiFi Overview dashboard and its widgets

Widget Name Metrics Type of data Technology Pack

Total APs Controller.APs.Connected.Count

Entity metric wifi-health-cisco

Total SSIDs Controller.Ssid.Count


2.4GHz Clients Controller.2.4G.Total.Client.Count


5GHz Clients Controller.5G.Total.Client.Count


Clients by RSSI Quality Controller.Client.Count.RSSI.Good


Controller.Client.Count.RSSI.Average


Controller.Client.Count.RSSI.Poor


Clients by SNR Quality Controller.Client.Count.SNR.Good


Controller.Client.Count.SNR.Average


Controller.Client.Count.SNR.Poor


WiFi Network Details wlanSsid Entity metric wifi-health-cisco

wlanAdminStatus Entity metric

wlanQos [0:bronze,1:silver, 2:gold,3:platinum]

Entity metric

Ssid.Client.Count Entity metric

Access Point Details apName Entity metric wifi-health-cisco

apLocation Entity metric

apIpAddress Entity metric

apAdminStatus Entity metric

AP.Total.Associated.Client.Count

Entity metric

2.4GHz: Worst 10Performing Radio byChannel Utilization (%)

Radio.Slot.Channel.Utilization.2.4G.Percent


5GHz: Worst 10Performing Radio byChannel Utilization (%)

Radio.Slot.Channel.Utilization.5G.Percent




Worst 10 PerformingChannels byInterference

Channel.Interference.Utilization.Percent


Properties of the WiFi Client Count dashboardThis information provides the properties of the WiFi Client Count and its associated widgets.

Data flow to WiFi Client Count dashboard and its widgets


2.4GHz:Client CountTrend

Controller.2.4G.Total.Client.Count


5GHz:Client Count Trend Controller.5G.Total.Client.Count


Client Count by RSSIQuality Trend

Controller.Client.Count.RSSI.Good


Controller.Client.Count.RSSI.Average


Controller.Client.Count.RSSI.Poor


Client Count by SNRQuality Trend

Controller.Client.Count.SNR.Good


Controller.Client.Count.SNR.Average


Controller.Client.Count.SNR.Poor


Properties of WiFi Interference and Noise Performance dashboardThis information provides the properties of the WiFi Interference and Noise Performance and itsassociated widgets.

Data flow to WiFi Interference and Noise Performance dashboard and its widgets


Interference Score (%)Trend

Channel.Interference.Utilization.Percent


Interference Power(dBm) Trend

Channel.Interference.Power.dBm


Noise (dBm) Trend Channel.Noise.Power.dBm


Reference 355

Properties of the NetFlow dashboardsThis information provides the properties of all the NetFlow dashboards.

Data flow to the NetFlow dashboards and widgets

NetFlow dashboards Flow metrics are stored in Network Performance Insight database. The raw metricsfrom Flow records are aggregated and stored FLOW_METRIC schema tables.

The following table shows the data properties of the Top Talker views in the NetFlow dashboards.

Table 7. NetFlow Dashboards

Aggregation name Grouping keys

Top Applications with ToS IF_ID + APP_NAME+SRC_TOS

Top Applications IF_ID + APP_NAME

Top Destination Autonomous Systems IF_ID+BGP_DST_AS_NUM

Top Source Autonomous Systems IF_ID+BGP_SRC_AS_NUM

Top Autonomous System Conversations IF_ID+BGP_SRC_AS_NUM+BGP_DST_AS_NUM

Top Conversations with Application IF_ID+SRC_IP+DST_IP+APP_NAME

Top Conversations with ToS IF_ID+SRC_IP+DST_IP+SRC_TOS

Top Conversations IF_ID+SRC_IP+DST_IP

Top Destinations with Application IF_ID+DST_IP+APP_NAME

Top Destinations IF_ID+DST_IP

Top IP Group Conversations IF_ID +SRC_IP_GROUP+DST_IP_GROUP

Top IP Group Conversations withApplication

IF_ID +SRC_IP_GROUP+DST_IP_GROUP+APP_NAME

Top Source IP Groups with Protocol IF_ID+SRC_IP_GROUP+PROTOCOL_ID

Top Destination IP Groups with Protocol IF_ID+DST_IP_GROUP+PROTOCOL_ID

Top Source IP Groups with ToS IF_ID+SRC_IP_GROUP+SRC_TOS

Top IP Group Conversations with Protocol IF_ID +SRC_IP_GROUP+DST_IP_GROUP+PROTOCOL_ID

Top Destination IP Groups with ToS IF_ID+DST_IP_GROUP+SRC_TOS

Top Source IP Groups with Application IF_ID+SRC_IP_GROUP+APP_NAME

Top IP Group Conversations with ToS IF_ID +SRC_IP_GROUP+DST_IP_GROUP+SRC_TOS

Top Destination IP Groups IF_ID+SRC_IP_GROUP


Table 7. NetFlow Dashboards (continued)

Aggregation name Grouping keys

Top Source IP Groups IF_ID+SRC_IP_GROUP

Top Destination IP Groups with Application IF_ID+DST_IP_GROUP+APP_NAME

Top Protocols with Conversation IF_ID+PROTOCOL_ID+SRC_IP+DST_IP

Top Protocols with Destination IF_ID+PROTOCOL_ID+DST_IP

Top Protocols with Application IF_ID+PROTOCOL_ID+APP_NAME

Top Protocols with Source IF_ID+PROTOCOL_ID+SRC_IP

Top Protocols IF_ID+PROTOCOL_ID

QoS Queue Drops IF_ID+POLICY_QOS_CLASSIFICATION_HIERARCHY+POLICY_QOS_QUEUE_ID

Top Sources IF_ID+SRC_IP

Top Sources with Application IF_ID+SRC_IP+APP_NAME

Top ToS IF_ID+SRC_TOS

Properties of the Applications Response Overview dashboardThis information provides the properties of the Applications Response Overview and its associatedwidgets.

Data flow to Applications Response Overview dashboard and its widgets

The following table shows the flow data properties in Applications Response Overview dashboardwidgets.

Widget name Metrics

Top 10 Applications by Client Network Delay (ms) max(maxClientNwkTime)

Top 10 Applications by Server Network Delay (ms) max(maxServerNwkTime)

Top 10 Applications by Application Delay (ms) max(maxServerRespTime)

Top 10 Applications by Total Delay (ms) max(maxTotalRespTime)

Properties of the Network Traffic Overview dashboardThis information provides the properties of the Network Traffic Overview and its associated widgets.

