Network Working Group                                         J. Quittek
Internet-Draft
Request for Comments: 5102                                           NEC
Intended status:
Category: Standards Track                                      S. Bryant
Expires: August 28, 2007
                                                               B. Claise
                                                               P. Aitken
                                                     Cisco Systems Systems, Inc.
                                                                J. Meyer
                                                                  PayPal
                                                       February 24,
                                                           December 2007

            Information Model for IP Flow Information Export
                        draft-ietf-ipfix-info-15

Status of this This Memo

   By submitting this Internet-Draft, each author represents that any
   applicable patent or other IPR claims of which he or she is aware
   have been or will be disclosed, and any of which he or she becomes
   aware will be disclosed, in accordance with Section 6 of BCP 79.

   Internet-Drafts are working documents of

   This document specifies an Internet standards track protocol for the
   Internet Engineering
   Task Force (IETF), its areas, community, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid requests discussion and suggestions for a maximum
   improvements.  Please refer to the current edition of six months the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list status of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list this protocol.  Distribution of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on August 28, 2007.

Copyright Notice

   Copyright (C) The IETF Trust (2007). this memo is unlimited.

Abstract

   This memo defines an information model for the IP Flow Information
   eXport (IPFIX) protocol.  It is used by the IPFIX protocol for
   encoding measured traffic information and information related to the
   traffic Observation Point, the traffic Metering Process Process, and the
   Exporting Process.  Although developed for the IPFIX protocol, the
   model is defined in an open way that easily allows using it in other
   protocols, interfaces, and applications.

