RFC 5102
Information Model for IP Flow Information Export
Appendix A. XML Specification of IPFIX Information Elements
This appendix contains a machine-readable description of the IPFIX information model coded in XML. Note that this appendix is of informational nature, while the text in Section 4 (generated from this appendix) is normative. Using a machine-readable syntax for the information model enables the creation of IPFIX-aware tools that can automatically adapt to extensions to the information model, by simply reading updated information model specifications. The wide availability of XML-aware tools and libraries for client devices is a primary consideration for this choice. In particular, libraries for parsing XML documents are readily available. Also, mechanisms such as the Extensible Stylesheet Language (XSL) allow for transforming a source XML document into other documents. This document was authored in XML and transformed according to [RFC2629]. It should be noted that the use of XML in Exporters, Collectors, or other tools is not mandatory for the deployment of IPFIX. In particular, Exporting Processes do not produce or consume XML as part of their operation. It is expected that IPFIX Collectors MAY take advantage of the machine readability of the information model vs. hard coding their behavior or inventing proprietary means for accommodating extensions. <?xml version="1.0" encoding="UTF-8"?> <fieldDefinitions xmlns="urn:ietf:params:xml:ns:ipfix-info" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:ietf:params:xml:ns:ipfix-info ipfix-info.xsd"> <field name="lineCardId" dataType="unsigned32" group="scope" dataTypeSemantics="identifier" elementId="141" applicability="option" status="current"> <description> <paragraph> An identifier of a line card that is unique per IPFIX Device hosting an Observation Point. Typically, this Information Element is used for limiting the scope of other Information Elements. </paragraph> </description> </field> <field name="portId" dataType="unsigned32"
group="scope"
dataTypeSemantics="identifier"
elementId="142" applicability="option" status="current">
<description>
<paragraph>
An identifier of a line port that is unique per IPFIX
Device hosting an Observation Point. Typically, this
Information Element is used for limiting the scope
of other Information Elements.
</paragraph>
</description>
</field>
<field name="ingressInterface" dataType="unsigned32"
group="scope"
dataTypeSemantics="identifier"
elementId="10" applicability="all" status="current">
<description>
<paragraph>
The index of the IP interface where packets of this Flow
are being received. The value matches the value of managed
object 'ifIndex' as defined in RFC 2863.
Note that ifIndex values are not assigned statically to an
interface and that the interfaces may be renumbered every
time the device's management system is re-initialized, as
specified in RFC 2863.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 2863 for the definition of the ifIndex object.
</paragraph>
</reference>
</field>
<field name="egressInterface" dataType="unsigned32"
group="scope"
dataTypeSemantics="identifier"
elementId="14" applicability="all" status="current">
<description>
<paragraph>
The index of the IP interface where packets of
this Flow are being sent. The value matches the value of
managed object 'ifIndex' as defined in RFC 2863.
Note that ifIndex values are not assigned statically to an
interface and that the interfaces may be renumbered every
time the device's management system is re-initialized, as
specified in RFC 2863.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 2863 for the definition of the ifIndex object.
</paragraph>
</reference>
</field>
<field name="meteringProcessId" dataType="unsigned32"
group="scope"
dataTypeSemantics="identifier"
elementId="143" applicability="option" status="current">
<description>
<paragraph>
An identifier of a Metering Process that is unique per
IPFIX Device. Typically, this Information Element is used
for limiting the scope of other Information Elements.
Note that process identifiers are typically assigned
dynamically.
The Metering Process may be re-started with a different ID.
</paragraph>
</description>
</field>
<field name="exportingProcessId" dataType="unsigned32"
group="scope"
dataTypeSemantics="identifier"
elementId="144" applicability="option" status="current">
<description>
<paragraph>
An identifier of an Exporting Process that is unique per
IPFIX Device. Typically, this Information Element is used
for limiting the scope of other Information Elements.
Note that process identifiers are typically assigned
dynamically. The Exporting Process may be re-started
with a different ID.
</paragraph>
</description>
</field>
<field name="flowId" dataType="unsigned64"
group="scope"
dataTypeSemantics="identifier"
elementId="148" applicability="option" status="current">
<description>
<paragraph>
An identifier of a Flow that is unique within an Observation
Domain. This Information Element can be used to distinguish
between different Flows if Flow Keys such as IP addresses and
port numbers are not reported or are reported in separate
records.
</paragraph>
</description>
</field>
<field name="templateId" dataType="unsigned16"
group="scope"
dataTypeSemantics="identifier"
elementId="145" applicability="option" status="current">
<description>
<paragraph>
An identifier of a Template that is locally unique within a
combination of a Transport session and an Observation Domain.