Data flow to Network Traffic Overview dashboard and its widgets

The following table shows the flow data properties in Network Traffic Overview dashboard widgets.

Widget name Metrics

Top 10 Inbound Utilization (%) avg(interfaceInUtilization)

Top 10 Outbound Utilization (%) avg(interfaceOutUtilization)

Reference 357

Widget name Metrics

Utilization Deviation avg(interfaceInUtilization)

avg(interfaceOutUtilization)

Utilization interfaceInUtilization

interfaceOutUtilization

Traffic Volume (Octets) sum(interfaceInOctets)

sum(interfaceOutOctets)

Interface Speed (bps) speed

4-Weeks Utilization Trend avg(interfaceOutUtilization)

Utilization Trend interfaceOutUtilization

interfaceInUtilization

The following table shows the flow data properties of the Top Talkers views in the Network TrafficOverview dashboard.

Widget name Aggregation name Grouping keys

Top 10 Applications by TrafficVolume (Octets)

Top Application IF_ID + APP_NAME

Top 10 Protocols by TrafficVolume (Octets)

Top Protocols IF_ID+PROTOCOL_ID

Top 10 ToS by Traffic Volume(Octets)

Top ToS IF_ID+SRC_TOS

Top 10 Conversations by TrafficVolume (Octets)

Top Conversations IF_ID+SRC_IP+DST_IP

Top 10 Sources by Traffic Volume(Octets)

Top Sources IF_ID+SRC_IP

Top 10 Destinations by TrafficVolume (Octets)

Top Destinations IF_ID+DST_IP

Properties of the On Demand Filtering dashboardsThis information provides the properties of all the On Demand Filtering dashboards.

Device Health dashboard

Data flow to On Demand Filtering Device Health dashboard

The following table shows the metrics information that are displayed on the Device Health dashboard.


Table 8. Device Health

Displayed KPI Metrics Type of data Technology pack

Inbound Utilization(%)


Entity metric

network-health-generic

Outbound Utilization(%)


Inbound Errors(pkts)

Network.Inbound.Errors.Count

Outbound Errors(pkts)

Network.Outbound.Errors.Count

Inbound Discards Network.Inbound.Discards.Count

Outbound Discards Network.Outbound.Discards.Count

Inbound Volumes(octets)

Network.Inbound.Octets.Bytes

Outbound Volumes(octets)

Network.Outbound.Octets.Bytes

Inbound Throughput(bps)

Network.Inbound.Throughput.bps

OutboundThroughput (bps)

Network.Outbound.Throughput.bps

CPU (%) CPU.Interrupt.Utilization.Percent

network-health-juniper

Memory (%) Memory.Utilization.Percent

network-health-cisco

Temperature(celsius)

Environment.Temperature.Level.Celcius

network-health-cisco

network-health-juniper

network-health-huawei

Flow dashboard

Data flow to On Demand Filtering Flow dashboard

To view the data properties of the Top Talker views in the On Demand Filtering Flow dashboard, refer to“Properties of the NetFlow dashboards” on page 356.

HTTP Operations dashboard

Data flow to On Demand Filtering HTTP Operations dashboard

The following table shows the metrics information that are displayed on the HTTP Operations dashboard.

Reference 359

Table 9. HTTP Operations

KPI Displayed KPI Metrics Technology pack

http

RTT (ms) Probe.HTTP.RTT.ms

network-healthDNS RTT (ms) Probe.HTTP.DNS.RTT.ms

TCP Connect RTT (ms) Probe.HTTP.TCP-Connect.RTT.ms

Transaction RTT (ms) Probe.HTTP.Total.Transaction.RTT.ms

IPSLA dashboard

Data flow to On Demand Filtering IPSLA dashboard

The following table shows the metrics information that are displayed on the IPSLA dashboard.

Table 10. IPSLA

SLA Test Displayed KPI Metrics Technology pack

echo

tcpConnect

udpEcho

Probe Count (count) Probe.Echo.Probe.Count

network-health

Probe Loss (%) Probe.Echo.Probe.Loss.Percent

Probe Succeeded (%) Probe.Echo.Probe.Succeeded.Percent

RTT (ms) Probe.Echo.RTT.ms

http

RTT (ms) Probe.Echo.RTT.ms

network-health

DNS RTT (ms) Probe.HTTP.DNS.RTT.ms

TCP Connect RTT(ms)

Probe.HTTP.TCP-Connect.RTT.ms

Transaction RTT (ms) Probe.HTTP.Total.Transaction.RTT.ms

jitter

Inbound Jitter (ms) Probe.Jitter.Inbound.Avg.ms

network-health

Outbound Jitter (ms) Probe.Jitter.Outbound.Avg.ms

Inbound One WayLatency (ms)

Probe.Jitter.Inbound.One-way.Avg.ms

Outbound One WayLatency (ms)

Probe.Jitter.Outbound.One-way.Avg.ms

Inbound Packet Loss(%)

Probe.Jitter.Inbound.Packet.Loss.Percent

Outbound PacketLoss (%)

Probe.Jitter.Outbound.Packet.Loss.Percent


Table 10. IPSLA (continued)

SLA Test Displayed KPI Metrics Technology pack

rtp

Inbound Jitter (ms) Probe.RTP.Inbound.Inter-Arrival.Jitter.ms

network-health

Outbound Jitter (ms) Probe.RTP.Outbound.Inter-Arrival.Jitter.ms


Probe.RTP.Inbound.Jitter.Avg.ms


Probe.RTP.Outbound.Jitter.Avg.ms


Probe.RTP.Inbound.Packet.Loss.Percent


Probe.RTP.Outbound.Packet.Loss.Percent

RTT (ms) Probe.RTP.RTT.ms

voip

Inbound Jitter (ms) Probe.Jitter.Inbound.Avg.ms

network-health

Outbound Jitter (ms) Probe.Jitter.Outbound.Avg.ms


Probe.Jitter.Inbound.One-way.Avg.ms


Probe.Jitter.Outbound.One-way.Avg.ms


Probe.Jitter.Inbound.Packet.Loss.Percent


Probe.Jitter.Outbound.Packet.Loss.Percent

MOS (count) Probe.VOIP.MOS

For more information, see Supported IP SLA metrics and formulas section in IBM Network PerformanceInsight: References.

Configuring Flow devicesProvides the command reference with examples for configuring the flow devices to enable them to workwith IBM Network Performance Insight, Version 1.3.1.