Table of Contents

   1. Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   7 ....................................................6
   2. Properties of IPFIX Protocol Information Elements . . . . . .   8 ...............7
      2.1. Information Elements Specification Template . . . . . . .   8 ................7
      2.2. Scope of Information Elements . . . . . . . . . . . . . .   9 ..............................9
      2.3. Naming Conventions for Information Elements . . . . . . .  10 ................9
   3. Type Space  . . . . . . . . . . . . . . . . . . . . . . . . .  11 .....................................................10
      3.1. Abstract Data Types . . . . . . . . . . . . . . . . . . .  11 .......................................10
           3.1.1. unsigned8  . . . . . . . . . . . . . . . . . . . . .  11 ..........................................10
           3.1.2. unsigned16 . . . . . . . . . . . . . . . . . . . . .  11 .........................................11
           3.1.3. unsigned32 . . . . . . . . . . . . . . . . . . . . .  11 .........................................11
           3.1.4. unsigned64 . . . . . . . . . . . . . . . . . . . . .  11 .........................................11
           3.1.5. signed8  . . . . . . . . . . . . . . . . . . . . . .  11 ............................................11
           3.1.6. signed16 . . . . . . . . . . . . . . . . . . . . . .  11 ...........................................11
           3.1.7. signed32 . . . . . . . . . . . . . . . . . . . . . .  12 ...........................................11
           3.1.8. signed64 . . . . . . . . . . . . . . . . . . . . . .  12 ...........................................11
           3.1.9. float32  . . . . . . . . . . . . . . . . . . . . . .  12 ............................................11
           3.1.10. float64  . . . . . . . . . . . . . . . . . . . . . .  12 ...........................................11
           3.1.11. boolean  . . . . . . . . . . . . . . . . . . . . . .  12 ...........................................12
           3.1.12. macAddress . . . . . . . . . . . . . . . . . . . . .  12 ........................................12
           3.1.13. octetArray . . . . . . . . . . . . . . . . . . . . .  12 ........................................12
           3.1.14. string . . . . . . . . . . . . . . . . . . . . . . .  12 ............................................12
           3.1.15. dateTimeSeconds  . . . . . . . . . . . . . . . . . .  12 ...................................12
           3.1.16. dateTimeMilliseconds . . . . . . . . . . . . . . . .  12 ..............................12
           3.1.17. dateTimeMicroseconds . . . . . . . . . . . . . . . .  13 ..............................12
           3.1.18. dateTimeNanoseconds  . . . . . . . . . . . . . . . .  13 ...............................13
           3.1.19. ipv4Address  . . . . . . . . . . . . . . . . . . . .  13 .......................................13
           3.1.20. ipv6Address  . . . . . . . . . . . . . . . . . . . .  13 .......................................13
      3.2. Data Type Semantics . . . . . . . . . . . . . . . . . . .  13 .......................................13
           3.2.1. quantity . . . . . . . . . . . . . . . . . . . . . .  13 ...........................................13
           3.2.2. totalCounter . . . . . . . . . . . . . . . . . . . .  13 .......................................13
           3.2.3. deltaCounter . . . . . . . . . . . . . . . . . . . .  14 .......................................14
           3.2.4. identifier . . . . . . . . . . . . . . . . . . . . .  14 .........................................14
           3.2.5. flags  . . . . . . . . . . . . . . . . . . . . . . .  14 ..............................................14
   4. Information Element Identifiers . . . . . . . . . . . . . . .  14 ................................14
   5. Information Elements  . . . . . . . . . . . . . . . . . . . .  18 ...........................................18
      5.1. Identifiers . . . . . . . . . . . . . . . . . . . . . . .  19 ...............................................19
           5.1.1. lineCardId . . . . . . . . . . . . . . . . . . . . .  19 .........................................20
           5.1.2. portId . . . . . . . . . . . . . . . . . . . . . . .  20 .............................................20
           5.1.3. ingressInterface . . . . . . . . . . . . . . . . . .  20 ...................................20
           5.1.4. egressInterface  . . . . . . . . . . . . . . . . . .  20 ....................................21
           5.1.5. meteringProcessId  . . . . . . . . . . . . . . . . .  21 ..................................21
           5.1.6. exportingProcessId . . . . . . . . . . . . . . . . .  21 .................................21
           5.1.7. flowId . . . . . . . . . . . . . . . . . . . . . . .  21 .............................................22
           5.1.8. templateId . . . . . . . . . . . . . . . . . . . . .  21 .........................................22
           5.1.9. observationDomainId  . . . . . . . . . . . . . . . .  22 ................................22
           5.1.10. observationPointId . . . . . . . . . . . . . . . . .  22 ................................23
           5.1.11. commonPropertiesId . . . . . . . . . . . . . . . . .  22 ................................23
      5.2. Metering and Exporting Process Configuration  . . . . . .  23 ..............23
           5.2.1. exporterIPv4Address  . . . . . . . . . . . . . . . .  23 ................................24
           5.2.2. exporterIPv6Address  . . . . . . . . . . . . . . . .  23 ................................24
           5.2.3. exporterTransportPort  . . . . . . . . . . . . . . .  24 ..............................24
           5.2.4. collectorIPv4Address . . . . . . . . . . . . . . . .  24 ...............................25
           5.2.5. collectorIPv6Address . . . . . . . . . . . . . . . .  24 ...............................25
           5.2.6. collectorInterface . . . . . . . . . . . . . . . . .  24 .................................25
           5.2.7. collectorProtocolVersion . . . . . . . . . . . . . .  25 ...........................26
           5.2.8. collectorTransportProtocol . . . . . . . . . . . . .  25 .........................26
           5.2.9. collectorTransportPort . . . . . . . . . . . . . . .  26 .............................27
           5.2.10. flowKeyIndicator . . . . . . . . . . . . . . . . . .  26 ..................................27
      5.3. Metering and Exporting Process Statistics . . . . . . . .  27 .................28
           5.3.1. exportedMessageTotalCount  . . . . . . . . . . . . .  27 ..........................28
           5.3.2. exportedOctetTotalCount  . . . . . . . . . . . . . .  27 ............................28
           5.3.3. exportedFlowRecordTotalCount . . . . . . . . . . . .  28 .......................29
           5.3.4. observedFlowTotalCount . . . . . . . . . . . . . . .  28 .............................29
           5.3.5. ignoredPacketTotalCount  . . . . . . . . . . . . . .  28 ............................29
           5.3.6. ignoredOctetTotalCount . . . . . . . . . . . . . . .  28 .............................30
           5.3.7. notSentFlowTotalCount  . . . . . . . . . . . . . . .  29 ..............................30
           5.3.8. notSentPacketTotalCount  . . . . . . . . . . . . . .  29 ............................30
           5.3.9. notSentOctetTotalCount . . . . . . . . . . . . . . .  29 .............................31
      5.4. IP Header Fields  . . . . . . . . . . . . . . . . . . . .  30 ..........................................31
           5.4.1. ipVersion  . . . . . . . . . . . . . . . . . . . . .  30 ..........................................31
           5.4.2. sourceIPv4Address  . . . . . . . . . . . . . . . . .  31 ..................................32
           5.4.3. sourceIPv6Address  . . . . . . . . . . . . . . . . .  31 ..................................32
           5.4.4. sourceIPv4PrefixLength . . . . . . . . . . . . . . .  31 .............................32
           5.4.5. sourceIPv6PrefixLength . . . . . . . . . . . . . . .  31 .............................33
           5.4.6. sourceIPv4Prefix . . . . . . . . . . . . . . . . . .  31 ...................................33
           5.4.7. sourceIPv6Prefix . . . . . . . . . . . . . . . . . .  32 ...................................33
           5.4.8. destinationIPv4Address . . . . . . . . . . . . . . .  32 .............................33
           5.4.9. destinationIPv6Address . . . . . . . . . . . . . . .  32 .............................34
           5.4.10. destinationIPv4PrefixLength  . . . . . . . . . . . .  32 .......................34
           5.4.11. destinationIPv6PrefixLength  . . . . . . . . . . . .  33 .......................34
           5.4.12. destinationIPv4Prefix  . . . . . . . . . . . . . . .  33 .............................34
           5.4.13. destinationIPv6Prefix  . . . . . . . . . . . . . . .  33 .............................35
           5.4.14. ipTTL  . . . . . . . . . . . . . . . . . . . . . . .  33 .............................................35
           5.4.15. protocolIdentifier . . . . . . . . . . . . . . . . .  34 ................................35
           5.4.16. nextHeaderIPv6 . . . . . . . . . . . . . . . . . . .  34 ....................................36
           5.4.17. ipDiffServCodePoint  . . . . . . . . . . . . . . . .  34 ...............................36
           5.4.18. ipPrecedence . . . . . . . . . . . . . . . . . . . .  35 ......................................36
           5.4.19. ipClassOfService . . . . . . . . . . . . . . . . . .  35 ..................................37
           5.4.20. postIpClassOfService . . . . . . . . . . . . . . . .  36 ..............................37
           5.4.21. flowLabelIPv6  . . . . . . . . . . . . . . . . . . .  36 .....................................38
           5.4.22. isMulticast  . . . . . . . . . . . . . . . . . . . .  36 .......................................38
           5.4.23. fragmentIdentification . . . . . . . . . . . . . . .  37 ............................39
           5.4.24. fragmentOffset . . . . . . . . . . . . . . . . . . .  37 ....................................39
           5.4.25. fragmentFlags  . . . . . . . . . . . . . . . . . . .  38 .....................................39
           5.4.26. ipHeaderLength . . . . . . . . . . . . . . . . . . .  39 ....................................40
           5.4.27. ipv4IHL  . . . . . . . . . . . . . . . . . . . . . .  39 ...........................................40
           5.4.28. totalLengthIPv4  . . . . . . . . . . . . . . . . . .  39 ...................................41
           5.4.29. ipTotalLength  . . . . . . . . . . . . . . . . . . .  39 .....................................41
           5.4.30. payloadLengthIPv6  . . . . . . . . . . . . . . . . .  40 .................................41
      5.5. Transport Header Fields . . . . . . . . . . . . . . . . .  40 ...................................42
           5.5.1. sourceTransportPort  . . . . . . . . . . . . . . . .  41 ................................42
           5.5.2. destinationTransportPort . . . . . . . . . . . . . .  41 ...........................42
           5.5.3. udpSourcePort  . . . . . . . . . . . . . . . . . . .  41 ......................................43
           5.5.4. udpDestinationPort . . . . . . . . . . . . . . . . .  42 .................................43
           5.5.5. udpMessageLength . . . . . . . . . . . . . . . . . .  42 ...................................43
           5.5.6. tcpSourcePort  . . . . . . . . . . . . . . . . . . .  42 ......................................44
           5.5.7. tcpDestinationPort . . . . . . . . . . . . . . . . .  42 .................................44
           5.5.8. tcpSequenceNumber  . . . . . . . . . . . . . . . . .  43 ..................................44
           5.5.9. tcpAcknowledgementNumber . . . . . . . . . . . . . .  43 ...........................44
           5.5.10. tcpWindowSize  . . . . . . . . . . . . . . . . . . .  43 .....................................45
           5.5.11. tcpWindowScale . . . . . . . . . . . . . . . . . . .  43 ....................................45
           5.5.12. tcpUrgentPointer . . . . . . . . . . . . . . . . . .  44 ..................................45
           5.5.13. tcpHeaderLength  . . . . . . . . . . . . . . . . . .  44 ...................................45
           5.5.14. icmpTypeCodeIPv4 . . . . . . . . . . . . . . . . . .  44 ..................................46
           5.5.15. icmpTypeIPv4 . . . . . . . . . . . . . . . . . . . .  45 ......................................46
           5.5.16. icmpCodeIPv4 . . . . . . . . . . . . . . . . . . . .  45 ......................................46
           5.5.17. icmpTypeCodeIPv6 . . . . . . . . . . . . . . . . . .  45 ..................................46
           5.5.18. icmpTypeIPv6 . . . . . . . . . . . . . . . . . . . .  45 ......................................47
           5.5.19. icmpCodeIPv6 . . . . . . . . . . . . . . . . . . . .  46 ......................................47
           5.5.20. igmpType . . . . . . . . . . . . . . . . . . . . . .  46 ..........................................47
      5.6. Sub-IP Header Fields  . . . . . . . . . . . . . . . . . .  46 ......................................48
           5.6.1. sourceMacAddress . . . . . . . . . . . . . . . . . .  47 ...................................48
           5.6.2. postSourceMacAddress . . . . . . . . . . . . . . . .  47 ...............................48
           5.6.3. vlanId . . . . . . . . . . . . . . . . . . . . . . .  47 .............................................49
           5.6.4. postVlanId . . . . . . . . . . . . . . . . . . . . .  47 .........................................49
           5.6.5. destinationMacAddress  . . . . . . . . . . . . . . .  48 ..............................49
           5.6.6. postDestinationMacAddress  . . . . . . . . . . . . .  48 ..........................49
           5.6.7. wlanChannelId  . . . . . . . . . . . . . . . . . . .  48 ......................................50
           5.6.8. wlanSSID . . . . . . . . . . . . . . . . . . . . . .  48 ...........................................50
           5.6.9. mplsTopLabelTTL  . . . . . . . . . . . . . . . . . .  49 ....................................50
           5.6.10. mplsTopLabelExp  . . . . . . . . . . . . . . . . . .  49 ...................................51
           5.6.11. postMplsTopLabelExp  . . . . . . . . . . . . . . . .  49 ...............................51
           5.6.12. mplsLabelStackDepth  . . . . . . . . . . . . . . . .  50 ...............................51
           5.6.13. mplsLabelStackLength . . . . . . . . . . . . . . . .  50 ..............................52
           5.6.14. mplsPayloadLength  . . . . . . . . . . . . . . . . .  50 .................................52
           5.6.15. mplsTopLabelStackSection . . . . . . . . . . . . . .  51 ..........................52
           5.6.16. mplsLabelStackSection2 . . . . . . . . . . . . . . .  51 ............................53
           5.6.17. mplsLabelStackSection3 . . . . . . . . . . . . . . .  51 ............................53
           5.6.18. mplsLabelStackSection4 . . . . . . . . . . . . . . .  52 ............................53
           5.6.19. mplsLabelStackSection5 . . . . . . . . . . . . . . .  52 ............................54
           5.6.20. mplsLabelStackSection6 . . . . . . . . . . . . . . .  52 ............................54
           5.6.21. mplsLabelStackSection7 . . . . . . . . . . . . . . .  53 ............................54
           5.6.22. mplsLabelStackSection8 . . . . . . . . . . . . . . .  53 ............................55
           5.6.23. mplsLabelStackSection9 . . . . . . . . . . . . . . .  53 ............................55
           5.6.24. mplsLabelStackSection10  . . . . . . . . . . . . . .  54 ...........................55
      5.7. Derived Packet Properties . . . . . . . . . . . . . . . .  54 .................................56
           5.7.1. ipPayloadLength  . . . . . . . . . . . . . . . . . .  55 ....................................56
           5.7.2. ipNextHopIPv4Address . . . . . . . . . . . . . . . .  55 ...............................56
           5.7.3. ipNextHopIPv6Address . . . . . . . . . . . . . . . .  55 ...............................57
           5.7.4. bgpSourceAsNumber  . . . . . . . . . . . . . . . . .  55 ..................................57
           5.7.5. bgpDestinationAsNumber . . . . . . . . . . . . . . .  56 .............................57
           5.7.6. bgpNextAdjacentAsNumber  . . . . . . . . . . . . . .  56 ............................57
           5.7.7. bgpPrevAdjacentAsNumber  . . . . . . . . . . . . . .  56 ............................58
           5.7.8. bgpNextHopIPv4Address  . . . . . . . . . . . . . . .  57 ..............................58
           5.7.9. bgpNextHopIPv6Address  . . . . . . . . . . . . . . .  57 ..............................58
           5.7.10. mplsTopLabelType . . . . . . . . . . . . . . . . . .  57 ..................................59
           5.7.11. mplsTopLabelIPv4Address  . . . . . . . . . . . . . .  58 ...........................59
           5.7.12. mplsTopLabelIPv6Address  . . . . . . . . . . . . . .  58 ...........................60
           5.7.13. mplsVpnRouteDistinguisher  . . . . . . . . . . . . .  58
     5.8.  Min/Max Flow Properties . . . . . . . . . . . . . . . . .  59
       5.8.1.   minimumIpTotalLength . . . . . . . . . . . . . . . .  59
       5.8.2.   maximumIpTotalLength . . . . . . . . . . . . . . . .  59
       5.8.3.   minimumTTL . . . . . . . . . . . . . . . . . . . . .  60
       5.8.4.   maximumTTL . . . . . . . . . . . . . . . . . . . . .  60
       5.8.5.   ipv4Options  . . . . . . . . . . . . . . . . . . . .  60
       5.8.6.   ipv6ExtensionHeaders . . . . . . . . . . . . . . . .  62
       5.8.7.   tcpControlBits . . . . . . . . . . . . . . . . . . .  64
       5.8.8.   tcpOptions . . . . . . . . . . . . . . . . . . . . .  64 .........................60
      5.8. Min/Max Flow Properties ...................................61
           5.8.1. minimumIpTotalLength ...............................61
           5.8.2. maximumIpTotalLength ...............................61
           5.8.3. minimumTTL .........................................61
           5.8.4. maximumTTL .........................................62
           5.8.5. ipv4Options ........................................62
           5.8.6. ipv6ExtensionHeaders ...............................64
           5.8.7. tcpControlBits .....................................65
           5.8.8. tcpOptions .........................................66
      5.9. Flow Time Stamps  . . . . . . . . . . . . . . . . . . . .  65 Timestamps ...........................................67
           5.9.1. flowStartSeconds . . . . . . . . . . . . . . . . . .  66 ...................................67
           5.9.2. flowEndSeconds . . . . . . . . . . . . . . . . . . .  66 .....................................68
           5.9.3. flowStartMilliseconds  . . . . . . . . . . . . . . .  66 ..............................68
           5.9.4. flowEndMilliseconds  . . . . . . . . . . . . . . . .  66 ................................68
           5.9.5. flowStartMicroseconds  . . . . . . . . . . . . . . .  67 ..............................68
           5.9.6. flowEndMicroseconds  . . . . . . . . . . . . . . . .  67 ................................68
           5.9.7. flowStartNanoseconds . . . . . . . . . . . . . . . .  67 ...............................69
           5.9.8. flowEndNanoseconds . . . . . . . . . . . . . . . . .  67 .................................69
           5.9.9. flowStartDeltaMicroseconds . . . . . . . . . . . . .  67 .........................69
           5.9.10. flowEndDeltaMicroseconds . . . . . . . . . . . . . .  68 ..........................69
           5.9.11. systemInitTimeMilliseconds . . . . . . . . . . . . .  68 ........................70
           5.9.12. flowStartSysUpTime . . . . . . . . . . . . . . . . .  68 ................................70
           5.9.13. flowEndSysUpTime . . . . . . . . . . . . . . . . . .  69 ..................................70
      5.10. Per-Flow Counters . . . . . . . . . . . . . . . . . . . .  69 ........................................70
           5.10.1. octetDeltaCount  . . . . . . . . . . . . . . . . . .  70 ...................................71
           5.10.2. postOctetDeltaCount  . . . . . . . . . . . . . . . .  70 ...............................71
           5.10.3. octetDeltaSumOfSquares . . . . . . . . . . . . . . .  70 ............................72
           5.10.4. octetTotalCount  . . . . . . . . . . . . . . . . . .  71 ...................................72
           5.10.5. postOctetTotalCount  . . . . . . . . . . . . . . . .  71 ...............................72
           5.10.6. octetTotalSumOfSquares . . . . . . . . . . . . . . .  71 ............................72
           5.10.7. packetDeltaCount . . . . . . . . . . . . . . . . . .  72 ..................................73
           5.10.8. postPacketDeltaCount . . . . . . . . . . . . . . . .  72 ..............................73
           5.10.9. packetTotalCount . . . . . . . . . . . . . . . . . .  72 ..................................73
           5.10.10. postPacketTotalCount . . . . . . . . . . . . . . . .  72 .............................74
           5.10.11. droppedOctetDeltaCount . . . . . . . . . . . . . . .  73 ...........................74
           5.10.12. droppedPacketDeltaCount  . . . . . . . . . . . . . .  73 ..........................74
           5.10.13. droppedOctetTotalCount . . . . . . . . . . . . . . .  73
       5.10.14. droppedPacketTotalCount  . . . . . . . . . . . . . .  73 droppedOctetTotalCount ...........................74
           5.10.14. droppedPacketTotalCount ..........................75
           5.10.15. postMCastPacketDeltaCount  . . . . . . . . . . . . .  74 ........................75
           5.10.16. postMCastOctetDeltaCount . . . . . . . . . . . . . .  74 .........................75
           5.10.17. postMCastPacketTotalCount  . . . . . . . . . . . . .  74 ........................76
           5.10.18. postMCastOctetTotalCount . . . . . . . . . . . . . .  75 .........................76
           5.10.19. tcpSynTotalCount . . . . . . . . . . . . . . . . . .  75 .................................76
           5.10.20. tcpFinTotalCount . . . . . . . . . . . . . . . . . .  75 .................................77
           5.10.21. tcpRstTotalCount . . . . . . . . . . . . . . . . . .  76 .................................77
           5.10.22. tcpPshTotalCount . . . . . . . . . . . . . . . . . .  76 .................................77
           5.10.23. tcpAckTotalCount . . . . . . . . . . . . . . . . . .  76 .................................78
           5.10.24. tcpUrgTotalCount . . . . . . . . . . . . . . . . . .  76 .................................78
      5.11. Miscellaneous Flow Properties . . . . . . . . . . . . . .  77 ............................78
           5.11.1. flowActiveTimeout  . . . . . . . . . . . . . . . . .  77 .................................79
           5.11.2. flowIdleTimeout  . . . . . . . . . . . . . . . . . .  77 ...................................79
           5.11.3. flowEndReason  . . . . . . . . . . . . . . . . . . .  78 .....................................79
           5.11.4. flowDurationMilliseconds . . . . . . . . . . . . . .  78 ..........................80
           5.11.5. flowDurationMicroseconds . . . . . . . . . . . . . .  78 ..........................80
           5.11.6. flowDirection  . . . . . . . . . . . . . . . . . . .  79 .....................................80
      5.12. Padding . . . . . . . . . . . . . . . . . . . . . . . . .  79 ..................................................80
           5.12.1. paddingOctets  . . . . . . . . . . . . . . . . . . .  79 .....................................81
   6. Extending the Information Model . . . . . . . . . . . . . . .  80 ................................81
   7. IANA Considerations . . . . . . . . . . . . . . . . . . . . .  80 ............................................82
      7.1. IPFIX Information Elements  . . . . . . . . . . . . . . .  80 ................................82
      7.2. MPLS Label Type Identifier  . . . . . . . . . . . . . . .  81
     7.3.  XML Namespace and Schema  . . . . . . . . . . . . . . . .  81
   8.  Security Considerations . . . . . . . . . . . . . . . . . . .  82
   9.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  82
   10. References  . . . . . . . . . . . . . . . . . . . . . . . . .  82 Identifier ................................82
      7.3. XML Namespace and Schema ..................................83
   8. Security Considerations ........................................83
   9. Acknowledgements ...............................................84
   10. References ....................................................84
      10.1. Normative References  . . . . . . . . . . . . . . . . . .  82 .....................................84
      10.2. Informative References  . . . . . . . . . . . . . . . . .  83 ...................................84
   Appendix A. XML Specification of IPFIX Information Elements  . .  86 .......89
   Appendix B. XML Specification of Abstract Data Types . . . . . . 156
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . . 168
   Intellectual Property and Copyright Statements  . . . . . . . . . 170 .............158

