RFC 5102
Information Model for IP Flow Information Export
5.5. Transport Header Fields
The set of Information Elements related to transport header fields and length includes the Information Elements listed in the table below. +-----+---------------------------+-----+---------------------------+ | ID | Name | ID | Name | +-----+---------------------------+-----+---------------------------+ | 7 | sourceTransportPort | 238 | tcpWindowScale | | 11 | destinationTransportPort | 187 | tcpUrgentPointer | | 180 | udpSourcePort | 188 | tcpHeaderLength | | 181 | udpDestinationPort | 32 | icmpTypeCodeIPv4 | | 205 | udpMessageLength | 176 | icmpTypeIPv4 | | 182 | tcpSourcePort | 177 | icmpCodeIPv4 | | 183 | tcpDestinationPort | 139 | icmpTypeCodeIPv6 | | 184 | tcpSequenceNumber | 178 | icmpTypeIPv6 | | 185 | tcpAcknowledgementNumber | 179 | icmpCodeIPv6 | | 186 | tcpWindowSize | 33 | igmpType | +-----+---------------------------+-----+---------------------------+5.5.1. sourceTransportPort
Description: The source port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the source port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. Abstract Data Type: unsigned16 Data Type Semantics: identifier ElementId: 7 Status: current Reference: See RFC 768 for the definition of the UDP source port field. See RFC 793 for the definition of the TCP source port field. See RFC 4960 for the definition of SCTP. Additional information on defined UDP and TCP port numbers can be found at http://www.iana.org/assignments/port-numbers.5.5.2. destinationTransportPort
Description: The destination port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the destination port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit destination port identifiers.
Abstract Data Type: unsigned16
Data Type Semantics: identifier
ElementId: 11
Status: current
Reference:
See RFC 768 for the definition of the UDP destination port field.
See RFC 793 for the definition of the TCP destination port field.
See RFC 4960 for the definition of SCTP. Additional information
on defined UDP and TCP port numbers can be found at
http://www.iana.org/assignments/port-numbers.
5.5.3. udpSourcePort
Description:
The source port identifier in the UDP header.
Abstract Data Type: unsigned16
Data Type Semantics: identifier
ElementId: 180
Status: current
Reference:
See RFC 768 for the definition of the UDP source port field.
Additional information on defined UDP port numbers can be found at
http://www.iana.org/assignments/port-numbers.
5.5.4. udpDestinationPort
Description:
The destination port identifier in the UDP header.
Abstract Data Type: unsigned16
Data Type Semantics: identifier
ElementId: 181
Status: current
Reference:
See RFC 768 for the definition of the UDP destination port field.
Additional information on defined UDP port numbers can be found at
http://www.iana.org/assignments/port-numbers.
5.5.5. udpMessageLength
Description:
The value of the Length field in the UDP header.
Abstract Data Type: unsigned16
ElementId: 205
Status: current
Units: octets
Reference:
See RFC 768 for the specification of the UDP header.
5.5.6. tcpSourcePort
Description: The source port identifier in the TCP header. Abstract Data Type: unsigned16 Data Type Semantics: identifier ElementId: 182 Status: current Reference: See RFC 793 for the definition of the TCP source port field. Additional information on defined TCP port numbers can be found at http://www.iana.org/assignments/port-numbers.5.5.7. tcpDestinationPort
Description: The destination port identifier in the TCP header. Abstract Data Type: unsigned16 Data Type Semantics: identifier ElementId: 183 Status: current Reference: See RFC 793 for the definition of the TCP source port field. Additional information on defined TCP port numbers can be found at http://www.iana.org/assignments/port-numbers.5.5.8. tcpSequenceNumber
Description: The sequence number in the TCP header. Abstract Data Type: unsigned32 ElementId: 184 Status: current Reference: See RFC 793 for the definition of the TCP sequence number.5.5.9. tcpAcknowledgementNumber
Description: The acknowledgement number in the TCP header. Abstract Data Type: unsigned32 ElementId: 185 Status: current Reference: See RFC 793 for the definition of the TCP acknowledgement number.