Before Network Performance Insight can gather data, routers and other network devices must beconfigured to send NetFlow data. These configurations are needed to ensure that routers send NetFlowdata periodically to the Collector subsystem.

For more detailed information about setting up flow devices for Network Performance Insight, see thespecific vendor documentation.

CAUTION: Only IT administrators with experience in configuring routers and switches must usethis information.

Reference 361

Supported devices and flow formatsIBM Network Performance Insight, Version 1.3.1 supports most of the devices and their flow formats thatare available in the market.

Some of devices and their flow formats that Network Performance Insight v1.3.1 supports:

Device Flow format

Cisco NetFlow (v1, v5, v9, and IPFIX versions) andFlexible NetFlow with AVC

Juniper J-Flow (v5 and v9)

Alcatel Cflow (v5 and v9)

Huawei NetStream (v5 and v9)

Configuring NetFlow on Cisco routersNetflow is a data collection and reporting protocol for monitoring network traffic that is supported bymultiple vendors.

As a part of this configuration, network administrators must configure the devices to transmit NetFlowinformation actively to the network monitoring application and configure the interfaces to gatherinformation about the traffic conversations. The configurations that you perform must be in line with thecapacity of the network application. In this case, Network Performance Insight.

NetFlow also monitors layers 2-4 of Open Systems Interconnection (OSI) model and other flowtechnologies and provides information on network usage and port conversations activity.

Related informationCisco IOS Configuration Fundamentals Command Reference, Release 12.2

Cisco IOS command modesYou use the CLI to access Cisco IOS software.

Enter a question mark (?) at the CLI prompt to obtain a list of commands that are available for eachcommand mode.

When you log in to the CLI, you are in user EXEC mode. User EXEC mode contains only a limited subset ofcommands. To have access to all commands, you must enter privileged EXEC mode, normally by using apassword. From privileged EXEC mode, you can give any EXEC command; user or privileged mode. Or, youcan enter global configuration mode.

These configuration modes are needed for you to change the running configuration. If you later save therunning configuration to the start configuration, these changed commands are stored when the softwareis rebooted. To enter specific configuration modes, you must start at global configuration mode. Fromglobal configuration mode, you can enter interface configuration mode and various other modes, such asprotocol-specific modes.

Command modesDescribes how to use various common command modes of the Cisco IOS software.

Command modesShows examples of the prompts displayed.

Command mode Command

User Exec

When you log in to the CLI, you are in User Execmode. Contains only a limited subset ofcommands.

Router>


http://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/command/reference/ffun_r/frf001.html

Command mode Command

Privileged Exec

You can have access to all commands in this mode.Typically, require a password. Use the enablecommand. Your prompt changes to Router#.

Router> enablePassword <password>Router#

Global configuration

Enter the configure terminal privileged EXECcommand to enter global configuration mode. Yourprompt changes to Router(config)#.

Router# configure terminalRouter(config)#

Note: Enter configuration commands, one per line.End with CTRL+Z or Exit command.

Interface configuration

From global configuration mode, specify aninterface by using an interface command. Yourprompt changes to Router(config_if)#.

Note: Enter "?" to display what you must enter nexton the command line.

Router(config)# interface serial ?<0-6> Serial interface numberRouter(config)# interface serial 4 ?/Router(config)# interface serial 4/ ?<0-3> Serial interface numberRouter(config)# interface serial 4/0Router(config-if)#

ROM monitor mode

ROM monitor mode is a separate mode that is usedwhen the Cisco IOS software cannot load properly.From privileged EXEC mode, use the reload EXECcommand. Your prompt changes to rommon #>.

Router# reload>

Configuring Flexible NetFlow and Application Visibility and Control (AVC)Use these configuration steps to enable your devices for the mandatory Flow fields and the enterpriseFlow fields to support AVC solution.

About this task

AVC is integrated approach that provides application recognition and performance monitoring capabilitiesto your NetFlow enabled devices. The information that is collected by Cisco AVC is exported in an openstandard format such as Netflow Version 9 and IPFIX. These formats allow both Cisco and third-partynetwork management to support Cisco AVC solution.

The following Cisco AVC solution components are supported in Network Performance Insight:

• Network-Based Application Recognition (NBAR)• Next Generation Network-Based Application Recognition (NBAR2)• Application Response Time (ART)• Quality of Service (QoS)

Related informationConfiguration Examples for Flexible Netflow

Configuring standard Flow fieldsThe flow record defines the record fields that must be exported from the device to the collector.

About this task

Standard Flow fields configuration.

Reference 363

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/15-mt/fnf-15-mt-book/fnf-fnetflow.html#d6093e9393a1635

Procedure

1. Configure to specify where the Flow data must be exported to:

configure terminalflow exporter <NPI_exporter>destination 100.100.10.10source GigabitEthernet0/3transport udp 2050export-portocol netflow-v9# Configure this option template to support application id to name and description mappingoption application table# Configure if required to support NBAR2 for application attributesoption application attributesexit

2. Configure the Flow record to collect the Flow fields:

Note: This example is for NetFlow V9 records.

configure terminalflow record type performance-monitor Netflow_v9match ipv4/ipv6 tosmatch ipv4/ipv6 protocolmatch ipv4/ipv6 source addressmatch ipv4/ipv6 destination addressmatch transport source-portmatch transport destination-portmatch interface inputmatch application namecollect interface outputcollect counter bytescollect counter packetscollect flow directioncollect routing source ascollect routing destination ascollect routing next-hop address ipv4collect transport tcp flagscollect timestamp sys-uptime firstcollect timestamp sys-uptime lastexit

3. Configure the Flow monitor that creates new NetFlow cache and the required Flow record and FlowExporter:

configure terminalflow monitor <NPI_monitor>description Netflow v9 monitorrecord Netflow_v9exporter <NPI_exporter>exit

4. Configure to apply the Flow Monitor to an interface:

configure terminalinterface GigabitEthernet0/3ip flow monitor <NPI_monitor> inputip flow monitor <NPI_monitor> outputexit

Related informationCisco IOS Flexible NetFlow Command Reference

Configuring Quality of Service (QoS) on Cisco devicesQoS provides prioritization and rate-limiting of traffic. High-priority, latency-sensitive traffic can be putinto the priority queue.

