Skip to main content

Cisco Specific Information Elements reused in IPFIX
draft-yourtchenko-cisco-ies-07

The information below is for an old version of the document.
Document Type
This is an older version of an Internet-Draft that was ultimately published as RFC 7270.
Authors Andrew Yourtchenko , Paul Aitken, Benoît Claise
Last updated 2013-10-02
RFC stream (None)
Formats
Reviews
Additional resources
Stream Stream state (No stream defined)
Consensus boilerplate Unknown
RFC Editor Note (None)
IESG IESG state Became RFC 7270 (Informational)
Telechat date (None)
Responsible AD (None)
Send notices to (None)
draft-yourtchenko-cisco-ies-07
Network Working Group                                     A. Yourtchenko
Internet-Draft                                                 P. Aitken
Intended status: Informational                                 B. Claise
Expires: April 05, 2014                              Cisco Systems, Inc.
                                                        October 02, 2013

          Cisco Specific Information Elements reused in IPFIX
                     draft-yourtchenko-cisco-ies-07

Abstract

   This document describes some additional Information Elements of Cisco
   Systems, Inc. that are not listed in RFC3954.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on April 05, 2014.

Copyright Notice

   Copyright (c) 2013 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Yourtchenko, et al.      Expires April 05, 2014                 [Page 1]
Internet-Draft         Cisco Information Elements           October 2013

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  Information Elements Overview . . . . . . . . . . . . . . . .   3
   4.  Information Elements  . . . . . . . . . . . . . . . . . . . .   3
     4.1.  samplingInterval  . . . . . . . . . . . . . . . . . . . .   3
     4.2.  samplingAlgorithm . . . . . . . . . . . . . . . . . . . .   3
     4.3.  engineType  . . . . . . . . . . . . . . . . . . . . . . .   4
     4.4.  engineId  . . . . . . . . . . . . . . . . . . . . . . . .   4
     4.5.  ipv4RouterSc  . . . . . . . . . . . . . . . . . . . . . .   4
     4.6.  samplerId . . . . . . . . . . . . . . . . . . . . . . . .   5
     4.7.  samplerMode . . . . . . . . . . . . . . . . . . . . . . .   5
     4.8.  samplerRandomInterval . . . . . . . . . . . . . . . . . .   5
     4.9.  classId . . . . . . . . . . . . . . . . . . . . . . . . .   5
     4.10. samplerName . . . . . . . . . . . . . . . . . . . . . . .   6
     4.11. flagsAndSamplerId . . . . . . . . . . . . . . . . . . . .   6
     4.12. forwardingStatus  . . . . . . . . . . . . . . . . . . . .   6
     4.13. srcTrafficIndex . . . . . . . . . . . . . . . . . . . . .   8
     4.14. dstTrafficIndex . . . . . . . . . . . . . . . . . . . . .   8
     4.15. className . . . . . . . . . . . . . . . . . . . . . . . .   8
     4.16. layer2packetSectionOffset . . . . . . . . . . . . . . . .   8
     4.17. layer2packetSectionSize . . . . . . . . . . . . . . . . .   8
     4.18. layer2packetSectionData . . . . . . . . . . . . . . . . .   9
   5.  Other Information Elements  . . . . . . . . . . . . . . . . .   9
     5.1.  Performance Metrics IEs . . . . . . . . . . . . . . . . .   9
     5.2.  Application Information IEs . . . . . . . . . . . . . . .   9
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   9
   7.  Security Considerations . . . . . . . . . . . . . . . . . . .  10
   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  10
     8.1.  Normative References  . . . . . . . . . . . . . . . . . .  10
     8.2.  Informative References  . . . . . . . . . . . . . . . . .  10
   Appendix A.  XML Specification of IPFIX Information Elements  . .  11
   Appendix B.  Changes  . . . . . . . . . . . . . . . . . . . . . .  18
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  18

1.  Introduction

   The section 4 of [RFC7012] defines the IPFIX Information Elements in
   the range of 1-127 to be compatible with the NetFlow version 9
   fields, as specified in the "Cisco Systems NetFlow Services Export
   Version 9" [RFC3954].  As [RFC3954] was specified in 2004, it does
   not contain all NetFlow version 9 specific fields in the range 1-127.
   The question was asked whether IPFIX Devices should exclusively
   report the IPFIX IANA IEs [IPFIX-IANA] ? In other words, when
   upgrading from a NetFlow metering process to an IPFIX Metering
   Process, should the IPFIX Devices stop reporting NetFlow version 9
   specific IEs that were not registered in IANA [IPFIX-IANA] ?

