Tech-invite3GPPspaceIETFspace
96959493929190898887868584838281807978777675747372717069686766656463626160595857565554535251504948474645444342414039383736353433323130292827262524232221201918171615141312111009080706050403020100
in Index   Prev   Next

RFC 5102

Information Model for IP Flow Information Export

Pages: 171
Obsoleted by:  7012
Updated by:  6313
Part 5 of 7 – Pages 88 to 118
First   Prev   Next

ToP   noToC   RFC5102 - Page 88   prevText

Appendix A. XML Specification of IPFIX Information Elements

This appendix contains a machine-readable description of the IPFIX information model coded in XML. Note that this appendix is of informational nature, while the text in Section 4 (generated from this appendix) is normative. Using a machine-readable syntax for the information model enables the creation of IPFIX-aware tools that can automatically adapt to extensions to the information model, by simply reading updated information model specifications. The wide availability of XML-aware tools and libraries for client devices is a primary consideration for this choice. In particular, libraries for parsing XML documents are readily available. Also, mechanisms such as the Extensible Stylesheet Language (XSL) allow for transforming a source XML document into other documents. This document was authored in XML and transformed according to [RFC2629]. It should be noted that the use of XML in Exporters, Collectors, or other tools is not mandatory for the deployment of IPFIX. In particular, Exporting Processes do not produce or consume XML as part of their operation. It is expected that IPFIX Collectors MAY take advantage of the machine readability of the information model vs. hard coding their behavior or inventing proprietary means for accommodating extensions. <?xml version="1.0" encoding="UTF-8"?> <fieldDefinitions xmlns="urn:ietf:params:xml:ns:ipfix-info" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:ietf:params:xml:ns:ipfix-info ipfix-info.xsd"> <field name="lineCardId" dataType="unsigned32" group="scope" dataTypeSemantics="identifier" elementId="141" applicability="option" status="current"> <description> <paragraph> An identifier of a line card that is unique per IPFIX Device hosting an Observation Point. Typically, this Information Element is used for limiting the scope of other Information Elements. </paragraph> </description> </field> <field name="portId" dataType="unsigned32"
ToP   noToC   RFC5102 - Page 89
            group="scope"
            dataTypeSemantics="identifier"
            elementId="142" applicability="option" status="current">
       <description>
         <paragraph>
           An identifier of a line port that is unique per IPFIX
           Device hosting an Observation Point.  Typically, this
           Information Element is used for limiting the scope
           of other Information Elements.
         </paragraph>
       </description>
     </field>

     <field name="ingressInterface" dataType="unsigned32"
            group="scope"
            dataTypeSemantics="identifier"
            elementId="10" applicability="all" status="current">
       <description>
         <paragraph>
           The index of the IP interface where packets of this Flow
           are being received.  The value matches the value of managed
           object 'ifIndex' as defined in RFC 2863.
           Note that ifIndex values are not assigned statically to an
           interface and that the interfaces may be renumbered every
           time the device's management system is re-initialized, as
           specified in RFC 2863.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 2863 for the definition of the ifIndex object.
         </paragraph>
       </reference>
     </field>

     <field name="egressInterface" dataType="unsigned32"
            group="scope"
            dataTypeSemantics="identifier"
            elementId="14" applicability="all" status="current">
       <description>
         <paragraph>
           The index of the IP interface where packets of
           this Flow are being sent.  The value matches the value of
           managed object 'ifIndex' as defined in RFC 2863.
           Note that ifIndex values are not assigned statically to an
           interface and that the interfaces may be renumbered every
           time the device's management system is re-initialized, as
           specified in RFC 2863.
ToP   noToC   RFC5102 - Page 90
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 2863 for the definition of the ifIndex object.
         </paragraph>
       </reference>
     </field>

     <field name="meteringProcessId" dataType="unsigned32"
            group="scope"
            dataTypeSemantics="identifier"
            elementId="143" applicability="option" status="current">
       <description>
         <paragraph>
           An identifier of a Metering Process that is unique per
           IPFIX Device.  Typically, this Information Element is used
           for limiting the scope of other Information Elements.
           Note that process identifiers are typically assigned
           dynamically.
           The Metering Process may be re-started with a different ID.
         </paragraph>
       </description>
     </field>

     <field name="exportingProcessId" dataType="unsigned32"
            group="scope"
            dataTypeSemantics="identifier"
            elementId="144" applicability="option" status="current">
       <description>
         <paragraph>
           An identifier of an Exporting Process that is unique per
           IPFIX Device.  Typically, this Information Element is used
           for limiting the scope of other Information Elements.
           Note that process identifiers are typically assigned
           dynamically.  The Exporting Process may be re-started
           with a different ID.
         </paragraph>
       </description>
     </field>

     <field name="flowId" dataType="unsigned64"
            group="scope"
            dataTypeSemantics="identifier"
            elementId="148" applicability="option" status="current">
       <description>
         <paragraph>
           An identifier of a Flow that is unique within an Observation
ToP   noToC   RFC5102 - Page 91
           Domain.  This Information Element can be used to distinguish
           between different Flows if Flow Keys such as IP addresses and
           port numbers are not reported or are reported in separate
           records.
         </paragraph>
       </description>
     </field>