About this task

QoS Flow fields configuration.


https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/command/fnf-cr-book.html

Procedure


configure terminalflow exporter <NPI_monitor>destination 100.100.10.10source GigabitEthernet0/3transport udp 2050export-portocol netflow-v9option application table # NBAR fields to support application id to name and description mappingoption application attributes [Configure if required to support NBAR2 for application attributesoption c3pl-policy-table # Configure if required to support QoS HIeararchy and Queue Drops reportingoption c3pl-class-table # Configure if required to support QoS HIeararchy and Queue Drops reportingexit

2. Configure the Flow record to collect the QoS fields:

configure terminalflow record type performance-monitor Netflow_v9match ipv4/ipv6 tosmatch ipv4/ipv6 protocolmatch ipv4/ipv6 source addressmatch ipv4/ipv6 destination addressmatch transport source-portmatch transport destination-portmatch interface inputmatch application namecollect interface outputcollect counter bytescollect counter packetscollect flow directioncollect routing source ascollect routing destination ascollect routing next-hop address ipv4collect transport tcp flagscollect policy qos class hierarchycollect policy qos queue idcollect timestamp sys-uptime firstcollect timestamp sys-uptime lastexit

a) Configure the QoS Queue Drops field collection:

Note: QoS Queue Drops must be configured in a separate Flow record as mandated by Cisco. SeeAVC Configuration.

configure terminalflow record type performance monitor QoS_Queue_Dropmatch policy qos queue indexcollect policy qos queue dropscollect interface outputcollect timestamp absolute monitoring-interval startcollect timestamp absolute monitoring-interval endexit


configure terminalflow monitor <NPI_monitor>description Netflow v9 monitorrecord Netflow_v9exporter <NPI_monitor>exit

Reference 365

https://www.cisco.com/c/en/us/td/docs/ios/solutions_docs/avc/guide/avc-user-guide/avc_config.html#63427

a) Configure the QoS monitor:

configure terminalflow monitor type performance-monitor <qos_Monitor>exporter <NPI_exporter>record QoS_Queue_Dropexit

b) Configure to create Performance Monitor Policy for QoS:

Note: Ensure that the required QoS policies and classes are defined. See AVC Configuration.

configure terminalpolicy-map type performance monitor pm-qosclass class-defaultflow monitor qos-monitorexit

4. Configure to apply the Flow Monitor to an interface:

configure terminalinterface GigabitEthernet0/3ip flow monitor NPI_monitor inputip flow monitor NPI_monitor outputservice-policy type performance monitor output pm-qosexit

Configuring Application Response Time (ART) on Cisco devicesART metrics are extracted or calculated by the ART engine. These metrics are available only for TCP flows.

About this task

ART Flow fields configuration.

Procedure


configure terminalflow exporter <NPI_exporter>destination 100.100.10.10source GigabitEthernet0/3transport udp 2050export-portocol netflow-v9option application table option application attributes exit

2. Configure a separate Flow record template for Application Response Time (ART) configuration as ARTrecords contain bi-directional data:

configure terminalflow record type performance-monitor ART_recordmatch ipv4/ipv6 protocolmatch application namematch connection client ipv4 addressmatch connection server ipv4 addressmatch connection server transport portcollect ipv4/ipv6 dscpcollect interface inputcollect interface outputcollect timestamp sys-uptime firstcollect timestamp sys-uptime lastcollect connection delay network to-server maxcollect connection delay network to-client maxcollect connection delay application maxcollect connection delay response client-to-server


https://www.cisco.com/c/en/us/td/docs/ios/solutions_docs/avc/guide/avc-user-guide/avc_config.html#63427


configure terminalflow monitor type performance-monitor ART-monitorexporter NPI_exporterrecord ART_recordexit

4. Create the Performance Monitor Policy:

configure terminalpolicy-map type performance monitor ARTclass class-defaultflow monitor ART-monitor

5. Associate the Performance Monitor to an interface:

configure terminalinterface <interface>service-policy type performance monitor output ART

Enabling NetFlow on your devicesTo enable NetFlow, configure IP routing and use these commands in global configuration mode.

About this taskEnabling flow monitoring for an interface.

Command Description

Router(config)# interface typeslot/port-adapter/port

Enters interface configuration mode and configuresthe interface.

For example, interfaceGigabitEthernet1/0/3

Router(config-if)# ip route-cache flow Enables NetFlow for IP routing.

Router(config-if)# ip route-cache ingressRouter(config-if)# ip route-cache egressRouter(config-if)# ip flow egressRouter(config-if)# ip flow ingress

Enables NetFlow on the sub interfaces withdirection.

Configuring the Flow ExportersNetFlow information can also be exported to network management applications.

About this taskTo configure a router to export NetFlow information that is maintained in the NetFlow cache to NetworkPerformance Insight, use these commands in global configuration mode. NetFlow information is exportedto Network Performance Insight when the Flow expires in NetFlow cache.

Reference 367

Command Description

Router(config)# ip flow-export ip-address udp-port

Where<IP_address>

IP address of the system to which you want to send theNetFlow information.

udp-portUDP protocol-specific port number.

Configures a router to export NetFlowcache entries to a Collector.

Note: To disable IP routing, use the noIP routing command as: no ip flow-export.

Router(config)# ip flow-export version 9 [peer-as | origin-as | bgp-nexthop]

Specifies that the export packet uses theVersion 9 format. Optionally, specify theorigin or peer autonomous systems.

• peer-as

Specifies that export statistics includethe originating autonomous system forthe source and destination.

• origin-as

Specifies that export statistics includethe peer autonomous system for thesource and destination.

• bgp-nexthop

Specifies that export statistics includeBGP next hop-related information.

show ip flow export Displays statistics for the NetFlow dataexport, including statistics for the maincache and for all other enabled caches.

Router(config)# ip flow-export source <interface>/<interface_number>

Sets the source IP address of theNetFlow exports that are sent by thedevice to the specified IP address.

Router(config)# ip flow-cache timeout active 1 Active timeout is the frequency of activeflow records that are exported from theflow cache to Network PerformanceInsight. Default value is 30 min. To getreal-time traffic reports, set this value to1.

Router(config)# ip flow-cache timeout inactive 15 Inactive timeout is the frequency ofinactive flow records that are exportedfrom the flow cache to NetworkPerformance Insight. A flow record isinactive when the conversation betweentwo interfaces is stopped. Default valueis 15 sec.

Related informationConfiguring NetFlow and NetFlow Data Export


https://www.cisco.com/en/US/docs/ios-xml/ios/netflow/configuration/15-2s/cfg-nflow-data-expt.html

Customizing the number of entries in flow cacheYou can increase or decrease the number of entries that are maintained in the cache to meet yourNetFlow traffic rates. The number of entries can be 1024 - 524288. The default is 65536.