</paragraph>
<paragraph>
Template IDs 0-255 are reserved for Template Sets, Options
Template Sets, and other reserved Sets yet to be created.
Template IDs of Data Sets are numbered from 256 to 65535.
</paragraph>
<paragraph>
Typically, this Information Element is used for limiting
the scope of other Information Elements.
Note that after a re-start of the Exporting Process Template
identifiers may be re-assigned.
</paragraph>
</description>
</field>
<field name="observationDomainId" dataType="unsigned32"
group="scope"
dataTypeSemantics="identifier"
elementId="149" applicability="option" status="current">
<description>
<paragraph>
An identifier of an Observation Domain that is locally
unique to an Exporting Process. The Exporting Process uses
the Observation Domain ID to uniquely identify to the
Collecting Process the Observation Domain where Flows
were metered. It is RECOMMENDED that this identifier is
also unique per IPFIX Device.
</paragraph>
<paragraph>
A value of 0 indicates that no specific Observation Domain
is identified by this Information Element.
</paragraph>
<paragraph>
Typically, this Information Element is used for limiting
the scope of other Information Elements.
</paragraph>
</description>
</field>
<field name="observationPointId" dataType="unsigned32"
group="scope"
dataTypeSemantics="identifier"
elementId="138" applicability="option" status="current">
<description>
<paragraph>
An identifier of an Observation Point that is unique per
Observation Domain. It is RECOMMENDED that this identifier is
also unique per IPFIX Device. Typically, this Information
Element is used for limiting the scope of other Information
Elements.
</paragraph>
</description>
</field>
<field name="commonPropertiesId" dataType="unsigned64"
group="scope"
dataTypeSemantics="identifier"
elementId="137" applicability="option" status="current">
<description>
<paragraph>
An identifier of a set of common properties that is
unique per Observation Domain and Transport Session.
Typically, this Information Element is used to link to
information reported in separate Data Records.
</paragraph>
</description>
</field>
<field name="exporterIPv4Address" dataType="ipv4Address"
dataTypeSemantics="identifier"
group="config"
elementId="130" applicability="all" status="current">
<description>
<paragraph>
The IPv4 address used by the Exporting Process. This is used
by the Collector to identify the Exporter in cases where the
identity of the Exporter may have been obscured by the use of
a proxy.
</paragraph>
</description>
</field>
<field name="exporterIPv6Address" dataType="ipv6Address"
dataTypeSemantics="identifier"
group="config"
elementId="131" applicability="all" status="current">
<description>
<paragraph>
The IPv6 address used by the Exporting Process. This is used
by the Collector to identify the Exporter in cases where the
identity of the Exporter may have been obscured by the use of
a proxy.
</paragraph>
</description>
</field>
<field name="exporterTransportPort" dataType="unsigned16"
group="config"
dataTypeSemantics="identifier"
elementId="217" applicability="all" status="current">
<description>
<paragraph>
The source port identifier from which the Exporting
Process sends Flow information. For the transport protocols
UDP, TCP, and SCTP, this is the source port number.
This field MAY also be used for future transport protocols
that have 16-bit source port identifiers. This field may
be useful for distinguishing multiple Exporting Processes
that use the same IP address.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 768 for the definition of the UDP
source port field.
See RFC 793 for the definition of the TCP
source port field.
See RFC 4960 for the definition of SCTP.
</paragraph>
<paragraph>
Additional information on defined UDP and TCP port numbers can
be found at http://www.iana.org/assignments/port-numbers.
</paragraph>
</reference>
</field>
<field name="collectorIPv4Address" dataType="ipv4Address"
dataTypeSemantics="identifier"
group="config"
elementId="211" applicability="all" status="current">
<description>
<paragraph>
An IPv4 address to which the Exporting Process sends Flow
information.
</paragraph>
</description>
</field>
<field name="collectorIPv6Address" dataType="ipv6Address"
dataTypeSemantics="identifier"
group="config"
elementId="212" applicability="all" status="current">
<description>
<paragraph>
An IPv6 address to which the Exporting Process sends Flow
information.
</paragraph>
</description>
</field>
<field name="exportInterface" dataType="unsigned32"
group="config"
dataTypeSemantics="identifier"
elementId="213" applicability="all" status="current">
<description>
<paragraph>
The index of the interface from which IPFIX Messages sent
by the Exporting Process to a Collector leave the IPFIX
Device. The value matches the value of
managed object 'ifIndex' as defined in RFC 2863.
Note that ifIndex values are not assigned statically to an
interface and that the interfaces may be renumbered every
time the device's management system is re-initialized, as
specified in RFC 2863.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 2863 for the definition of the ifIndex object.