1.  Introduction

   The IP Flow Information eXport (IPFIX) protocol serves for
   transmitting information related to measured IP traffic over the
   Internet.  The protocol specification in [I-D.ietf-ipfix-protocol] [RFC5101] defines how
   Information Elements are transmitted.  For Information Elements, it
   specifies the encoding of a set of basic data types.  However, the
   list of Information Elements that can be transmitted by the protocol,
   such as Flow attributes (source IP address, number of packets, etc.)
   and information about the Metering and Exporting Process (packet
   Observation Point, sampling rate, Flow timeout interval, etc.), is
   not specified in [I-D.ietf-ipfix-protocol]. [RFC5101].

   This document complements the IPFIX protocol specification by
   providing the IPFIX information model.  IPFIX-specific terminology
   used in this document is defined in section Section 2 of [I-D.ietf-ipfix-
   protocol]. [RFC5101].  As in [I-D.ietf-ipfix-protocol],
   [RFC5101], these IPFIX-specific terms have the first letter of a word
   capitalized when used in this document.

   The use of the term 'information model' is not fully in line with the
   definition of this term in [RFC3444].  The IPFIX information model
   does not specify relationships between Information Elements, but also
   it does not specify a concrete encoding of Information Elements.
   Besides the encoding used by the IPFIX protocol, also other encodings of
   IPFIX Information Elements can be applied, for example example, XML-based
   encodings.

   The main part of this document is section 5 defining Section 5, which defines the
   (extensible) list of Information Elements to be transmitted by the
   IPFIX protocol.  Section 2 defines a template for specifying IPFIX
   Information Elements in section Section 5.  Section 3 defines the set of
   abstract data types that are available for IPFIX Information
   Elements.  Section 6 discusses extensibility of the IPFIX information
   model.

   The main bodies of sections Sections 2, 3 3, and 5 were generated from XML
   documents.  The XML-based specification of template, abstract data
   types
   types, and IPFIX Information Elements can be used for automatically
   checking syntactical correctness of the specification of IPFIX
   Information Elements.  It can further be used for generating IPFIX
   protocol implementation code that deals with processing IPFIX
   Information Elements.  Also  Also, code for applications that further
   process traffic information transmitted via the IPFIX protocol can be
   generated with the XML specification of IPFIX Information Elements.

   For that reason, the XML document that served as a source for section Section
   5 and the XML schema that served as source for sections Sections 2 and 3 are
   attached to this document in Appendices A and B.

   Note that although partially generated from the attached XML
   documents, the main body of this document is normative while the
   appendices are informational.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC2119].

2.  Properties of IPFIX Protocol Information Elements

2.1.  Information Elements Specification Template

   Information in messages of the IPFIX protocol is modeled in terms of
   Information Elements of the IPFIX information model.  IPFIX
   Information Elements are specified in section Section 5.  For specifying
   these Information Elements, a template is used that is described
   below.

   All Information Elements specified for the IPFIX protocol either in
   this document or by any future extension MUST have the following
   properties defined:

   name - A unique and meaningful name for the Information Element.

   elementId - A numeric identifier of the Information Element.  If this
      identifier is used without an enterprise identifier (see
      [I-D.ietf-ipfix-protocol] [RFC5101]
      and enterpriseId below), then it is globally unique and the list
      of allowed values is administered by IANA.  It is used for compact
      identification of an Information Element when encoding Templates
      in the protocol.

   description - The semantics of this Information Element.  Describes
      how this Information Element is derived from the Flow or other
      information available to the observer.

   dataType - One of the types listed in section Section 3.1 of this document or
      in a future extension of the information model.  The type space
      for attributes is constrained to facilitate implementation.  The
      existing type space does however encompass most basic types used
      in modern programming languages, as well as some derived types
      (such as ipv4Address) which that are common to this domain and useful to
      distinguish.

   status - The status of the specification of this Information Element.
      Allowed values are 'current', 'deprecated', and 'obsolete'.

   Enterprise-specific Information Elements MUST have the following
   property defined:

   enterpriseId - Enterprises may wish to define Information Elements
      without registering them with IANA, for example example, for enterprise-
      internal
      enterprise-internal purposes.  For such Information Elements Elements, the
      Information Element identifier described above is not sufficient
      when the Information Element is used outside the enterprise.  If
      specifications of enterprise-specific Information Elements are
      made public and/or if enterprise-specific identifiers are used by
      the IPFIX protocol outside the enterprise, then the enterprise-
      specific
      enterprise-specific identifier MUST be made globally unique by
      combining it with an enterprise identifier.  Valid values for the
      enterpriseId are defined by IANA as SMI Structure of Management
      Information (SMI) network management private enterprise codes.
      They are defined at
      http://www.iana.org/assignments/enterprise-numbers. http://www.iana.org/assignments/enterprise-
      numbers.

   All Information Elements specified for the IPFIX protocol either in
   this document or by any future extension MAY have the following
   properties defined:

   dataTypeSemantics - The integral types may be qualified by additional
      semantic details.  Valid values for the data type semantics are
      specified in section Section 3.2 of this document or in a future extension
      of the information model.

   units - If the Information Element is a measure of some kind, the
      units identify what the measure is.

   range - Some Information Elements may only be able to take on a
      restricted set of values which that can be expressed as a range (e.g. (e.g., 0
      through 511 inclusive).  If this is the case, the valid inclusive
      range should be specified.

   reference - Identifies additional specifications which that more precisely
      define this item or provide additional context for its use.

2.2.  Scope of Information Elements

   By default, most Information Elements have a scope specified in their
   definitions.

   o  The Information Elements defined in sections Sections 5.2 and 5.3 have a
      default of "a specific Metering Process" or of "a specific
      Exporting Process", respectively.

   o  The Information Elements defined in sections 5.4 - 5.11 Sections 5.4-5.11 have a scope
      of "a specific Flow".

   Within Data Records defined by Option Templates, the IPFIX protocol
   allows further limiting of the Information Element scope.  The new
   scope is specified by one or more scope fields and defined as the
   combination of all specified scope values, values; see section Section 3.4.2.1 on
   IPFIX scopes in [I-D.ietf-ipfix-protocol]. [RFC5101].

2.3.  Naming Conventions for Information Elements

    The following naming conventions were used for naming Information
    Elements in this document.  It is recommended that extensions of the
    model use the same conventions.

   o  Names of Information Elements schould should be descriptive.

   o  Names of Information Elements that are not enterprise-specific
      MUST be unique within the IPFIX Information Model.  Enterprise-
      specific information model.
      Enterprise-specific Information Elements SHOULD be prefixed with a
      vendor name.

   o  Names of Information Elements start with non-capitalized letters.

   o  Composed names use capital letters for the first letter of each
      component (except for the first one).  All other letters are non-
      capitalized,
      non-capitalized, even for acronyms.  Exceptions are made for
      acronyms containing non-capitalized letter, such as 'IPv4' and
      'IPv6'.  Examples are sourceMacAddress and destinationIPv4Address.

   o  Middleboxes [RFC3234] may change Flow properties, such as the DSCP
      Differentiated Service Code Point (DSCP) value or the source IP
      address.  If an IPFIX Observation Point is located in the path of
      a Flow before one or more middleboxes that potentially modify
      packets of the Flow, then it may be desirable to also report Flow
      properties after the modification performed by the middleboxes.
      An example is an Observation Point before a packet marker changing
      a packet's IPv4 TOS Type of Service (TOS) field that is encoded in
      Information Element classOfServiceIPv4.  Then the value observed
      and reported by Information Element classOfServiceIPv4 is valid at
      the Observation Point, but not anymore after the packet passed the packet
      marker.  For reporting the change value of the TOS field, the
      IPFIX information model uses Information Elements that have a name
      prefix "post", for example, "postClassOfServiceIPv4".  Information
      Elements with prefix "post" report on Flow properties that are not
      necessarily observed at the Observation Point, but which are
      obtained within the Flow's Observation Domain by other means that are
      considered to be sufficiently reliable, for example, by analyzing
      the packet marker's marking tables.