     <field name="templateId" dataType="unsigned16"
            group="scope"
            dataTypeSemantics="identifier"
            elementId="145" applicability="option" status="current">
       <description>
         <paragraph>
           An identifier of a Template that is locally unique within a
           combination of a Transport session and an Observation Domain.
         </paragraph>
         <paragraph>
           Template IDs 0-255 are reserved for Template Sets, Options
           Template Sets, and other reserved Sets yet to be created.
           Template IDs of Data Sets are numbered from 256 to 65535.
         </paragraph>
         <paragraph>
           Typically, this Information Element is used for limiting
           the scope of other Information Elements.
           Note that after a re-start of the Exporting Process Template
           identifiers may be re-assigned.
         </paragraph>
       </description>
     </field>

     <field name="observationDomainId" dataType="unsigned32"
            group="scope"
            dataTypeSemantics="identifier"
            elementId="149" applicability="option" status="current">
       <description>
         <paragraph>
           An identifier of an Observation Domain that is locally
           unique to an Exporting Process.  The Exporting Process uses
           the Observation Domain ID to uniquely identify to the
           Collecting Process the Observation Domain where Flows
           were metered.  It is RECOMMENDED that this identifier is
           also unique per IPFIX Device.
         </paragraph>
         <paragraph>
           A value of 0 indicates that no specific Observation Domain
           is identified by this Information Element.
         </paragraph>
ToP   noToC   RFC5102 - Page 92
         <paragraph>
           Typically, this Information Element is used for limiting
           the scope of other Information Elements.
         </paragraph>
       </description>
     </field>

     <field name="observationPointId" dataType="unsigned32"
            group="scope"
            dataTypeSemantics="identifier"
            elementId="138" applicability="option" status="current">
       <description>
         <paragraph>
         An identifier of an Observation Point that is unique per
         Observation Domain.  It is RECOMMENDED that this identifier is
         also unique per IPFIX Device.  Typically, this Information
         Element is used for limiting the scope of other Information
         Elements.
         </paragraph>
       </description>
     </field>
     <field name="commonPropertiesId" dataType="unsigned64"
            group="scope"
            dataTypeSemantics="identifier"
            elementId="137" applicability="option" status="current">
       <description>
         <paragraph>
           An identifier of a set of common properties that is
           unique per Observation Domain and Transport Session.
           Typically, this Information Element is used to link to
           information reported in separate Data Records.
         </paragraph>
       </description>
     </field>

     <field name="exporterIPv4Address" dataType="ipv4Address"
            dataTypeSemantics="identifier"
            group="config"
            elementId="130" applicability="all" status="current">
       <description>
         <paragraph>
         The IPv4 address used by the Exporting Process.  This is used
         by the Collector to identify the Exporter in cases where the
         identity of the Exporter may have been obscured by the use of
         a proxy.
         </paragraph>
       </description>
     </field>
ToP   noToC   RFC5102 - Page 93
     <field name="exporterIPv6Address" dataType="ipv6Address"
            dataTypeSemantics="identifier"
            group="config"
            elementId="131" applicability="all" status="current">
       <description>
         <paragraph>
         The IPv6 address used by the Exporting Process.  This is used
         by the Collector to identify the Exporter in cases where the
         identity of the Exporter may have been obscured by the use of
         a proxy.
         </paragraph>
       </description>
     </field>

     <field name="exporterTransportPort" dataType="unsigned16"
            group="config"
            dataTypeSemantics="identifier"
            elementId="217" applicability="all" status="current">
       <description>
         <paragraph>
         The source port identifier from which the Exporting
         Process sends Flow information.  For the transport protocols
         UDP, TCP, and SCTP, this is the source port number.
         This field MAY also be used for future transport protocols
         that have 16-bit source port identifiers.  This field may
         be useful for distinguishing multiple Exporting Processes
         that use the same IP address.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 768 for the definition of the UDP
         source port field.
         See RFC 793 for the definition of the TCP
         source port field.
         See RFC 4960 for the definition of SCTP.
         </paragraph>
         <paragraph>
         Additional information on defined UDP and TCP port numbers can
         be found at http://www.iana.org/assignments/port-numbers.
         </paragraph>
       </reference>
     </field>

     <field name="collectorIPv4Address" dataType="ipv4Address"
            dataTypeSemantics="identifier"
            group="config"
            elementId="211" applicability="all" status="current">
ToP   noToC   RFC5102 - Page 94
       <description>
         <paragraph>
         An IPv4 address to which the Exporting Process sends Flow
         information.
         </paragraph>
       </description>
     </field>

     <field name="collectorIPv6Address" dataType="ipv6Address"
            dataTypeSemantics="identifier"
            group="config"
            elementId="212" applicability="all" status="current">
       <description>
         <paragraph>
         An IPv6 address to which the Exporting Process sends Flow
         information.
         </paragraph>
       </description>
     </field>

     <field name="exportInterface" dataType="unsigned32"
            group="config"
            dataTypeSemantics="identifier"
            elementId="213" applicability="all" status="current">
       <description>
         <paragraph>
           The index of the interface from which IPFIX Messages sent
           by the Exporting Process to a Collector leave the IPFIX
           Device.  The value matches the value of
           managed object 'ifIndex' as defined in RFC 2863.
           Note that ifIndex values are not assigned statically to an
           interface and that the interfaces may be renumbered every
           time the device's management system is re-initialized, as
           specified in RFC 2863.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 2863 for the definition of the ifIndex object.
         </paragraph>
       </reference>
     </field>