</paragraph>
</reference>
</field>
<field name="exportProtocolVersion" dataType="unsigned8"
dataTypeSemantics="identifier"
group="config"
elementId="214" applicability="all" status="current">
<description>
<paragraph>
The protocol version used by the Exporting Process for
sending Flow information. The protocol version is given
by the value of the Version Number field in the Message
Header.
</paragraph>
<paragraph>
The protocol version is 10 for IPFIX and 9 for NetFlow
version 9.
A value of 0 indicates that no export protocol is in use.
</paragraph>
</description>
<reference>
<paragraph>
See the IPFIX protocol specification [RFC5101] for the
definition of the IPFIX Message Header.
</paragraph>
<paragraph>
See RFC 3954 for the definition of the NetFlow
version 9 message header.
</paragraph>
</reference>
</field>
<field name="exportTransportProtocol" dataType="unsigned8"
group="config"
dataTypeSemantics="identifier"
elementId="215" applicability="all" status="current">
<description>
<paragraph>
The value of the protocol number used by the Exporting Process
for sending Flow information.
The protocol number identifies the IP packet payload type.
Protocol numbers are defined in the IANA Protocol Numbers
registry.
</paragraph>
<paragraph>
In Internet Protocol version 4 (IPv4), this is carried in the
Protocol field. In Internet Protocol version 6 (IPv6), this
is carried in the Next Header field in the last extension
header of the packet.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the specification of the IPv4
protocol field.
See RFC 2460 for the specification of the IPv6
protocol field.
See the list of protocol numbers assigned by IANA at
http://www.iana.org/assignments/protocol-numbers.
</paragraph>
</reference>
</field>
<field name="collectorTransportPort" dataType="unsigned16"
group="config"
dataTypeSemantics="identifier"
elementId="216" applicability="all" status="current">
<description>
<paragraph>
The destination port identifier to which the Exporting
Process sends Flow information. For the transport protocols
UDP, TCP, and SCTP, this is the destination port number.
This field MAY also be used for future transport protocols
that have 16-bit source port identifiers.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 768 for the definition of the UDP
destination port field.
See RFC 793 for the definition of the TCP
destination port field.
See RFC 4960 for the definition of SCTP.
</paragraph>
<paragraph>
Additional information on defined UDP and TCP port numbers can
be found at http://www.iana.org/assignments/port-numbers.
</paragraph>
</reference>
</field>
<field name="flowKeyIndicator" dataType="unsigned64"
dataTypeSemantics="flags"
group="config"
elementId="173" applicability="all" status="current">
<description>
<paragraph>
This set of bit fields is used for marking the Information
Elements of a Data Record that serve as Flow Key. Each bit
represents an Information Element in the Data Record with
the n-th bit representing the n-th Information Element.
A bit set to value 1 indicates that the corresponding
Information Element is a Flow Key of the reported Flow.
A bit set to value 0 indicates that this is not the case.
</paragraph>
<paragraph>
If the Data Record contains more than 64 Information Elements,
the corresponding Template SHOULD be designed such that all
Flow Keys are among the first 64 Information Elements, because
the flowKeyIndicator only contains 64 bits. If the Data Record
contains less than 64 Information Elements, then the bits in
the flowKeyIndicator for which no corresponding Information
Element exists MUST have the value 0.
</paragraph>
</description>
</field>
<field name="exportedMessageTotalCount" dataType="unsigned64"
dataTypeSemantics="totalCounter"
group="processCounter"
elementId="41" applicability="data" status="current">
<description>
<paragraph>
The total number of IPFIX Messages that the Exporting Process
has sent since the Exporting Process (re-)initialization to
a particular Collecting Process.
The reported number excludes the IPFIX Message that carries
the counter value.
If this Information Element is sent to a particular
Collecting Process, then by default it specifies the number
of IPFIX Messages sent to this Collecting Process.
</paragraph>
</description>
<units>messages</units>
</field>
<field name="exportedOctetTotalCount" dataType="unsigned64"
dataTypeSemantics="totalCounter"
group="processCounter"
elementId="40" applicability="data" status="current">
<description>
<paragraph>
The total number of octets that the Exporting Process
has sent since the Exporting Process (re-)initialization
to a particular Collecting Process.
The value of this Information Element is calculated by
summing up the IPFIX Message Header length values of all
IPFIX Messages that were successfully sent to the Collecting
Process. The reported number excludes octets in the IPFIX
Message that carries the counter value.
If this Information Element is sent to a particular
Collecting Process, then by default it specifies the number
of octets sent to this Collecting Process.