3.  Type Space

   This section describes the abstract data types that can be used for
   the specification of IPFIX Information Elements in section Section 4.
   Section 3.1 describes the set of abstract data types.

   Abstract data types unsigned8, unsigned16, unsigned32, unsigned64,
   signed8, signed16, signed32, and signed64 are integral data types.
   As described in section Section 3.2, their data type semantics can be further
   specified, for example, by 'totalCounter', 'deltaCounter',
   'identifier'
   'deltaCounter','identifier', or 'flags'.

3.1.  Abstract Data Types

   This section describes the set of valid abstract data types of the
   IPFIX information model.  Note that further abstract data types may
   be specified by future extensions of the IPFIX information model.

3.1.1.  unsigned8

   The type "unsigned8" represents a non-negative integer value in the
   range of 0 to 255.

3.1.2.  unsigned16

   The type "unsigned16" represents a non-negative integer value in the
   range of 0 to 65535.

3.1.3.  unsigned32

   The type "unsigned32" represents a non-negative integer value in the
   range of 0 to 4294967295.

3.1.4.  unsigned64

   The type "unsigned64" represents a non-negative integer value in the
   range of 0 to 18446744073709551615.

3.1.5.  signed8

   The type "signed8" represents an integer value in the range of -128
   to 127.

3.1.6.  signed16

   The type "signed16" represents an integer value in the range of
   -32768 to 32767.

3.1.7.  signed32

   The type "signed32" represents an integer value in the range of
   -2147483648 to 2147483647.

3.1.8.  signed64

   The type "signed64" represents an integer value in the range of
   -9223372036854775808 to 9223372036854775807.

3.1.9.  float32

   The type "float32" corresponds to an IEEE single-precision 32-bit
   floating point type as defined in [IEEE.754.1985].

3.1.10.  float64

   The type "float64" corresponds to an IEEE double-precision 64-bit
   floating point type as defined in [IEEE.754.1985].

3.1.11.  boolean

   The type "boolean" represents a binary value.  The only allowed
   values are "true" and "false".

3.1.12.  macAddress

   The type "macAddress" represents a string of 6 octets.

3.1.13.  octetArray

   The type "octetArray" represents a finite length finite-length string of octets.

3.1.14.  string

   The type "string" represents a finite length finite-length string of valid
   characters from the Unicode character encoding set [ISO.10646-
   1.1993].  Unicode allows for ASCII [ISO.646.1991] and many other
   international character sets to be used.

3.1.15.  dateTimeSeconds

   The type "dateTimeSeconds" represents a time value in units of
   seconds normalized based on coordinated universal time (UTC).  The choice of an
   epoch, for example, 00:00 UTC, January 1, 1970, is left to
   corresponding encoding specifications for this type, for example, the GMT time zone.
   IPFIX protocol specification.  Leap seconds are excluded.  Note that
   transformation of values might be required between different
   encodings if different epoch values are used.

3.1.16.  dateTimeMilliseconds

   The type "dateTimeMilliseconds" represents a time value in units of
   milliseconds normalized based on coordinated universal time (UTC).  The choice
   of an epoch, for example, 00:00 UTC, January 1, 1970, is left to
   corresponding encoding specifications for this type, for example, the GMT time zone.
   IPFIX protocol specification.  Leap seconds are excluded.  Note that
   transformation of values might be required between different
   encodings if different epoch values are used.

3.1.17.  dateTimeMicroseconds

   The type "dateTimeMicroseconds" represents a time value in units of
   microseconds normalized based on coordinated universal time (UTC).  The choice
   of an epoch, for example, 00:00 UTC, January 1, 1970, is left to
   corresponding encoding specifications for this type, for example, the GMT time zone.
   IPFIX protocol specification.  Leap seconds are excluded.  Note that
   transformation of values might be required between different
   encodings if different epoch values are used.

3.1.18.  dateTimeNanoseconds

   The type "dateTimeNanoseconds" "dateTimeNamoseconds" represents a time value in units of
   nanoseconds normalized based on coordinated universal time (UTC).  The choice of
   an epoch, for example, 00:00 UTC, January 1, 1970, is left to
   corresponding encoding specifications for this type, for example, the GMT time zone.
   IPFIX protocol specification.  Leap seconds are excluded.  Note, that
   transformation of values might be required between different
   encodings if different epoch values are used.

3.1.19.  ipv4Address

   The type "ipv4Address" represents a value of an IPv4 address.

3.1.20.  ipv6Address

   The type "ipv6Address" represents a value of an IPv6 address.

3.2.  Data Type Semantics

   This section describes the set of valid data type semantics of the
   IPFIX information model.  Note that further data type semantics may
   be specified by future extensions of the IPFIX information model.

3.2.1.  quantity

   A quantity value represents a discrete measured value pertaining to
   the record.  This is distinguished from counters which that represent an
   ongoing measured value whose "odometer" reading is captured as part
   of a given record.  If no semantic qualifier is given, the
   Information Elements that have an integral data type should behave as
   a quantity.

3.2.2.  totalCounter

   An integral value reporting the value of a counter.  Counters are
   unsigned and wrap back to zero after reaching the limit of the type.
   For example, an unsigned64 with counter semantics will continue to
   increment until reaching the value of 2**64 - 1.  At this point point, the
   next increment will wrap its value to zero and continue counting from
   zero.  The semantics of a total counter is similar to the semantics
   of counters used in SNMP, Simple Network Management Protocol (SNMP), such
   as Counter32 defined in RFC 2578 [RFC2578].  The only difference
   between total counters and counters used in SNMP is that the total
   counters have an initial value of 0.  A total counter counts
   independently of the export of its value.

3.2.3.  deltaCounter

   An integral value reporting the value of a counter.  Counters are
   unsigned and wrap back to zero after reaching the limit of the type.
   For example, an unsigned64 with counter semantics will continue to
   increment until reaching the value of 2**64 - 1.  At this point point, the
   next increment will wrap its value to zero and continue counting from
   zero.  The semantics of a delta counter is similar to the semantics
   of counters used in SNMP, such as Counter32 defined in RFC 2578
   [RFC2578].  The only difference between delta counters and counters
   used in SNMP is that the delta counters have an initial value of 0.
   A delta counter is reset to 0 each time its value is exported.

3.2.4.  identifier

   An integral value which that serves as an identifier.  Specifically  Specifically,
   mathematical operations on two identifiers (aside from the equality
   operation) are meaningless.  For example, Autonomous System ID 1 *
   Autonomous System ID 2 is meaningless.

3.2.5.  flags

   An integral value which that actually represents a set of bit fields.
   Logical operations are appropriate on such values, but not other
   mathematical operations.  Flags should always be of an unsigned type.

4.  Information Element Identifiers

   All Information Elements defined in section Section 5 of this document or in
   future extensions of the IPFIX information model have their
   identifiers assigned by IANA.  Their identifiers can be retrieved at
   http://www.iana.org/assignments/ipfix-element-numbers.

   EDITORIAL NOTE: this URL needs probably to be updated after IANA
   created a URL for IPFIX Information Elements
   http://www.iana.org/assignments/ipfix.

   The value of these identifiers are is in the range of 1 - 32767. 1-32767.  Within
   this range, Information Element identifier values in the sub-range of
   1-127 are compatible with field types used by NetFlow version 9
   [RFC3954].

   +---------------------------------+---------------------------------+
   | Range of IANA-assigned          | Description                     |
   | Information Element identifiers |                                 |
   +---------------------------------+---------------------------------+
   | 0                               | Reserved.                       |
   | 1 - 127 1-127                           | Information Element identifiers |
   |                                 | compatible with NetFlow version |
   |                                 | 9 field types [RFC3954].        |
   | 128 - 32767 128-32767                       | Further Information Element     |
   |                                 | identifiers.                    |
   +---------------------------------+---------------------------------+

   Enterprise-specific Information Element identifiers have the same
   range of 1-32767, but they are coupled with an additional enterprise
   identifier.

   Enterprise-specific Information Element identifiers can be chosen by
   an enterprise arbitrarily within the range of 1-32767.  The same
   identifier may be assigned by other enterprises for different
   purposes.

   Still, Collecting Processes can distinguish these Information
   Elements because the Information Element identifier is coupled with
   an enterprise identifier.

   Enterprise identifiers MUST be registered as SMI network management
   private enterprise code numbers with IANA.  The registry can be found
   at http://www.iana.org/assignments/enterprise-numbers.

   The following list gives an overview of the Information Element
   identifiers that are specified in section Section 5 and are compatible with
   field types used by NetFlow version 9 [RFC3954].

   +----+----------------------------+-------+-------------------------+
   | ID | Name                       |    ID | Name                    |
   +----+----------------------------+-------+-------------------------+
   |  1 | octetDeltaCount            |    43 | RESERVED                |
   |  2 | packetDeltaCount           |    44 | sourceIPv4Prefix        |
   |  3 | RESERVED                   |    45 | destinationIPv4Prefix   |
   |  4 | protocolIdentifier         |    46 | mplsTopLabelType        |
   |  5 | ipClassOfService           |    47 | mplsTopLabelIPv4Address |
   |  6 | tcpControlBits             | 48-51 | RESERVED                |
   |  7 | sourceTransportPort        |    52 | minimumTTL              |
   |  8 | sourceIPv4Address          |    53 | maximumTTL              |
   |  9 | sourceIPv4PrefixLength     |    54 | fragmentIdentification  |
   | 10 | ingressInterface           |    55 | postIpClassOfService    |
   | 11 | destinationTransportPort   |    56 | sourceMacAddress        |
   | 12 | destinationIPv4Address     |    57 |postDestinationMacAddress|
   | 13 | destinationIPv4PrefixLength|    58 | vlanId                  |
   | 14 | egressInterface            |    59 | postVlanId              |
   | 15 | ipNextHopIPv4Address       |    60 | ipVersion               |
   | 16 | bgpSourceAsNumber          |    61 | flowDirection           |
   | 17 | bgpDestinationAsNumber     |    62 | ipNextHopIPv6Address    |
   | 18 | bgpNexthopIPv4Address      |    63 | bgpNexthopIPv6Address   |
   | 19 | postMCastPacketDeltaCount  |    64 | ipv6ExtensionHeaders    |
   | 20 | postMCastOctetDeltaCount   | 65-69 | RESERVED                |
   | 21 | flowEndSysUpTime           |    70 | mplsTopLabelStackSection|
   | 22 | flowStartSysUpTime         |    71 | mplsLabelStackSection2  |
   | 23 | postOctetDeltaCount        |    72 | mplsLabelStackSection3  |
   | 24 | postPacketDeltaCount       |    73 | mplsLabelStackSection4  |
   | 25 | minimumIpTotalLength       |    74 | mplsLabelStackSection5  |
   | 26 | maximumIpTotalLength       |    75 | mplsLabelStackSection6  |
   | 27 | sourceIPv6Address          |    76 | mplsLabelStackSection7  |
   | 28 | destinationIPv6Address     |    77 | mplsLabelStackSection8  |
   | 29 | sourceIPv6PrefixLength     |    78 | mplsLabelStackSection9  |
   | 30 | destinationIPv6PrefixLength|    79 | mplsLabelStackSection10 |
   | 31 | flowLabelIPv6              |    80 | destinationMacAddress   |
   | 32 | icmpTypeCodeIPv4           |    81 | postSourceMacAddress    |
   | 33 | igmpType                   | 82-84 | RESERVED                |
   | 34 | RESERVED                   |    85 | octetTotalCount         |
   | 35 | RESERVED                   |    86 | packetTotalCount        |
   | 36 | flowActiveTimeout          |    87 | RESERVED                |
   | 37 | flowIdleTimeout            |    88 | fragmentOffset          |
   | 38 | RESERVED                   |    89 | RESERVED                |
   | 39 | RESERVED                   |    90 |mplsVpnRouteDistinguisher|
   | 40 | exportedOctetTotalCount    |91-127 | RESERVED                |
   | 41 | exportedMessageTotalCount  |       |                         |
   | 42 |exportedFlowRecordTotalCount|       |                         |
   +----+----------------------------+-------+-------------------------+
   The following list gives an overview of the Information Element
   identifiers that are specified in section Section 5 and extend extends the list of
   Information Element identifiers specified already in [RFC3954].