5.5.10. tcpWindowSize
Description: The window field in the TCP header. If the TCP window scale is supported, then TCP window scale must be known to fully interpret the value of this information. Abstract Data Type: unsigned16 ElementId: 186 Status: current Reference: See RFC 793 for the definition of the TCP window field. See RFC 1323 for the definition of the TCP window scale.5.5.11. tcpWindowScale
Description: The scale of the window field in the TCP header. Abstract Data Type: unsigned16 ElementId: 238 Status: current Reference: See RFC 1323 for the definition of the TCP window scale.5.5.12. tcpUrgentPointer
Description: The urgent pointer in the TCP header. Abstract Data Type: unsigned16 ElementId: 187 Status: current Reference: See RFC 793 for the definition of the TCP urgent pointer.5.5.13. tcpHeaderLength
Description: The length of the TCP header. Note that the value of this Information Element is different from the value of the Data Offset field in the TCP header. The Data Offset field indicates the length of the TCP header in units of 4 octets. This Information Elements specifies the length of the TCP header in units of octets. Abstract Data Type: unsigned8 ElementId: 188 Status: current Units: octets Reference: See RFC 793 for the definition of the TCP header.
5.5.14. icmpTypeCodeIPv4
Description: Type and Code of the IPv4 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code. Abstract Data Type: unsigned16 Data Type Semantics: identifier ElementId: 32 Status: current Reference: See RFC 792 for the definition of the IPv4 ICMP type and code fields.5.5.15. icmpTypeIPv4
Description: Type of the IPv4 ICMP message. Abstract Data Type: unsigned8 Data Type Semantics: identifier ElementId: 176 Status: current Reference: See RFC 792 for the definition of the IPv4 ICMP type field.5.5.16. icmpCodeIPv4
Description: Code of the IPv4 ICMP message. Abstract Data Type: unsigned8 Data Type Semantics: identifier ElementId: 177 Status: current Reference: See RFC 792 for the definition of the IPv4 ICMP code field.5.5.17. icmpTypeCodeIPv6
Description: Type and Code of the IPv6 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code. Abstract Data Type: unsigned16 Data Type Semantics: identifier ElementId: 139 Status: current Reference: See RFC 4443 for the definition of the IPv6 ICMP type and code fields.
5.5.18. icmpTypeIPv6
Description: Type of the IPv6 ICMP message. Abstract Data Type: unsigned8 Data Type Semantics: identifier ElementId: 178 Status: current Reference: See RFC 4443 for the definition of the IPv6 ICMP type field.5.5.19. icmpCodeIPv6
Description: Code of the IPv6 ICMP message. Abstract Data Type: unsigned8 Data Type Semantics: identifier ElementId: 179 Status: current Reference: See RFC 4443 for the definition of the IPv6 ICMP code field.5.5.20. igmpType
Description: The type field of the IGMP message. Abstract Data Type: unsigned8 Data Type Semantics: identifier ElementId: 33 Status: current Reference: See RFC 3376 for the definition of the IGMP type field.