     <field name="exportProtocolVersion" dataType="unsigned8"
            dataTypeSemantics="identifier"
            group="config"
            elementId="214" applicability="all" status="current">
       <description>
ToP   noToC   RFC5102 - Page 95
         <paragraph>
           The protocol version used by the Exporting Process for
           sending Flow information.  The protocol version is given
           by the value of the Version Number field in the Message
           Header.
         </paragraph>
         <paragraph>
           The protocol version is 10 for IPFIX and 9 for NetFlow
           version 9.
           A value of 0 indicates that no export protocol is in use.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See the IPFIX protocol specification [RFC5101] for the
         definition of the IPFIX Message Header.
         </paragraph>
         <paragraph>
         See RFC 3954 for the definition of the NetFlow
         version 9 message header.
         </paragraph>
       </reference>
     </field>

     <field name="exportTransportProtocol" dataType="unsigned8"
            group="config"
            dataTypeSemantics="identifier"
            elementId="215" applicability="all" status="current">
       <description>
         <paragraph>
         The value of the protocol number used by the Exporting Process
         for sending Flow information.
         The protocol number identifies the IP packet payload type.
         Protocol numbers are defined in the IANA Protocol Numbers
         registry.
         </paragraph>

         <paragraph>
         In Internet Protocol version 4 (IPv4), this is carried in the
         Protocol field.  In Internet Protocol version 6 (IPv6), this
         is carried in the Next Header field in the last extension
         header of the packet.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the specification of the IPv4
         protocol field.
ToP   noToC   RFC5102 - Page 96
         See RFC 2460 for the specification of the IPv6
         protocol field.
         See the list of protocol numbers assigned by IANA at
         http://www.iana.org/assignments/protocol-numbers.
         </paragraph>
       </reference>
     </field>

     <field name="collectorTransportPort" dataType="unsigned16"
            group="config"
            dataTypeSemantics="identifier"
            elementId="216" applicability="all" status="current">
       <description>
         <paragraph>
         The destination port identifier to which the Exporting
         Process sends Flow information.  For the transport protocols
         UDP, TCP, and SCTP, this is the destination port number.
         This field MAY also be used for future transport protocols
         that have 16-bit source port identifiers.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 768 for the definition of the UDP
         destination port field.
         See RFC 793 for the definition of the TCP
         destination port field.
         See RFC 4960 for the definition of SCTP.
         </paragraph>
         <paragraph>
         Additional information on defined UDP and TCP port numbers can
         be found at http://www.iana.org/assignments/port-numbers.
         </paragraph>
       </reference>
     </field>

     <field name="flowKeyIndicator" dataType="unsigned64"
            dataTypeSemantics="flags"
            group="config"
            elementId="173" applicability="all" status="current">
       <description>
         <paragraph>
         This set of bit fields is used for marking the Information
         Elements of a Data Record that serve as Flow Key.  Each bit
         represents an Information Element in the Data Record with
         the n-th bit representing the n-th Information Element.
         A bit set to value 1 indicates that the corresponding
         Information Element is a Flow Key of the reported Flow.
ToP   noToC   RFC5102 - Page 97
         A bit set to value 0 indicates that this is not the case.
         </paragraph>
         <paragraph>
         If the Data Record contains more than 64 Information Elements,
         the corresponding Template SHOULD be designed such that all
         Flow Keys are among the first 64 Information Elements, because
         the flowKeyIndicator only contains 64 bits.  If the Data Record
         contains less than 64 Information Elements, then the bits in
         the flowKeyIndicator for which no corresponding Information
         Element exists MUST have the value 0.
         </paragraph>
       </description>
     </field>

     <field name="exportedMessageTotalCount" dataType="unsigned64"
            dataTypeSemantics="totalCounter"
            group="processCounter"
            elementId="41" applicability="data" status="current">
       <description>
         <paragraph>
           The total number of IPFIX Messages that the Exporting Process
           has sent since the Exporting Process (re-)initialization to
           a particular Collecting Process.
           The reported number excludes the IPFIX Message that carries
           the counter value.
           If this Information Element is sent to a particular
           Collecting Process, then by default it specifies the number
           of IPFIX Messages sent to this Collecting Process.
         </paragraph>
       </description>
       <units>messages</units>
     </field>

     <field name="exportedOctetTotalCount" dataType="unsigned64"
            dataTypeSemantics="totalCounter"
            group="processCounter"
            elementId="40" applicability="data" status="current">
       <description>
         <paragraph>
           The total number of octets that the Exporting Process
           has sent since the Exporting Process (re-)initialization
           to a particular Collecting Process.
           The value of this Information Element is calculated by
           summing up the IPFIX Message Header length values of all
           IPFIX Messages that were successfully sent to the Collecting
           Process.  The reported number excludes octets in the IPFIX
           Message that carries the counter value.
           If this Information Element is sent to a particular
ToP   noToC   RFC5102 - Page 98
           Collecting Process, then by default it specifies the number
           of octets sent to this Collecting Process.
         </paragraph>
       </description>
       <units>octets</units>
     </field>

     <field name="exportedFlowRecordTotalCount" dataType="unsigned64"
            group="processCounter"
            dataTypeSemantics="totalCounter"
            elementId="42" applicability="data" status="current">
       <description>
         <paragraph>
           The total number of Flow Records that the Exporting
           Process has sent as Data Records since the Exporting
           Process (re-)initialization to a particular Collecting
           Process.  The reported number excludes Flow Records in
           the IPFIX Message that carries the counter value.
           If this Information Element is sent to a particular
           Collecting Process, then by default it specifies the number
           of Flow Records sent to this process.
         </paragraph>
       </description>
       <units>flows</units>
     </field>

