IPFIX Working Group P. Aitken, Ed. Internet-Draft B. Claise Intended status: Standards Track S. B S Expires: April 24, 2014 C. McDowall Cisco Systems, Inc. J. Schoenwaelder Jacobs University Bremen October 21, 2013 Exporting MIB Variables using the IPFIX Protocol draft-ietf-ipfix-mib-variable-export-03 Abstract This document specifies a way to complement IPFIX Data Records with Management Information Base (MIB) objects, avoiding the need to define new IPFIX Information Elements for existing Management Information Base objects that are already fully specified. An IPFIX Option Template and method are specified, which are used to export the extra information required to fully describe Simple Network Management Protocol (SNMP) MIB Objects. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on April 24, 2014. Copyright Notice Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents Aitken, et al. Expires April 24, 2014 [Page 1] Internet-Draft Exporting MIB Variables with IPFIX October 2013 (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Open Issues / To do list . . . . . . . . . . . . . . . . . . 3 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4 3. Motivation and Architectural Model . . . . . . . . . . . . . 6 4. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 7 5. MIB Object Value Information Element and the MIB Field Option Template . . . . . . . . . . . . . . . . . . . . . . . . . . 8 5.1. MIB Field Option Template Format . . . . . . . . . . . . 9 5.1.1. Use of field order in the MIB Field Option template . 9 5.1.2. Minimum Required MIB Object Fields . . . . . . . . . 10 5.2. MIB Field Option Architecture . . . . . . . . . . . . . . 10 5.3. MIB Field Option Template Formats . . . . . . . . . . . . 12 5.3.1. Data Template containing a MIBObject Field . . . . . 13 5.3.2. Option Template containing a MIBObject Field . . . . 14 5.3.3. mibFieldOption Template . . . . . . . . . . . . . . . 15 5.3.4. mibFieldOption Data Records . . . . . . . . . . . . . 17 5.3.5. mibFieldOption Template with Indexing . . . . . . . . 18 5.3.6. mibFieldOption Template with Semantics Fields . . . . 19 5.3.7. mibFieldOption Template with extra MIB Object Details 20 5.4. Identifying the SNMP Context . . . . . . . . . . . . . . 22 5.5. Template Management . . . . . . . . . . . . . . . . . . . 22 6. Example Use Cases . . . . . . . . . . . . . . . . . . . . . . 22 6.1. Without Using the Specifications in this Document . . . . 22 6.2. Non-indexed MIB Object: Established TCP Connections . . . 23 6.3. Enterprise Specific MIB Object: Detailing CPU Load History . . . . . . . . . . . . . . . . . . . . . . . . . 26 6.4. Indexed MIB Object with Two OIDs: The ipIfStatsInForwDatagrams . . . . . . . . . . . . . . . . 29 6.5. Indexed MIB Object with an IPFIX Information Element: Output Interface Queue Size in PSAMP Packet Report . . . 32 6.6. Indexed MIB Object with an OID: Output Interface Queue Size in PSAMP Packet Report . . . . . . . . . . . . . . . 36 6.7. Indexed MIB Objects with a mix of MIB OID and IPFIX Information Element . . . . . . . . . . . . . . . . . . . 39 6.8. Indexed MIB Object with MIBInstanceIdentifier Information Element: ipIfStatsOutOctets . . . . . . . . . . . . . . . 39 6.9. Using MIB Objects as IPFIX Options Scope fields . . . . . 42 6.9.1. Using non-Indexed MIB Objects as Option Scope fields 42 6.9.2. Using Indexed MIB Objects as Option Scope fields . . 42 Aitken, et al. Expires April 24, 2014 [Page 2] Internet-Draft Exporting MIB Variables with IPFIX October 2013 6.10. Using MIB Objects with IPFIX Structured Data . . . . . . 42 6.11. Using IPFIX Structured Data to group the index MIB and indices . . . . . . . . . . . . . . . . . . . . . . . . . 42 6.12. Non-indexed MIB Object: Established TCP Connections With Optional Fields . . . . . . . . . . . . . . . . . . . . . 42 7. Configuration Considerations . . . . . . . . . . . . . . . . 45 8. The Collecting Process's Side . . . . . . . . . . . . . . . . 45 9. Applicability . . . . . . . . . . . . . . . . . . . . . . . . 46 10. Security Considerations . . . . . . . . . . . . . . . . . . . 46 11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 47 11.1. New Data Types . . . . . . . . . . . . . . . . . . . . . 47 11.2. New Information Elements . . . . . . . . . . . . . . . . 47 11.2.1. mibObjectValue . . . . . . . . . . . . . . . . . . . 48 11.2.2. mibObjectIdentifier . . . . . . . . . . . . . . . . 48 11.2.3. mibIndexList . . . . . . . . . . . . . . . . . . . . 49 11.2.4. mibIndexString . . . . . . . . . . . . . . . . . . . 49 11.2.5. mibObjectName . . . . . . . . . . . . . . . . . . . 50 11.2.6. mibObjectDescription . . . . . . . . . . . . . . . . 50 11.2.7. mibObjectBaseSyntax . . . . . . . . . . . . . . . . 50 11.2.8. mibObjectSyntax . . . . . . . . . . . . . . . . . . 52 11.2.9. mibCaptureTimeSemantics . . . . . . . . . . . . . . 52 11.2.10. mibContextIdentifier . . . . . . . . . . . . . . . . 53 11.2.11. mibName . . . . . . . . . . . . . . . . . . . . . . 53 12. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 54 13. References . . . . . . . . . . . . . . . . . . . . . . . . . 54 13.1. Normative References . . . . . . . . . . . . . . . . . . 54 13.2. Informative References . . . . . . . . . . . . . . . . . 54 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 55 1. Open Issues / To do list o "timestamps, exporters, and other animals" -> see the mailing list. o The value of the MIB OID acting as an index may not be of fixed length and may have no default length, for example the OID can be of type string or type MIB OID. o Some TODOs in the XML version: * write section 6.7: "Indexed MIB Objects with a mix of MIB OID and IPFIX Information Element" * write section 6.10: "Using MIB Objects with IPFIX Structured Data" * write section 6.11: "Using IPFIX Structured Data to group the index MIB and indices" Aitken, et al. Expires April 24, 2014 [Page 3] Internet-Draft Exporting MIB Variables with IPFIX October 2013 o RFC 5610: explain what needs to be updated. o ID to name mappings? -> use this for an example in section 5. o What does this mean? : "(Consider the counter synchronization issue, non-key info should be static)". o (JS) Do we need to add something about the contextEngineID and contextName? Optionally associate context with template via options Could be done with common properties or in a flow record. See section 5.6. However, do we limit all MIB variables in a Template Record to a single context? 3 cases: 1. if a simple SNMP agent, no contextEngineID and contextName, because it's the default 2. the context information is valid for the entire flow record 3. the context information is specific for each IE within the entire flow record question regarding 3.: only one context for an entire flow or can a flow record export MIB OID from different context? (JS): ask the IPFIX mailing list. (BC): ask internally in Cisco Action: complete the "Identifying the SNMP Context" section o (JS) Inacio's figure: send email to the mailing list. o Tidy up the XML. o Properly specify the new data types in section 11.1. o Should the mibObjectBaseSyntax types in section 11.2.7 be consolidated with the RFC5610 / [IANA-DATATYPES] types? o Should there be 11 different IEs (one of each of the mibObjectBaseSyntax types) rather than a single mibObjectValue? o Add missing examples in sections 6.7, 6.9.1, 6.9.2, 6.10, 6.11. o Describe all the orphaned figures ("Figure NN shows ..."). 2. Introduction Aitken, et al. Expires April 24, 2014 [Page 4] Internet-Draft Exporting MIB Variables with IPFIX October 2013 There is growing interest in using IPFIX as a push mechanism for exporting management information. Using a push protocol such as IPFIX instead of a polling protocol like SNMP is especially interesting in situations where large chunks of repetitive data need to be exported periodically. While initially targeted at different problems, there is a large parallel between the information transported via IPFIX and SNMP. Furthermore, certain Management Information Base (MIB) objects are highly relevant to flows as they are understood today. For example, in the IPFIX information model [RFC7012], Information Elements coming from the SNMP world have already been specified, e.g., ingressInterface and egressInterface both refer to the ifIndex defined in [RFC2863]. Rather than mapping existing MIB objects to IPFIX Information Elements on a case by case basis, it would be advantageous to enable the export of any existing or future MIB objects as part of an IPFIX Data Record. This way, the duplication of data models [RFC3444], both as SMI MIB objects and IPFIX Information Elements, out of the same information model [RFC3444] would be avoided. This document specifies a method for creating an IPFIX Option Template which is used to export the extra data required to describe MIB variables (see Section 5.1.2). This allows IPFIX Templates to contain any combination of fields defined by traditional IPFIX Information Element(s) and/or MIB Object Identifier(s). The MIB Object Identifiers can reference either non-indexed or indexed MIB object(s). Enterprise-specific MIB Object Identifiers are also supported. When an indexed MIB object is exported, a method to identify how that MIB object is indexed is specified so that the full meaning of the information being exported can be conveyed. The specification encompasses the different index types for the MIB Object Identifier: o indexed by one or multiple MIB variable(s) o indexed by one or multiple IPFIX Information Element(s) o indexed by a mix of MIB variable(s) and IPFIX Information Element(s) o indexed by a string A set of example use cases illustrates how these specifications can be used. Aitken, et al. Expires April 24, 2014 [Page 5] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Some Exporters may not have the knowledge to convey the full information on how the MIB objects being exported are indexed. They may not know the index count and/or the OIDs of the objects that are used to index a MIB object. In such cases the Exporter can send the the values of the index OIDs identifying the instance of the object being exported as one string that conveys the instance identifier part of an object being exported. The Collecting Process may know how a MIB object is indexed by some other means, for example, it could compile this information from the MIB Module that defines exported MIB object or the Collecting Process could be hardcoded with this information for a pre-defined set of MIB objects that it is interested in. An example use case is used to illustrate this mechanism. 