Yourtchenko, et al.      Expires April 05, 2014                 [Page 2]
Internet-Draft         Cisco Information Elements           October 2013

   This document is intended to fill the gap in this IE range.  That
   way, IPFIX implementations could export all the IEs specified in
   IANA, regardless of the range.

2.  Terminology

   IPFIX-specific terminology used in this document is defined in
   Section 2 of [RFC7011].  As in [RFC7011], these IPFIX-specific terms
   have the first letter of a word capitalized when used in this
   document.

3.  Information Elements Overview

   The following Information Elements are discussed in the sections
   below:

     +----+-----------------------+-----+---------------------------+
     | ID | Name                  |  ID | Name                      |
     +----+-----------------------+-----+---------------------------+
     | 34 | samplingInterval      |  87 | flagsAndSamplerId         |
     | 35 | samplingAlgorithm     |  89 | forwardingStatus          |
     | 38 | engineType            |  92 | srcTrafficIndex           |
     | 39 | engineId              |  93 | dstTrafficIndex           |
     | 43 | ipv4RouterSc          | 100 | className                 |
     | 48 | samplerId             | 102 | layer2packetSectionOffset |
     | 49 | samplerMode           | 103 | layer2packetSectionSize   |
     | 50 | samplerRandomInterval | 104 | layer2packetSectionData   |
     | 51 | classId               |     |                           |
     +----+-----------------------+-----+---------------------------+

                                  Table 1

4.  Information Elements

4.1.  samplingInterval

   Description:
      Deprecated in favor of 305 samplingPacketInterval.  When using
      sampled NetFlow, the rate at which packets are sampled - e.g. a
      value of 100 indicates that one of every 100 packets is sampled.
   Abstract Data Type:  unsigned32
   ElementId:  34
   Semantics:  quantity
   Status:  deprecated
   Units:  packets

4.2.  samplingAlgorithm

Yourtchenko, et al.      Expires April 05, 2014                 [Page 3]
Internet-Draft         Cisco Information Elements           October 2013

   Description:
      Deprecated in favor of 304 selectorAlgorithm.  The type of
      algorithm used for sampled NetFlow:

         1 - Deterministic Sampling;
         2 - Random Sampling.

      The values are not compatible with the selectorAlgorithm IE, where
      "Deterministic" has been replaced by "Systematic count-based" (1)
      or "Systematic time-based" (2), and "Random" is (3).  Conversion
      is required, see PSAMP parameters [PSAMP-IANA].
   Abstract Data Type:  unsigned8
   ElementId:  35
   Semantics:  identifier
   Status:  deprecated

4.3.  engineType

   Description:
      Type of flow switching engine in a router/switch:

         RP = 0,
         VIP/Line card = 1,
         PFC/DFC = 2.

      Reserved for internal use on the collector.
   Abstract Data Type:  unsigned8
   ElementId:  38
   Semantics:  identifier
   Status:  deprecated

4.4.  engineId

   Description:
      VIP or line card slot number of the flow switching engine in a
      router/switch.  Reserved for internal use on the collector.
   Abstract Data Type:  unsigned8
   ElementId:  39
   Semantics:  identifier
   Status:  deprecated

4.5.  ipv4RouterSc

   Description:
      This is a platform-specific field for Catalyst 5000/Catalyst 6000
      family.  It is used to store the address of a router that is being
      shortcut when performing MultiLayer Switching.

Yourtchenko, et al.      Expires April 05, 2014                 [Page 4]
Internet-Draft         Cisco Information Elements           October 2013

   Abstract Data Type:  ipv4Address
   ElementId:  43
   Semantics:  identifier
   Status:  deprecated
   Reference:  [CCO-MLS] describes the MultiLayer Switching.

