Technical Summary
This document describes a file format for the storage of flow data
based upon the IPFIX Protocol. It proposes a set of requirements for
flat-file, binary flow data file formats, then specifies the IPFIX
File format to meet these requirements based upon IPFIX Messages.
This IPFIX File format is designed to facilitate interoperability and
reusability among a wide variety of flow storage, processing, and
analysis tools.
Working Group Summary
Work started on this document in 2006, and has gone through several
revisions in response to mailing list discussion. Originally it
included the material about 'exporting type information,' but the
WG split it out into a seperate RFC to make it more easily accessible
for other uses. The WG has reached a clear consensus on this draft.
Document Quality
This document has been reviwed by Benoit Claise, Paul Aitken, Andrew
Johnson, and Gerhard Muenz, as well as by the WG chairs. Vijay K. Gurbani
reviewed the document on behaf of GenART. It specifies a file format for
IPFIX data, making the point that this is simply another data transport
for IPFIX. It does not make any changes to the IPFIX protocol.
Personnel
Nevil Brownlee is the Protocol Shepherd, Dan Romascanu is the shepherding
AD.
RFC Editor Note
Section 9.1:
OLD:
eContentType id-ct-anyContentType, --
(1.2.840.113549.1.9.16.1.0)
NEW:
eContentType id-data, -- (1.2.840.113549.1.7.1)
Section 9.1.4:
OLD:
The EncapsulatedContentInfo structure contains a content type
identifier. Since a detached signature is being created, it does not
encapsulate the Internet-Draft. The fields of
EncapsulatedContentInfo are as follows:
eContentType is an object identifier that uniquely specifies the
content type. The content type associated with the plain text
file MUST be id-ct-anyContentType (1.2.840.113549.1.9.16.1.0).
NEW:
The EncapsulatedContentInfo structure contains a content type
identifier. Since a detached signature is being created, it does not
encapsulate the IPFIX File. The fields of
EncapsulatedContentInfo are as follows:
eContentType is an object identifier that uniquely specifies the
content type. The content type associated with IPFIX File
MUST be id-data (1.2.840.113549.1.7.1).