3. Motivation and Architectural Model Most Flow Records contain the ingressInterface and/or the egressInterface Information Element. These Information Elements carry an ifIndex value, a MIB object defined in [RFC2863]. In order to retrieve additional information about the identified interface, a Collector could simply poll relevant objects from the device running the Exporter via SNMP. However, that approach has several problems: o It requires implementing a mediation function between two data models, i.e., MIB objects and IPFIX Information Elements. o Confirming the validity of simple mappings (e.g., ifIndex to ifName) requires either checking on a regular basis that the Exporter's network management system did not reload, or imposing ifIndex persistence across an Exporter's reload. o Synchronization problems occur since counters carried in Flow Records and counters carried in SNMP messages are retrieved from the Exporter at different points in time and thus cannot be correlated. In the best case, assuming very tight integration of an IPFIX Collector with and SNMP polling engine, SNMP data is retrieved shortly after Data Records have been received, which implies the sum of the active or inactive timeouts (if not null) plus the time to export the Flow Record to the Collector. If, however, the SNMP data is retrieved by a generic Network Management Station (NMS) polling interface statistics, then the time lag between IPFIX counters and SNMP counters can be significant. The intended scope of this work is the addition of MIB variable(s) to IPFIX Information Elements in Data Records, in order to complement the Records with useful and already standardized information. More specifically, the case of an existing Template Record, which needs to Aitken, et al. Expires April 24, 2014 [Page 6] Internet-Draft Exporting MIB Variables with IPFIX October 2013 be augmented with some MIB variables whose index was already present in the Template Record as an IPFIX Information Element: typically, a 7-tuple Record containing the ingressInterface Information Element, augmented by interface counters [RFC2863], which are indexed by the respective ingressInterface values in the Data Records. The intended goal of this work is not a replacement of SNMP notifications, even if the specifications in this document could potentially allow this. Since IPFIX is a push mechanism, initiated from the Exporter with no acknowledgment method, this specification does not provide the ability to execute configuration changes. The Distributed Management Expression MIB [RFC2982], which is a mechanism to create new MIB variables based on the content of existing ones, could also be advantageous in the context of this specification. Indeed, newly created MIB objects (for example, the link utilization MIB variable), created with the Distributed Management Expression MIB [RFC2982] could nicely complement Data Records. Another advantage of exporting MIB objects via IPFIX is that IPFIX would benefit from an extended series of types to be exported. The simple and application-wide data types specified in SMIv2 [RFC2578], along with a new textual conventions, can be exported within IPFIX and then decoded in the Collector. +------+ +-------+ +.........+ +.....+ | SNMP | | IPFIX | : NETCONF : : CLI : +------+ +-------+ +.........+ +.....+ | | | | +--------------------------------------------+ | Instrumentation (specified in MIB modules) | +--------------------------------------------+ Figure 1: Architectural Model The overall architectural model is depicted in Figure 1. The IPFIX Exporter accesses the device's instrumentation, which follows the specifications contained in MIB modules. Other management interfaces such as NETCONF or the device's Command Line Interface (CLI) may provide access to the same instrumentation. 4. Terminology Aitken, et al. Expires April 24, 2014 [Page 7] Internet-Draft Exporting MIB Variables with IPFIX October 2013 IPFIX-specific terminology (Information Element, Template, Template Record, Options Template Record, Template Set, Collector, Exporter, Flow Record, etc.) used in this document is defined in Section 2 of [RFC7011]. As in [RFC7011], these IPFIX-specific terms have the first letter of a word capitalized. This document prefers the more generic term "Data Record" as opposed to "Flow Record" as this specification allows the export of MIB objects. MIB Object Identifier (MIB OID) An ASCII character sequence of decimal non-negative sub-identifier values. Each sub-identifier value MUST NOT exceed 2^32-1 (4294967295) and MUST NOT have leading zeros. Sub-identifiers are separated by single dots and without any intermediate whitespace. MIB Object Identifier Information Element An IPFIX Information Element ("mibObjectIdentifier") which denotes that a MIB Object Identifier (MIB OID) is exported in the (Options) Data Record. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 5. MIB Object Value Information Element and the MIB Field Option Template This document defines a new mibObjectValue Information Element (in Section 11). This is used to export MIB Objects as part of standard IPFIX Templates. The mibObjectValue Information Element contains the actual data retrieved from a MIB Object. The issue that arises from exporting MIBs in IPFIX is that the standard IPFIX Template format ([RFC7011]) only provides the Collector with the length of the Information Element. The actual MIB OID would be unknown, so every mibObjectValue Field would appear identical and the contents of the mibObjectValue field would be incomprehensible data to a Collector. For the values in the mibObjectValue field to be understandable, more meta information about the mibObjectValue must be sent as part of the IPFIX export. The required minimum meta information is defined in Section 5.1.2. Aitken, et al. Expires April 24, 2014 [Page 8] Internet-Draft Exporting MIB Variables with IPFIX October 2013 One approach to this problem would be to extend the IPFIX standard to allow Extended Field Specifiers as shown in Section 6.1 so metadata about Fields can be included in Data Templates. This would however require a new version of the IPFIX standard which may not be backwards compatible. However, future versions of IPFIX MAY export the required MIB metadata as part of newer set versions. This document defines a mibFieldOption Template to export the extra meta information required for a mibObjectValue field. This is a standard IPFIX Option Template Set that MUST include a minimum set of required fields (see Section 5.1.2) and MAY include extra fields to provide more meta information about the mibObjectValue field. 5.1. MIB Field Option Template Format For each mibObjectValue field that is defined in an IPFIX Data or Option Template, a mibFieldOption Data Record MUST be exported that provides the required minimum information to define the MIB object that is being exported (see Section 5.1.2). This mibFieldOption is defined in a template referred to in this document as a mibFieldOption Template and has the format that is specified in Section 5.3. A Template that uses a mibObjectValue Field MUST be exported in the same IPFIX message as the corresponding mibFieldOption Template and Data Records. Note that this places an implicit size constraint on the export. 5.1.1. Use of field order in the MIB Field Option template The mibFieldOption export makes use of the informationElementIndex to specify which field in the template that the metadata relates to, which avoids any ordering constraints on the data template. The MIB field and any fields used to index it can be in any order in the export packet. The informationElementIndex specifies which Field in the Template extra information is being provided for. This is analogous to standard IPFIX Template Sets which also specify the order of the fields and provide their type and size. If the template changes such that the order is different then the mibfieldOption data MUST be resent to reflect the new ordering. A new Template id MUST be used to reflect that the ordering has changed. Otherwise older mibFieldOption details may be used to refer to the incorrect field. Aitken, et al. Expires April 24, 2014 [Page 9] Internet-Draft Exporting MIB Variables with IPFIX October 2013 5.1.2. Minimum Required MIB Object Fields At a minimum, the mibObjectValue (Section 11.2.1), mibObjectIdentifier (Section 11.2.2), and mibObjectBaseSyntax (Section 11.2.7) are REQUIRED. These are used as described in Section 5.3.3. Additionally for indexed MIBs, the mibIndexList (Section 11.2.3) or mibIndexString (Section 11.2.4) are REQUIRED. While the following are optional, they are nevertheless RECOMMENDED in order to provide the Collector with additional information about the MIB. Such information might not otherwise be available: o mibObjectName (Section 11.2.5) o mibObjectDescription (Section 11.2.6) o mibObjectSyntax (Section 11.2.8) o mibCaptureTimeSemantics (Section 11.2.9) o mibContextIdentifier (Section 11.2.10) o mibName (Section 11.2.11). 5.2. MIB Field Option Architecture Four IPFIX Sets are used together to export a Flow using the mibObjectValue Field. These are: 1. A Data or Option Template Set which includes the mibObjectValue field. 2. A mibFieldOption Template Set 3. mibFieldOption Data Set 4. Data Set. The Template Set or Option Template Set informs the Collector that a MIB Object Value of length n will be exported. The mibFieldOption Template describes which metadata will be sent for each mibObjectValue being exported. Aitken, et al. Expires April 24, 2014 [Page 10] Internet-Draft Exporting MIB Variables with IPFIX October 2013 The mibFieldOption Data Set includes the metadata for each MIB object (ie the mibObjectIdentifier). The metadata about the mibObjectValues only needs to be resent as per normal Template refreshes or resends. The Data Set contains only the actual data extracted from the MIB. Figure 2 shows the IPFIX Message structure for a MIB Field in a Template Set, while Figure 3 shows the IPFIX Message structure for a MIB Field in an Option Template Set. +----------------------------------------------------+ | IPFIX Message Header | +----------------------------------------------------+ | Template Set (X) | +----------------------------------------------------+ | Option Template Set (mibFieldOption Template) | +----------------------------------------------------+ | Data Set (mibFieldOption Data) | +----------------------------------------------------+ | Data Set (X) | +----------------------------------------------------+ Figure 2: IPFIX Message structure for a MIB Field in a Template Set The mibFieldOption Template can be used with Standard Option Templates as well. +----------------------------------------------------+ | IPFIX Message Header | +----------------------------------------------------+ | Option Template Set (Y) | +----------------------------------------------------+ | Option Template Set (mibFieldOption Template) | +----------------------------------------------------+ | Data Set (mibFieldOption Data) | +----------------------------------------------------+ | Data Set (Y) | +----------------------------------------------------+ Figure 3: IPFIX Message structure for a MIB Field in an Option Template Set More Data Sets that use the mibObjectValue can then be send in subsequent packets. Figure 4 shows the relationships between the Records discussed above. Aitken, et al. Expires April 24, 2014 [Page 11] Internet-Draft Exporting MIB Variables with IPFIX October 2013 The mibFieldOption Template defines mibFieldOption Records. The mibFieldOption Data record annotate the Data Template with mibObjectValue metadata. Together the Data Template and mibFieldOption define the Data Records that will be exported. The Data Records X have a dependency on the 2 Templates and the mibFieldOption Data Records. +--------------------------+ | mibFieldOption Template Y| +--------------------------+ |(templateId, elementIndex)| +--------------------------+ | BaseSyntax, mibOID | +--------------------------+ | | Defines V +------------------------+ +--------------------------+ | Data Template X | | mibFieldOption Data Y | +------------------------+ +--------------------------+ |Field 0 - regular IE | | | +------------------------+ +--------------------------+ |Field 1 - mibObjectValue| <----------- | (X,1) = BaseSyntax, OID | +------------------------+ Annotates +--------------------------+ |Field 2 - mibObjectValue| <----------- | (X,2) = BaseSyntax, OID | +------------------------+ +--------------------------+ | | |------------------------------------/ | | Defines | V +------------------------+ | Data Records X | |------------------------| | Field 0 data | +------------------------+ | Field 1 data | +------------------------+ | Field 2 data | +------------------------+ Figure 4: Relationships between Sets 5.3. MIB Field Option Template Formats Aitken, et al. Expires April 24, 2014 [Page 12] Internet-Draft Exporting MIB Variables with IPFIX October 2013 5.3.1. Data Template containing a MIBObject Field The Template Record Format of a Template that uses the mibObjectValue field is identical to the standard IPFIX Format as defined in [RFC7011], so the mibObjectValue field is specified using standard IPFIX Field Specifiers as in [RFC7011]. The only extra requirement on a Template Record using mibObjectValue Fields is that it MUST export the required metadata specified for EACH mibObjectValue Field (see Section 5.1.2). A mibFieldOption Template and corresponding Data Record MUST be exported to provide the minimum required metadata. Figure 5 shows an IPFIX Template Set using a mibObjectValue Field. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 2 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 256 | Field Count = N | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = Existing IPFIX Field | Field Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = mibObjectValue (TBD1) | Field Length (mib) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 5: IPFIX Template Set using mibObjectValue Field Where: mibObjectValue An IPFIX Information Element which denotes that MIB Object data (ie, the value of a MIB OID) will be exported in the (Options) Template Record. The mibObjectValue is opaque data. When the mibObjectValue Information Element is used, the MIB Object Identifier ("mibObjectIdentifier") and MIB Object Base Syntax ("mibObjectBaseSyntax") MUST be exported via a mibFieldOption or by other means. See Section 5.1.2. Field Length (mib) The length of the encoded MIB OID data in the corresponding Data Records, in octets. The definition is as [RFC7011]. Note that the Field Length can be expressed using reduced size encoding per [RFC7011]. Note that the Field Length may be encoded using variable-length encoding per [RFC7011]. Aitken, et al. Expires April 24, 2014 [Page 13] Internet-Draft Exporting MIB Variables with IPFIX October 2013 5.3.2. Option Template containing a MIBObject Field The Option Template Record Format of a Template that uses the mibObjectValue field is identical to the standard Format as defined in [RFC7011]. The mibObjectValue field is specified using standard Field Specifiers as in [RFC7011]. A mibObjectValue Field can be a Scope Field or a Non Scope Option Field. The only extra requirement on a Option Template Record using mibObjectValue Fields is that it MUST export the required metadata specified in Section 5.1.2 for EACH mibObjectValue Field. An IPFIX Option Template Record MUST export a mibFieldOption Template and Data Record to provide the minimum required metadata for each mibObjectValue Field. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 257 | Field Count = 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope Field Count = 1 |0| IE = Existing IPFIX Field | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length |0| IE = mibObjectValue (TBD1) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 6: IPFIX Option Template Set using a Non Scope mibObjectValue Field 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 258 | Field Count = 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope Field Count = 1 |0| IE = mibObjectValue (TBD1) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length |0| IE = Existing IPFIX Field | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Aitken, et al. Expires April 24, 2014 [Page 14] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Figure 7: IPFIX Option Template Set using a Scope mibObjectValue Field 5.3.3. mibFieldOption Template The mibFieldOption Template is a Standard Option Template which defines the Fields that will be exported to provide enough metadata about a mibObjectValue so that the Collector can tie the data values in the mibObjectValue back to the definition of the MIB Object. All mibFieldOption Templates MUST contain the following Fields: o (scope) templateId o (scope) informationElementIndex o mibObjectBaseSyntax o mibObjectIdentifier A mibFieldOption Template MAY specify other Information Elements as part of the mibFieldOption template. This document defines some common optional Information Elements which allow exporting more information about MIB Indexing, extra data from the MIB and the semantics of how the mibObjectValue was collected prior to export. See Section 11.2. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID | Field Count | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope field count = 2 |0| IE = templateId | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = informationElementIndex| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = mibObjectBaseSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 |0| IE = mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 8: MIB Field Option Template Format - Required Fields Aitken, et al. Expires April 24, 2014 [Page 15] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Where: templateId The first scope field is an IPFIX Information Element which denotes that a Template Identifier will be exported as part of the mibFieldOption Data Record. This Template Identifier paired with an index into that template, the "informationElementIndex" field, uniquely references one mibObjectValue Field being exported. informationElementIndex The second scope field is an IPFIX Information Element which denotes a zero based index into the fields defined by a Template. When paired with a "templateId" the Record will uniquely reference one mibObjectValue Field being exported. mibObjectBaseSyntax An IPFIX Information Element which denotes that the SMI SYNTAX will be exported as defined in Section 11.2.7. This is exported so that if the Collector does not have access to the MIB it will know the primitive type of data the mibObjectValue will contain. This may help with displaying data and planning storage for Data Records prior to decoding. mibObjectIdentifier An IPFIX Information Element which denotes the a MIB Object Identifier for the mibObjectValue exported in the (Options) Template Record. When the MIB Object Value Information Element is used, the MIB Object Identifier MUST be specified in the mibFieldOption Template Record or specified by other means. Variable-length encoding SHOULD be used with the mibObjectIdentifier so that multiple different length MIB OIDs can be exported efficiently. This will also allow reuse of the mibFieldOption Template. Aitken, et al. Expires April 24, 2014 [Page 16] Internet-Draft Exporting MIB Variables with IPFIX October 2013 5.3.4. mibFieldOption Data Records The mibFieldOption Data Records conform to the Template Specification in the mibFieldOption Template. There may be multiple mibFieldOption Records exported. The Collecting Process MUST store all received mibFieldOption Data information for the duration of each Transport Session, because the Collecting Process will need to refer to the extra meta information to decode a mibObjectValue Field fully. Figure 9 shows the format of the exported mib Field Option detailing the metadata that will be exported to match the Template in section (see Figure 8). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID | Length = N | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | templateId | informationElementIndex | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | mibBaseSyntax | VLEN | mibObjectIdentifier ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mibObjectIdentifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mibObjectIdentifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mibObjectIdentifier continued | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | templateId | informationElementIndex | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | mibBaseSyntax | VLEN | mibObjectIdentifier ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mibObjectIdentifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mibObjectIdentifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mibObjectIdentifier continued | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 9: Format of mibFieldOption Data Record Aitken, et al. Expires April 24, 2014 [Page 17] Internet-Draft Exporting MIB Variables with IPFIX October 2013 5.3.5. mibFieldOption Template with Indexing 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID | Field Count | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope field count = 2 |0| IE = templateId | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = informationElementIndex| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = mibObjectBaseSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 |0| IE = mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibIndexList | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = N | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 10: mibFieldOption Format for a indexed MIB Object Where: mibIndexList The MIB Index List IPFIX Information Element which denotes that a list of informationElementIndex values will be exported as part of the Data Record. The index data for a mibObjectValue will be other fields contained in the same Data Record. In a similar manner to the informationElementIndex field in the Template, the mibIndexList lists the Fields whose value(s) should be added to the mibObjectIdentifier to completely index the value. If the mibIndexList is exported with variable-length encoding, then a zero length mibIndexList indicates that the mibObjectValue does not have an index. The Information Elements referred to by mibIndexList could be any Information Element(s) that can be appended onto a the mibObjectIdentifier to index it fully. If there are no other suitable Fields to index a mibObjectValue, then a mibIndexString field can be included in the (Options) Template Record. Aitken, et al. Expires April 24, 2014 [Page 18] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Example Information Elements that could be used: Existing IPFIX Fields mibObjectValues as defined in this document a mibIndexString as defined in this document 5.3.6. mibFieldOption Template with Semantics Fields A mibFieldOption Template MAY specify that extra Information Elements will be exported to record how the mibObjectValue was collected 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID | Field Count | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope field count = 2 |0| IE = templateId | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = informationElementIndex| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = mibObjectBaseSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 |0| IE = mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibCaptureTimeSemantics| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 11: mibFieldOption Format for a non-indexed Field with Semantic Data Where: mibCaptureTimeSemantics The MIB Capture Time Semantics IPFIX Information Element, as defined in Section 11.2.9. It is RECOMMENDED to include this field when exporting mibObjectValues that specify counters or statistics. In particular for situations with long lived Flows. Aitken, et al. Expires April 24, 2014 [Page 19] Internet-Draft Exporting MIB Variables with IPFIX October 2013 5.3.7. mibFieldOption Template with extra MIB Object Details The MIB OID exported within the mibObjectIdentifier IPFIX Information Element provides a reference to a MIB that will fully describe the MIB Variable being Exported. However an Exported Process MAY decide to include some extra MIB Fields to more fully describe the mibObjectValue. This can be helpful if the Collecting Process may not have access to the MIB. It also allows the IPFIX Field Types to be extended with any MIB Variable already defined purely through IPFIX. The exporting process can either include the extra Object Details fields as part of the mibFieldOption Template or export a separate Option Template and Data that maps MIB OIDs in mibObjectIdentifier Fields to the Object details. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID | Field Count | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope field count = 2 |0| IE = templateId | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = informationElementIndex| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = mibObjectBaseSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 |0| IE = mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibObjectSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibObjectName | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibObjectDescription | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibName | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 12: mibFieldOption Format for a non-indexed Field with Object Details Where: Aitken, et al. Expires April 24, 2014 [Page 20] Internet-Draft Exporting MIB Variables with IPFIX October 2013 mibOjectSyntax The MIB SYNTAX string for a mibObjectIdentifier, which contains the SYNTAX string as defined for the MIB Object referenced by the MIB OID. This will either be the name of one of the primitive "base types" from [RFC2578] or a Textual Convention name. mibObjectName The textual name for a mibObjectIdentifier Object. mibObjectDescription The textual description for a mibObjectIdentifier. mibName The textual name of the MIB which defines a MIB OID Object. Or the MIB details can be exported as an Standard Option Export as shown in Figure 13 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID | Field Count | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope field count = 1 |0| IE = mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibObjectBaseSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 |0| IE = mibObjectSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibObjectName | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibObjectDescription | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibName | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 13: Alternative Option Export mibObjectIdentifier to Details Aitken, et al. Expires April 24, 2014 [Page 21] Internet-Draft Exporting MIB Variables with IPFIX October 2013 5.4. Identifying the SNMP Context Each MIB OID is looked up in a specific context, usually the default context. If exporting a MIB OID value that isn't in the default context then the context string MUST be identified and associated with the MIB OID. This can be done on a per template basis by exporting an Options Template Record. A new IPFIX Information Element, "mibContextIdentifier" has been allocated for this purpose. See Section 11. 5.5. Template Management Templates are managed as per [RFC7011] with the additional constraint that the mibFieldOption Template and Data Records MUST be exported in the same IPFIX Message as any (Option) Template Record that uses a mibObjectValue. If a Template using mibObjectValues is resent for any reason the Records it depends on MUST be sent as well. If a Template is replaced with a new (Option) Template Record then a new mibFieldOption Data Record MUST be sent with the replacement referencing the new Template ID. An Exporting Process SHOULD reuse mibFieldOption Template IDs IFF the Templates are identical. Each (Option) Template Record MUST still be accompanied by a copy of the mibFieldOption Template. 6. Example Use Cases 6.1. Without Using the Specifications in this Document This example shows the export of indexed MIB objects using the example of exporting ifInOctets. Note that ifInOctets.1 has the MIB Object Identifier 1.3.6.1.2.1.2.2.1.10.1 It's clearly impossible to define a new IPFIX Information Element for each MIB OID which is to be exported. IPFIX would quickly run out of Information Elements, and there would be no re-use of the existing MIBs. Therefore one IPFIX Information Element "mibObjectIdentifier" is used to indicate that a MIB is being exported, with additional information about the MIB OID being encoded in extension. Aitken, et al. Expires April 24, 2014 [Page 22] Internet-Draft Exporting MIB Variables with IPFIX October 2013 A Template Record for exporting the ifInOctets for the interface represented by the interface ifIndex 1 (i.e., ifInOctets.1) is shown in Figure 14. Note that a new IPFIX Set type is required due to the non-standard format which is required to encode the MIB OID extension. While this may be useful for exporting the single ifInOctets.1 field, clearly additional Templates are required in order to export ifInOctets.2, ifInOctets.3, etc. Therefore Indexed MIB objects (per Section 5.3.5) are required in order to export arbitrary ifInOctets.x. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = ?? | Length = 40 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 256 | Field Count = 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = mibObjectIdentifier | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Extension Length = 26 | Extension 1 Type = "MIB OID" | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Extension 1 Data Length = 0 | Extension 1 Info Length = 22 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Extension 1 Info = MIB Object Identifier ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier = "1.3.6.1.2.1.2.2.1.10.1" | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 14: Template for exporting ifInOctets.1 6.2. Non-indexed MIB Object: Established TCP Connections The number of established TCP connections of a remote network device could be monitored by configuring it to periodically export the number of established TCP connections to a centralized Collector. In this example, the Exporter would export an IPFIX Message every 30 minutes that contained Data Records detailing the number of established TCP connections. The table of data that is to be exported looks like: Aitken, et al. Expires April 24, 2014 [Page 23] Internet-Draft Exporting MIB Variables with IPFIX October 2013 +------------------------------------+-----------------------+ | TIMESTAMP | ESTABLISHED TCP CONN. | +------------------------------------+-----------------------+ | StartTime + 0 seconds | 10 | | StartTime + 60 seconds | 14 | | StartTime + 120 seconds | 19 | | StartTime + 180 seconds | 16 | | StartTime + 240 seconds | 23 | | StartTime + 300 seconds | 29 | +------------------------------------+-----------------------+ Table 1: Established TCP Connections The Template Record for such a Data Record will detail two Information Elements: 1. flowStartSeconds from [RFC7012], Information Element 150: The absolute timestamp of the first packet of this Flow. 2. tcpCurrEstab from [RFC4022], Object ID "1.3.6.1.2.1.6.9": The number of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT. Figure 15 shows the exported Template Set detailing the Template Record for exporting the number of established TCP connections (see Section 6.2). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 2 | Length = 16 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 257 | Field Count = 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = flowStartSeconds | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = mibObjectValue | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 15: Example of tcpCurrEstab Template Set Figure 16 shows the exported mib Field Option detailing the metadata that will be exported about the mibObjectValue Field in Template 257 in Template Record (see Section 6.2). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Aitken, et al. Expires April 24, 2014 [Page 24] Internet-Draft Exporting MIB Variables with IPFIX October 2013 | Set ID = 3 | Length = 26 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 258 | Field Count = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope field count = 2 |0| IE = templateId | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = informationElementIndex| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = mibObjectBaseSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 |0| IE = mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 16: Example of tcpCurrEstab mibFieldOption Template Set Figure 17 shows the exported mib Field Option detailing the metadata that will be exported about the mibObjectValue Field in Template 257 in Template Record (see Section 6.2). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 258 | Length = 25 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | templateId = 257 | informationElementIndex = 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |BSyntax=Gauge32| VLEN=16 | mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mibObjectIdentifier = "1.3.6.1.2.1.6.9" | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | +-+-+-+-+-+-+-+-+ Figure 17: Example of tcpCurrEstab mibFieldOption Data Set Figure 18 shows the start of the Data Set for exporting the number of established TCP connections (see Section 6.2). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Aitken, et al. Expires April 24, 2014 [Page 25] Internet-Draft Exporting MIB Variables with IPFIX October 2013 | Set ID = 257 | Length = 52 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | StartTime + 0 seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 10 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | StartTime + 60 seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 14 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | StartTime + 120 seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 19 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | StartTime + 180 seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 16 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | StartTime + 240 seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 23 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | StartTime + 300 seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 29 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 18: Example of tcpCurrEstab Data Set 6.3. Enterprise Specific MIB Object: Detailing CPU Load History For the sake of demonstrating a enterprise-specific MIB object, a non-indexed MIB object is chosen for simplicity. The CPU Usage of a remote network device could be monitored by configuring it to periodically export CPU usage information, i.e. the cpmCPUTotal1minRev from the proprietary CISCO-PROCESS-MIB, Object ID "1.3.6.1.4.1.9.9.109.1.1.1.1.7", to a centralized Collector. In this example, the Exporter would export an IPFIX Message every 30 minutes that contained Data Records detailing the CPU 1 minute busy average at 1 minute intervals. The table of data that is to be exported looks like: +------------------------------------+---------------------+ | TIMESTAMP | CPU BUSY PERCENTAGE | +------------------------------------+---------------------+ | StartTime + 0 seconds | 10% | | StartTime + 60 seconds | 14% | Aitken, et al. Expires April 24, 2014 [Page 26] Internet-Draft Exporting MIB Variables with IPFIX October 2013 | StartTime + 120 seconds | 19% | | StartTime + 180 seconds | 16% | | StartTime + 240 seconds | 23% | | StartTime + 300 seconds | 29% | +------------------------------------+---------------------+ Table 2: CPU Usage Data The Template Record for such a Data Record will detail two Information Elements: 1. flowStartSeconds from [RFC7012], Information Element 150: The absolute timestamp of the first packet of this Flow. 2. a mibObjectValue for cpmCPUTotal1minRev, the overall CPU busy percentage in the last one-minute period Figure 19 shows the exported Template Set detailing the Template Record for exporting CPU Load (see Section 6.3). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 2 | Length = 53 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 259 | Field Count = 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = flowStartSeconds | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = mibObjectValue | Field Length = 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 19: Example of CPU Load Template Set Figure 20 shows the exported Template Set detailing the mibfieldOption Template Record for exporting CPU Load (see Section 6.3). Note this identical to the mibFieldOption template given in Figure 16 so the same template could have been reused. 0 1 2 3 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length = 26 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 260 | Field Count = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope field count = 2 |0| IE = templateId | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = informationElementIndex| Aitken, et al. Expires April 24, 2014 [Page 27] Internet-Draft Exporting MIB Variables with IPFIX October 2013 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = mibObjectBaseSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 |0| IE = mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 20: Example of CPU Load mibFieldOption Template Set Figure 21 shows the exported mib Field Option detailing the metadata that will be exported about the mibObjectValue Field in Template 259 in Template Record (see Section 6.3). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 260 | Length = 40 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | templateId = 259 | informationElementIndex = 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |BSyntax=Gauge32| VLEN=31 | mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | .. mibObjectIdentifier = "1.3.6.1.4.1.9.9.109.1.1.1.1.7" .. | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 21: Example of CPULoad mibFieldOption Data Set Note that although cpmCPUTotal1minRev is 32 bits long, reduced size encoding ([RFC7011]) has been used to encoded it within a single octet. This example stresses that, even though the OID cpmCPUTotal1minRev is enterprise-specific, the E bit for the mibObjectValue and mibObjectIdentifier is set to "0" since the "mibObjectValue" and "mibObjectIdentifier" Information Element is not enterprise-specific. Aitken, et al. Expires April 24, 2014 [Page 28] Internet-Draft Exporting MIB Variables with IPFIX October 2013 The corresponding Data Set does not add any value for this example, and is therefore not displayed. 6.4. Indexed MIB Object with Two OIDs: The ipIfStatsInForwDatagrams MIB objects may be indexed by multiple indices. Note that all the indices apply to the MIB object, i.e. index 2 is not an index of index 1. (If that was the case, then IPFIX Structured Data [RFC6313] must be used to group the indices.) This example shows the export of ipIfStatsInForwDatagrams from the IP-MIB [RFC4293] indexed by the ipIfStatsIPVersion and ipIfStatsIfIndex which are provided as scope fields in an IPFIX option. Note that since these fields are used as indices for ipIfStatsInForwDatagrams, they don't need their own indices to be identified. The Options Template Record for the example Data Record contains the following Information Elements: 1. ipIfStatsIPVersion (1.3.6.1.2.1.4.31.3.1.1) (scope field) 2. ipIfStatsIfIndex (1.3.6.1.2.1.4.31.3.1.2) (scope field) 3. ipIfStatsInForwDatagrams (1.3.6.1.2.1.4.31.3.1.12) (non-scope field) indexed by ipIfStatsIPVersion and ipIfStatsIfIndex Figure 22 shows the exported Options Template Set. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length = 22 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 261 | Field Count = 3 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope Field Count = 2 |0|Scope Field 1=mibObjectValue | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope Field 1 Length = 1 |0|Scope Field 2=mibObjectValue | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope Field 1 Length = 2 |0| IE = mibObjectValue | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 22: Example of an Options Template for an Indexed MIB Object with two indices. Aitken, et al. Expires April 24, 2014 [Page 29] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Figure 23 shows the exported mibFieldOptions Template used to export the required mibObjectValue metadata. This example of the mibFieldOption Template includes the mibIndexList to indicate that some of the other fields in the data records are indexes. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length = 34 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 262 | Field Count = 5 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope field count = 2 |0| IE = templateId | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = informationElementIndex| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = mibObjectBaseSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 |0| IE = mibIndexList | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibOjectSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+++++++++++++++++++++++++++++++++ | Field Length = 65535 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 23: Example of an MIB Field Options Template for an Indexed MIB Object with two indices. Figure 24 shows the exported mibFieldOption Data used to export the required mibObjectValue metadata. Note that the first 2 Data Records have their mibIndexList length set to an empty length of 0. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 262 | Length = 140 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | templateId = 261 | informationElementIndex = 0 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | BaSyntax=INT | index VLEN=0 | OID VLEN = 22 | mibOID ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | .. MIB Object Identifier = "1.3.6.1.2.1.4.31.3.1.1" ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | Aitken, et al. Expires April 24, 2014 [Page 30] Internet-Draft Exporting MIB Variables with IPFIX October 2013 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | VLEN = 18 | mibObjectSyntax ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mib object syntax = ipIfStatsIPVersion ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mib object syntax continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mib object syntax continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mib object syntax continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | templateId = 261 | informationElementIndex = 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | BaSyntax=INT32| index VLEN=0 | OID VLEN = 23 | Mib OID ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | .. MIB Object Identifier = "1.3.6.1.2.1.4.31.3.1.2" ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | VLEN = 15 | mib Object Syntax = InterfaceIndex | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mib Object Syntax continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mib Object Syntax continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mib Object Syntax continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | templateId = 261 | informationElementIndex = 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |BaSyntx=Cnter32| index VLEN=2 | mibIndexList 1st index = 0 .. | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | .. minIndexList 2nd index = 1 | OID VLEN = 23 | mibOID ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | .. MIB Object Identifier = "1.3.6.1.2.1.4.31.3.1.12" | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | Aitken, et al. Expires April 24, 2014 [Page 31] Internet-Draft Exporting MIB Variables with IPFIX October 2013 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Id ... | VLEN = 9 | mibObjSyntax. | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Syntax = "Counter32" ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Syntax continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 24: Example of an MIB Field Options Data Set for an Indexed MIB Object with two indices. Figure 25 shows the Data records that export the values of the 3 mibObjectValues. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 261 | Length = 18 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 4 | 10 | 10000 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | .... | 6 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 10 | 20000 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 25: Example of an MIB Data Set for an Indexed MIB Object with two indices. 