   +-----+---------------------------+-----+---------------------------+
   |  ID | Name                      |  ID | Name                      |
   +-----+---------------------------+-----+---------------------------+
   | 128 | bgpNextAdjacentAsNumber   | 169 | destinationIPv6Prefix     |
   | 129 | bgpPrevAdjacentAsNumber   | 170 | sourceIPv6Prefix          |
   | 130 | exporterIPv4Address       | 171 | postOctetTotalCount       |
   | 131 | exporterIPv6Address       | 172 | postPacketTotalCount      |
   | 132 | droppedOctetDeltaCount    | 173 | flowKeyIndicator          |
   | 133 | droppedPacketDeltaCount   | 174 | postMCastPacketTotalCount |
   | 134 | droppedOctetTotalCount    | 175 | postMCastOctetTotalCount  |
   | 135 | droppedPacketTotalCount   | 176 | icmpTypeIPv4              |
   | 136 | flowEndReason             | 177 | icmpCodeIPv4              |
   | 137 | commonPropertiesId        | 178 | icmpTypeIPv6              |
   | 138 | observationPointId        | 179 | icmpCodeIPv6              |
   | 139 | icmpTypeCodeIPv6          | 180 | udpSourcePort             |
   | 140 | mplsTopLabelIPv6Address   | 181 | udpDestinationPort        |
   | 141 | lineCardId                | 182 | tcpSourcePort             |
   | 142 | portId                    | 183 | tcpDestinationPort        |
   | 143 | meteringProcessId         | 184 | tcpSequenceNumber         |
   | 144 | exportingProcessId        | 185 | tcpAcknowledgementNumber  |
   | 145 | templateId                | 186 | tcpWindowSize             |
   | 146 | wlanChannelId             | 187 | tcpUrgentPointer          |
   | 147 | wlanSSID                  | 188 | tcpHeaderLength           |
   | 148 | flowId                    | 189 | ipHeaderLength            |
   | 149 | observationDomainId       | 190 | totalLengthIPv4           |
   | 150 | flowStartSeconds          | 191 | payloadLengthIPv6         |
   | 151 | flowEndSeconds            | 192 | ipTTL                     |
   | 152 | flowStartMilliseconds     | 193 | nextHeaderIPv6            |
   | 153 | flowEndMilliseconds       | 194 | mplsPayloadLength         |
   | 154 | flowStartMicroseconds     | 195 | ipDiffServCodePoint       |
   | 155 | flowEndMicroseconds       | 196 | ipPrecedence              |
   | 156 | flowStartNanoseconds      | 197 | fragmentFlags             |
   | 157 | flowEndNanoseconds        | 198 | octetDeltaSumOfSquares    |
   | 158 | flowStartDeltaMicroseconds| 199 | octetTotalSumOfSquares    |
   | 159 | flowEndDeltaMicroseconds  | 200 | mplsTopLabelTTL           |
   | 160 | systemInitTimeMilliseconds| 201 | mplsLabelStackLength      |
   | 161 | flowDurationMilliseconds  | 202 | mplsLabelStackDepth       |
   | 162 | flowDurationMicroseconds  | 203 | mplsTopLabelExp           |
   | 163 | observedFlowTotalCount    | 204 | ipPayloadLength           |
   | 164 | ignoredPacketTotalCount   | 205 | udpMessageLength          |
   | 165 | ignoredOctetTotalCount    | 206 | isMulticast               |
   | 166 | notSentFlowTotalCount     | 207 | ipv4IHL                   |
   | 167 | notSentPacketTotalCount   | 208 | ipv4Options               |
   | 168 | notSentOctetTotalCount    | 209 | tcpOptions                |
   +-----+---------------------------+-----+---------------------------+
   +-----+---------------------------+-----+---------------------------+
   |  ID | Name                      |  ID | Name                      |
   +-----+---------------------------+-----+---------------------------+
   | 210 | paddingOctets             | 218 | tcpSynTotalCount          |
   | 211 | collectorIPv4Address      | 219 | tcpFinTotalCount          |
   | 212 | collectorIPv6Address      | 220 | tcpRstTotalCount          |
   | 213 | collectorInterface        | 221 | tcpPshTotalCount          |
   | 214 | collectorProtocolVersion  | 222 | tcpAckTotalCount          |
   | 215 | collectorTransportProtocol| 223 | tcpUrgTotalCount          |
   | 216 | collectorTransportPort    | 224 | ipTotalLength             |
   | 217 | exporterTransportPort     | 237 | postMplsTopLabelExp       |
   |     |                           | 238 | tcpWindowScale            |
   +-----+---------------------------+-----+---------------------------+

5.  Information Elements

   This section describes the Information Elements of the IPFIX
   information model.  The elements are grouped into 12 groups according
   to their semantics and their applicability:

   1.   Identifiers
   2.   Metering and Exporting Process Configuration
   3.   Metering and Exporting Process Statistics
   4.   IP Header Fields
   5.   Transport Header Fields
   6.   Sub-IP Header Fields
   7.   Derived Packet Properties
   8.   Min/Max Flow Properties
   9.   Flow Time Stamps Timestamps
   10.  Per-Flow Counters
   11.  Miscellaneous Flow Properties
   12.  Padding

   The Information Elements that are derived from fields of packets or
   from packet treatment, such as the Information Elements in groups
   4.-7.,
   4-7, can serve as Flow Keys used for mapping packets to Flows.

   If they do not serve as Flow Keys, their value may change from packet
   to packet within a single Flow.  For Information Elements with values
   that are derived from fields of packets or from packet treatment and
   for which the value may change from packet to packet within a single
   Flow, the IPFIX information model defines that their value is
   determined by the first packet observed for the corresponding Flow,
   unless the description of the Information Element explicitly
   specifies a different semantics.  This simple rule allows writing all
   Information Elements related to header fields once when the first
   packet of the Flow is observed.  For further observed packets of the
   same Flow, only Flow properties that depend on more than one packet,
   such as the Information Elements in groups 8.-11., 8-11, need to be updated.

   Information Elements with a name having the "post" prefix, for
   example, "postClassOfServiceIPv4", do not report properties that were
   actually observed at the Observation Point, but retrieved by other
   means within the Observation Domain.  These information Information Elements can
   be used if there are middlebox functions within the Observation
   Domain changing Flow properties after packets passed the Observation
   Point.

   Information Elemens Elements in this section use the reference property to
   reference [RFC0768], [RFC0791], [RFC0792], [RFC0793], [RFC1108],
   [RFC1112], [RFC1191], [RFC1323], [RFC1385], [RFC1812], [RFC1930],
   [RFC2113], [RFC2119], [RFC4302], [RFC2460], [RFC2675], [RFC2863],
   [RFC2960],
   [RFC3031], [RFC3032], [RFC3036], [RFC3193], [RFC3234], [RFC3260], [RFC3270],
   [RFC3376], [RFC3954], [RFC4271], [RFC4291],
   [RFC4302], [RFC4303], [RFC4364],
   [RFC4382], [RFC4443], [IEEE.802-
   11.1999], [RFC4443],[RFC4960], [RFC5036], [IEEE.802-11.1999],
   [IEEE.802-1Q.2003], and [IEEE.802-3.2002].

5.1.  Identifiers

   Information Elements grouped in the table below are identifying
   components of the IPFIX architecture, of an IPFIX Device, or of the
   IPFIX protocol.  All of them have an integral abstract data type and
   data type semantics "identifier" as described in section Section 3.2.4.

   Typically, some of them are used for limiting scopes of other
   Information Elements.  However, also other Information Elements MAY be
   used for limiting scopes.  Note also that all Information Elements
   listed below MAY be used for other purposes than limiting scopes.

   +-----+---------------------------+-----+---------------------------+
   |  ID | Name                      |  ID | Name                      |
   +-----+---------------------------+-----+---------------------------+
   | 141 | lineCardId                | 148 | flowId                    |
   | 142 | portId                    | 145 | templateId                |
   |  10 | ingressInterface          | 149 | observationDomainId       |
   |  14 | egressInterface           | 138 | observationPointId        |
   | 143 | meteringProcessId         | 137 | commonPropertiesId        |
   | 144 | exportingProcessId        |     |                           |
   +-----+---------------------------+-----+---------------------------+

5.1.1.  lineCardId

   Description:
      An identifier of a line card that is unique per IPFIX Device
      hosting an Observation Point.  Typically, this Information Element
      is used for limiting the scope of other Information Elements.
   Abstract Data Type: unsigned32
   Data Type Semantics: identifier
   ElementId: 141
   Status: current

5.1.2.  portId

   Description:
      An identifier of a line port that is unique per IPFIX Device
      hosting an Observation Point.  Typically, this Information Element
      is used for limiting the scope of other Information Elements.
   Abstract Data Type: unsigned32
   Data Type Semantics: identifier
   ElementId: 142
   Status: current

5.1.3.  ingressInterface

   Description:
      The index of the IP interface where packets of this Flow are being
      received.  The value matches the value of managed object 'ifIndex'
      as defined in RFC 2863.  Note that ifIndex values are not assigned
      statically to an interface, interface and that the interfaces may be
      renumbered every time the device's management system is re-
      initialized,
      re-initialized, as specified in RFC 2863.
   Abstract Data Type: unsigned32
   Data Type Semantics: identifier
   ElementId: 10
   Status: current
   Reference:
      See RFC 2863 for the definition of the ifIndex object.