About this task

Command Description

Router(config)# ip flow-cache entries <number> Changes the number of entries that aremaintained in the NetFlow cache.

CAUTION: Improper use of thisfeature might cause networkproblems. To return to thedefault NetFlow cache entries,use the no ip flow-cacheentries in global configurationmode.

Monitoring NetFlow informationUse these commands to verify whether the NetFlow data export is functioning and displaying the data.

About this task

Command Description

Router# show ip flow export Displays information aboutNetFlow flow exporters andstatistics.

Router# show flow exporter <exporter_name> Displays the statistics of thespecified Flow Exporter.

Router# show ip flow interface Displays NetFlow accountingconfiguration on interfaces.

Router# show ip interface Displays the usability status ofinterfaces that are configured forIP.

Router# show ip cache flow Displays the NetFlow statisticssuch as:

• IP packet size distribution• IP flow cache information• Flow information; protocol, total

flow, flows per second

Router# clear ip flow stats Clears the NetFlow statistics.

An example Cisco device configurationCisco device configuration.

configure terminalinterface serial 3/0/0ip route-cache flowexitip flow-export 127.1.0.0 0 version 5 peer-asexitclear ip flow statsRouter# show ip cache flow

Reference 369

The output is as shown:

IP packet size distribution (230151 total packets):1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480.999 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000512 544 576 1024 1536 2048 2560 3072 3584 4096 4608.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

Configuring flow on Juniper devicesProvides commands and examples to configure J-Flow on an SRX Series device.

Command modes

Command mode Description

Operational mode

When you log in to the router and type the CLIcommand, you are automatically in operationalmode:

user@host>

This mode displays the status of the device. Inoperational mode, you enter commands to monitorand troubleshoot the Junos OS, devices, andnetwork connectivity.

Configuration mode

user@host>configureuser@host#

To exit the mode, give the following commands:

user@host# commit and-quitcommit completeuser@host

To exit without commit:

user@host# exitExiting configuration modeuser@host>

A configuration for a device that is running onJunos OS is stored as a hierarchy of statements. Inconfiguration mode, you enter these statements todefine all properties of the Junos OS, includinginterfaces, general routing information, routingprotocols, user access, and several system andhardware properties.

Active Flow monitoringFlow monitoring versions 5, 8, and 9 support active flow monitoring. For active flow monitoring, themonitoring station participates in the network as an active router. A router performs the following actionsduring active Flow monitoring:

• Sampling

The router selects and analyzes only a portion of the traffic.• Sampling with templates

The router selects, analyzes, and arranges a portion of the traffic into templates.• Sampling per sampling instance

The router selects, analyzes, and arranges a portion of the traffic according to the configuration andbinding of a sampling instance.

• Port mirroring

The router copies entire packets and sends the copies to another interface.• Multiple port mirroring

The router sends multiple copies of monitored packets to multiple export interfaces with the next-hop-group statement at the (edit forwarding-options) hierarchy level.


• Discard accounting

The router accounts for selected traffic before it discards. Such traffic is not forwarded out of the router.Instead, the traffic is quarantined and deleted.

• Flow-tap processing

The router processes requests for active flow monitoring dynamically by using the Dynamic TaskingControl Protocol (DTCP).

Some of the commands for these actions are described here.Related informationFlow Monitoring Feature Guide for Routing DevicesActive Flow Monitoring Overview

Configuring J-Flow versions 5 and 8Commands to configure J-Flow versions 5 and 8.

About this task

Commands Description

user@host# set interfaces ge-0/0/0 unit 0 family inet sampling inputuser@host# set interfaces ge-0/0/0 unit 0 family inet sampling output

Enables sampling on one or moreinterfaces and specify the direction.

user@host# set forwarding-options sampling input rate 100

Specifies the sampling rate.

CAUTION: Caution: Activation offlow collection can have asignificant impact on theperformance of the SRX Seriesdevice. The smaller the samplerate, the bigger the impact. It isrecommended to not use asampling input rate of 1.

Where:forwarding-options

Starts the inline J-Flowconfiguration, so that the samplingand the J-Flow service thread areimplemented in the forwardingengine.

samplingConfigures the J-Flow packetsampling options.

inputEnables sampling.

rateSpecifies the ratio of packets to besampled.

user@host# set forwarding-options sampling family inet output flow-server 10.10.10.1 port 2056

Specifies the UDP port number of thehost that is collecting cflowd packets.

user@host# set forwarding-options sampling family inet output flow-server 10.10.10.1 version 5

Specify the version format 5.

Reference 371

http://www.juniper.net/documentation/en_US/junos14.2/information-products/pathway-pages/solutions/flow-monitoring/flow-monitoring.html

https://www.juniper.net/techpubs/en_US/junos14.2/topics/concept/flowmonitoring-active-overview-solutions.html

Related informationSRX Getting Started - Configure J-Flow

Configuring J-Flow version 9Commands to configure J-Flow versions 9.

About this task


user@host# set services flow-monitoring version9 template v4 flow-active-timeout 30

user@host# set services flow-monitoring version9 template v4 flow-inactive-timeout 30

user@host# set services flow-monitoring version9 template v4 <ipv4-template>

Configures the J-Flow v9template.

Note: Currently, the IPv4template is supported.

user@host# set forwarding-options sampling input rate 100

user@host# set forwarding-options sampling input run-length 0

Specifies the sampling rate andrun length.

user@host# set forwarding-options sampling family inet output flow-server <IP_add> port 2222

user@host# set forwarding-options sampling family inet output flow-server <IP_address> version9 template <template_name>

Configures the external flowcollector and its port number.

Note: The J-Flow v9 templateis associated with the externalflow collector. Up to eight flowcollectors can besimultaneously configured.

user@host# set forwarding-options samplinguser@host# set forwarding-options sampling inputuser@host# set forwarding-options sampling output family inet output inline-jflow source-address<IP_address>

Configure the inline-jflow, sothat the sampling and the J-Flow service thread areimplemented in the forwardingengine.

user@host# set interfaces ge-0/0/14 unit 0 family inet sampling inputuser@host# set interfaces ge-1/0/0 unit 0 family inet sampling output user@host# set interfaces ge-0/0/14 unit 0 family inet address <IP_address>/24

Configure the sampling filter onan interface (or interfaces) inthe direction, on which the J-Flow service is required.

user@host# show interfaces descriptions Displays all the configuredinterfaces.