6.5. Indexed MIB Object with an IPFIX Information Element: Output Interface Queue Size in PSAMP Packet Report If a PSAMP Packet Report [RFC5476] was generated on any dropped packets on an interface then it may be desirable to know if the send queue on the output interface was full. This could be done be exporting the size of the send queue (ifOutQLen) in the same Data Record as the PSAMP Packet Report. The exported data looks like: +-------------+-------------+--------+----------+-------------------+ | SRC ADDR | DST ADDR | PAK | OUTPUT | OUTPUT Q. LEN | Aitken, et al. Expires April 24, 2014 [Page 32] Internet-Draft Exporting MIB Variables with IPFIX October 2013 | | | LEN | I/F | (ifOutQLen) | +-------------+-------------+--------+----------+-------------------+ | 192.0.2.1 | 192.0.2.3 | 150 | Eth 1/0 | 45 | | | | | (15) | | | 192.0.2.4 | 192.0.2.9 | 350 | Eth 1/0 | 45 | | | | | (15) | | | 192.0.2.3 | 192.0.2.9 | 650 | Eth 1/0 | 23 | | | | | (15) | | | 192.0.2.4 | 192.0.2.6 | 350 | Eth 1/1 | 0 | | | | | (16) | | +-------------+-------------+--------+----------+-------------------+ Table 3: Packet Report with Interface Output Queue Length (ifOutQLen) Data The MIB object for the Interface Output Queue Length, ifOutQLen ("1.3.6.1.2.1.2.2.1.21"), is indexed by the ifIndex interface index as detailed in the IF-MIB [RFC2863]. If, for example, the interface index of "Eth 1/0" in the example is 15, the full MIB Object Identifier for (ifOutQLen) would be "1.3.6.1.2.1.2.2.1.21.15". Without a method to specify the index the full MIB OID would have to be used, which would mean specifying a new Template Record. Rather than export a separate Template Record for each Interface Index, it is more practical to identify the index in the Data Record itself. In fact, only how the indexed object was indexed is necessary, although it is often useful to specify the index value. The example identifies the Egress Interface, but for other uses it may be sufficient to know that the ifOutQLen value was taken for the interface that the packet was switched out of, without identifying the actual interface. The Template Record for the example Data Record contains the following Information Elements: 1. sourceIPv4Address 2. destinationIPv4Address 3. totalLengthIPv4 4. egressInterface 5. ifOutQLen indexed by: egressInterface Aitken, et al. Expires April 24, 2014 [Page 33] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Figure 26 shows the exported Template Set detailing the Template for exporting a PSAMP Report with Interface Output Queue Length (ifOutQLen). Figure 27 and Figure 28 show the mibFieldOption Template and Data Record. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 2 | Length = 63 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 263 | Field Count = 5 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = sourceIPv4Address | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = destinationIPv4Address | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = totalLengthIPv4 | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = egressInterface | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = mibObjectValue | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 26: Example of Template for a PSAMP Report with ifOutQLen indexed by egressInterface 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length = 34 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 264 | Field Count = 5 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope field count = 2 |0| IE = templateId | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = informationElementIndex| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = mibObjectBaseSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 |0| IE = mibIndexList | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 27: Example of mibFieldOption Template for a PSAMP Report with ifOutQLen indexed by egressInterface Aitken, et al. Expires April 24, 2014 [Page 34] Internet-Draft Exporting MIB Variables with IPFIX October 2013 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 264 | Length = 41 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | templateId = 263 | informationElementIndex = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | BaSyntax=INT | index VLEN=2 | mibIndexList = 3 = egressInt | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OID VLEN = 20 | mibObjectIdentifier ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier = "1.3.6.1.2.1.2.2.1.21" | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | +-+-+-+-+-+-+-+-+ Figure 28: Example of mibFieldOption Data Record for a PSAMP Report with ifOutQLen indexed by egressInterface The corresponding IPFIX Data Record is shown in Figure 29. For the sake of the example, the interface index of "Eth 1/0" is 15 and the interface index of "Eth 1/1" is 16. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 260 | Length = 84 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.0.2.1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.0.2.3 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 150 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 15 (Eth 1/0) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 45 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.0.2.4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.0.2.9 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Aitken, et al. Expires April 24, 2014 [Page 35] Internet-Draft Exporting MIB Variables with IPFIX October 2013 | 350 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 15 (Eth 1/0) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 45 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.0.2.3 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.0.2.9 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 650 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 15 (Eth 1/0) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 23 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.0.2.4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.0.2.6 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 350 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 16 (Eth 1/1) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 0 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 29: Example of PSAMP Packet Report with ifOutQLen indexed by egressInterface 6.6. Indexed MIB Object with an OID: Output Interface Queue Size in PSAMP Packet Report Following on the example from the previous section (see Section 6.5), if the Template Record for the example Data Record does not contain the egressInterface, the ifOutQLen can be indexed by the ifIndex interface index as detailed in the IF-MIB [RFC2863] contained in the mibIndexString IE : The Template Record for the example Data Record contains the following Information Elements: 1. sourceIPv4Address 2. destinationIPv4Address 3. totalLengthIPv4 Aitken, et al. Expires April 24, 2014 [Page 36] Internet-Draft Exporting MIB Variables with IPFIX October 2013 4. mibIndexString containing ifIndex 5. ifOutQLen indexed by: the mibIndexString Figure 30 shows the exported Template Set detailing the Template for exporting a PSAMP Report with Interface Output Queue Length (ifOutQLen) but using the ifIndex MIB object as the exported index. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 2 | Length = 63 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 265 | Field Count = 5 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = sourceIPv4Address | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = destinationIPv4Address | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = totalLengthIPv4 | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = mibObjectValue | Field Length = 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = mibIndexString | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 30: Example of Template for a PSAMP Report with ifOutQLen indexed by a string index 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length = 34 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 266 | Field Count = 5 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope field count = 2 |0| IE = templateId | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = informationElementIndex| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = mibObjectBaseSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 |0| IE = mibIndexList | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Aitken, et al. Expires April 24, 2014 [Page 37] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Figure 31: Example of mibFieldOption Template for a PSAMP Report with ifOutQLen indexed by a string index 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 264 | Length = 41 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | templateId = 263 | informationElementIndex = 3 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |BaSyn=Gauge32 | index VLEN=2 | mibIndexList = 4 = IndexString| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OID VLEN = 20 | mibObjectIdentifier ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier = "1.3.6.1.2.1.2.2.1.21" | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | +-+-+-+-+-+-+-+-+ Figure 32: Example of mibFieldOption Data Record for a PSAMP Report with ifOutQLen indexed by a string index Note that IPFIX reduced size encoding [RFC7011] has been used in this example to express ifOutQLen in a single octet, rather than the 32 bits specified in the IF-MIB [RFC2863]. The corresponding IPFIX Data Record is shown in Figure 33. For the sake of the example, the interface index of "Eth 1/0" is 15 and the interface index of "Eth 1/1" is 16. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 263 | Length = 72 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.0.2.1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.0.2.3 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 150 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 45 | "15" ... | Aitken, et al. Expires April 24, 2014 [Page 38] Internet-Draft Exporting MIB Variables with IPFIX October 2013 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | 192.0.2.4 ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | 192.0.2.9 ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | 350 ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | 45 | "15" ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | 192.0.2.3 ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | 192.0.2.9 ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | 650 ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | 23 | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... "15" | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... 192.0.2.4 | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... 192.0.2.6 | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... 350 | 0 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | "16" | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 33: Example of PSAMP Packet Report with the ifOutQLen using ifIndex from IF-MIB [RFC2863] as an index 6.7. Indexed MIB Objects with a mix of MIB OID and IPFIX Information Element TODO: insert example. 