5.1.4.  egressInterface

   Description:
      The index of the IP interface where packets of this Flow are being
      sent.  The value matches the value of managed object 'ifIndex' as
      defined in RFC 2863.  Note that ifIndex values are not assigned
      statically to an interface, interface and that the interfaces may be
      renumbered every time the device's management system is re-
      initialized,
      re-initialized, as specified in RFC 2863.
   Abstract Data Type: unsigned32
   Data Type Semantics: identifier
   ElementId: 14
   Status: current
   Reference:
      See RFC 2863 for the definition of the ifIndex object.

5.1.5.  meteringProcessId

   Description:
      An identifier of a Metering Process that is unique per IPFIX
      Device.  Typically, this Information Element is used for limiting
      the scope of other Information Elements.  Note that process
      identifiers are typically assigned dynamically.  The Metering
      Process may be re-started with a different ID.
   Abstract Data Type: unsigned32
   Data Type Semantics: identifier
   ElementId: 143
   Status: current

5.1.6.  exportingProcessId

   Description:
      An identifier of an Exporting Process that is unique per IPFIX
      Device.  Typically, this Information Element is used for limiting
      the scope of other Information Elements.  Note that process
      identifiers are typically assigned dynamically.  The Exporting
      Process may be re-started with a different ID.
   Abstract Data Type: unsigned32
   Data Type Semantics: identifier
   ElementId: 144
   Status: current

5.1.7.  flowId

   Description:
      An identifier of a Flow that is unique within an Observation
      Domain.  This Information Element can be used to distinguish
      between different Flows if Flow Keys such as IP addresses and port
      numbers are not reported or are reported in separate records.
   Abstract Data Type: unsigned64
   Data Type Semantics: identifier
   ElementId: 148
   Status: current

5.1.8.  templateId

   Description:
      An identifier of a Template that is locally unique within a
      combination of a Transport session and an Observation Domain.
      Template IDs 0-255 are reserved for Template Sets, Options
      Template Sets, and other reserved Sets yet to be created.
      Template IDs of Data Sets are numbered from 256 to 65535.
      Typically, this Information Element is used for limiting the scope
      of other Information Elements.  Note that after a re-start of the
      Exporting Process Template identifiers may be re-assigned.
   Abstract Data Type: unsigned16
   Data Type Semantics: identifier
   ElementId: 145
   Status: current

5.1.9.  observationDomainId

   Description:
      An identifier of an Observation Domain that is locally unique to
      an Exporting Process.  The Exporting Process uses the Observation
      Domain ID to uniquely identify to the Collecting Process the
      Observation Domain where Flows were metered.  It is RECOMMENDED
      that this identifier is also unique per IPFIX Device.  A value of
      0 indicates that no specific Observation Domain is identified by
      this Information Element.  Typically, this Information Element is
      used for limiting the scope of other Information Elements.
   Abstract Data Type: unsigned32
   Data Type Semantics: identifier
   ElementId: 149
   Status: current

5.1.10.  observationPointId

   Description:
      An identifier of an Observation Point that is unique per
      Observation Domain.  It is RECOMMENDED that this identifier is
      also unique per IPFIX Device.  Typically, this Information Element
      is used for limiting the scope of other Information Elements.
   Abstract Data Type: unsigned32
   Data Type Semantics: identifier
   ElementId: 138
   Status: current

5.1.11.  commonPropertiesId

   Description:
      An identifier of a set of common properties that is unique per
      Observation Domain and Transport Session.  Typically, this
      Information Element is used to link to information reported in
      separate Data Records.
   Abstract Data Type: unsigned64
   Data Type Semantics: identifier
   ElementId: 137
   Status: current

5.2.  Metering and Exporting Process Configuration

   Information Elements in this section describe the configuration of
   the Metering Process or the Exporting Process.  The set of these
   Information Elements is listed in the table below below.

   +-----+--------------------------+-----+----------------------------+
   |  ID | Name                     |  ID | Name                       |
   +-----+--------------------------+-----+----------------------------+
   | 130 | exporterIPv4Address      | 213 | collectorInterface         |
   | 131 | exporterIPv6Address      | 214 | collectorProtocolVersion   |
   | 217 | exporterTransportPort    | 215 | collectorTransportProtocol |
   | 211 | collectorIPv4Address     | 216 | collectorTransportPort     |
   | 212 | collectorIPv6Address     | 173 | flowKeyIndicator           |
   +-----+--------------------------+-----+----------------------------+

5.2.1.  exporterIPv4Address

Description:
      The IPv4 address used by the Exporting Process.  This is used by
      the Collector to identify the Exporter in cases where the identity
      of the Exporter may have been obscured by the use of a proxy.
   Abstract Data Type: ipv4Address
   Data Type Semantics: identifier
   ElementId: 130
   Status: current

5.2.2.  exporterIPv6Address

   Description:
      The IPv6 address used by the Exporting Process.  This is used by
      the Collector to identify the Exporter in cases where the identity
      of the Exporter may have been obscured by the use of a proxy.
   Abstract Data Type: ipv6Address
   Data Type Semantics: identifier
   ElementId: 131 br Status: current

5.2.3.  exporterTransportPort

   Description:
      The source port identifier from which the Exporting Process sends
      Flow information.  For the transport protocols UDP, TCP TCP, and SCTP
      Stream Control Transmission Protocol (SCTP) this is the source
      port number.  This field MAY also be used for future transport
      protocols that have 16 bit 16-bit source port identifiers.  This field
      may be useful for distinguishing multiple Exporting Processes that
      use the same IP address.
   Abstract Data Type: unsigned16
   Data Type Semantics: identifier
   ElementId: 217
   Status: current
   Reference:
      See RFC 768 for the definition of the UDP source port field.  See
      RFC 793 for the definition of the TCP source port field.  See RFC
      2960
      4960 for the definition of SCTP.  Additional information on
      defined UDP and TCP port numbers can be found at
      http://www.iana.org/assignments/port-numbers.

5.2.4.  collectorIPv4Address

   Description:
      An IPv4 address to which the Exporting Process sends Flow
      information.
   Abstract Data Type: ipv4Address
   Data Type Semantics: identifier
   ElementId: 211
   Status: current

5.2.5.  collectorIPv6Address

   Description:
      An IPv6 address to which the Exporting Process sends Flow
      information.
   Abstract Data Type: ipv6Address
   Data Type Semantics: identifier
   ElementId: 212
   Status: current

5.2.6.  collectorInterface

   Description:
      The index of the interface from which IPFIX Messages sent by the
      Exporting Process to a Collector leave the IPFIX Device.  The
      value matches the value of managed object 'ifIndex' as defined in
      RFC 2863.  Note that ifIndex values are not assigned statically to
      an interface, interface and that the interfaces may be renumbered every time
      the device's management system is re-initialized, as specified in
      RFC 2863.
   Abstract Data Type: unsigned32
   Data Type Semantics: identifier
   ElementId: 213
   Status: current
   Reference:
      See RFC 2863 for the definition of the ifIndex object.

5.2.7.  collectorProtocolVersion

   Description:
      The protocol version used by the Exporting Process for sending
      Flow information.  The protocol version is given by the value of
      the Version Number field in the Message Header.  The protocol
      version is 10 for IPFIX and 9 for NetFlow version 9.  A value of 0
      indicates that no export protocol is in use.
   Abstract Data Type: unsigned8
   Data Type Semantics: identifier
   ElementId: 214
   Status: current
   Reference:
      See the IPFIX protocol specification [RFC5101] for the definition
      of the IPFIX Message header.
      EDITOR'S NOTE: This should be replaced by a reference to the IPFIX
      protocol specification as soon as an RFC number has been assigned
      to it. Header.
      See RFC 3954 or for the definition of the NetFlow version 9 message
      header.

5.2.8.  collectorTransportProtocol

   Description:
      The value of the protocol number used by the Exporting Process for
      sending Flow information.  The protocol number identifies the IP
      packet payload type.  Protocol numbers are defined in the IANA
      Protocol Numbers registry.
      In Internet Protocol version 4 (IPv4) (IPv4), this is carried in the
      "Protocol"
      Protocol field.  In Internet Protocol version 6 (IPv6) (IPv6), this is
      carried in the "Next Header" Next Header field in the last extension header of
      the packet.
   Abstract Data Type: unsigned8
   Data Type Semantics: identifier
   ElementId: 215
   Status: current
   Reference:
      See RFC 791 for the specification of the IPv4 protocol field.  See
      RFC 2460 for the specification of the IPv6 protocol field.  See
      the list of protocol numbers assigned by IANA at
      http://www.iana.org/assignments/protocol-numbers.

5.2.9.  collectorTransportPort

   Description:
      The destination port identifier to which the Exporting Process
      sends Flow information.  For the transport protocols UDP, TCP TCP, and
      SCTP
      SCTP, this is the destination port number.  This field MAY also be
      used for future transport protocols that have 16 bit 16-bit source port
      identifiers.
   Abstract Data Type: unsigned16
   Data Type Semantics: identifier
   ElementId: 216
   Status: current Reference:
      See RFC 768 for the definition of the UDP destination port field.
      See RFC 793 for the definition of the TCP destination port field.
      See RFC 2960 4960 for the definition of SCTP.
      Additional information on defined UDP and TCP port numbers can be
      found at http://www.iana.org/assignments/port-numbers.

5.2.10.  flowKeyIndicator

   Description:
      This set of bit fields is used for marking the Information
      Elements of a Data Record that serve as Flow Key.  Each bit
      represents an Information Element in the Data Record with the n-th
      bit representing the n-th Information Element.  A bit set to value
      1 indicates that the corresponding Information Element is a Flow
      Key of the reported Flow.  A bit set to value 0 indicates that
      this is not the case.
      If the Data Record contains more than 64 Information Elements, the
      corresponding Template SHOULD be designed such that all Flow Keys
      are among the first 64 Information Elements, because the
      flowKeyIndicator only contains 64 bits.  If the Data Record
      contains less than 64 Information Elements, then the bits in the
      flowKeyIndicator for which no corresponding Information Element
      exists MUST have the value 0.
   Abstract Data Type: unsigned64
   Data Type Semantics: flags
   ElementId: 173
   Status: current

5.3.  Metering and Exporting Process Statistics

   Information Elements in this section describe statistics of the
   Metering Process and/or the Exporting Process.  The set of these
   Information Elements is listed in the table below below.