     <field name="observedFlowTotalCount" dataType="unsigned64"
            dataTypeSemantics="totalCounter"
            group="processCounter"
            elementId="163" applicability="data" status="current">
       <description>
         <paragraph>
         The total number of Flows observed in the Observation Domain
         since the Metering Process (re-)initialization for this
         Observation Point.
         </paragraph>
       </description>
       <units>flows</units>
     </field>

     <field name="ignoredPacketTotalCount" dataType="unsigned64"
            dataTypeSemantics="totalCounter"
            group="processCounter"
            elementId="164" applicability="data" status="current">
       <description>
         <paragraph>
            The total number of observed IP packets that the
            Metering Process did not process since the
ToP   noToC   RFC5102 - Page 99
            (re-)initialization of the Metering Process.
         </paragraph>
       </description>
       <units>packets</units>
     </field>

     <field name="ignoredOctetTotalCount" dataType="unsigned64"
            dataTypeSemantics="totalCounter"
            group="processCounter"
            elementId="165" applicability="data" status="current">
       <description>
         <paragraph>
            The total number of octets in observed IP packets
            (including the IP header) that the Metering Process
            did not process since the (re-)initialization of the
            Metering Process.
         </paragraph>
       </description>
       <units>octets</units>
     </field>

     <field name="notSentFlowTotalCount" dataType="unsigned64"
            dataTypeSemantics="totalCounter"
            group="processCounter"
            elementId="166" applicability="data" status="current">
       <description>
         <paragraph>
            The total number of Flow Records that were generated by the
            Metering Process and dropped by the Metering Process or
            by the Exporting Process instead of being sent to the
            Collecting Process.  There are several potential reasons for
            this including resource shortage and special Flow export
            policies.
         </paragraph>
       </description>
       <units>flows</units>
     </field>

     <field name="notSentPacketTotalCount" dataType="unsigned64"
            dataTypeSemantics="totalCounter"
            group="processCounter"
            elementId="167" applicability="data" status="current">
       <description>
         <paragraph>
            The total number of packets in Flow Records that were
            generated by the Metering Process and dropped
            by the Metering Process or by the Exporting Process
            instead of being sent to the Collecting Process.
ToP   noToC   RFC5102 - Page 100
            There are several potential reasons for this including
            resource shortage and special Flow export policies.
         </paragraph>
       </description>
       <units>packets</units>
     </field>

     <field name="notSentOctetTotalCount" dataType="unsigned64"
            dataTypeSemantics="totalCounter"
            group="processCounter"
            elementId="168" applicability="data" status="current">
       <description>
         <paragraph>
            The total number of octets in packets in Flow Records
            that were generated by the Metering Process and
            dropped by the Metering Process or by the Exporting
            Process instead of being sent to the Collecting Process.
            There are several potential reasons for this including
            resource shortage and special Flow export policies.
         </paragraph>
       </description>
       <units>octets</units>
     </field>

     <field name="ipVersion" dataType="unsigned8"
            group="ipHeader"
            dataTypeSemantics="identifier"
            elementId="60" applicability="all" status="current">
       <description>
         <paragraph>
         The IP version field in the IP packet header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the definition of the version field
         in the IPv4 packet header.
         See RFC 2460 for the definition of the version field
         in the IPv6 packet header.
         Additional information on defined version numbers
         can be found at
         http://www.iana.org/assignments/version-numbers.
         </paragraph>
       </reference>
     </field>

     <field name="sourceIPv4Address" dataType="ipv4Address"
            group="ipHeader"
ToP   noToC   RFC5102 - Page 101
            dataTypeSemantics="identifier"
            elementId="8" applicability="all" status="current">
       <description>
         <paragraph>
         The IPv4 source address in the IP packet header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the definition of the IPv4 source
         address field.
         </paragraph>
       </reference>
     </field>

     <field name="sourceIPv6Address" dataType="ipv6Address"
            group="ipHeader"
            dataTypeSemantics="identifier"
            elementId="27" applicability="all" status="current">
       <description>
         <paragraph>
         The IPv6 source address in the IP packet header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 2460 for the definition of the
         Source Address field in the IPv6 header.
         </paragraph>
       </reference>
     </field>

     <field name="sourceIPv4PrefixLength" dataType="unsigned8"
            group="ipHeader"
            elementId="9" applicability="option" status="current">
       <description>
         <paragraph>
         The number of contiguous bits that are relevant in the
         sourceIPv4Prefix Information Element.
         </paragraph>
       </description>
       <units>bits</units>
       <range>0-32</range>
     </field>

     <field name="sourceIPv6PrefixLength" dataType="unsigned8"
            group="ipHeader"
            elementId="29" applicability="option" status="current">
ToP   noToC   RFC5102 - Page 102
       <description>
         <paragraph>
         The number of contiguous bits that are relevant in the
         sourceIPv6Prefix Information Element.
         </paragraph>
       </description>
       <units>bits</units>
       <range>0-128</range>
     </field>

     <field name="sourceIPv4Prefix" dataType="ipv4Address"
            group="ipHeader"
            elementId="44" applicability="data" status="current">
       <description>
         <paragraph>
         IPv4 source address prefix.
         </paragraph>
       </description>
     </field>