6.8. Indexed MIB Object with MIBInstanceIdentifier Information Element: ipIfStatsOutOctets This example shows the export of ipIfStatsOutOctets from the IP-MIB [RFC4293] indexed by the ipIfStatsIPVersion and ipIfStatsIfIndex, using the MIBInstanceIdentifier Information Element to carry the index information. The exported data looks like: +--------------------+------------------+--------------------+ | ipIfStatsIPVersion | ipIfStatsIfIndex | ipIfStatsOutOctets | Aitken, et al. Expires April 24, 2014 [Page 39] Internet-Draft Exporting MIB Variables with IPFIX October 2013 +--------------------+------------------+--------------------+ | 1(IPv4) | 10 | 235876 | | 2(IPv6) | 11 | 38688 | +--------------------+------------------+--------------------+ Table 4: The number octets in IP datagrams delivered to the lower layers for transmission The MIB object ipIfStatsOutOctets ("1.3.6.1.2.1.4.31.3.1.32"), is indexed by ipIfStatsIPVersion and ipIfStatsIfIndex as detailed in IP- MIB [RFC4293]. The instance of the ipIfStatsOutOctets for the IPv4 protocol on the interface identified by ifIndex 10 is identified in the Data Record Field mibIndexString with the instance identifier segment ("1.10") in string format, while the instance of the ipIfStatsOutOctets for the IPv6 protocol on the interface identified by ifIndex 11 is identified in the Data Record Field mibIndexString with the instance identifier segment ("2.11") in string format. The Template Record for the example Data Records contains the following Information Elements: 1. mibObjectValue ipIfStatsOutOctets (1.3.6.1.2.1.4.31.3.1.32) 2. mibIndexString Figure 34 shows the exported Template Set. 0 1 2 2 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 2 | Length = 16 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 267 | Field Count = 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = mibObjectIdentifier | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = mibIndexString | Field Length = 65535 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 34: Example of a Template for MIB Objects that use the MIBInstanceIdentifier Information Element 0 1 2 2 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length = 34 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 268 | Field Count = 5 | Aitken, et al. Expires April 24, 2014 [Page 40] Internet-Draft Exporting MIB Variables with IPFIX October 2013 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope field count = 2 |0| IE = templateId | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = informationElementIndex| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = mibObjectBaseSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 |0| IE = mibIndexList | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 35: Example of a mibFieldOption Template for MIB Objects that use the MIBInstanceIdentifier Information Element 0 1 2 2 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 266 | Length = 41 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | templateId = 265 | informationElementIndex = 0 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | BaSyntax=CNT32| index VLEN=2 | mibIndexList = 1 = IndexString| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OID VLEN = 23 | mibObjectIdentifier ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier = "1.3.6.1.2.1.4.31.3.1.32" | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 36: Example of a mibFieldOption Data Set for MIB Objects that use the MIBInstanceIdentifier Information Element The corresponding IPFIX Data Record is shown in Figure 37. Variable length encoding is used for MIBInstanceIdentifier Information Element. Aitken, et al. Expires April 24, 2014 [Page 41] Internet-Draft Exporting MIB Variables with IPFIX October 2013 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 262 | Length = 22 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ipIfStatsOutOctets = 235876 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Length = 4 | "1.10"... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | ipIfStatsOutOctets = 38688 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | Length = 4 | "2.11"... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 37: Example of ipIfStatsOutOctets using ipIfStatsIPVersion and ipIfStatsIfIndex as indices 6.9. Using MIB Objects as IPFIX Options Scope fields Both indexed and non-indexed MIB Objects may be used as IPFIX Options Scope fields as discussed in Section 5.3.2. 6.9.1. Using non-Indexed MIB Objects as Option Scope fields TODO: insert example. 6.9.2. Using Indexed MIB Objects as Option Scope fields TODO: insert example. 6.10. Using MIB Objects with IPFIX Structured Data It's possible to export both indexed and non-indexed MIB objects using IPFIX Structured Data per [RFC6313] as shown in the example below. TODO: insert example. 6.11. Using IPFIX Structured Data to group the index MIB and indices TODO: insert example. 6.12. Non-indexed MIB Object: Established TCP Connections With Optional Fields Aitken, et al. Expires April 24, 2014 [Page 42] Internet-Draft Exporting MIB Variables with IPFIX October 2013 This is an extended example of Figure 18 that also includes all the optional mibFieldOption Fields that MAY be included. The Template Record for such a Data Record will detail two Information Elements: 1. flowStartSeconds from [RFC7012], Information Element 150: The absolute timestamp of the first packet of this Flow. 2. tcpCurrEstab from [RFC4022], Object ID "1.3.6.1.2.1.6.9": The number of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT. Figure 38 shows the exported Template Set detailing the Template Record for exporting the number of established TCP connections (see Section 6.12). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 2 | Length = 16 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 269 | Field Count = 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = flowStartSeconds | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| IE = mibObjectValue | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 38: Example of tcpCurrEstab Template Set Figure 39 shows the exported mib Field Option detailing the metadata that will be exported about the mibObjectValue Field in Template 257 in Template Record (see Section 6.12). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 3 | Length = 38 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 270 | Field Count = 3 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope field count = 2 |0| IE = templateId | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = informationElementIndex| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 2 |0| IE = mibObjectBaseSyntax | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Aitken, et al. Expires April 24, 2014 [Page 43] Internet-Draft Exporting MIB Variables with IPFIX October 2013 | Field Length = 1 |0| IE = mibCaptureTimeSemantics| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 1 |0| IE = mibObjectIdentifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibObjectName | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 |0| IE = mibObjectDescription | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 65535 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 39: Example of tcpCurrEstab mibFieldOption Template Set Figure 40 shows the exported mib Field Option detailing the metadata that will be exported about the mibObjectValue Field in Template 257 in Template Record (see Section 6.12). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 258 | Length = 134 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | templateId = 257 | informationElementIndex = 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Syntax=Gauge32| eTime = Start | VLEN=16 |mibObjectIden...| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mibObjectIdentifier = "1.3.6.1.2.1.6.9" | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... MIB Object Identifier continued ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | VLEN=8 | mibObjectName = ........ | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... mibObjectName = "tcpCurrEstab" | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... name | VLEN=100 | mibObjectDescription ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ..mibObjectDescription = "The number of TCP connections for | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ..mibObjectDescription = which the current state is either | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ..mibObjectDescription = ESTABLISHED or CLOSE-WAIT." ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... end of mibObjectDescription | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Aitken, et al. Expires April 24, 2014 [Page 44] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Figure 40: Example of tcpCurrEstab mibFieldOption Data Set Figure 41 shows the start of the Data Set for exporting the number of established TCP connections (see Section 6.12). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Set ID = 257 | Length = 52 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | StartTime + 0 seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 10 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | StartTime + 60 seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 14 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | StartTime + 120 seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 19 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | StartTime + 180 seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 16 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | StartTime + 240 seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 23 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | StartTime + 300 seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 29 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 41: Example of tcpCurrEstab Data Set 7. Configuration Considerations When configuring a MIB OID for export, consideration should be given to whether the SNMP Context String should also be configurable. If a non-default Context String is used then it should be associated with the fields as per Section 5.4. 8. The Collecting Process's Side This section describes the Collecting Process when using SCTP and PR- SCTP as the transport protocol. Any necessary changes to the Aitken, et al. Expires April 24, 2014 [Page 45] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Collecting Process specifically related to TCP or UDP transport protocols are specified in section 10 of [RFC7011]. The specifications in section 9 of [RFC7011] also apply to Collector's that implement this specification. In addition, the following specifications should be noted. A Collecting Process that implements this specification MUST have access to MIB modules in order to look up the received MIB Object Identifiers and find the type and name of MIB OID fields used in received templates. It should be noted that since reduced size encoding MAY be used by the Exporting Process, the Collecting Process cannot assume a received size for a field is the maximum size it should expect for that field. If a Collecting Process receives a MIB Object Identifier that it cannot decode, it SHOULD log an error. If a Collecting Process receives a MIB Object Identifier for an indexed MIB object but isn't sent the appropriate number of indices then it SHOULD log an error, but it MAY use the Template Record to decode the Data Records as the associated indices are purely semantic information. 9. Applicability Making available the many and varied items from MIB modules opens up a wide range of possible applications for the IPFIX protocol, some quite different from the usual flow information. Some potential enhancements for traditional applications are detailed below: Some monitoring applications periodically export an interface id to interface name mapping using IPFIX Options Templates. This could be expanded to include the MIB object "ifInUcastPkts" of the IF-MIB [RFC2863] indexed using the ingressInterface Information Element, as a index. This would give the input statistics for each interface which can be compared to the flow information to ensure the sampling rate is expected. Or, if there is no sampling, to ensure that all the expected packets are being monitored. 