4.6.  samplerId

   Description:
      Deprecated in favor of 302 selectorId.  The unique identifier
      associated with samplerName.
   Abstract Data Type:  unsigned8
   ElementId:  48
   Semantics:  identifier
   Status:  deprecated

4.7.  samplerMode

   Description:
      Deprecated in favor of 304 selectorAlgorithm.  The values are not
      compatible: selectorAlgorithm=3 is random sampling.  The type of
      algorithm used for sampling data: 1 - deterministic, 2 - random
      sampling.  Use with samplerRandomInterval.
   Abstract Data Type:  unsigned8
   ElementId:  49
   Semantics:  identifier
   Status:  deprecated

4.8.  samplerRandomInterval

   Description:
      Deprecated in favour of 305 samplingPacketInterval.  Packet
      interval at which to sample - in case of random sampling.  Used in
      connection with samplerMode 0x02 (random sampling) value.
   Abstract Data Type:  unsigned32
   ElementId:  50
   Semantics:  quantity
   Status:  deprecated

4.9.  classId

   Description:
      Deprecated in favour of 302 selectorId.  Characterizes the traffic
      class, i.e. QoS treatment.
   Abstract Data Type:  unsigned8
   ElementId:  51
   Semantics:  identifier
   Status:  deprecated

Yourtchenko, et al.      Expires April 05, 2014                 [Page 5]
Internet-Draft         Cisco Information Elements           October 2013

4.10.  samplerName

   Description:
      Deprecated in favor of 335 selectorName.  Name of the flow
      sampler.
   Abstract Data Type:  string
   ElementId:  84
   Status:  deprecated

4.11.  flagsAndSamplerId

   Description:
      Flow flags and the value of the sampler ID (samplerId) combined in
      one bitmapped field.  Reserved for internal use on the collector.
   Abstract Data Type:  unsigned32
   ElementId:  87
   Semantics:  identifier
   Status:  deprecated

4.12.  forwardingStatus

   Description:
      This Information Element describes the forwarding status of the
      flow and any attached reasons.  The Reduced Size Encoding rules as
      per [RFC7011] apply.

      The basic encoding is 8 bits. The future extensions
      could add one or three bytes. The layout of the basic
      encoding is as follows:

         MSB -   0   1   2   3   4   5   6   7   - LSB
               +---+---+---+---+---+---+---+---+
               | Status|  Reason code or flags |
               +---+---+---+---+---+---+---+---+

      Status:

      00b = Unknown
      01b = Forwarded
      10b = Dropped
      11b = Consumed

      Reason Code (status = 01b, Forwarded)

      01 000000b = 64 = Unknown
      01 000001b = 65 = Fragmented
      01 000010b = 66 = Not Fragmented

Yourtchenko, et al.      Expires April 05, 2014                 [Page 6]
Internet-Draft         Cisco Information Elements           October 2013

      Reason Code (status = 10b, Dropped)

      10 000000b = 128 = Unknown
      10 000001b = 129 = ACL deny
      10 000010b = 130 = ACL drop
      10 000011b = 131 = Unroutable
      10 000100b = 132 = Adjacency
      10 000101b = 133 = Fragmentation and DF set
      10 000110b = 134 = Bad header checksum
      10 000111b = 135 = Bad total Length
      10 001000b = 136 = Bad header length
      10 001001b = 137 = bad TTL
      10 001010b = 138 = Policer
      10 001011b = 139 = WRED
      10 001100b = 140 = RPF
      10 001101b = 141 = For us
      10 001110b = 142 = Bad output interface
      10 001111b = 143 = Hardware

      Reason Code (status = 11b, Consumed)

      11 000000b = 192 = Unknown
      11 000001b = 193 = Punt Adjacency
      11 000010b = 194 = Incomplete Adjacency
      11 000011b = 195 = For us

      Examples:

        value : 0x40 = 64
        binary: 01000000
        decode: 01        -> Forward
                  000000  -> No further information

        value : 0x89 = 137
        binary: 10001001
        decode: 10        -> Drop
                  001001  -> Fragmentation and DF set

   Abstract Data Type:  unsigned32
   ElementId:  89
   Semantics:  identifier
   Status:  current
   Reference:
      See [CCO-NF9FMT] - NetFlow Version 9 Record Format.