</paragraph>
</description>
<units>octets</units>
</field>
<field name="exportedFlowRecordTotalCount" dataType="unsigned64"
group="processCounter"
dataTypeSemantics="totalCounter"
elementId="42" applicability="data" status="current">
<description>
<paragraph>
The total number of Flow Records that the Exporting
Process has sent as Data Records since the Exporting
Process (re-)initialization to a particular Collecting
Process. The reported number excludes Flow Records in
the IPFIX Message that carries the counter value.
If this Information Element is sent to a particular
Collecting Process, then by default it specifies the number
of Flow Records sent to this process.
</paragraph>
</description>
<units>flows</units>
</field>
<field name="observedFlowTotalCount" dataType="unsigned64"
dataTypeSemantics="totalCounter"
group="processCounter"
elementId="163" applicability="data" status="current">
<description>
<paragraph>
The total number of Flows observed in the Observation Domain
since the Metering Process (re-)initialization for this
Observation Point.
</paragraph>
</description>
<units>flows</units>
</field>
<field name="ignoredPacketTotalCount" dataType="unsigned64"
dataTypeSemantics="totalCounter"
group="processCounter"
elementId="164" applicability="data" status="current">
<description>
<paragraph>
The total number of observed IP packets that the
Metering Process did not process since the
(re-)initialization of the Metering Process.
</paragraph>
</description>
<units>packets</units>
</field>
<field name="ignoredOctetTotalCount" dataType="unsigned64"
dataTypeSemantics="totalCounter"
group="processCounter"
elementId="165" applicability="data" status="current">
<description>
<paragraph>
The total number of octets in observed IP packets
(including the IP header) that the Metering Process
did not process since the (re-)initialization of the
Metering Process.
</paragraph>
</description>
<units>octets</units>
</field>
<field name="notSentFlowTotalCount" dataType="unsigned64"
dataTypeSemantics="totalCounter"
group="processCounter"
elementId="166" applicability="data" status="current">
<description>
<paragraph>
The total number of Flow Records that were generated by the
Metering Process and dropped by the Metering Process or
by the Exporting Process instead of being sent to the
Collecting Process. There are several potential reasons for
this including resource shortage and special Flow export
policies.
</paragraph>
</description>
<units>flows</units>
</field>
<field name="notSentPacketTotalCount" dataType="unsigned64"
dataTypeSemantics="totalCounter"
group="processCounter"
elementId="167" applicability="data" status="current">
<description>
<paragraph>
The total number of packets in Flow Records that were
generated by the Metering Process and dropped
by the Metering Process or by the Exporting Process
instead of being sent to the Collecting Process.
There are several potential reasons for this including
resource shortage and special Flow export policies.
</paragraph>
</description>
<units>packets</units>
</field>
<field name="notSentOctetTotalCount" dataType="unsigned64"
dataTypeSemantics="totalCounter"
group="processCounter"
elementId="168" applicability="data" status="current">
<description>
<paragraph>
The total number of octets in packets in Flow Records
that were generated by the Metering Process and
dropped by the Metering Process or by the Exporting
Process instead of being sent to the Collecting Process.
There are several potential reasons for this including
resource shortage and special Flow export policies.
</paragraph>
</description>
<units>octets</units>
</field>
<field name="ipVersion" dataType="unsigned8"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="60" applicability="all" status="current">
<description>
<paragraph>
The IP version field in the IP packet header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the definition of the version field
in the IPv4 packet header.
See RFC 2460 for the definition of the version field
in the IPv6 packet header.
Additional information on defined version numbers
can be found at
http://www.iana.org/assignments/version-numbers.
</paragraph>
</reference>
</field>
<field name="sourceIPv4Address" dataType="ipv4Address"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="8" applicability="all" status="current">
<description>
<paragraph>
The IPv4 source address in the IP packet header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the definition of the IPv4 source
address field.
</paragraph>
</reference>
</field>
<field name="sourceIPv6Address" dataType="ipv6Address"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="27" applicability="all" status="current">
<description>
<paragraph>
The IPv6 source address in the IP packet header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 2460 for the definition of the
Source Address field in the IPv6 header.
</paragraph>
</reference>
</field>
<field name="sourceIPv4PrefixLength" dataType="unsigned8"
group="ipHeader"
elementId="9" applicability="option" status="current">
<description>
<paragraph>
The number of contiguous bits that are relevant in the
sourceIPv4Prefix Information Element.
</paragraph>
</description>
<units>bits</units>
<range>0-32</range>
</field>
<field name="sourceIPv6PrefixLength" dataType="unsigned8"
group="ipHeader"
elementId="29" applicability="option" status="current">
<description>
<paragraph>
The number of contiguous bits that are relevant in the
sourceIPv6Prefix Information Element.
</paragraph>
</description>
<units>bits</units>
<range>0-128</range>
</field>
<field name="sourceIPv4Prefix" dataType="ipv4Address"
group="ipHeader"
elementId="44" applicability="data" status="current">
<description>
<paragraph>
IPv4 source address prefix.