5.6. Sub-IP Header Fields
The set of Information Elements related to Sub-IP header fields includes the Information Elements listed in the table below. +-----+---------------------------+-----+---------------------------+ | ID | Name | ID | Name | +-----+---------------------------+-----+---------------------------+ | 56 | sourceMacAddress | 201 | mplsLabelStackLength | | 81 | postSourceMacAddress | 194 | mplsPayloadLength | | 58 | vlanId | 70 | mplsTopLabelStackSection | | 59 | postVlanId | 71 | mplsLabelStackSection2 | | 80 | destinationMacAddress | 72 | mplsLabelStackSection3 | | 57 | postDestinationMacAddress | 73 | mplsLabelStackSection4 | | 146 | wlanChannelId | 74 | mplsLabelStackSection5 | | 147 | wlanSSID | 75 | mplsLabelStackSection6 | | 200 | mplsTopLabelTTL | 76 | mplsLabelStackSection7 | | 203 | mplsTopLabelExp | 77 | mplsLabelStackSection8 | | 237 | postMplsTopLabelExp | 78 | mplsLabelStackSection9 | | 202 | mplsLabelStackDepth | 79 | mplsLabelStackSection10 | +-----+---------------------------+-----+---------------------------+5.6.1. sourceMacAddress
Description: The IEEE 802 source MAC address field. Abstract Data Type: macAddress Data Type Semantics: identifier ElementId: 56 Status: current Reference: See IEEE.802-3.2002.5.6.2. postSourceMacAddress
Description: The definition of this Information Element is identical to the definition of Information Element 'sourceMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. Abstract Data Type: macAddress Data Type Semantics: identifier ElementId: 81 Status: current Reference: See IEEE.802-3.2002.
5.6.3. vlanId
Description: The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control Information field that was attached to the IP packet. Abstract Data Type: unsigned16 Data Type Semantics: identifier ElementId: 58 Status: current Reference: See IEEE.802-1Q.2003.5.6.4. postVlanId
Description: The definition of this Information Element is identical to the definition of Information Element 'vlanId', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. Abstract Data Type: unsigned16 Data Type Semantics: identifier ElementId: 59 Status: current Reference: See IEEE.802-1Q.2003.5.6.5. destinationMacAddress
Description: The IEEE 802 destination MAC address field. Abstract Data Type: macAddress Data Type Semantics: identifier ElementId: 80 Status: current Reference: See IEEE.802-3.2002.5.6.6. postDestinationMacAddress
Description: The definition of this Information Element is identical to the definition of Information Element 'destinationMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. Abstract Data Type: macAddress Data Type Semantics: identifier ElementId: 57 Status: current
Reference:
See IEEE.802-3.2002.
5.6.7. wlanChannelId
Description:
The identifier of the 802.11 (Wi-Fi) channel used.
Abstract Data Type: unsigned8
Data Type Semantics: identifier
ElementId: 146
Status: current
Reference:
See IEEE.802-11.1999.
5.6.8. wlanSSID
Description:
The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi)
network used. According to IEEE.802-11.1999, the SSID is encoded
into a string of up to 32 characters.
Abstract Data Type: string
ElementId: 147
Status: current
Reference:
See IEEE.802-11.1999.
5.6.9. mplsTopLabelTTL
Description:
The TTL field from the top MPLS label stack entry, i.e., the last
label that was pushed.
Abstract Data Type: unsigned8
ElementId: 200
Status: current
Units: hops
Reference:
See RFC 3032 for the specification of the TTL field.
5.6.10. mplsTopLabelExp
Description: The Exp field from the top MPLS label stack entry, i.e., the last label that was pushed. Bits 0-4: Don't Care, value is irrelevant. Bits 5-7: MPLS Exp field. 0 1 2 3 4 5 6 7 +---+---+---+---+---+---+---+---+ | don't care | Exp | +---+---+---+---+---+---+---+---+ Abstract Data Type: unsigned8 Data Type Semantics: flags ElementId: 203 Status: current Reference: See RFC 3032 for the specification of the Exp field. See RFC 3270 for usage of the Exp field.5.6.11. postMplsTopLabelExp
Description: The definition of this Information Element is identical to the definition of Information Element 'mplsTopLabelExp', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. Abstract Data Type: unsigned8 Data Type Semantics: flags ElementId: 237 Status: current Reference: See RFC 3032 for the specification of the Exp field. See RFC 3270 for usage of the Exp field.5.6.12. mplsLabelStackDepth
Description: The number of labels in the MPLS label stack. Abstract Data Type: unsigned32 ElementId: 202 Status: current Units: label stack entries Reference: See RFC 3032 for the specification of the MPLS label stack.