Yourtchenko, et al.      Expires April 05, 2014                 [Page 7]
Internet-Draft         Cisco Information Elements           October 2013

4.13.  srcTrafficIndex

   Description:
      BGP Policy Accounting Source Traffic Index
   Abstract Data Type:  unsigned32
   ElementId:  92
   Semantics:  identifier
   Status:  current
   Reference:
      BGP policy accounting as described in [CCO-BGPPOL]

4.14.  dstTrafficIndex

   Description:
      BGP Policy Accounting Destination Traffic Index
   Abstract Data Type:  unsigned32
   ElementId:  93
   Semantics:  identifier
   Status:  current
   Reference:
      BGP policy accounting as described in [CCO-BGPPOL]

4.15.  className

   Description:
      Deprecated in favor of 335 selectorName.  Traffic Class Name,
      associated with the classId Information Element.
   Abstract Data Type:  string
   ElementId:  100
   Status:  deprecated

4.16.  layer2packetSectionOffset

   Description:
      Layer 2 packet section offset.  Potentially a generic packet
      section offset.
   Abstract Data Type:  unsigned16
   ElementId:  102
   Semantics:  quantity
   Status:  current
   EDITOR'S NOTE:  [I-D.ietf-ipfix-data-link-layer-monitoring] contains
      a corresponding field 'sectionOffset' with a better description.
      One solution is to assign the value 102 for the 'sectionOffset' in
      [I-D.ietf-ipfix-data-link-layer-monitoring].

4.17.  layer2packetSectionSize

   Description:

Yourtchenko, et al.      Expires April 05, 2014                 [Page 8]
Internet-Draft         Cisco Information Elements           October 2013

      Layer 2 packet section size.  Potentially a generic packet section
      size.
   Abstract Data Type:  unsigned16
   ElementId:  103
   Semantics:  quantity
   Status:  current
   EDITOR'S NOTE:  [I-D.ietf-ipfix-data-link-layer-monitoring] contains
      a corresponding field 'sectionObservedOctets' with a better
      description.  One solution is to assign the value 103 to
      'sectionObservedOctets' in
      [I-D.ietf-ipfix-data-link-layer-monitoring].

4.18.  layer2packetSectionData

   Description:
      Layer 2 packet section data.
   Abstract Data Type:  octetArray
   ElementId:  104
   Status:  current
   EDITOR's NOTE:  [I-D.ietf-ipfix-data-link-layer-monitoring] contains
      a corresponding field 'dataLinkFrameSection' with a better
      description.  One solution is to assign the value 104 to
      'dataLinkFrameSection' in
      [I-D.ietf-ipfix-data-link-layer-monitoring].

5.  Other Information Elements

5.1.  Performance Metrics IEs

   ElementId: 65 .. 69

   Performance metrics will need a consolidation in the industry, based
   on RFC6390.  Once this consolidation happens, via a separate document
   the IEs 65-69 will either be assigned in the IANA registry or their
   status will be deprecated.

5.2.  Application Information IEs

   ElementId: 101

   ElementId: 94 .. 97

   Please refer to the RFC 6759 [RFC6759]

6.  IANA Considerations

Yourtchenko, et al.      Expires April 05, 2014                 [Page 9]
Internet-Draft         Cisco Information Elements           October 2013