     <field name="sourceIPv6Prefix" dataType="ipv6Address"
            group="ipHeader"
            elementId="170" applicability="data" status="current">
       <description>
         <paragraph>
         IPv6 source address prefix.
         </paragraph>
       </description>
     </field>

     <field name="destinationIPv4Address" dataType="ipv4Address"
            group="ipHeader"
            dataTypeSemantics="identifier"
            elementId="12" applicability="all" status="current">
       <description>
         <paragraph>
         The IPv4 destination address in the IP packet header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the definition of the IPv4
         destination address field.
         </paragraph>
       </reference>
     </field>

     <field name="destinationIPv6Address" dataType="ipv6Address"
ToP   noToC   RFC5102 - Page 103
            group="ipHeader"
            dataTypeSemantics="identifier"
            elementId="28" applicability="all" status="current">
       <description>
         <paragraph>
         The IPv6 destination address in the IP packet header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 2460 for the definition of the
         Destination Address field in the IPv6 header.
         </paragraph>
       </reference>
     </field>

     <field name="destinationIPv4PrefixLength" dataType="unsigned8"
            group="ipHeader"
            elementId="13" applicability="option" status="current">
       <description>
         <paragraph>
         The number of contiguous bits that are relevant in the
         destinationIPv4Prefix Information Element.
         </paragraph>
       </description>
       <units>bits</units>
       <range>0-32</range>
     </field>

     <field name="destinationIPv6PrefixLength" dataType="unsigned8"
            group="ipHeader"
            elementId="30" applicability="option" status="current">
       <description>
         <paragraph>
         The number of contiguous bits that are relevant in the
         destinationIPv6Prefix Information Element.
         </paragraph>
       </description>
       <units>bits</units>
       <range>0-128</range>
     </field>

     <field name="destinationIPv4Prefix" dataType="ipv4Address"
            group="ipHeader"
            elementId="45" applicability="data" status="current">
       <description>
         <paragraph> IPv4 destination address prefix. </paragraph>
       </description>
ToP   noToC   RFC5102 - Page 104
     </field>

     <field name="destinationIPv6Prefix" dataType="ipv6Address"
            group="ipHeader"
            elementId="169" applicability="data" status="current">
       <description>
         <paragraph> IPv6 destination address prefix. </paragraph>
       </description>
     </field>

     <field name="ipTTL" dataType="unsigned8"
            group="ipHeader"
            elementId="192" applicability="all" status="current">
       <description>
         <paragraph>
         For IPv4, the value of the Information Element matches
         the value of the Time to Live (TTL) field in the IPv4 packet
         header.  For IPv6, the value of the Information Element
         matches the value of the Hop Limit field in the IPv6
         packet header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the definition of the IPv4
         Time to Live field.
         See RFC 2460 for the definition of the IPv6
         Hop Limit field.
         </paragraph>
       </reference>
       <units>hops</units>
     </field>

     <field name="protocolIdentifier" dataType="unsigned8"
            group="ipHeader"
            dataTypeSemantics="identifier"
            elementId="4" applicability="all" status="current">
       <description>
         <paragraph>
         The value of the protocol number in the IP packet header.
         The protocol number identifies the IP packet payload type.
         Protocol numbers are defined in the IANA Protocol Numbers
         registry.
            </paragraph>

         <paragraph>
         In Internet Protocol version 4 (IPv4), this is carried in the
         Protocol field.  In Internet Protocol version 6 (IPv6), this
ToP   noToC   RFC5102 - Page 105
         is carried in the Next Header field in the last extension
         header of the packet.
            </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the specification of the IPv4
         protocol field.
         See RFC 2460 for the specification of the IPv6
         protocol field.
         See the list of protocol numbers assigned by IANA at
         http://www.iana.org/assignments/protocol-numbers.
         </paragraph>
       </reference>
     </field>

     <field name="nextHeaderIPv6" dataType="unsigned8"
            group="ipHeader"
            elementId="193" applicability="all" status="current">
       <description>
         <paragraph>
         The value of the Next Header field of the IPv6 header.
         The value identifies the type of the following IPv6
         extension header or of the following IP payload.
         Valid values are defined in the IANA
         Protocol Numbers registry.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 2460 for the definition of the IPv6
         Next Header field.
         See the list of protocol numbers assigned by IANA at
         http://www.iana.org/assignments/protocol-numbers.
         </paragraph>
       </reference>
     </field>

     <field name="ipDiffServCodePoint" dataType="unsigned8"
            group="ipHeader"
            dataTypeSemantics="identifier"
            elementId="195" applicability="all" status="current">
       <description>
         <paragraph>
         The value of a Differentiated Services Code Point (DSCP)
         encoded in the Differentiated Services field.  The
         Differentiated Services field spans the most significant
         6 bits of the IPv4 TOS field or the IPv6 Traffic Class
ToP   noToC   RFC5102 - Page 106
         field, respectively.
         </paragraph>
         <paragraph>
         This Information Element encodes only the 6 bits of the
         Differentiated Services field.  Therefore, its value may
         range from 0 to 63.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 3260 for the definition of the
         Differentiated Services field.
         See RFC 1812 (Section 5.3.2) and RFC 791 for the definition
         of the IPv4 TOS field.  See RFC 2460 for the definition of
         the IPv6 Traffic Class field.
         </paragraph>
       </reference>
       <range>0-63</range>
     </field>