5.6.13. mplsLabelStackLength
Description: The length of the MPLS label stack in units of octets. Abstract Data Type: unsigned32 ElementId: 201 Status: current Units: octets Reference: See RFC 3032 for the specification of the MPLS label stack.5.6.14. mplsPayloadLength
Description: The size of the MPLS packet without the label stack. Abstract Data Type: unsigned32 ElementId: 194 Status: current Units: octets Reference: See RFC 3031 for the specification of MPLS packets. See RFC 3032 for the specification of the MPLS label stack.5.6.15. mplsTopLabelStackSection
Description: The Label, Exp, and S fields from the top MPLS label stack entry, i.e., from the last label that was pushed. The size of this Information Element is 3 octets. 0 1 2 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Label | Exp |S| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Label: Label Value, 20 bits Exp: Experimental Use, 3 bits S: Bottom of Stack, 1 bit Abstract Data Type: octetArray Data Type Semantics: identifier ElementId: 70 Status: current Reference: See RFC 3032.
5.6.16. mplsLabelStackSection2
Description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsTopLabelStackSection. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. Abstract Data Type: octetArray Data Type Semantics: identifier ElementId: 71 Status: current Reference: See RFC 3032.5.6.17. mplsLabelStackSection3
Description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection2. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. Abstract Data Type: octetArray Data Type Semantics: identifier ElementId: 72 Status: current Reference: See RFC 3032.5.6.18. mplsLabelStackSection4
Description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection3. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. Abstract Data Type: octetArray Data Type Semantics: identifier ElementId: 73 Status: current Reference: See RFC 3032.
5.6.19. mplsLabelStackSection5
Description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection4. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. Abstract Data Type: octetArray Data Type Semantics: identifier ElementId: 74 Status: current Reference: See RFC 3032.5.6.20. mplsLabelStackSection6
Description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection5. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. Abstract Data Type: octetArray Data Type Semantics: identifier ElementId: 75 Status: current Reference: See RFC 3032.5.6.21. mplsLabelStackSection7
Description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection6. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. Abstract Data Type: octetArray Data Type Semantics: identifier ElementId: 76 Status: current Reference: See RFC 3032.
5.6.22. mplsLabelStackSection8
Description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection7. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. Abstract Data Type: octetArray Data Type Semantics: identifier ElementId: 77 Status: current Reference: See RFC 3032.5.6.23. mplsLabelStackSection9
Description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection8. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. Abstract Data Type: octetArray Data Type Semantics: identifier ElementId: 78 Status: current Reference: See RFC 3032.5.6.24. mplsLabelStackSection10
Description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection9. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. Abstract Data Type: octetArray Data Type Semantics: identifier ElementId: 79 Status: current Reference: See RFC 3032.
5.7. Derived Packet Properties
The set of Information Elements derived from packet properties (for example, values of header fields) includes the Information Elements listed in the table below. +-----+---------------------------+-----+---------------------------+ | ID | Name | ID | Name | +-----+---------------------------+-----+---------------------------+ | 204 | ipPayloadLength | 18 | bgpNextHopIPv4Address | | 15 | ipNextHopIPv4Address | 63 | bgpNextHopIPv6Address | | 62 | ipNextHopIPv6Address | 46 | mplsTopLabelType | | 16 | bgpSourceAsNumber | 47 | mplsTopLabelIPv4Address | | 17 | bgpDestinationAsNumber | 140 | mplsTopLabelIPv6Address | | 128 | bgpNextAdjacentAsNumber | 90 | mplsVpnRouteDistinguisher | | 129 | bgpPrevAdjacentAsNumber | | | +-----+---------------------------+-----+---------------------------+5.7.1. ipPayloadLength