   This document specifies several new IPFIX Information Elements in the
   IPFIX Information Element registry as defined in Section 3 above.
   The following Information Elements must be assigned:

   o  IE Number 34 for the samplingInterval IE
   o  IE Number 35 for the samplingAlgorithm IE
   o  IE Number 38 for the engineType IE
   o  IE Number 39 for the engineId IE
   o  IE Number 43 for the ipv4RouterSc IE
   o  IE Number 48 for the samplerId IE
   o  IE Number 49 for the samplerMode IE
   o  IE Number 50 for the samplerRandomInterval IE
   o  IE Number 51 for the classId IE
   o  IE Number 84 for the samplerName IE
   o  IE Number 87 for the flagsAndSamplerId IE
   o  IE Number 89 for the forwardingStatus IE
   o  IE Number 92 for the srcTrafficIndex IE
   o  IE Number 93 for the dstTrafficIndex IE
   o  IE Number 100 for the className IE
   o  IE Number 102 for the layer2packetSectionOffset IE
   o  IE Number 103 for the layer2packetSectionSize IE
   o  IE Number 104 for the layer2packetSectionData IE

7.  Security Considerations

   This document specifies the definitions of several Information
   Elements and does not alter the security considerations of the base
   protocol.  Please refer to the security considerations sections of
   RFC 3954 [RFC3954] and RFC 7012 [RFC7012].

   However, the export of the sections of the packet payload may
   unintentionally change the security assumptions of other protocols.

8.  References

8.1.  Normative References

   [RFC7011]  Claise, B., Trammell, B., and P. Aitken, "Specification of
              the IP Flow Information Export (IPFIX) Protocol for the
              Exchange of Flow Information", STD 77, RFC 7011, September
              2013.

8.2.  Informative References

   [CCO-BGPPOL]

Yourtchenko, et al.      Expires April 05, 2014                [Page 10]
Internet-Draft         Cisco Information Elements           October 2013

              Cisco, "BGP Policy Accounting and BGP Policy Accounting
              Output Interface Accounting Features", 2005, <http://
              www.cisco.com/en/US/tech/tk365/
              technologies_tech_note09186a0080094e88.shtml>.

   [CCO-MLS]  Cisco, "IP MultiLayer Switching Sample Configuration",
              2007, <http://www.cisco.com/en/US/products/hw/switches/
              ps700/
              products_configuration_example09186a00800ab513.shtml>.

   [CCO-NF9FMT]
              Cisco, "NetFlow version 9 Flow-Record format", 2011,
              <http://www.cisco.com/en/US/technologies/tk648/tk362/
              technologies_white_paper09186a00800a3db9.html>.

   [I-D.ietf-ipfix-data-link-layer-monitoring]
              Kashima, S., Kobayashi, A., and P. Aitken, "Information
              Elements for Data Link Layer Traffic Measurement", draft-
              ietf-ipfix-data-link-layer-monitoring-04 (work in
              progress), September 2013.

   [IPFIX-IANA]
              IANA, "IP Flow Information Export (IPFIX) Entities", 2013,
              <http://www.iana.org/assignments/ipfix/ipfix.xml>.

   [PSAMP-IANA]
              IANA, "Packet Sampling (PSAMP) Parameters", 2013, <http://
              www.iana.org/assignments/psamp-parameters/psamp-
              parameters.xml>.

   [RFC3954]  Claise, B., "Cisco Systems NetFlow Services Export Version
              9", RFC 3954, October 2004.

   [RFC6759]  Claise, B., Aitken, P., and N. Ben-Dvora, "Cisco Systems
              Export of Application Information in IP Flow Information
              Export (IPFIX)", RFC 6759, November 2012.

   [RFC7012]  Claise, B. and B. Trammell, "Information Model for IP Flow
              Information Export (IPFIX)", RFC 7012, September 2013.

Appendix A.  XML Specification of IPFIX Information Elements

   <?xml version="1.0" encoding="UTF-8"?>

   <fieldDefinitions xmlns="urn:ietf:params:xml:ns:ipfix-info"
                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                 xsi:schemaLocation="urn:ietf:params:xml:ns:ipfix-info
                 ipfix-info.xsd">

Yourtchenko, et al.      Expires April 05, 2014                [Page 11]
Internet-Draft         Cisco Information Elements           October 2013