   +-----+-----------------------------+-----+-------------------------+
   |  ID | Name                        |  ID | Name                    |
   +-----+-----------------------------+-----+-------------------------+
   |  41 | exportedMessageTotalCount   | 165 | ignoredOctetTotalCount  |
   |  40 | exportedOctetTotalCount     | 166 | notSentFlowTotalCount   |
   |  42 | exportedFlowRecordTotalCount| 167 | notSentPacketTotalCount |
   | 163 | observedFlowTotalCount      | 168 | notSentOctetTotalCount  |
   | 164 | ignoredPacketTotalCount     |     |                         |
   +-----+-----------------------------+-----+-------------------------+

5.3.1.  exportedMessageTotalCount

   Description:
      The total number of IPFIX Messages that the Exporting Process sent
      since the Exporting Process (re-)initialization to the Collecting
      Process receiving a report that contains this Information Element.
      The reported number excludes the IPFIX Message that carries the
      counter value.
   Abstract Data Type: unsigned64
   Data Type Semantics: totalCounter
   ElementId: 41
   Status: current
   Units: messages

5.3.2.  exportedOctetTotalCount

   Description:
      The total number of octets that the Exporting Process successfully
      sent since the Exporting Process (re-)initialization to the
      Collecting Process receiving a report that contains this
      Information Element.  The value of this Information Element is
      calculated by summing up the IPFIX Message Header length values of
      all IPFIX Messages that were successfully sent to the Collecting
      Process receiving a report that contains this Information Element.
      The reported number excludes octets in the IPFIX Message that
      carries the counter value.
   Abstract Data Type: unsigned64
   Data Type Semantics: totalCounter
   ElementId: 40
   Status: current
   Units: octets

5.3.3.  exportedFlowRecordTotalCount

   Description:
      The total number of Flow Records that the Exporting Process
      successfully sent as Data Records since the Exporting Process
      (re-)initialization to the Collecting Process receiving a report
      that contains this Information Element.  The reported number
      excludes Flow Records in the IPFIX message Message that carries the
      counter value.
   Abstract Data Type: unsigned64
   Data Type Semantics: totalCounter
   ElementId: 42
   Status: current
   Units: flows

5.3.4.  observedFlowTotalCount

   Description:
      The total number of Flows observed in the Observation Domain since
      the Metering Process (re-)initialization for this Observation
      Point.
   Abstract Data Type: unsigned64
   Data Type Semantics: totalCounter
   ElementId: 163
   Status: current
   Units: flows

5.3.5.  ignoredPacketTotalCount

   Description:
      The total number of observed IP packets that the Metering Process
      did not process since the (re-)initialization of the Metering
      Process.
   Abstract Data Type: unsigned64
   Data Type Semantics: totalCounter
   ElementId: 164
   Status: current
   Units: packets

5.3.6.  ignoredOctetTotalCount

   Description:
      The total number of octets in observed IP packets (including the
      IP header) that the Metering Process did not process since the
      (re-)initialization of the Metering Process.
   Abstract Data Type: unsigned64
   Data Type Semantics: totalCounter
   ElementId: 165
   Status: current
   Units: octets

5.3.7.  notSentFlowTotalCount

   Description:
      The total number of Flow Records that were generated by the
      Metering Process and but dropped by the Metering Process or by the
      Exporting Process instead of sending it being sent to the Collecting Process.
      There are several potential reasons for this including resource
      shortage and special Flow export policies.
   Abstract Data Type: unsigned64
   Data Type Semantics: totalCounter
   ElementId: 166
   Status: current
   Units: flows

5.3.8.  notSentPacketTotalCount

   Description:
      The total number of packets in Flow Records that were generated by
      the Metering Process and but dropped by the Metering Process or by the
      Exporting Process instead of sending it being sent to the Collecting Process.
      There are several potential reasons for this including resource
      shortage and special Flow export policies.
   Abstract Data Type: unsigned64
   Data Type Semantics: totalCounter
   ElementId: 167
   Status: current
   Units: packets

5.3.9.  notSentOctetTotalCount

   Description:
      The total number of octets in packets in Flow Records that were
      generated by the Metering Process and but dropped by the Metering
      Process or by the Exporting Process instead of sending it being sent to the
      Collecting Process.  There are several potential reasons for this
      including resource shortage and special Flow export policies.
   Abstract Data Type: unsigned64
   Data Type Semantics: totalCounter
   ElementId: 168
   Status: current
   Units: octets

5.4.  IP Header Fields

   Information Elements in this section indicate values of IP header
   fields or are derived from IP header field values in combination with
   further information.

   +-----+----------------------------+-----+--------------------------+
   |  ID | Name                       |  ID | Name                     |
   +-----+----------------------------+-----+--------------------------+
   |  60 | ipVersion                  | 193 | nextHeaderIPv6           |
   |   8 | sourceIPv4Address          | 195 | ipDiffServCodePoint      |
   |  27 | sourceIPv6Address          | 196 | ipPrecedence             |
   |   9 | sourceIPv4PrefixLength     |   5 | ipClassOfService         |
   |  29 | sourceIPv6PrefixLength     |  55 | postIpClassOfService     |
   |  44 | sourceIPv4Prefix           |  31 | flowLabelIPv6            |
   | 170 | sourceIPv6Prefix           | 206 | isMulticast              |
   |  12 | destinationIPv4Address     |  54 | fragmentIdentification   |
   |  28 | destinationIPv6Address     |  88 | fragmentOffset           |
   |  13 | destinationIPv4PrefixLength| 197 | fragmentFlags            |
   |  30 | destinationIPv6PrefixLength| 189 | ipHeaderLength           |
   |  45 | destinationIPv4Prefix      | 207 | ipv4IHL                  |
   | 169 | destinationIPv6Prefix      | 190 | totalLengthIPv4          |
   | 192 | ipTTL                      | 224 | ipTotalLength            |
   |   4 | protocolIdentifier         | 191 | payloadLengthIPv6        |
   +-----+----------------------------+-----+--------------------------+

5.4.1.  ipVersion

   Description:
      The IP version field in the IP packet header.
   Abstract Data Type: unsigned8
   Data Type Semantics: identifier
   ElementId: 60
   Status: current
   Reference:
      See RFC 791 for the definition of the version field in the IPv4
      packet header.  See RFC 2460 for the definition of the version
      field in the IPv6 packet header.  Additional information on
      defined version numbers can be found at
      http://www.iana.org/assignments/version-numbers.

5.4.2.  sourceIPv4Address

   Description:
      The IPv4 source address in the IP packet header.
   Abstract Data Type: ipv4Address
   Data Type Semantics: identifier
   ElementId: 8
   Status: current
   Reference:
      See RFC 791 for the definition of the IPv4 source address field.

5.4.3.  sourceIPv6Address

   Description:
      The IPv6 source address in the IP packet header.
   Abstract Data Type: ipv6Address
   Data Type Semantics: identifier
   ElementId: 27
   Status: current
   Reference:
      See RFC 2460 for the definition of the Source Address field in the
      IPv6 header.

5.4.4.  sourceIPv4PrefixLength

   Description:
      The number of contiguous bits that are relevant in the
      sourceIPv4Prefix Information Element.
   Abstract Data Type: unsigned8
   ElementId: 9
   Status: current
   Units: bits
   Range: The valid range is 0-32.

5.4.5.  sourceIPv6PrefixLength

   Description:
      The number of contiguous bits that are relevant in the
      sourceIPv6Prefix Information Element.
   Abstract Data Type: unsigned8
   ElementId: 29
   Status: current
   Units: bits
   Range: The valid range is 0-128.

5.4.6.  sourceIPv4Prefix

   Description:
      IPv4 source address prefix.
   Abstract Data Type: ipv4Address
   ElementId: 44
   Status: current

5.4.7.  sourceIPv6Prefix

   Description:
      IPv6 source address prefix.
   Abstract Data Type: ipv6Address
   ElementId: 170
   Status: current

5.4.8.  destinationIPv4Address

   Description:  The IPv4 destination address in the IP packet header.
   Abstract Data Type: ipv4Address
   Data Type Semantics: identifier
   ElementId: 12
   Status: current
   Reference:
      See RFC 791 for the definition of the IPv4 destination address
      field.

5.4.9.  destinationIPv6Address

   Description:
      The IPv6 destination address in the IP packet header.
   Abstract Data Type: ipv6Address
   Data Type Semantics: identifier
   ElementId: 28
   Status: current
   Reference:
      See RFC 2460 for the definition of the Destination Address field
      in the IPv6 header.

5.4.10.  destinationIPv4PrefixLength

   Description:
      The number of contiguous bits that are relevant in the
      destinationIPv4Prefix Information Element.
   Abstract Data Type: unsigned8
   ElementId: 13
   Status: current
   Units: bits
   Range: The valid range is 0-32.

5.4.11.  destinationIPv6PrefixLength

   Description:
      The number of contiguous bits that are relevant in the
      destinationIPv6Prefix Information Element.
   Abstract Data Type: unsigned8
   ElementId: 30
   Status: current
   Units: bits
   Range: The valid range is 0-128.

5.4.12.  destinationIPv4Prefix

   Description:
      IPv4 destination address prefix.
   Abstract Data Type: ipv4Address
   ElementId: 45
   Status: current

5.4.13.  destinationIPv6Prefix

   Description:
      IPv6 destination address prefix.
   Abstract Data Type: ipv6Address
   ElementId: 169
   Status: current

5.4.14.  ipTTL

   Description:
      For IPv4, the value of the Information Element matches the value
      of the Time to Live (TTL) field in the IPv4 packet header.  For
      IPv6, the value of the Information Element matches the value of
      the Hop Limit field in the IPv6 packet header.
   Abstract Data Type: unsigned8
   ElementId: 192
   Status: current
   Units: hops
   Reference:
      See RFC 791 for the definition of the IPv4 Time to Live field.
      See RFC 2460 for the definition of the IPv6 Hop Limit field.

5.4.15.  protocolIdentifier

   Description:
      The value of the protocol number in the IP packet header.  The
      protocol number identifies the IP packet payload type.  Protocol
      numbers are defined in the IANA Protocol Numbers registry.  In
      Internet Protocol version 4 (IPv4) (IPv4), this is carried in the
      "Protocol"
      Protocol field.  In Internet Protocol version 6 (IPv6) (IPv6), this is
      carried in the "Next Header" Next Header field in the last extension header of
      the packet.
   Abstract Data Type: unsigned8
   Data Type Semantics: identifier
   ElementId: 4
   Status: current
   Reference:
      See RFC 791 for the specification of the IPv4 protocol field.  See
      RFC 2460 for the specification of the IPv6 protocol field.  See
      the list of protocol numbers assigned by IANA at
      http://www.iana.org/assignments/protocol-numbers.

5.4.16.  nextHeaderIPv6

   Description:
      The value of the Next Header field of the IPv6 header.  The value
      identifies the type of the following IPv6 extension header or of
      the following IP payload.  Valid values are defined in the IANA
      Protocol Numbers registry.
   Abstract Data Type: unsigned8
   ElementId: 193
   Status: current
   Reference:
      See RFC 2460 for the definition of the IPv6 Next Header field.
      See the list of protocol numbers assigned by IANA at
      http://www.iana.org/assignments/protocol-numbers.