Description: The effective length of the IP payload. For IPv4 packets, the value of this Information Element is the difference between the total length of the IPv4 packet (as reported by Information Element totalLengthIPv4) and the length of the IPv4 header (as reported by Information Element headerLengthIPv4). For IPv6, the value of the Payload Length field in the IPv6 header is reported except in the case that the value of this field is zero and that there is a valid jumbo payload option. In this case, the value of the Jumbo Payload Length field in the jumbo payload option is reported. Abstract Data Type: unsigned32 ElementId: 204 Status: current Units: octets Reference: See RFC 791 for the specification of IPv4 packets. See RFC 2460 for the specification of the IPv6 payload length. See RFC 2675 for the specification of the IPv6 jumbo payload length.5.7.2. ipNextHopIPv4Address
Description: The IPv4 address of the next IPv4 hop. Abstract Data Type: ipv4Address Data Type Semantics: identifier ElementId: 15 Status: current
5.7.3. ipNextHopIPv6Address
Description: The IPv6 address of the next IPv6 hop. Abstract Data Type: ipv6Address Data Type Semantics: identifier ElementId: 62 Status: current5.7.4. bgpSourceAsNumber
Description: The autonomous system (AS) number of the source IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. Abstract Data Type: unsigned32 Data Type Semantics: identifier ElementId: 16 Status: current Reference: See RFC 4271 for a description of BGP-4, and see RFC 1930 for the definition of the AS number.5.7.5. bgpDestinationAsNumber
Description: The autonomous system (AS) number of the destination IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. Abstract Data Type: unsigned32 Data Type Semantics: identifier ElementId: 17 Status: current Reference: See RFC 4271 for a description of BGP-4, and see RFC 1930 for the definition of the AS number.5.7.6. bgpNextAdjacentAsNumber
Description: The autonomous system (AS) number of the first AS in the AS path to the destination IP address. The path is deduced by looking up the destination IP address of the Flow in the BGP routing information base. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0.
Abstract Data Type: unsigned32
Data Type Semantics: identifier
ElementId: 128
Status: current
Reference:
See RFC 4271 for a description of BGP-4, and see RFC 1930 for the
definition of the AS number.
5.7.7. bgpPrevAdjacentAsNumber
Description:
The autonomous system (AS) number of the last AS in the AS path
from the source IP address. The path is deduced by looking up the
source IP address of the Flow in the BGP routing information base.
If AS path information for this Flow is only available as an
unordered AS set (and not as an ordered AS sequence), then the
value of this Information Element is 0. In case of BGP asymmetry,
the bgpPrevAdjacentAsNumber might not be able to report the
correct value.
Abstract Data Type: unsigned32
Data Type Semantics: identifier
ElementId: 129
Status: current
Reference:
See RFC 4271 for a description of BGP-4, and see RFC 1930 for the
definition of the AS number.
5.7.8. bgpNextHopIPv4Address
Description:
The IPv4 address of the next (adjacent) BGP hop.
Abstract Data Type: ipv4Address
Data Type Semantics: identifier
ElementId: 18
Status: current
Reference:
See RFC 4271 for a description of BGP-4.
5.7.9. bgpNextHopIPv6Address
Description:
The IPv6 address of the next (adjacent) BGP hop.
Abstract Data Type: ipv6Address
Data Type Semantics: identifier
ElementId: 63
Status: current
Reference:
See RFC 4271 for a description of BGP-4.
5.7.10. mplsTopLabelType
Description: This field identifies the control protocol that allocated the top-of-stack label. Initial values for this field are listed below. Further values may be assigned by IANA in the MPLS label type registry. - 0x01 TE-MIDPT: Any TE tunnel mid-point or tail label - 0x02 Pseudowire: Any PWE3 or Cisco AToM based label - 0x03 VPN: Any label associated with VPN - 0x04 BGP: Any label associated with BGP or BGP routing - 0x05 LDP: Any label associated with dynamically assigned labels using LDP Abstract Data Type: unsigned8 Data Type Semantics: identifier ElementId: 46 Status: current Reference: See RFC 3031 for the MPLS label structure. See RFC 4364 for the association of MPLS labels with Virtual Private Networks (VPNs). See RFC 4271 for BGP and BGP routing. See RFC 5036 for Label Distribution Protocol (LDP). See the list of MPLS label types assigned by IANA at http://www.iana.org/assignments/mpls-label-values.5.7.11. mplsTopLabelIPv4Address
Description: The IPv4 address of the system that the MPLS top label will cause this Flow to be forwarded to. Abstract Data Type: ipv4Address Data Type Semantics: identifier ElementId: 47 Status: current Reference: See RFC 3031 for the association between MPLS labels and IP addresses.