     <field name="samplingInterval" dataType="unsigned32"
              group=""
              dataTypeSemantics="quantity"
              elementId="34" applicability="flow" status="deprecated">
       <description>
        <paragraph>
        Deprecated in favor of 305 samplingPacketInterval. When using
        sampled NetFlow, the rate at which packets are sampled - e.g. a
        value of 100 indicates that one of every 100 packets is sampled.
        </paragraph>
       </description>
     </field>
     <field name="samplingAlgorithm" dataType="unsigned8"
              group=""
              dataTypeSemantics="identifier"
              elementId="35" applicability="flow" status="deprecated">
       <description>
        <paragraph>
        Deprecated in favor of 304 selectorAlgorithm. The type of
        algorithm used for sampled NetFlow: 1 - Deterministic Sampling;
        2 - Random Sampling. The values are not compatible with the
        selectorAlgorithm IE, where "Deterministic" has been replaced by
        "Systematic count-based" (1) or "Systematic time-based" (2), and
        "Random" is (3). Conversion is required, see
        <REF:PSAMP-IANA>PSAMP parameters.
        </paragraph>
       </description>
     </field>
     <field name="engineType" dataType="unsigned8"
              group=""
              dataTypeSemantics="identifier"
              elementId="38" applicability="flow" status="deprecated">
       <description>
        <paragraph>
        Type of flow switching engine in a router/switch: RP = 0,
        VIP/Line card = 1, PFC/DFC = 2. Reserved for internal use on the
        collector.
        </paragraph>
       </description>
     </field>
     <field name="engineId" dataType="unsigned8"
             group=""
             dataTypeSemantics="identifier"
             elementId="39" applicability="flow" status="deprecated">
       <description>
        <paragraph>
        VIP or line card slot number of the flow switching engine in a
        router/switch. Reserved for internal use on the collector.

Yourtchenko, et al.      Expires April 05, 2014                [Page 12]
Internet-Draft         Cisco Information Elements           October 2013

        </paragraph>
       </description>
     </field>
     <field name="ipv4RouterSc" dataType="ipv4Address"
             group=""
             dataTypeSemantics="identifier"
             elementId="43" applicability="flow" status="deprecated">
       <description>
        <paragraph>
        This is a platform-specific field for Catalyst 5000/Catalyst
        6000 family. It is used to store the address of a router that is
        being shortcut when performing MultiLayer Switching.
        </paragraph>
       </description>
       <reference>
        http://www
        .cisco.com
        /en/US/pro
        ducts/hw/s
        witches/ps
        700/products_configuration_example09186a00800ab513.shtml
        describes the MultiLayer Switching.
       </reference>
     </field>
     <field name="samplerId" dataType="unsigned8"
             group=""
             dataTypeSemantics="identifier"
             elementId="48" applicability="flow" status="deprecated">
       <description>
        <paragraph>
        Deprecated in favor of 302 selectorId. The unique identifier
        associated with samplerName.
        </paragraph>
       </description>
     </field>
     <field name="samplerMode" dataType="unsigned8"
             group=""
             dataTypeSemantics="identifier"
             elementId="49" applicability="flow" status="deprecated">
       <description>
        <paragraph>
        Deprecated in favor of 304 selectorAlgorithm. The values are not
        compatible: selectorAlgorithm=3 is random sampling. The type of
        algorithm used for sampling data: 1 - deterministic, 2 - random
        sampling. Use with samplerRandomInterval.
        </paragraph>
       </description>
     </field>

Yourtchenko, et al.      Expires April 05, 2014                [Page 13]
Internet-Draft         Cisco Information Elements           October 2013