5.4.17.  ipDiffServCodePoint

   Description:
      The value of a Differentiated Services Code Point (DSCP) encoded
      in the Differentiated Services Field. field.  The Differentiated Services
      Field
      field spans the most significant 6 bits of the IPv4 TOS field or
      the IPv6 Traffic class Class field, respectively.
      This Information Element encodes only the 6 bits of the
      Differentiated Services field.  Therefore  Therefore, its value may range
      from 0 to 63.
   Abstract Data Type: unsigned8
   Data Type Semantics: identifier
   ElementId: 195
   Status: current
   Range: The valid range is 0-63.
   Reference:
      See RFC 3260 for the definition of the Differentiated Services
      Field.
      field.  See section 5.3.2 of RFC 1812 (Section 5.3.2) and RFC 791 for the
      definition of the IPv4 TOS field.  See RFC 2460 for the definition
      of the IPv6 Traffic Class field.

5.4.18.  ipPrecedence

   Description:
      The value of the IP Precedence.  The IP Precedence value is
      encoded in the first 3 bits of the IPv4 TOS field or the IPv6
      Traffic class Class field, respectively.  This Information Element
      encodes only these 3 bits.  Therefore  Therefore, its value may range from 0
      to 7.
   Abstract Data Type: unsigned8
   Data Type Semantics: identifier
   ElementId: 196
   Status: current
   Range: The valid range is 0-7.
   Reference:
      See section 5.3.3 of RFC 1812 (Section 5.3.3) and RFC 791 for the definition of the
      IP Precedence.  See section 5.3.2 of RFC 1812 (Section 5.3.2) and RFC 791 for the
      definition of the IPv4 TOS field.  See RFC 2460 for the definition
      of the IPv6 Traffic Class field.

5.4.19.  ipClassOfService

   Description:
      For IPv4 packets, this is the value of the TOS field in the IPv4
      packet header.  For IPv6 packets, this is the value of the Traffic
      Class field in the IPv6 packet header.
   Abstract Data Type: unsigned8
   Data Type Semantics: identifier
   ElementId: 5
   Status: current
   Reference:
      See section 5.3.2 of RFC 1812 (Section 5.3.2) and RFC 791 for the definition of the
      IPv4 TOS field.  See RFC 2460 for the definition of the IPv6
      Traffic Class field.

5.4.20.  postIpClassOfService

   Description:
      The definition of this Information Element is identical to the
      definition of Information Element 'ipClassOfService', except that
      it reports a potentially modified value caused by a middlebox
      function after the packet passed the Observation Point.
   Abstract Data Type: unsigned8
   Data Type Semantics: identifier
   ElementId: 55
   Status: current
   Reference:
      See RFC 791 for the definition of the IPv4 TOS field.  See RFC
      2460 for the definition of the IPv6 traffic class Traffic Class field.  See RFC
      3234 for the definition of middleboxes.

5.4.21.  flowLabelIPv6

   Description:
      The value of the IPv6 Flow Label field in the IP packet header.
   Abstract Data Type: unsigned32
   Data Type Semantics: identifier
   ElementId: 31
   Status: current
   Reference:
      See RFC 2460 for the definition of the flow label Flow Label field in the
      IPv6 packet header.

5.4.22.  isMulticast

   Description:
      If the IP destination address is not a reserved multicast address address,
      then the value of all bits of the octet (including the reserved
      ones) is zero.
      The first bit of this octet is set to 1 if the Version field of
      the IP header has the value 4 and if the Destination Address field
      contains a reserved multicast address in the range from 224.0.0.0
      to 239.255.255.255.  Otherwise, this bit is set to 0.  The second
      and third bit bits of this octet are reserved for future use.
      The remaining bits of the octet are only set to values other than
      zero if the IP Destination Address is a reserved IPv6 multicast
      address.  Then the fourth bit of the octet is set to the value of
      the T flag in the IPv6 multicast address and the remaining four
      bits are set to the value of the scope field in the IPv6 multicast
      address.

            0      1      2      3      4      5      6      7
         +------+------+------+------+------+------+------+------+
         | MCv4 | RES. | RES. |  T   |   IPv6 multicast scope    |
         +------+------+------+------+------+------+------+------+

         Bit  0:    set to 1 if IPv4 multicast
          Bit
         Bits 1-2:  reserved for future use
         Bit  4:    set to value of T-flag, T flag, if IPv6 multicast
          Bit
         Bits 4-7:  set to value of multicast scope if IPv6 multicast

   Abstract Data Type: unsigned8
   Data Type Semantics: flags
   ElementId: 206
   Status: current
   Reference:
      See RFC 1112 for the specification of reserved IPv4 multicast
      addresses.  See RFC 4291 for the specification of reserved IPv6
      multicast addresses and the definition of the T-flag T flag and the IPv6
      multicast scope.

5.4.23.  fragmentIdentification

   Description:
      The value of the Identification field in the IPv4 packet header or
      the IPv6 Fragment header, respectively.  The value is 0 for IPv6
      if there is no Fragment fragment header.
   Abstract Data Type: unsigned32
   Data Type Semantics: identifier
   ElementId: 54
   Status: current
   Reference:
      See RFC 791 for the definition of the IPv4 Identification field.
      See RFC 2460 for the definition of the Identification field in the
      IPv6 Fragment header.

5.4.24.  fragmentOffset

   Description:
      The value of the IP fragment offset field in the IPv4 packet
      header or the IPv6 Fragment header, respectively.  The value is 0
      for IPv6 if there is no Fragment fragment header.
   Abstract Data Type: unsigned16
   Data Type Semantics: identifier
   ElementId: 88
   Status: current
   Reference:
      See RFC 791 for the specification of the fragment offset in the
      IPv4 header.  See RFC 2460 for the specification of the fragment
      offset in the IPv6 Fragment header.

5.4.25.  fragmentFlags

   Description:
      Fragmentation properties indicated by flags in the IPv4 packet
      header or the IPv6 Fragment header, respectively.

      Bit 0:    (RS) Reserved.
                The value of this bit MUST be 0 until specified
                otherwise.

      Bit 1:    (DF) 0 = May Fragment,  1 = Don't Fragment.
                Corresponds to the value of the DF flag in the
                IPv4 header.  Will always be 0 for IPv6 unless
                a "don't fragment" feature is introduced to IPv6.

      Bit 2:    (MF) 0 = Last Fragment, 1 = More Fragments.
                Corresponds to the MF flag in the IPv4 header
                or to the M flag in the IPv6 Fragment header,
                respectively.  The value is 0 for IPv6 if there
                is no Fragment fragment header.

      Bits 3-7: (DC) Don't Care.
                The values of these bits are irrelevant.

           0   1   2   3   4   5   6   7
         +---+---+---+---+---+---+---+---+
         | R | D | M | D | D | D | D | D |
         | S | F | F | C | C | C | C | C |
         +---+---+---+---+---+---+---+---+

   Abstract Data Type: unsigned8
   Data Type Semantics: flags
   ElementId: 197
   Status: current
   Reference:
      See RFC 791 for the specification of the IPv4 fragment flags.  See
      RFC 2460 for the specification of the IPv6 Fragment header.

5.4.26.  ipHeaderLength

   Description:
      The length of the IP header.  For IPv6, the value of this
      Information Element is 40.
   Abstract Data Type: unsigned8
   ElementId: 189
   Status: current
   Units: octets
   Reference:
      See RFC 791 for the specification of the IPv4 header.  See RFC
      2460 for the specification of the IPv6 header.

5.4.27.  ipv4IHL

   Description:
      The value of the Internet Header Length (IHL) field in the IPv4
      header.  It specifies the length of the header in units of 4
      octets.  Please note that its unit is different to from most of the
      other Information Elements reporting length values.

   Abstract Data Type: unsigned8
   ElementId: 207
   Status: current
   Units: 4 octets
   Reference:
      See RFC 791 for the specification of the IPv4 header.

5.4.28.  totalLengthIPv4

   Description:
      The total length of the IPv4 packet.
   Abstract Data Type: unsigned16
   ElementId: 190
   Status: current
   Units: octets
   Reference:
      See RFC 791 for the specification of the IPv4 total length.

5.4.29.  ipTotalLength

   Description:
      The total length of the IP packet.
   Abstract Data Type: unsigned64
   ElementId: 224
   Status: current
   Units: octets
   Reference:
      See RFC 791 for the specification of the IPv4 total length.  See
      RFC 2460 for the specification of the IPv6 payload length.  See
      RFC 2675 for the specification of the IPv6 jumbo payload length.

5.4.30.  payloadLengthIPv6

   Description:
      This Information Element reports the value of the Payload Length
      field in the IPv6 header.  Note that IPv6 extension headers belong
      to the payload.  Also note that in case of a jumbo payload option
      the value of the Payload Length field in the IPv6 header is zero
      and so will be the value reported by this Information Element.
   Abstract Data Type: unsigned16
   ElementId: 191
   Status: current
   Reference:
      See RFC 2460 for the specification of the IPv6 payload length.
      See RFC 2675 for the specification of the IPv6 jumbo payload
      option.

5.5.  Transport Header Fields

   The set of Information Elements related to transport header fields
   and length includes the Information Elements listed in the table
   below.

   +-----+---------------------------+-----+---------------------------+
   |  ID | Name                      |  ID | Name                      |
   +-----+---------------------------+-----+---------------------------+
   |   7 | sourceTransportPort       | 238 | tcpWindowScale            |
   |  11 | destinationTransportPort  | 187 | tcpUrgentPointer          |
   | 180 | udpSourcePort             | 188 | tcpHeaderLength           |
   | 181 | udpDestinationPort        |  32 | icmpTypeCodeIPv4          |
   | 205 | udpMessageLength          | 176 | icmpTypeIPv4              |
   | 182 | tcpSourcePort             | 177 | icmpCodeIPv4              |
   | 183 | tcpDestinationPort        | 139 | icmpTypeCodeIPv6          |
   | 184 | tcpSequenceNumber         | 178 | icmpTypeIPv6              |
   | 185 | tcpAcknowledgementNumber  | 179 | icmpCodeIPv6              |
   | 186 | tcpWindowSize             |  33 | igmpType                  |
   +-----+---------------------------+-----+---------------------------+

5.5.1.  sourceTransportPort

   Description:
      The source port identifier in the transport header.  For the
      transport protocols UDP, TCP TCP, and SCTP SCTP, this is the source port
      number given in the respective header.  This field MAY also be
      used for future transport protocols that have 16 bit 16-bit source port
      identifiers.
   Abstract Data Type: unsigned16
   Data Type Semantics: identifier
   ElementId: 7
   Status: current
   Reference:
      See RFC 768 for the definition of the UDP source port field.  See
      RFC 793 for the definition of the TCP source port field.  See RFC
      2960
      4960 for the definition of SCTP.
      Additional information on defined UDP and TCP port numbers can be
      found at http://www.iana.org/assignments/port-numbers.

5.5.2.  destinationTransportPort

   Description:
      The destination port identifier in the transport header.  For the
      transport protocols UDP, TCP TCP, and SCTP SCTP, this is the destination
      port number given in the respective header.  This field MAY also
      be used for future transport protocols that have 16 bit 16-bit
      destination port identifiers.

   Abstract Data Type: unsigned16
   Data Type Semantics: identifier
   ElementId: 11
   Status: current
   Reference:
      See RFC 768 for the definition of the UDP destination port field.
      See RFC 793 for the definition of the TCP destination port field.
      See RFC