     <field name="ipPrecedence" dataType="unsigned8"
            group="ipHeader"
            dataTypeSemantics="identifier"
            elementId="196" applicability="all" status="current">
       <description>
         <paragraph>
         The value of the IP Precedence.  The IP Precedence value
         is encoded in the first 3 bits of the IPv4 TOS field
         or the IPv6 Traffic Class field, respectively.
         </paragraph>
         <paragraph>
         This Information Element encodes only these 3 bits.
         Therefore, its value may range from 0 to 7.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 1812 (Section 5.3.3) and RFC 791
         for the definition of the IP Precedence.
         See RFC 1812 (Section 5.3.2) and RFC 791
         for the definition of the IPv4 TOS field.
         See RFC 2460 for the definition of the IPv6
         Traffic Class field.
         </paragraph>
       </reference>
       <range>0-7</range>
     </field>
ToP   noToC   RFC5102 - Page 107
     <field name="ipClassOfService" dataType="unsigned8"
            group="ipHeader"
            dataTypeSemantics="identifier"
            elementId="5" applicability="all" status="current">
       <description>
         <paragraph>
         For IPv4 packets, this is the value of the TOS field in
         the IPv4 packet header.  For IPv6 packets, this is the
         value of the Traffic Class field in the IPv6 packet header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 1812 (Section 5.3.2) and RFC 791
         for the definition of the IPv4 TOS field.
         See RFC 2460 for the definition of the IPv6
         Traffic Class field.
         </paragraph>
       </reference>
     </field>

     <field name="postIpClassOfService" dataType="unsigned8"
            group="ipHeader"
            dataTypeSemantics="identifier"
            elementId="55" applicability="all" status="current">
       <description>
         <paragraph>
         The definition of this Information Element is identical
         to the definition of Information Element
         'ipClassOfService', except that it reports a
         potentially modified value caused by a middlebox
         function after the packet passed the Observation Point.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the definition of the IPv4
         TOS field.
         See RFC 2460 for the definition of the IPv6
         Traffic Class field.
         See RFC 3234 for the definition of middleboxes.
         </paragraph>
       </reference>
     </field>

     <field name="flowLabelIPv6" dataType="unsigned32"
            group="ipHeader"
            dataTypeSemantics="identifier"
ToP   noToC   RFC5102 - Page 108
            elementId="31" applicability="all" status="current">
       <description>
         <paragraph>
         The value of the IPv6 Flow Label field in the IP packet header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 2460 for the definition of the
         Flow Label field in the IPv6 packet header.
         </paragraph>
       </reference>
     </field>

     <field name="isMulticast" dataType="unsigned8"
            group="ipHeader"
            dataTypeSemantics="flags"
            elementId="206" applicability="data" status="current">
       <description>
         <paragraph>
           If the IP destination address is not a reserved multicast
           address, then the value of all bits of the octet (including
           the reserved ones) is zero.
         </paragraph>
         <paragraph>
           The first bit of this octet is set to 1 if the Version
           field of the IP header has the value 4 and if the
           Destination Address field contains a reserved multicast
           address in the range from 224.0.0.0 to 239.255.255.255.
           Otherwise, this bit is set to 0.
         </paragraph>
         <paragraph>
           The second and third bits of this octet are reserved for
           future use.
         </paragraph>
         <paragraph>
           The remaining bits of the octet are only set to values
           other than zero if the IP Destination Address is a
           reserved IPv6 multicast address.  Then the fourth bit
           of the octet is set to the value of the T flag in the
           IPv6 multicast address and the remaining four bits are
           set to the value of the scope field in the IPv6
           multicast address.
         </paragraph>
         <artwork>
             0      1      2      3      4      5      6      7
          +------+------+------+------+------+------+------+------+
          | MCv4 | RES. | RES. |  T   |   IPv6 multicast scope    |
ToP   noToC   RFC5102 - Page 109
          +------+------+------+------+------+------+------+------+

          Bit  0:    set to 1 if IPv4 multicast
          Bits 1-2:  reserved for future use
          Bit  4:    set to value of T flag, if IPv6 multicast
          Bits 4-7:  set to value of multicast scope if IPv6 multicast
         </artwork>
       </description>
       <reference>
         <paragraph>
         See RFC 1112 for the specification of reserved
         IPv4 multicast addresses.
         See RFC 4291 for the specification of reserved
         IPv6 multicast addresses and the definition of the T flag
         and the IPv6 multicast scope.
         </paragraph>
       </reference>
     </field>

     <field name="fragmentIdentification" dataType="unsigned32"
            group="ipHeader"
            dataTypeSemantics="identifier"
            elementId="54" applicability="data" status="current">
       <description>
         <paragraph>
         The value of the Identification field
         in the IPv4 packet header or in the IPv6 Fragment header,
         respectively.  The value is 0 for IPv6 if there is
         no fragment header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the definition of the IPv4
         Identification field.
         See RFC 2460 for the definition of the
         Identification field in the IPv6 Fragment header.
         </paragraph>
       </reference>
     </field>

     <field name="fragmentOffset" dataType="unsigned16"
            group="ipHeader"
            dataTypeSemantics="identifier"
            elementId="88" applicability="all" status="current">
       <description>
         <paragraph>
         The value of the IP fragment offset field in the
ToP   noToC   RFC5102 - Page 110
         IPv4 packet header or the IPv6 Fragment header,
         respectively.  The value is 0 for IPv6 if there is
         no fragment header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the specification of the
         fragment offset in the IPv4 header.
         See RFC 2460 for the specification of the
         fragment offset in the IPv6 Fragment header.
         </paragraph>
       </reference>
     </field>