     <field name="samplerRandomInterval" dataType="unsigned32"
             group=""
             dataTypeSemantics="quantity"
             elementId="50" applicability="flow" status="deprecated">
       <description>
        <paragraph>
        Deprecated in favour of 305 samplingPacketInterval. Packet
        interval at which to sample - in case of random sampling. Used
        in connection with samplerMode 0x02 (random sampling) value.
        </paragraph>
       </description>
     </field>
     <field name="classId" dataType="unsigned8"
             group=""
             dataTypeSemantics="identifier"
             elementId="51" applicability="flow" status="deprecated">
       <description>
        <paragraph>
        Deprecated in favour of 302 selectorId. Characterizes the
        traffic class, i.e. QoS treatment.
        </paragraph>
       </description>
     </field>
     <field name="samplerName" dataType="string"
             group=""
             dataTypeSemantics=""
             elementId="84" applicability="flow" status="deprecated">
       <description>
        <paragraph>
        Deprecated in favor of 335 selectorName. Name of the flow
        sampler.
        </paragraph>
       </description>
     </field>
     <field name="flagsAndSamplerId" dataType="unsigned32"
             group=""
             dataTypeSemantics="identifier"
             elementId="87" applicability="flow" status="deprecated">
       <description>
        <paragraph>
        Flow flags and the value of the sampler ID (samplerId) combined
        in one bitmapped field. Reserved for internal use on the
        collector.
        </paragraph>
       </description>
     </field>
     <field name="forwardingStatus" dataType="unsigned32"
             group=""

Yourtchenko, et al.      Expires April 05, 2014                [Page 14]
Internet-Draft         Cisco Information Elements           October 2013

             dataTypeSemantics="identifier"
             elementId="89" applicability="flow" status="current">
       <description>
        <paragraph>
        This Information Element describes the forwarding status of the
        flow and any attached reasons. The Reduced Size Encoding rules
        as per <REF:RFC7011> apply.
        </paragraph>
        <artwork>
           The basic encoding is 8 bits. The future extensions
           could add one or three bytes. The layout of the basic
           encoding is as follows:

             MSB -   0   1   2   3   4   5   6   7   - LSB
                 +---+---+---+---+---+---+---+---+
                 | Status|  Reason code or flags |
                 +---+---+---+---+---+---+---+---+
           Status:

           00b = Unknown
           01b = Forwarded
           10b = Dropped
           11b = Consumed

           Reason Code (status = 01b, Forwarded)

           01 000000b = 64 = Unknown
           01 000001b = 65 = Fragmented
           01 000010b = 66 = Not Fragmented

           Reason Code (status = 10b, Dropped)

           10 000000b = 128 = Unknown
           10 000001b = 129 = ACL deny
           10 000010b = 130 = ACL drop
           10 000011b = 131 = Unroutable
           10 000100b = 132 = Adjacency
           10 000101b = 133 = Fragmentation and DF set
           10 000110b = 134 = Bad header checksum
           10 000111b = 135 = Bad total Length
           10 001000b = 136 = Bad header length
           10 001001b = 137 = bad TTL
           10 001010b = 138 = Policer
           10 001011b = 139 = WRED
           10 001100b = 140 = RPF
           10 001101b = 141 = For us
           10 001110b = 142 = Bad output interface

Yourtchenko, et al.      Expires April 05, 2014                [Page 15]
Internet-Draft         Cisco Information Elements           October 2013

           10 001111b = 143 = Hardware

           Reason Code (status = 11b, Consumed)

           11 000000b = 192 = Unknown
           11 000001b = 193 = Punt Adjacency
           11 000010b = 194 = Incomplete Adjacency
           11 000011b = 195 = For us

           Examples:

             value : 0x40 = 64
             binary: 01000000
             decode: 01     -> Forward
                   000000  -> No further information

             value : 0x89 = 137
             binary: 10001001
             decode: 10     -> Drop
                   001001  -> Fragmentation and DF set
        </artwork>
       </description>
       <reference>
        See http:/
        /www.cisco
        .com/en/US
        /technolog
        ies/tk648/tk362/technologies_white_paper09186a00800a3db9.html -
        NetFlow Version 9 Record Format.
       </reference>
     </field>
     <field name="srcTrafficIndex" dataType="unsigned32"
             group=""
             dataTypeSemantics="identifier"
             elementId="92" applicability="flow" status="current">
       <description>
        <paragraph>
        BGP Policy Accounting Source Traffic Index
        </paragraph>
       </description>
       <reference>
        BGP policy accounting as described in
        http://www
        .cisco.com
        /en/US/tech/tk365/technologies_tech_note09186a0080094e88.shtml
       </reference>
     </field>
     <field name="dstTrafficIndex" dataType="unsigned32"