</paragraph>
</description>
</field>
<field name="sourceIPv6Prefix" dataType="ipv6Address"
group="ipHeader"
elementId="170" applicability="data" status="current">
<description>
<paragraph>
IPv6 source address prefix.
</paragraph>
</description>
</field>
<field name="destinationIPv4Address" dataType="ipv4Address"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="12" applicability="all" status="current">
<description>
<paragraph>
The IPv4 destination address in the IP packet header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the definition of the IPv4
destination address field.
</paragraph>
</reference>
</field>
<field name="destinationIPv6Address" dataType="ipv6Address"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="28" applicability="all" status="current">
<description>
<paragraph>
The IPv6 destination address in the IP packet header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 2460 for the definition of the
Destination Address field in the IPv6 header.
</paragraph>
</reference>
</field>
<field name="destinationIPv4PrefixLength" dataType="unsigned8"
group="ipHeader"
elementId="13" applicability="option" status="current">
<description>
<paragraph>
The number of contiguous bits that are relevant in the
destinationIPv4Prefix Information Element.
</paragraph>
</description>
<units>bits</units>
<range>0-32</range>
</field>
<field name="destinationIPv6PrefixLength" dataType="unsigned8"
group="ipHeader"
elementId="30" applicability="option" status="current">
<description>
<paragraph>
The number of contiguous bits that are relevant in the
destinationIPv6Prefix Information Element.
</paragraph>
</description>
<units>bits</units>
<range>0-128</range>
</field>
<field name="destinationIPv4Prefix" dataType="ipv4Address"
group="ipHeader"
elementId="45" applicability="data" status="current">
<description>
<paragraph> IPv4 destination address prefix. </paragraph>
</description>
</field>
<field name="destinationIPv6Prefix" dataType="ipv6Address"
group="ipHeader"
elementId="169" applicability="data" status="current">
<description>
<paragraph> IPv6 destination address prefix. </paragraph>
</description>
</field>
<field name="ipTTL" dataType="unsigned8"
group="ipHeader"
elementId="192" applicability="all" status="current">
<description>
<paragraph>
For IPv4, the value of the Information Element matches
the value of the Time to Live (TTL) field in the IPv4 packet
header. For IPv6, the value of the Information Element
matches the value of the Hop Limit field in the IPv6
packet header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the definition of the IPv4
Time to Live field.
See RFC 2460 for the definition of the IPv6
Hop Limit field.
</paragraph>
</reference>
<units>hops</units>
</field>
<field name="protocolIdentifier" dataType="unsigned8"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="4" applicability="all" status="current">
<description>
<paragraph>
The value of the protocol number in the IP packet header.
The protocol number identifies the IP packet payload type.
Protocol numbers are defined in the IANA Protocol Numbers
registry.
</paragraph>
<paragraph>
In Internet Protocol version 4 (IPv4), this is carried in the
Protocol field. In Internet Protocol version 6 (IPv6), this
is carried in the Next Header field in the last extension
header of the packet.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the specification of the IPv4
protocol field.
See RFC 2460 for the specification of the IPv6
protocol field.
See the list of protocol numbers assigned by IANA at
http://www.iana.org/assignments/protocol-numbers.
</paragraph>
</reference>
</field>
<field name="nextHeaderIPv6" dataType="unsigned8"
group="ipHeader"
elementId="193" applicability="all" status="current">
<description>
<paragraph>
The value of the Next Header field of the IPv6 header.
The value identifies the type of the following IPv6
extension header or of the following IP payload.
Valid values are defined in the IANA
Protocol Numbers registry.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 2460 for the definition of the IPv6
Next Header field.
See the list of protocol numbers assigned by IANA at
http://www.iana.org/assignments/protocol-numbers.
</paragraph>
</reference>
</field>
<field name="ipDiffServCodePoint" dataType="unsigned8"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="195" applicability="all" status="current">
<description>
<paragraph>
The value of a Differentiated Services Code Point (DSCP)
encoded in the Differentiated Services field. The
Differentiated Services field spans the most significant
6 bits of the IPv4 TOS field or the IPv6 Traffic Class
field, respectively.
</paragraph>
<paragraph>
This Information Element encodes only the 6 bits of the
Differentiated Services field. Therefore, its value may
range from 0 to 63.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 3260 for the definition of the
Differentiated Services field.
See RFC 1812 (Section 5.3.2) and RFC 791 for the definition
of the IPv4 TOS field. See RFC 2460 for the definition of
the IPv6 Traffic Class field.