5.7.12. mplsTopLabelIPv6Address
Description: The IPv6 address of the system that the MPLS top label will cause this Flow to be forwarded to. Abstract Data Type: ipv6Address Data Type Semantics: identifier ElementId: 140 Status: current Reference: See RFC 3031 for the association between MPLS labels and IP addresses.5.7.13. mplsVpnRouteDistinguisher
Description: The value of the VPN route distinguisher of a corresponding entry in a VPN routing and forwarding table. Route distinguisher ensures that the same address can be used in several different MPLS VPNs and that it is possible for BGP to carry several completely different routes to that address, one for each VPN. According to RFC 4364, the size of mplsVpnRouteDistinguisher is 8 octets. However, in RFC 4382 an octet string with flexible length was chosen for representing a VPN route distinguisher by object MplsL3VpnRouteDistinguisher. This choice was made in order to be open to future changes of the size. This idea was adopted when choosing octetArray as abstract data type for this Information Element. The maximum length of this Information Element is 256 octets. Abstract Data Type: octetArray Data Type Semantics: identifier ElementId: 90 Status: current Reference: See RFC 4364 for the specification of the route distinguisher. See RFC 4382 for the specification of the MPLS/BGP Layer 3 Virtual Private Network (VPN) Management Information Base.
5.8. Min/Max Flow Properties
Information Elements in this section are results of minimum or maximum operations over all packets of a Flow. +-----+---------------------------+-----+---------------------------+ | ID | Name | ID | Name | +-----+---------------------------+-----+---------------------------+ | 25 | minimumIpTotalLength | 208 | ipv4Options | | 26 | maximumIpTotalLength | 64 | ipv6ExtensionHeaders | | 52 | minimumTTL | 6 | tcpControlBits | | 53 | maximumTTL | 209 | tcpOptions | +-----+---------------------------+-----+---------------------------+5.8.1. minimumIpTotalLength
Description: Length of the smallest packet observed for this Flow. The packet length includes the IP header(s) length and the IP payload length. Abstract Data Type: unsigned64 ElementId: 25 Status: current Units: octets Reference: See RFC 791 for the specification of the IPv4 total length. See RFC 2460 for the specification of the IPv6 payload length. See RFC 2675 for the specification of the IPv6 jumbo payload length.5.8.2. maximumIpTotalLength
Description: Length of the largest packet observed for this Flow. The packet length includes the IP header(s) length and the IP payload length. Abstract Data Type: unsigned64 ElementId: 26 Status: current Units: octets Reference: See RFC 791 for the specification of the IPv4 total length. See RFC 2460 for the specification of the IPv6 payload length. See RFC 2675 for the specification of the IPv6 jumbo payload length.5.8.3. minimumTTL
Description: Minimum TTL value observed for any packet in this Flow.
Abstract Data Type: unsigned8
ElementId: 52
Status: current
Units: hops
Reference:
See RFC 791 for the definition of the IPv4 Time to Live field.
See RFC 2460 for the definition of the IPv6 Hop Limit field.
5.8.4. maximumTTL
Description:
Maximum TTL value observed for any packet in this Flow.
Abstract Data Type: unsigned8
ElementId: 53
Status: current
Units: hops
Reference:
See RFC 791 for the definition of the IPv4 Time to Live field.
See RFC 2460 for the definition of the IPv6 Hop Limit field.