Yourtchenko, et al.      Expires April 05, 2014                [Page 16]
Internet-Draft         Cisco Information Elements           October 2013

             group=""
             dataTypeSemantics="identifier"
             elementId="93" applicability="flow" status="current">
       <description>
        <paragraph>
        BGP Policy Accounting Destination Traffic Index
        </paragraph>
       </description>
       <reference>
        BGP policy accounting as described in
        http://www
        .cisco.com
        /en/US/tech/tk365/technologies_tech_note09186a0080094e88.shtml
       </reference>
     </field>
     <field name="className" dataType="string"
             group=""
             dataTypeSemantics=""
             elementId="100" applicability="flow" status="deprecated">
       <description>
        <paragraph>
        Deprecated in favor of 335 selectorName. Traffic Class Name,
        associated with the classId Information Element.
        </paragraph>
       </description>
     </field>
     <field name="layer2packetSectionOffset" dataType="unsigned16"
             group=""
             dataTypeSemantics="quantity"
             elementId="102" applicability="flow" status="current">
       <description>
        <paragraph>
        Layer 2 packet section offset. Potentially a generic packet
        section offset.
        </paragraph>
       </description>
     </field>
     <field name="layer2packetSectionSize" dataType="unsigned16"
             group=""
             dataTypeSemantics="quantity"
             elementId="103" applicability="flow" status="current">
       <description>
        <paragraph>
        Layer 2 packet section size. Potentially a generic packet
        section size.
        </paragraph>
       </description>
     </field>

Yourtchenko, et al.      Expires April 05, 2014                [Page 17]
Internet-Draft         Cisco Information Elements           October 2013

     <field name="layer2packetSectionData" dataType="octetArray"
             group=""
             dataTypeSemantics=""
             elementId="104" applicability="flow" status="current">
       <description>
        <paragraph>
        Layer 2 packet section data.
        </paragraph>
       </description>
     </field>
   </fieldDefinitions>

Appendix B.  Changes

   To be removed by RFC Editor before publication

   01: initial revision presented at the IETF meeting.

   02: removed "flow" from flowSamplerId, flowSamplerMode, and
   flowSamplerRandomInterval; updated the related drafts in references;
   added the "reference" column to the XML definitions; renamed
   fsFlowEntryTotalCount into deltaFlowCount to keep the naming in sync
   with draft-trammell-ipfix-a9n. Also minor changes to formatting and
   added the IE overview table.

   03: updated the references to draft-claise-export-application-info-
   in-ipfix, slightly tweaked the title and removed the unused reference
   to draft-ietf-ipfix-flow-selection-tech.

   04: sync the references.

   05: update references to draft-claise-export-application-info-in-
   ipfix with reference to rfc6759, draft-trammell-ipfix-a9n to draft-
   ietf-ipfix-a9n, draft-kashima-ipfix-data-link-layer-monitoring to
   draft-ietf-ipfix-data-link-layer-monitoring.

   06: sync the references.

   07: Update per comment from Andrew Feren - change semantics of
   ipv4RouterSc to "identifier" and remove deltaFlowCount as it made it
   to IANA.  Update references RFC5101 to RFC7011, draft-ietf-ipfix-
   data-link-layer-monitoring from -03 to -04.

Authors' Addresses

Yourtchenko, et al.      Expires April 05, 2014                [Page 18]
Internet-Draft         Cisco Information Elements           October 2013

   Andrew Yourtchenko
   Cisco Systems, Inc.
   De Kleetlaan, 7
   Brussels, Diegem  B-1831
   Belgium

   Phone: +32 2 704 5494
   Email: ayourtch@cisco.com

   Paul Aitken
   Cisco Systems, Inc.
   96 Commercial Quay
   Edinburgh  EH6 6LX
   Scotland

   Phone: +44 131 561 3616
   Email: paitken@cisco.com

   Benoit Claise
   Cisco Systems, Inc.
   De Kleetlaan, 6a b1
   Diegem  B-1831
   Belgium

   Phone: +32 2 704 5622
   Email: bclaise@cisco.com

Yourtchenko, et al.      Expires April 05, 2014                [Page 19]