</paragraph>
</reference>
<range>0-63</range>
</field>
<field name="ipPrecedence" dataType="unsigned8"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="196" applicability="all" status="current">
<description>
<paragraph>
The value of the IP Precedence. The IP Precedence value
is encoded in the first 3 bits of the IPv4 TOS field
or the IPv6 Traffic Class field, respectively.
</paragraph>
<paragraph>
This Information Element encodes only these 3 bits.
Therefore, its value may range from 0 to 7.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 1812 (Section 5.3.3) and RFC 791
for the definition of the IP Precedence.
See RFC 1812 (Section 5.3.2) and RFC 791
for the definition of the IPv4 TOS field.
See RFC 2460 for the definition of the IPv6
Traffic Class field.
</paragraph>
</reference>
<range>0-7</range>
</field>
<field name="ipClassOfService" dataType="unsigned8"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="5" applicability="all" status="current">
<description>
<paragraph>
For IPv4 packets, this is the value of the TOS field in
the IPv4 packet header. For IPv6 packets, this is the
value of the Traffic Class field in the IPv6 packet header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 1812 (Section 5.3.2) and RFC 791
for the definition of the IPv4 TOS field.
See RFC 2460 for the definition of the IPv6
Traffic Class field.
</paragraph>
</reference>
</field>
<field name="postIpClassOfService" dataType="unsigned8"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="55" applicability="all" status="current">
<description>
<paragraph>
The definition of this Information Element is identical
to the definition of Information Element
'ipClassOfService', except that it reports a
potentially modified value caused by a middlebox
function after the packet passed the Observation Point.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the definition of the IPv4
TOS field.
See RFC 2460 for the definition of the IPv6
Traffic Class field.
See RFC 3234 for the definition of middleboxes.
</paragraph>
</reference>
</field>
<field name="flowLabelIPv6" dataType="unsigned32"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="31" applicability="all" status="current">
<description>
<paragraph>
The value of the IPv6 Flow Label field in the IP packet header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 2460 for the definition of the
Flow Label field in the IPv6 packet header.
</paragraph>
</reference>
</field>
<field name="isMulticast" dataType="unsigned8"
group="ipHeader"
dataTypeSemantics="flags"
elementId="206" applicability="data" status="current">
<description>
<paragraph>
If the IP destination address is not a reserved multicast
address, then the value of all bits of the octet (including
the reserved ones) is zero.
</paragraph>
<paragraph>
The first bit of this octet is set to 1 if the Version
field of the IP header has the value 4 and if the
Destination Address field contains a reserved multicast
address in the range from 224.0.0.0 to 239.255.255.255.
Otherwise, this bit is set to 0.
</paragraph>
<paragraph>
The second and third bits of this octet are reserved for
future use.
</paragraph>
<paragraph>
The remaining bits of the octet are only set to values
other than zero if the IP Destination Address is a
reserved IPv6 multicast address. Then the fourth bit
of the octet is set to the value of the T flag in the
IPv6 multicast address and the remaining four bits are
set to the value of the scope field in the IPv6
multicast address.
</paragraph>
<artwork>
0 1 2 3 4 5 6 7
+------+------+------+------+------+------+------+------+
| MCv4 | RES. | RES. | T | IPv6 multicast scope |
+------+------+------+------+------+------+------+------+
Bit 0: set to 1 if IPv4 multicast
Bits 1-2: reserved for future use
Bit 4: set to value of T flag, if IPv6 multicast
Bits 4-7: set to value of multicast scope if IPv6 multicast
</artwork>
</description>
<reference>
<paragraph>
See RFC 1112 for the specification of reserved
IPv4 multicast addresses.
See RFC 4291 for the specification of reserved
IPv6 multicast addresses and the definition of the T flag
and the IPv6 multicast scope.
</paragraph>
</reference>
</field>
<field name="fragmentIdentification" dataType="unsigned32"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="54" applicability="data" status="current">
<description>
<paragraph>
The value of the Identification field
in the IPv4 packet header or in the IPv6 Fragment header,
respectively. The value is 0 for IPv6 if there is
no fragment header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the definition of the IPv4
Identification field.
See RFC 2460 for the definition of the
Identification field in the IPv6 Fragment header.
</paragraph>
</reference>
</field>
<field name="fragmentOffset" dataType="unsigned16"
group="ipHeader"
dataTypeSemantics="identifier"
elementId="88" applicability="all" status="current">
<description>
<paragraph>
The value of the IP fragment offset field in the
IPv4 packet header or the IPv6 Fragment header,
respectively. The value is 0 for IPv6 if there is
no fragment header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the specification of the
fragment offset in the IPv4 header.
See RFC 2460 for the specification of the
fragment offset in the IPv6 Fragment header.