     <field name="fragmentFlags" dataType="unsigned8"
            group="ipHeader"
            dataTypeSemantics="flags"
            elementId="197" applicability="all" status="current">
       <description>
         <paragraph>
           Fragmentation properties indicated by flags in the IPv4
           packet header or the IPv6 Fragment header, respectively.
         </paragraph>
         <artwork>

         Bit 0:    (RS) Reserved.
                   The value of this bit MUST be 0 until specified
                   otherwise.
         Bit 1:    (DF) 0 = May Fragment,  1 = Don't Fragment.
                   Corresponds to the value of the DF flag in the
                   IPv4 header.  Will always be 0 for IPv6 unless
                   a "don't fragment" feature is introduced to IPv6.
         Bit 2:    (MF) 0 = Last Fragment, 1 = More Fragments.
                   Corresponds to the MF flag in the IPv4 header
                   or to the M flag in the IPv6 Fragment header,
                   respectively.  The value is 0 for IPv6 if there
                   is no fragment header.
         Bits 3-7: (DC) Don't Care.
                   The values of these bits are irrelevant.

             0   1   2   3   4   5   6   7
           +---+---+---+---+---+---+---+---+
           | R | D | M | D | D | D | D | D |
           | S | F | F | C | C | C | C | C |
           +---+---+---+---+---+---+---+---+
         </artwork>
       </description>
ToP   noToC   RFC5102 - Page 111
       <reference>
         <paragraph>
         See RFC 791 for the specification of the IPv4
         fragment flags.
         See RFC 2460 for the specification of the IPv6
         Fragment header.
         </paragraph>
       </reference>
     </field>

     <field name="ipHeaderLength" dataType="unsigned8"
            group="ipHeader"
            elementId="189" applicability="all" status="current">
       <description>
         <paragraph>
         The length of the IP header.  For IPv6, the value of this
         Information Element is 40.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the specification of the
         IPv4 header.
         See RFC 2460 for the specification of the
         IPv6 header.
         </paragraph>
       </reference>
       <units>octets</units>
     </field>

     <field name="ipv4IHL" dataType="unsigned8"
            group="ipHeader"
            elementId="207" applicability="all" status="current">
       <description>
         <paragraph>
         The value of the Internet Header Length (IHL) field in
         the IPv4 header.  It specifies the length of the header
         in units of 4 octets.  Please note that its unit is
         different from most of the other Information Elements
         reporting length values.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the specification of the
         IPv4 header.
         </paragraph>
       </reference>
ToP   noToC   RFC5102 - Page 112
       <units>4 octets</units>
     </field>

     <field name="totalLengthIPv4" dataType="unsigned16"
            group="ipHeader"
            elementId="190" applicability="all" status="current">
       <description>
         <paragraph>
         The total length of the IPv4 packet.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the specification of the
         IPv4 total length.
         </paragraph>
       </reference>
       <units>octets</units>
     </field>

     <field name="ipTotalLength" dataType="unsigned64"
            group="ipHeader"
            elementId="224" applicability="all" status="current">
       <description>
         <paragraph>
         The total length of the IP packet.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 791 for the specification of the
         IPv4 total length.
         See RFC 2460 for the specification of the
         IPv6 payload length.
         See RFC 2675 for the specification of the
         IPv6 jumbo payload length.
         </paragraph>
       </reference>
       <units>octets</units>
     </field>

     <field name="payloadLengthIPv6" dataType="unsigned16"
            group="ipHeader"
            elementId="191" applicability="all" status="current">
       <description>
         <paragraph>
         This Information Element reports the value of the Payload
         Length field in the IPv6 header.  Note that IPv6 extension
ToP   noToC   RFC5102 - Page 113
         headers belong to the payload.  Also note that in case of a
         jumbo payload option the value of the Payload Length field in
         the IPv6 header is zero and so will be the value reported
         by this Information Element.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 2460 for the specification of the
         IPv6 payload length.
         See RFC 2675 for the specification of the
         IPv6 jumbo payload option.
         </paragraph>
       </reference>
       <units>octets</units>
     </field>

     <field name="sourceTransportPort" dataType="unsigned16"
            group="transportHeader"
            dataTypeSemantics="identifier"
            elementId="7" applicability="all" status="current">
       <description>
         <paragraph>
         The source port identifier in the transport header.
         For the transport protocols UDP, TCP, and SCTP, this is the
         source port number given in the respective header.  This
         field MAY also be used for future transport protocols that
         have 16-bit source port identifiers.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 768 for the definition of the UDP
         source port field.
         See RFC 793 for the definition of the TCP
         source port field.
         See RFC 4960 for the definition of SCTP.
         </paragraph>
         <paragraph>
         Additional information on defined UDP and TCP port numbers can
         be found at http://www.iana.org/assignments/port-numbers.
         </paragraph>
       </reference>
     </field>

     <field name="destinationTransportPort" dataType="unsigned16"
            group="transportHeader"
            dataTypeSemantics="identifier"
ToP   noToC   RFC5102 - Page 114
            elementId="11" applicability="all" status="current">
       <description>
         <paragraph>
         The destination port identifier in the transport header.
         For the transport protocols UDP, TCP, and SCTP, this is the
         destination port number given in the respective header.
         This field MAY also be used for future transport protocols
         that have 16-bit destination port identifiers.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 768 for the definition of the UDP
         destination port field.
         See RFC 793 for the definition of the TCP
         destination port field.
         See RFC 4960 for the definition of SCTP.
         </paragraph>
         <paragraph>
         Additional information on defined UDP and TCP port numbers can
         be found at http://www.iana.org/assignments/port-numbers.
         </paragraph>
       </reference>
     </field>