Related informationJuniper Flow Monitoring

Configuring the sampling instanceYou can configure active sampling by using a sampling instance and associate that sampling instance to aparticular Packet Forwarding Engine. In addition, you can define multiple sampling instances that areassociated with multiple destinations (as many as the number of Packet Forwarding Engines in thechassis), with multiple protocol families per each sampling instance destination.


http://kb.juniper.net/InfoCenter/index?page=content&id=KB16677

http://kb.juniper.net/library/CUSTOMERSERVICE/GLOBAL_JTAC/BK16677/3500204-en.pdf

About this task

set chassis fpc 0 sampling-instance s0 set interfaces ge-0/1/0 unit 0 family inet sampling input set interfaces ge-0/1/0 unit 0 family inet address set interfaces ge-1/0/0 unit 0 family inet address set interfaces sp-2/0/0 unit 0 family inet set forwarding-options sampling instance s0 input rate 1 set forwarding-options sampling instance s0 input run-length 0 set forwarding-options sampling instance s0 family inet output flow-server 2.2.2.2 port 2055 set forwarding-options sampling instance s0 family inet output flow-server 2.2.2.2 version9 template v4; set forwarding-options sampling instance s0 family inet output interface sp-2/0/0 source-address 1.1.1.1 set routing-options static route 50.0.0.0/8 next-hop 20.0.0.2 set services flow-monitoring version9 template v4 flow-active-timeout 30 set services flow-monitoring version9 template v4 flow-inactive-timeout 30 set services flow-monitoring version9 template v4 ipv4-template

Related informationExample: Sampling Instance Configuration

Configuring J-Flow version 9 for SRX-DataCenter devicesCommands to configure J-Flow versions 9 for SRX-DataCenter devices.

About this task


user@host# set services flow-monitoring version9 template <template_name>

Configures the J-Flow v9 template

user@host# set samplng family inet output flow server <flow_collector_ip_add> port <flow_collector_port> version9 template <template_name>

Configures external flow collector, in thiscase, Network Performance InsightCollector.

user@host# set forwarding-options sampling instance <instance1> input rate 100

user@host# set forwarding-options sampling instance <instance1> input run-length 0

Specifies the sampling rate.

Note: Currently, IPv4 template issupported.

user@host# set forwarding-options sampling instance instance1 family inet output flow-server <Ip_address> port 2222

user@host# set forwarding-options sampling instance instance1 family inet output flow-server <Ip_address> version9 template <template_name>

Configures the external flow collectorand its port address.

Note: The J-Flow v9 template isassociated with the external flowcollector. Up to eight flow collectors canbe simultaneously configured.

user@host# set forwarding-options sampling instance instance1 family inet output inline-jflow source-address <Ip_address>

Configures the inline-jflow, so that thesampling and the J-Flow service threadare implemented in the forwardingengine.

user@host# set interfaces ge-0/0/14 unit 0 family inet sampling inputuser@host# set interfaces ge-0/0/14 unit 0 family inet address 2.2.2.1/24

Configures the sampling filter on aninterface (or interfaces) in the direction,on which the J-Flow service is required.

Reference 373

http://www.juniper.net/documentation/en_US/junos12.1/topics/example/flowmonitoring-active-sampling-instance-example.html

Related informationSRX Getting Started - Configure J-Flow

Using the show commandsDescribes the possible show command options in configuration mode and Operational mode.

About this task

configure//To enter a configuration modeshow ?

<[Enter]> Execute this command> access Network access configuration> access-profile Access profile for this instance> accounting-options Accounting data configuration> applications Define applications by protocol characteristics+ apply-groups Groups from which to inherit configuration data> chassis Chassis configuration> class-of-service Class-of-service configuration> ethernet-switching-options Ethernet-switching configuration options> event-options Event processing configuration> firewall Define a firewall configuration> forwarding-options Configure options to control packet forwarding> groups Configuration groups> interfaces Interface configuration> multi-chassis> multicast-snooping-options Multicast snooping option configuration> policy-options Policy option configuration> protocols Routing protocol configuration> routing-instances Routing instance configuration> routing-options Protocol-independent routing option configuration> schedulers Security scheduler> security Security configuration> services Set services parameters> smtp Simple Mail Transfer Protocol service configuration> snmp Simple Network Management Protocol configuration> system System parameters> vlans VLAN configuration | Pipe through a command

Exit//To exit the configuration modeShow// To run the show command options in User Excec mode

accounting Show accounting profiles and records arp Show system Address Resolution Protocol table entries as-path Show table of known autonomous system paths authentication-whitelist Show 802.1X White List MAC addresses bfd Show Bidirectional Forwarding Detection information bgp Show Border Gateway Protocol information chassis Show chassis information class-of-service Show class-of-service (CoS) information cli Show command-line interface settings configuration Show current configuration connections Show circuit cross-connect connections database-replication Show database replication information dhcp Show Dynamic Host Configuration Protocol information dhcpv6 Show Dynamic Host Configuration Protocol v6 information dialer Show dialer information dot1x Show 802.1X information dvmrp Show Distance Vector Multicast Routing Protocol information dynamic-tunnels Show dynamic tunnel information information esis Show end system-to-intermediate system information ethernet-switching Show Ethernet-switching information


http://kb.juniper.net/InfoCenter/index?page=content&id=KB16677

event-options Show event-options information firewall Show firewall information forwarding-options Show forwarding-options information gvrp Show Generic VLAN Registration Protocol information helper Show port-forwarding helper information hfrr Show information related to Host (Direct route) Fast reroute host Show hostname information from domain name server iccp Show Inter Chassis Control Protocol information igmp Show Internet Group Management Protocol information igmp-snooping Show IGMP snooping information ingress-replication Show Ingress-Replication tunnel information interfaces Show interface information ipv6 Show IP version 6 information isdn Show Integrated Services Digital Network information isis Show Intermediate System-to-Intermediate System information l2circuit Show Layer 2 circuit information l2vpn Show Layer 2 VPN information lacp Show Link Aggregation Control Protocol information ldp Show Label Distribution Protocol information lldp Show Link Layer Discovery Protocol information log Show contents of log file mld Show multicast listener discovery information mld-snooping Show MLD snooping information mpls Show mpls information msdp Show Multicast Source Discovery Protocol information multicast Show multicast information mvpn Show Multicast Virtual Private Network (MVPN) information network-access Show network-access related information ntp Show Network Time Protocol information oam Show OAM-related information ospf Show Open Shortest Path First information ospf3 Show Open Shortest Path First version 3 information pfe Show Packet Forwarding Engine information pgm Show Pragmatic Generalized Multicast information pim Show Protocol Independent Multicast information policer Show interface policer counters and information policy Show policy information ppp Show PPP process information pppoe Show PPP over Ethernet information r2cp Show Radio-to-Router Protocol information rip Show Routing Information Protocol information ripng Show Routing Information Protocol for IPv6 information route Show routing table information rsvp Show Resource Reservation Protocol information sap Show Session Announcement Protocol information schedulers Show the information on one or more schedulers security Show security information services Show services smtp Show Simple Mail Transfer Protocol information snmp Show Simple Network Management Protocol information spanning-tree Show Spanning Tree Protocol information system Show system information task Show routing protocol per-task information ted Show Traffic Engineering Database information tgm Show telephony gateway module information version Show software process revision levels vlans Show VLAN information vpls Show VPLS information vrrp Show Virtual Router Redundancy Protocol information wan-acceleration Show WAN acceleration module information