</paragraph>
</reference>
</field>
<field name="fragmentFlags" dataType="unsigned8"
group="ipHeader"
dataTypeSemantics="flags"
elementId="197" applicability="all" status="current">
<description>
<paragraph>
Fragmentation properties indicated by flags in the IPv4
packet header or the IPv6 Fragment header, respectively.
</paragraph>
<artwork>
Bit 0: (RS) Reserved.
The value of this bit MUST be 0 until specified
otherwise.
Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment.
Corresponds to the value of the DF flag in the
IPv4 header. Will always be 0 for IPv6 unless
a "don't fragment" feature is introduced to IPv6.
Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments.
Corresponds to the MF flag in the IPv4 header
or to the M flag in the IPv6 Fragment header,
respectively. The value is 0 for IPv6 if there
is no fragment header.
Bits 3-7: (DC) Don't Care.
The values of these bits are irrelevant.
0 1 2 3 4 5 6 7
+---+---+---+---+---+---+---+---+
| R | D | M | D | D | D | D | D |
| S | F | F | C | C | C | C | C |
+---+---+---+---+---+---+---+---+
</artwork>
</description>
<reference>
<paragraph>
See RFC 791 for the specification of the IPv4
fragment flags.
See RFC 2460 for the specification of the IPv6
Fragment header.
</paragraph>
</reference>
</field>
<field name="ipHeaderLength" dataType="unsigned8"
group="ipHeader"
elementId="189" applicability="all" status="current">
<description>
<paragraph>
The length of the IP header. For IPv6, the value of this
Information Element is 40.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the specification of the
IPv4 header.
See RFC 2460 for the specification of the
IPv6 header.
</paragraph>
</reference>
<units>octets</units>
</field>
<field name="ipv4IHL" dataType="unsigned8"
group="ipHeader"
elementId="207" applicability="all" status="current">
<description>
<paragraph>
The value of the Internet Header Length (IHL) field in
the IPv4 header. It specifies the length of the header
in units of 4 octets. Please note that its unit is
different from most of the other Information Elements
reporting length values.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the specification of the
IPv4 header.
</paragraph>
</reference>
<units>4 octets</units>
</field>
<field name="totalLengthIPv4" dataType="unsigned16"
group="ipHeader"
elementId="190" applicability="all" status="current">
<description>
<paragraph>
The total length of the IPv4 packet.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the specification of the
IPv4 total length.
</paragraph>
</reference>
<units>octets</units>
</field>
<field name="ipTotalLength" dataType="unsigned64"
group="ipHeader"
elementId="224" applicability="all" status="current">
<description>
<paragraph>
The total length of the IP packet.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 791 for the specification of the
IPv4 total length.
See RFC 2460 for the specification of the
IPv6 payload length.
See RFC 2675 for the specification of the
IPv6 jumbo payload length.
</paragraph>
</reference>
<units>octets</units>
</field>
<field name="payloadLengthIPv6" dataType="unsigned16"
group="ipHeader"
elementId="191" applicability="all" status="current">
<description>
<paragraph>
This Information Element reports the value of the Payload
Length field in the IPv6 header. Note that IPv6 extension
headers belong to the payload. Also note that in case of a
jumbo payload option the value of the Payload Length field in
the IPv6 header is zero and so will be the value reported
by this Information Element.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 2460 for the specification of the
IPv6 payload length.
See RFC 2675 for the specification of the
IPv6 jumbo payload option.
</paragraph>
</reference>
<units>octets</units>
</field>
<field name="sourceTransportPort" dataType="unsigned16"
group="transportHeader"
dataTypeSemantics="identifier"
elementId="7" applicability="all" status="current">
<description>
<paragraph>
The source port identifier in the transport header.
For the transport protocols UDP, TCP, and SCTP, this is the
source port number given in the respective header. This
field MAY also be used for future transport protocols that
have 16-bit source port identifiers.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 768 for the definition of the UDP
source port field.
See RFC 793 for the definition of the TCP
source port field.
See RFC 4960 for the definition of SCTP.
</paragraph>
<paragraph>
Additional information on defined UDP and TCP port numbers can
be found at http://www.iana.org/assignments/port-numbers.
</paragraph>
</reference>
</field>
<field name="destinationTransportPort" dataType="unsigned16"
group="transportHeader"
dataTypeSemantics="identifier"
elementId="11" applicability="all" status="current">
<description>
<paragraph>
The destination port identifier in the transport header.
For the transport protocols UDP, TCP, and SCTP, this is the
destination port number given in the respective header.
This field MAY also be used for future transport protocols
that have 16-bit destination port identifiers.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 768 for the definition of the UDP
destination port field.
See RFC 793 for the definition of the TCP
destination port field.
See RFC 4960 for the definition of SCTP.