5.8.5. ipv4Options
Description:
IPv4 options in packets of this Flow. The information is encoded
in a set of bit fields. For each valid IPv4 option type, there is
a bit in this set. The bit is set to 1 if any observed packet of
this Flow contains the corresponding IPv4 option type. Otherwise,
if no observed packet of this Flow contained the respective IPv4
option type, the value of the corresponding bit is 0. The list of
valid IPv4 options is maintained by IANA. Note that for
identifying an option not just the 5-bit Option Number, but all 8
bits of the Option Type need to match one of the IPv4 options
specified at http://www.iana.org/assignments/ip-parameters.
Options are mapped to bits according to their option numbers.
Option number X is mapped to bit X. The mapping is illustrated by
the figure below.
0 1 2 3 4 5 6 7
+------+------+------+------+------+------+------+------+
| EOOL | NOP | SEC | LSR | TS |E-SEC |CIPSO | RR | ...
+------+------+------+------+------+------+------+------+
8 9 10 11 12 13 14 15
+------+------+------+------+------+------+------+------+
... | SID | SSR | ZSU | MTUP | MTUR | FINN | VISA |ENCODE| ...
+------+------+------+------+------+------+------+------+
16 17 18 19 20 21 22 23
+------+------+------+------+------+------+------+------+
... |IMITD | EIP | TR |ADDEXT|RTRALT| SDB |NSAPA | DPS | ...
+------+------+------+------+------+------+------+------+
24 25 26 27 28 29 30 31
+------+------+------+------+------+------+------+------+
... | UMP | QS | to be assigned by IANA | EXP | |
+------+------+------+------+------+------+------+------+
Type Option
Bit Value Name Reference
---+-----+-------+------------------------------------
0 0 EOOL End of Options List, RFC 791
1 1 NOP No Operation, RFC 791
2 130 SEC Security, RFC 1108
3 131 LSR Loose Source Route, RFC 791
4 68 TS Time Stamp, RFC 791
5 133 E-SEC Extended Security, RFC 1108
6 134 CIPSO Commercial Security
7 7 RR Record Route, RFC 791
8 136 SID Stream ID, RFC 791
9 137 SSR Strict Source Route, RFC 791
10 10 ZSU Experimental Measurement
11 11 MTUP (obsoleted) MTU Probe, RFC 1191
12 12 MTUR (obsoleted) MTU Reply, RFC 1191
13 205 FINN Experimental Flow Control
14 142 VISA Experimental Access Control
15 15 ENCODE
16 144 IMITD IMI Traffic Descriptor
17 145 EIP Extended Internet Protocol, RFC 1385
18 82 TR Traceroute, RFC 3193
19 147 ADDEXT Address Extension
20 148 RTRALT Router Alert, RFC 2113
21 149 SDB Selective Directed Broadcast
22 150 NSAPA NSAP Address
23 151 DPS Dynamic Packet State
24 152 UMP Upstream Multicast Pkt.
25 25 QS Quick-Start
30 30 EXP RFC3692-style Experiment
30 94 EXP RFC3692-style Experiment
30 158 EXP RFC3692-style Experiment
30 222 EXP RFC3692-style Experiment
... ... ... Further options numbers
may be assigned by IANA
Abstract Data Type: unsigned32
Data Type Semantics: flags
ElementId: 208
Status: current
Reference:
See RFC 791 for the definition of IPv4 options. See the list of
IPv4 option numbers assigned by IANA at
http://www.iana.org/assignments/ip-parameters.
5.8.6. ipv6ExtensionHeaders
Description:
IPv6 extension headers observed in packets of this Flow. The
information is encoded in a set of bit fields. For each IPv6
option header, there is a bit in this set. The bit is set to 1 if
any observed packet of this Flow contains the corresponding IPv6
extension header. Otherwise, if no observed packet of this Flow
contained the respective IPv6 extension header, the value of the
corresponding bit is 0.
0 1 2 3 4 5 6 7
+-----+-----+-----+-----+-----+-----+-----+-----+
| Res | FRA1| RH | FRA0| UNK | Res | HOP | DST | ...