10. Security Considerations For this extension to the IPFIX protocol, the same security considerations as for the IPFIX protocol apply [RFC7011]. The access to MIB objects is controlled by the configuration of the IPFIX exporter. This is consistent with the way IPFIX controls access to other Information Elements in general. The configuration Aitken, et al. Expires April 24, 2014 [Page 46] Internet-Draft Exporting MIB Variables with IPFIX October 2013 of an IPFIX Exporter determines which MIB objects are included in IPFIX Data Records sent to certain collectors. Network operators should take care that the only MIB objects which are included in IPFIX Data Records are ones which the receiving flow collector is allowed to receive. 11. IANA Considerations 11.1. New Data Types The following new data types must be allocated in IANA's IPFIX Information Element Data Types registry [IANA-DATATYPES]. o mibObjectValue o mibObjectIdentifier o mibIndexList o mibIndexString o mibObjectSyntax o mibObjectName o mibObjectDescription o mibCaptureTimeSemantics o mibContext TODO: these types must be properly specified here, like section 3.1 of RFC5102. 11.2. New Information Elements The following new Information Elements must be allocated in IANA's IPFIX registry [IANA-IPFIX], as defined in the following sub- sections: o mibObjectValue o mibObjectIdentifier o mibIndexList o mibIndexString Aitken, et al. Expires April 24, 2014 [Page 47] Internet-Draft Exporting MIB Variables with IPFIX October 2013 o mibObjectName o mibObjectDescription o mibObjectBaseSyntax o mibObjectSyntax o mibCaptureTimeSemantics o mibContextIdentifier o mibName 11.2.1. mibObjectValue A new Information Element "mibObjectValue" must be allocated in IANA's IPFIX registry [IANA-IPFIX], with the following definition: Description: An IPFIX Information Element which denotes that a value from a MIB will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field will be exported as a MIB Object Identifier field in a MIB Field Option. The mibObjectValue Information Element contains the actual data retrieved from a MIB Object. Abstract Data Type: octetArray Data Type Semantics: ElementId: TBD1 Status: current Reference: [this document]. TBD: should there be one IE per type per Section 11.2.7 ? 11.2.2. mibObjectIdentifier A new Information Element "mibObjectIdentifier" must be allocated in IANA's IPFIX registry [IANA-IPFIX], with the following definition: Description: An IPFIX Information Element which denotes that a MIB Object Identifier (MIB OID) is exported in the (Options) Template Record. The mibObjectIdentifier Information Element contains the MIB OID. Aitken, et al. Expires April 24, 2014 [Page 48] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Abstract Data Type: string Data Type Semantics: identifier ElementId: TBD2 Status: current Reference: [this document]. 11.2.3. mibIndexList A new Information Element "mibIndexList" must be allocated in IANA's IPFIX registry [IANA-IPFIX], with the following definition: Description: A list of zero-based indexes of Information Elements referenced by informationElementId within a Template referenced by templateId. These indices indicate which fields index the mibObjectValue. Each informationElementId in the list applies to the mibObjectValue. If exported with variable length and the length is 0 then the list is empty and no indexes apply for this mibObjectValue. Abstract Data Type: octetArray Data Type Semantics: identifier or list ElementId: TBD3 Status: current Reference: [this document]. 11.2.4. mibIndexString A new Information Element "mibIndexString" must be allocated in IANA's IPFIX registry [IANA-IPFIX], with the following definition: Description: A textual representation of an index into a MIB Object. The mibObjectIdentifier and mibIndexString can be concatenated to form a complete index into a MIB. The mibIndexString can be used when the Exporter knows the values of the index OIDs identifying the instance of the object being exported, without the knowledge of the full information on how the MIB objects being exported are indexed. Abstract Data Type: string Aitken, et al. Expires April 24, 2014 [Page 49] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Data Type Semantics: identifier ElementId: TBD4 Status: current Reference: [this document]. 11.2.5. mibObjectName A new Information Element "mibObjectName" must be allocated in IANA's IPFIX registry [IANA-IPFIX], with the following definition: Description: The textual name for a mibObjectIdentifier. Abstract Data Type: string Data Type Semantics: ElementId: TBD5 Status: current Reference: [this document]. 11.2.6. mibObjectDescription A new Information Element "mibObjectDescription" must be allocated in IANA's IPFIX registry [IANA-IPFIX], with the following definition: Description: The textual description for a mibObjectIdentifier. Abstract Data Type: string Data Type Semantics: ElementId: TBD6 Status: current Reference: [this document]. 11.2.7. mibObjectBaseSyntax A new Information Element "mibObjectBaseSyntax" must be allocated in IANA's IPFIX registry [IANA-IPFIX], with the following definition: Aitken, et al. Expires April 24, 2014 [Page 50] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Description: The SMI SYNTAX base type for an exported mibObjectValue. The base SYNTAX will be one of the "base types" defined in the ObjectSyntax CHOICE from [RFC2578]. Allowed values : 1. INTEGER 2. OCTET STRING 3. OBJECT IDENTIFIER 4. Integer32 5. IpAddress 6. Counter32 7. Gauge32 8. Unsigned32 9. TimeTicks 10. Opaque 11. Counter64 Abstract Data Type: unsigned8 Data Type Semantics: ElementId: TBD7 Status: current Reference: [this document]. TBD: should these be consolidated with the RFC5610 / [IANA- DATATYPES] types? TBD: should there be 11 different IEs, one of each of the above types, rather than a single mibObjectValue? Aitken, et al. Expires April 24, 2014 [Page 51] Internet-Draft Exporting MIB Variables with IPFIX October 2013 11.2.8. mibObjectSyntax A new Information Element "mibObjectSyntax" must be allocated in IANA's IPFIX registry [IANA-IPFIX], with the following definition: Description: The MIB SYNTAX string for a mibObjectIdentifier contains the SYNTAX string as defined for the MIB Object referenced by the MIB OID. This will either be the name of one of the primitive "base types" from [RFC2578] or a Textual Convention name. Abstract Data Type: string Data Type Semantics: ElementId: TBD8 Status: current Reference: [this document]. 11.2.9. mibCaptureTimeSemantics A new Information Element "mibCaptureTimeSemantics" must be allocated in IANA's IPFIX registry [IANA-IPFIX], with the following definition: Description: Indicates when in the lifetime of the flow the MIB value was extracted for a mibObjectIdentifier. This is used to indicate if the value exported was collected from the MIB closer to flow creation or flow export time and will refer to the Timestamp fields included in the same record. This field SHOULD be used when exporting mibObjectValues that specify counters or statistics. Values: 1. undefined 2. flow creation - The value for the MIB Object is captured from the MIB when the Flow is created 3. flow end - The value for the MIB Object is captured from the MIB when the Flow ends 4. flow export - The value for the MIB Object is captured from the MIB the Flow is being Exported Aitken, et al. Expires April 24, 2014 [Page 52] Internet-Draft Exporting MIB Variables with IPFIX October 2013 5. average - The value for the MIB Object is an average of multiple captures from the MIB over the life of the Flow Abstract Data Type: unsigned8 Data Type Semantics: ElementId: TBD9 Status: current Reference: [this document]. 11.2.10. mibContextIdentifier A new Information Element "mibContextIdentifier" must be allocated in IANA's IPFIX registry [IANA-IPFIX], with the following definition: Description: This Information Element denotes that a MIB Context Identifier is exported in the (Options) Template Record. Abstract Data Type: mibContext Data Type Semantics: identifier ElementId: TBD10 Status: current Reference: [this document]. 11.2.11. mibName A new Information Element "mibName" must be allocated in IANA's IPFIX registry [IANA-IPFIX], with the following definition: Description: The textual name of the MIB that defines a MIB OID Object. Abstract Data Type: string Data Type Semantics: ElementId: TBD11 Status: current Reference: [this document]. Aitken, et al. Expires April 24, 2014 [Page 53] Internet-Draft Exporting MIB Variables with IPFIX October 2013 12. Acknowledgements The authors would like to thank Andrew Johnson for his collaboration on the first version of the draft. 13. References 13.1. Normative References [IANA-DATATYPES] IANA, "IPFIX Information Element Data Types registry", , , . [IANA-IPFIX] IANA, "IPFIX Information Elements registry", , . [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC2578] McCloghrie, K., Ed., Perkins, D., Ed., and J. Schoenwaelder, Ed., "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. [RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group MIB", RFC 2863, June 2000. [RFC4293] Routhier, S., "Management Information Base for the Internet Protocol (IP)", RFC 4293, April 2006. [RFC7011] Claise, B., Trammell, B., and P. Aitken, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information", STD 77, RFC 7011, September 2013. [RFC7012] Claise, B. and B. Trammell, "Information Model for IP Flow Information Export (IPFIX)", RFC 7012, September 2013. 13.2. Informative References [RFC2982] Kavasseri, R., "Distributed Management Expression MIB", RFC 2982, October 2000. [RFC3444] Pras, A. and J. Schoenwaelder, "On the Difference between Information Models and Data Models", RFC 3444, January 2003. Aitken, et al. Expires April 24, 2014 [Page 54] Internet-Draft Exporting MIB Variables with IPFIX October 2013 [RFC4022] Raghunarayan, R., "Management Information Base for the Transmission Control Protocol (TCP)", RFC 4022, March 2005. [RFC5476] Claise, B., Johnson, A., and J. Quittek, "Packet Sampling (PSAMP) Protocol Specifications", RFC 5476, March 2009. [RFC6313] Claise, B., Dhandapani, G., Aitken, P., and S. Yates, "Export of Structured Data in IP Flow Information Export (IPFIX)", RFC 6313, July 2011. Authors' Addresses Paul Aitken (editor) Cisco Systems, Inc. 96 Commercial Quay Commercial Street Edinburgh EH6 6LX UK Phone: +44 131 561 3616 Email: paitken@cisco.com Benoit Claise Cisco Systems, Inc. De Kleetlaan 6a b1 Diegem 1813 Belgium Phone: +32 2 704 5622 Email: bclaise@cisco.com Srikar Cisco Systems, Inc. Mail Stop BGL13/3/, SEZ Unit, Cessna Business Park, Kadubeesanahalli Village Varthur Hobli, Sarjapur Marathalli Outer Ring Road Bangalore KARNATAKA 560 103 IN Phone: +91 80 4426 3264 Email: srikar@cisco.com Aitken, et al. Expires April 24, 2014 [Page 55] Internet-Draft Exporting MIB Variables with IPFIX October 2013 Colin McDowall Cisco Systems, Inc. 96 Commercial Quay Commercial Street Edinburgh EH6 6LX UK Phone: +44 131 561 3634 Email: cmcdowal@cisco.com Juergen Schoenwaelder Jacobs University Bremen Campus Ring 1 Bremen 28725 Germany Phone: +49 421 200-3587 Email: j.schoenwaelder@jacobs-university.de Aitken, et al. Expires April 24, 2014 [Page 56]