</paragraph>
<paragraph>
Additional information on defined UDP and TCP port numbers can
be found at http://www.iana.org/assignments/port-numbers.
</paragraph>
</reference>
</field>
<field name="udpSourcePort" dataType="unsigned16"
group="transportHeader"
dataTypeSemantics="identifier"
elementId="180" applicability="all" status="current">
<description>
<paragraph>
The source port identifier in the UDP header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 768 for the definition of the
UDP source port field.
Additional information on defined UDP port numbers can
be found at http://www.iana.org/assignments/port-numbers.
</paragraph>
</reference>
</field>
<field name="udpDestinationPort" dataType="unsigned16"
group="transportHeader"
dataTypeSemantics="identifier"
elementId="181" applicability="all" status="current">
<description>
<paragraph>
The destination port identifier in the UDP header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 768 for the definition of the
UDP destination port field.
Additional information on defined UDP port numbers can
be found at http://www.iana.org/assignments/port-numbers.
</paragraph>
</reference>
</field>
<field name="udpMessageLength" dataType="unsigned16"
group="transportHeader"
elementId="205" applicability="all" status="current">
<description>
<paragraph>
The value of the Length field in the UDP header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 768 for the specification of the
UDP header.
</paragraph>
</reference>
<units>octets</units>
</field>
<field name="tcpSourcePort" dataType="unsigned16"
group="transportHeader"
dataTypeSemantics="identifier"
elementId="182" applicability="all" status="current">
<description>
<paragraph>
The source port identifier in the TCP header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 793 for the definition of the TCP
source port field.
Additional information on defined TCP port numbers can
be found at http://www.iana.org/assignments/port-numbers.
</paragraph>
</reference>
</field>
<field name="tcpDestinationPort" dataType="unsigned16"
group="transportHeader"
dataTypeSemantics="identifier"
elementId="183" applicability="all" status="current">
<description>
<paragraph>
The destination port identifier in the TCP header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 793 for the definition of the TCP
source port field.
Additional information on defined TCP port numbers can
be found at http://www.iana.org/assignments/port-numbers.
</paragraph>
</reference>
</field>
<field name="tcpSequenceNumber" dataType="unsigned32"
group="transportHeader"
elementId="184" applicability="all" status="current">
<description>
<paragraph>
The sequence number in the TCP header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 793 for the definition of the TCP
sequence number.
</paragraph>
</reference>
</field>
<field name="tcpAcknowledgementNumber" dataType="unsigned32"
group="transportHeader"
elementId="185" applicability="all" status="current">
<description>
<paragraph>
The acknowledgement number in the TCP header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 793 for the definition of the TCP
acknowledgement number.
</paragraph>
</reference>
</field>
<field name="tcpWindowSize" dataType="unsigned16"
group="transportHeader"
elementId="186" applicability="all" status="current">
<description>
<paragraph>
The window field in the TCP header.
If the TCP window scale is supported,
then TCP window scale must be known
to fully interpret the value of this information.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 793 for the definition of the TCP window field.
See RFC 1323 for the definition of the TCP window scale.
</paragraph>
</reference>
</field>
<field name="tcpWindowScale" dataType="unsigned16"
group="transportHeader"
elementId="238" applicability="all" status="current">
<description>
<paragraph>
The scale of the window field in the TCP header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 1323 for the definition of the TCP window scale.
</paragraph>
</reference>
</field>
<field name="tcpUrgentPointer" dataType="unsigned16"
group="transportHeader"
elementId="187" applicability="all" status="current">
<description>
<paragraph>
The urgent pointer in the TCP header.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 793 for the definition of the TCP
urgent pointer.
</paragraph>
</reference>
</field>
<field name="tcpHeaderLength" dataType="unsigned8"
group="transportHeader"
elementId="188" applicability="all" status="current">
<description>
<paragraph>
The length of the TCP header. Note that the value of this
Information Element is different from the value of the Data
Offset field in the TCP header. The Data Offset field
indicates the length of the TCP header in units of 4 octets.
This Information Elements specifies the length of the TCP
header in units of octets.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 793 for the definition of the
TCP header.
</paragraph>
</reference>
<units>octets</units>
</field>
<field name="icmpTypeCodeIPv4" dataType="unsigned16"
group="transportHeader"
dataTypeSemantics="identifier"
elementId="32" applicability="all" status="current">
<description>
<paragraph>
Type and Code of the IPv4 ICMP message. The combination of
both values is reported as (ICMP type * 256) + ICMP code.
</paragraph>
</description>
<reference>
<paragraph>
See RFC 792 for the definition of the IPv4 ICMP
type and code fields.
</paragraph>
</reference>
</field>
(next page on part 6)