+-----+-----+-----+-----+-----+-----+-----+-----+
8 9 10 11 12 13 14 15
+-----+-----+-----+-----+-----+-----+-----+-----+
... | PAY | AH | ESP | Reserved | ...
+-----+-----+-----+-----+-----+-----+-----+-----+
16 17 18 19 20 21 22 23
+-----+-----+-----+-----+-----+-----+-----+-----+
... | Reserved | ...
+-----+-----+-----+-----+-----+-----+-----+-----+
24 25 26 27 28 29 30 31
+-----+-----+-----+-----+-----+-----+-----+-----+
... | Reserved |
+-----+-----+-----+-----+-----+-----+-----+-----+
Bit IPv6 Option Description
0, Res Reserved
1, FRA1 44 Fragmentation header - not first fragment
2, RH 43 Routing header
3, FRA0 44 Fragment header - first fragment
4, UNK Unknown Layer 4 header
(compressed, encrypted, not supported)
5, Res Reserved
6, HOP 0 Hop-by-hop option header
7, DST 60 Destination option header
8, PAY 108 Payload compression header
9, AH 51 Authentication Header
10, ESP 50 Encrypted security payload
11 to 31 Reserved
Abstract Data Type: unsigned32
Data Type Semantics: flags
ElementId: 64
Status: current
Reference:
See RFC 2460 for the general definition of IPv6 extension headers
and for the specification of the hop-by-hop options header, the
routing header, the fragment header, and the destination options
header. See RFC 4302 for the specification of the authentication
header. See RFC 4303 for the specification of the encapsulating
security payload.
5.8.7. tcpControlBits
Description:
TCP control bits observed for packets of this Flow. The
information is encoded in a set of bit fields. For each TCP
control bit, there is a bit in this set. A bit is set to 1 if any
observed packet of this Flow has the corresponding TCP control bit
set to 1. A value of 0 for a bit indicates that the corresponding
bit was not set in any of the observed packets of this Flow.
0 1 2 3 4 5 6 7
+-----+-----+-----+-----+-----+-----+-----+-----+
| Reserved | URG | ACK | PSH | RST | SYN | FIN |
+-----+-----+-----+-----+-----+-----+-----+-----+
Reserved: Reserved for future use by TCP. Must be zero.
URG: Urgent Pointer field significant
ACK: Acknowledgment field significant
PSH: Push Function
RST: Reset the connection
SYN: Synchronize sequence numbers
FIN: No more data from sender
Abstract Data Type: unsigned8
Data Type Semantics: flags
ElementId: 6
Status: current
Reference:
See RFC 793 for the definition of the TCP control bits in the TCP
header.
5.8.8. tcpOptions
Description: TCP options in packets of this Flow. The information is encoded in a set of bit fields. For each TCP option, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding TCP option. Otherwise, if no observed packet of this Flow contained the respective TCP option, the value of the corresponding bit is 0. Options are mapped to bits according to their option numbers. Option number X is mapped to bit X. TCP option numbers are maintained by IANA. 0 1 2 3 4 5 6 7 +-----+-----+-----+-----+-----+-----+-----+-----+ | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | ... +-----+-----+-----+-----+-----+-----+-----+-----+ 8 9 10 11 12 13 14 15 +-----+-----+-----+-----+-----+-----+-----+-----+ ... | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |... +-----+-----+-----+-----+-----+-----+-----+-----+ 16 17 18 19 20 21 22 23 +-----+-----+-----+-----+-----+-----+-----+-----+ ... | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 |... +-----+-----+-----+-----+-----+-----+-----+-----+ . . . 56 57 58 59 60 61 62 63 +-----+-----+-----+-----+-----+-----+-----+-----+ ... | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | +-----+-----+-----+-----+-----+-----+-----+-----+ Abstract Data Type: unsigned64 Data Type Semantics: flags ElementId: 209 Status: current Reference: See RFC 793 for the definition of TCP options. See the list of TCP option numbers assigned by IANA at http://www.iana.org/assignments/tcp-parameters.
(next page on part 4)