Reference 375

Verifying the configuration with show commandsTo verify that your configuration is correct, use these commands on the monitoring station that isconfigured for active flow monitoring.

About this task

show servicesshow services flow-monitoringshow services flow-monitoring version9 template <template_name>show services accounting errorsshow services accounting (flow | flow-detail)show services accounting memoryshow services accounting packet-size-distributionshow services accounting statusshow services accounting usageshow services accounting aggregation template template-name name (detail | extensive | terse)

Most active flow monitoring operational mode commands contain equivalent output information to thefollowing passive flow monitoring commands:

show services accounting errors = show passive-monitoring errorshow services accounting flow = show passive-monitoring flowshow services accounting memory = show passive-monitoring memoryshow services accounting status = show passive-monitoring statusshow services accounting usage = show passive-monitoring usage

The active flow monitoring commands can be used with most active flow monitoring applications,including sampling, discard accounting, port mirroring, and multiple port mirroring. The followingcommand shows the output of the show commands that are used with the configuration example:

user@router> show services accounting errors

Service Accounting interface: sp-2/0/0, Local interface index: 542Service name: (default sampling) Error information Packets dropped (no memory): 0, Packets dropped (not IP): 0 Packets dropped (not IPv4): 0, Packets dropped (header too small): 0 Memory allocation failures: 0, Memory free failures: 0 Memory free list failures: 0 Memory overload: No, PPS overload: No, BPS overload: Yes

user@router> show services accounting flow-detail limit 10

Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Protocol Source Source Destination Destination Packet Byte Address Port Address Port count countudp(17) 10.1.1.2 53 10.0.0.1 53 4329 3386035ip(0) 10.1.1.2 0 10.0.0.2 0 4785 3719654ip(0) 10.1.1.2 0 10.0.1.2 0 4530 3518769udp(17) 10.1.1.2 0 10.0.7.1 0 5011 3916767tcp(6) 10.1.1.2 20 10.3.0.1 20 1 1494tcp(6) 10.1.1.2 20 10.168.80.1 20 1 677tcp(6) 10.1.1.2 20 10.69.192.1 20 1 446tcp(6) 10.1.1.2 20 10.239.240.1 20 1 1426tcp(6) 10.1.1.2 20 10.126.160.1 20 1 889tcp(6) 10.1.1.2 20 10.71.224.1 20 1 1046

user@router> show services accounting memory


Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Memory utilization Allocation count: 437340, Free count: 430681, Maximum allocated: 6782 Allocations per second: 3366, Frees per second: 6412 Total memory used (in bytes): 133416928, Total memory free (in bytes): 133961744

user@router> show services accounting packet-size-distribution

Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Range start Range end Number of packets Percentage packets 64 96 1705156 100

user@router> show services accounting status

Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling) Interface state: Monitoring Group index: 0 Export interval: 60 secs, Export format: cflowd v5 Protocol: IPv4, Engine type: 55, Engine ID: 5 Route record count: 13, IFL to SNMP index count: 30, AS count: 1 Time set: Yes, Configuration set: Yes Route record set: Yes, IFL SNMP map set: Yes

user@router> show services accounting usage

Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling) CPU utilization Uptime: 4790345 milliseconds, Interrupt time: 1668537848 microseconds Load (5 second): 71%, Load (1 minute): 63%

Related informationVerifying Your Work

Viewing device configurationAn example configuration for the J-Flow v9 template ipv4-test, flow collector 172.19.101.85 (port 2222)with sampling rate 1:100 and run length as 0.

For example, to view the configuration for the following set commands:

set services flow-monitoring version9 template ipv4-test ipv4-templateset forwarding-options sampling input rate 1set forwarding-options sampling input run-length 0set forwarding-options sampling family inet output flow-server 172.19.101.85 port2222set forwarding-options sampling family inet output flow-server 172.19.101.85version9 template ipv4-testset forwarding-options sampling family inet output inline-jflow source-address172.19.101.132set interfaces ge-0/0/14 unit 0 family inet sampling inputset interfaces ge-0/0/14 unit 0 family inet address 23.23.23.1/24

Give this command to view the details:

show configuration

Reference 377

https://www.juniper.net/techpubs/en_US/junos14.2/topics/example/flowmonitoring-active-sampling-solutions.html

Configuring NetStream traffic on Huawei devicesHuawei devices support NetStream flow, which is a supported flow type in Network Performance Insight.Related informationNetStream Configuration

Configuring NetStream exportHuawei NetStream works much like Cisco NetFlow. The NetStream process gathers detailed data aboutflows and stores them to a cache table. NetStream then processes the flow data from the cache table andsends it to Network Performance Insight for monitoring.

About this taskThere are export options for flow sampling, aggregation, and flow record content depending on how andwhat you are monitoring and how you need to export and report.


[RouterA] ip NetStream export host <hostname>|<ip_address> 9996

Enables NetStream onHuawei devices

ip NetStream export source interface <interface_name> Exports the NetStream datato a specified IP address.

[RouterA] ip NetStream sampler inbound 100

[RouterA] ip NetStream sampler outbound 100

Configures global sampling.

[RouterA] interface gigabitethernet 1/0/0

[RouterA-GigabitEthernet1/0/0] ip address <IP_address1> <IP_address2>

Sets up an interface.

[RouterA-GigabitEthernet1/0/0] ip NetStream inbound

[RouterA-GigabitEthernet1/0/0] ip NetStream outbound

Enables NetStream statisticson the inbound and outboundinterfaces


http://support.huawei.com/enterprise/docinforeader!loadDocument1.action?contentId=DOC1000019448&partNo=10022#dc_cfg_netstream_0004

Notices

This information was developed for products and services offered in the US. This material might beavailable from IBM in other languages. However, you may be required to own a copy of the product orproduct version in that language in order to access it.