     <field name="udpSourcePort" dataType="unsigned16"
            group="transportHeader"
            dataTypeSemantics="identifier"
            elementId="180" applicability="all" status="current">
       <description>
         <paragraph>
         The source port identifier in the UDP header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 768 for the definition of the
         UDP source port field.
         Additional information on defined UDP port numbers can
         be found at http://www.iana.org/assignments/port-numbers.
         </paragraph>
       </reference>
     </field>

     <field name="udpDestinationPort" dataType="unsigned16"
            group="transportHeader"
            dataTypeSemantics="identifier"
            elementId="181" applicability="all" status="current">
ToP   noToC   RFC5102 - Page 115
       <description>
         <paragraph>
         The destination port identifier in the UDP header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 768 for the definition of the
         UDP destination port field.
         Additional information on defined UDP port numbers can
         be found at http://www.iana.org/assignments/port-numbers.
         </paragraph>
       </reference>
     </field>

     <field name="udpMessageLength" dataType="unsigned16"
            group="transportHeader"
            elementId="205" applicability="all" status="current">
       <description>
         <paragraph>
         The value of the Length field in the UDP header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 768 for the specification of the
         UDP header.
         </paragraph>
       </reference>
       <units>octets</units>
     </field>

     <field name="tcpSourcePort" dataType="unsigned16"
            group="transportHeader"
            dataTypeSemantics="identifier"
            elementId="182" applicability="all" status="current">
       <description>
         <paragraph>
         The source port identifier in the TCP header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 793 for the definition of the TCP
         source port field.
         Additional information on defined TCP port numbers can
         be found at http://www.iana.org/assignments/port-numbers.
         </paragraph>
ToP   noToC   RFC5102 - Page 116
       </reference>
     </field>

     <field name="tcpDestinationPort" dataType="unsigned16"
            group="transportHeader"
            dataTypeSemantics="identifier"
            elementId="183" applicability="all" status="current">
       <description>
         <paragraph>
         The destination port identifier in the TCP header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 793 for the definition of the TCP
         source port field.
         Additional information on defined TCP port numbers can
         be found at http://www.iana.org/assignments/port-numbers.
         </paragraph>
       </reference>
     </field>

     <field name="tcpSequenceNumber" dataType="unsigned32"
            group="transportHeader"
            elementId="184" applicability="all" status="current">
       <description>
         <paragraph>
         The sequence number in the TCP header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 793 for the definition of the TCP
         sequence number.
         </paragraph>
       </reference>
     </field>

     <field name="tcpAcknowledgementNumber" dataType="unsigned32"
            group="transportHeader"
            elementId="185" applicability="all" status="current">
       <description>
         <paragraph>
         The acknowledgement number in the TCP header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
ToP   noToC   RFC5102 - Page 117
         See RFC 793 for the definition of the TCP
         acknowledgement number.
         </paragraph>
       </reference>
     </field>

     <field name="tcpWindowSize" dataType="unsigned16"
            group="transportHeader"
            elementId="186" applicability="all" status="current">
       <description>
         <paragraph>
         The window field in the TCP header.
         If the TCP window scale is supported,
         then TCP window scale must be known
         to fully interpret the value of this information.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 793 for the definition of the TCP window field.
         See RFC 1323 for the definition of the TCP window scale.
         </paragraph>
       </reference>
     </field>

     <field name="tcpWindowScale" dataType="unsigned16"
            group="transportHeader"
            elementId="238" applicability="all" status="current">
       <description>
         <paragraph>
         The scale of the window field in the TCP header.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 1323 for the definition of the TCP window scale.
         </paragraph>
       </reference>
     </field>

     <field name="tcpUrgentPointer" dataType="unsigned16"
            group="transportHeader"
            elementId="187" applicability="all" status="current">
       <description>
         <paragraph>
         The urgent pointer in the TCP header.
         </paragraph>
       </description>
ToP   noToC   RFC5102 - Page 118
       <reference>
         <paragraph>
         See RFC 793 for the definition of the TCP
         urgent pointer.
         </paragraph>
       </reference>
     </field>

     <field name="tcpHeaderLength" dataType="unsigned8"
            group="transportHeader"
            elementId="188" applicability="all" status="current">
       <description>
         <paragraph>
         The length of the TCP header.  Note that the value of this
         Information Element is different from the value of the Data
         Offset field in the TCP header.  The Data Offset field
         indicates the length of the TCP header in units of 4 octets.
         This Information Elements specifies the length of the TCP
         header in units of octets.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 793 for the definition of the
         TCP header.
         </paragraph>
       </reference>
       <units>octets</units>
     </field>

     <field name="icmpTypeCodeIPv4" dataType="unsigned16"
            group="transportHeader"
            dataTypeSemantics="identifier"
            elementId="32" applicability="all" status="current">
       <description>
         <paragraph>
         Type and Code of the IPv4 ICMP message.  The combination of
         both values is reported as (ICMP type * 256) + ICMP code.
         </paragraph>
       </description>
       <reference>
         <paragraph>
         See RFC 792 for the definition of the IPv4 ICMP
            type and code fields.
         </paragraph>
       </reference>
     </field>


(next page on part 6)

Next Section