IBM may not offer the products, services, or features discussed in this document in other countries.Consult your local IBM representative for information on the products and services currently available inyour area. Any reference to an IBM product, program, or service is not intended to state or imply that onlythat IBM product, program, or service may be used. Any functionally equivalent product, program, orservice that does not infringe any IBM intellectual property right may be used instead. However, it is theuser's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in this document.The furnishing of this document does not grant you any license to these patents. You can send licenseinquiries, in writing, to:

IBM Director of LicensingIBM CorporationNorth Castle Drive, MD-NC119Armonk, NY 10504-1785US

For license inquiries regarding double-byte character set (DBCS) information, contact the IBM IntellectualProperty Department in your country or send inquiries, in writing, to:

Intellectual Property LicensingLegal and Intellectual Property LawIBM Japan Ltd.19-21, Nihonbashi-Hakozakicho, Chuo-kuTokyo 103-8510, Japan

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS"WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR APARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer of express or implied warranties incertain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodicallymade to the information herein; these changes will be incorporated in new editions of the publication.IBM may make improvements and/or changes in the product(s) and/or the program(s) described in thispublication at any time without notice.

Any references in this information to non-IBM websites are provided for convenience only and do not inany manner serve as an endorsement of those websites. The materials at those websites are not part ofthe materials for this IBM product and use of those websites is at your own risk.

IBM may use or distribute any of the information you provide in any way it believes appropriate withoutincurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) theexchange of information between independently created programs and other programs (including thisone) and (ii) the mutual use of the information which has been exchanged, should contact:

IBM Director of LicensingIBM CorporationNorth Castle Drive, MD-NC119Armonk, NY 10504-1785US

© Copyright IBM Corp. 2015, 2019 379

Such information may be available, subject to appropriate terms and conditions, including in some cases,payment of a fee.

The licensed program described in this document and all licensed material available for it are provided byIBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or anyequivalent agreement between us.

The performance data discussed herein is presented as derived under specific operating conditions.Actual results may vary.

The client examples cited are presented for illustrative purposes only. Actual performance results mayvary depending on specific configurations and operating conditions.

Information concerning non-IBM products was obtained from the suppliers of those products, theirpublished announcements or other publicly available sources. IBM has not tested those products andcannot confirm the accuracy of performance, compatibility or any other claims related to non-IBMproducts. Questions on the capabilities of non-IBM products should be addressed to the suppliers ofthose products.

Statements regarding IBM's future direction or intent are subject to change or withdrawal without notice,and represent goals and objectives only.

All IBM prices shown are IBM's suggested retail prices, are current and are subject to change withoutnotice. Dealer prices may vary.

This information is for planning purposes only. The information herein is subject to change before theproducts described become available.

This information contains examples of data and reports used in daily business operations. To illustratethem as completely as possible, the examples include the names of individuals, companies, brands, andproducts. All of these names are fictitious and any similarity to actual people or business enterprises isentirely coincidental.

COPYRIGHT LICENSE:

This information contains sample application programs in source language, which illustrate programmingtechniques on various operating platforms. You may copy, modify, and distribute these sample programsin any form without payment to IBM, for the purposes of developing, using, marketing or distributingapplication programs conforming to the application programming interface for the operating platform forwhich the sample programs are written. These examples have not been thoroughly tested under allconditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of theseprograms. The sample programs are provided "AS IS", without warranty of any kind. IBM shall not beliable for any damages arising out of your use of the sample programs.

Each copy or any portion of these sample programs or any derivative work must include a copyright noticeas follows:

© (your company name) (year).Portions of this code are derived from IBM Corp. Sample Programs.© Copyright IBM Corp. _enter the year or years_.

TrademarksIBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International BusinessMachines Corp., registered in many jurisdictions worldwide. Other product and service names might betrademarks of IBM or other companies. A current list of IBM trademarks is available on the web at"Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.

Adobe, Acrobat, PostScript and all Adobe-based trademarks are either registered trademarks ortrademarks of Adobe Systems Incorporated in the United States, other countries, or both.

IT Infrastructure Library is a registered trademark of the Central Computer and TelecommunicationsAgency which is now part of the Office of Government Commerce.

380 Notices

http://www.ibm.com/legal/us/en/copytrade.shtml

Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon,Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation orits subsidiaries in the United States and other countries.

Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both

Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, orboth.

ITIL is a registered trademark, and a registered community trademark of The Minister for the CabinetOffice, and is registered in the U.S. Patent and Trademark Office.

UNIX is a registered trademark of The Open Group in the United States and other countries.

Java and all Java-based trademarks and logos aretrademarks or registered trademarks of Oracleand/or its affiliates.

Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the United States, othercountries, or both and is used under license therefrom.

Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are trademarks of HP, IBM Corp. andQuantum in the U.S. and other countries.

Terms and conditions for product documentationPermissions for the use of these publications are granted subject to the following terms and conditions.

Applicability

These terms and conditions are in addition to any terms of use for the IBM website.

Personal use

You may reproduce these publications for your personal, noncommercial use provided that all proprietarynotices are preserved. You may not distribute, display or make derivative work of these publications, orany portion thereof, without the express consent of IBM.

Commercial use

You may reproduce, distribute and display these publications solely within your enterprise provided thatall proprietary notices are preserved. You may not make derivative works of these publications, orreproduce, distribute or display these publications or any portion thereof outside your enterprise, withoutthe express consent of IBM.

Rights

Except as expressly granted in this permission, no other permissions, licenses or rights are granted, eitherexpress or implied, to the publications or any information, data, software or other intellectual propertycontained therein.

IBM reserves the right to withdraw the permissions granted herein whenever, in its discretion, the use ofthe publications is detrimental to its interest or, as determined by IBM, the above instructions are notbeing properly followed.

You may not download, export or re-export this information except in full compliance with all applicablelaws and regulations, including all United States export laws and regulations.

IBM MAKES NO GUARANTEE ABOUT THE CONTENT OF THESE PUBLICATIONS. THE PUBLICATIONS AREPROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED,

Notices 381

INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT,AND FITNESS FOR A PARTICULAR PURPOSE.


Network Performance Insight References · Network Performance Insight services are running on...

Documents

Transcript of Network Performance Insight References · Network Performance Insight services are running on...