Network Working Group B. Trammell Internet-Draft ETH Zurich Intended status: Informational S. Niccolini Expires: October 13, 2011 NEC B. Claise Cisco Systems Inc. H. Kaplan Acme Packet April 11, 2011 SIP Message Information Export using IPFIX draft-trammell-ipfix-sip-msg-00 Abstract This draft defines a set of Information Elements and example Templates for IP Flow Information Export (IPFIX) based on the SIP Common Log Format data model, to allow IPFIX export of application- layer information about SIP messages. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on October 13, 2011. Copyright Notice Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect Trammell, et al. Expires October 13, 2011 [Page 1] Internet-Draft SIP Messages in IPFIX April 2011 to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Base Information Elements for SIP Message Information Export . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1. sipObservationType . . . . . . . . . . . . . . . . . . . . 4 2.2. sipMethod . . . . . . . . . . . . . . . . . . . . . . . . 4 2.3. sipSequenceNumber . . . . . . . . . . . . . . . . . . . . 4 2.4. sipRequestURI . . . . . . . . . . . . . . . . . . . . . . 4 2.5. sipFromURI . . . . . . . . . . . . . . . . . . . . . . . . 5 2.6. sipFromTag . . . . . . . . . . . . . . . . . . . . . . . . 5 2.7. sipToURI . . . . . . . . . . . . . . . . . . . . . . . . . 5 2.8. sipToTag . . . . . . . . . . . . . . . . . . . . . . . . . 5 2.9. sipCallId . . . . . . . . . . . . . . . . . . . . . . . . 5 2.10. sipResponseStatus . . . . . . . . . . . . . . . . . . . . 5 2.11. sipServerTransaction . . . . . . . . . . . . . . . . . . . 5 2.12. sipClientTransaction . . . . . . . . . . . . . . . . . . . 6 2.13. sipMethod subregistry . . . . . . . . . . . . . . . . . . 6 3. Recommended Templates for SIP Message Information Export . . . 6 4. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 4.1. Base Template Export . . . . . . . . . . . . . . . . . . . 8 4.2. UAC registration . . . . . . . . . . . . . . . . . . . . . 9 4.3. Direct Call . . . . . . . . . . . . . . . . . . . . . . . 11 4.4. Single Downstream Branch Call . . . . . . . . . . . . . . 12 4.5. Forked Call . . . . . . . . . . . . . . . . . . . . . . . 14 5. Security Considerations . . . . . . . . . . . . . . . . . . . 18 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 18 7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 18 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 18 8.1. Normative References . . . . . . . . . . . . . . . . . . . 18 8.2. Informative References . . . . . . . . . . . . . . . . . . 19 Appendix A. Definition of SIP Message Information Elements in IANA XML Registry format . . . . . . . . . . . . . . 20 Appendix B. Definition of sipMethod registry in IANA XML Registry format . . . . . . . . . . . . . . . . . . . 23 Appendix C. Example messages in base64 . . . . . . . . . . . . . 26 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 28 Trammell, et al. Expires October 13, 2011 [Page 2] Internet-Draft SIP Messages in IPFIX April 2011 1. Introduction IPFIX [RFC5101] provides a standardized means of exporting flow information from IPFIX exporters to IPFIX collectors. This allows collectors to analyze flows from one or more sources for numerous uses, such as traffic patterns/trends, anomalies, failures, attacks, and much more. IPFIX supports exporting data in near real-time, in a secure manner, over multiple transports; as well as in local storage with a defined file format. The core IPFIX information model is maintained by IANA as a registry of Information Elements at http://www.iana.org/assignments/ipfix/. In addition to these, which cover many network measurement and management applications, enterprise-specific Information Elements may be defined, scoped to an SMI private enterprise number, for vendor-proprietary Information Elements. Session Initiation Protocol (SIP), defined by [RFC3261] and its extensions, is used by many devices to perform a rendezvous service, initiate and manage real-time communication sessions, install and monitor state information, and more. In many deployments, SIP messages cross multiple systems managed by the same administrative entity, and thus providing a means of exporting and collecting SIP message information from such systems using a standard protocol is highly desirable. This document defines a set of IPFIX Information Elements to enable SIP devices, such as user agents and proxies, to export SIP message information to IPFIX collectors using the IPFIX protocol. The purpose of doing so is to enable collectors to analyze the SIP "traffic", for similar purposes as those for any other IPFIX flows. Defining IANA-registered (i.e., well-known) IPFIX IE fields enables IPFIX records of SIP message information to be generated and consumed by different vendors. Within the context of this document's IPFIX IE fields, a single SIP message is a complete IPFIX Flow as defined in [RFC5101] The SIPCLF Working Group has defined a data model [I-D.ietf-sipclf-problem-statement] for logging information about SIP messages to ASCII-based SIPCLF files. While useful for on-box storage and analysis with ASCII-based tools, SIPCLF does not provide a means of exporting such information, nor is that its goal. This document borrows the data model from SIPCLF and represents these in IPFIX Information Elements. It additionally provides examples for IPFIX representation of the example SIP Messages provided in the SIPCLF problem statement. Trammell, et al. Expires October 13, 2011 [Page 3] Internet-Draft SIP Messages in IPFIX April 2011 2. Base Information Elements for SIP Message Information Export The following Information Elements represent SIP-specific mandatory fields defined in [I-D.ietf-sipclf-problem-statement], many themselves taken from [RFC3261]. Together with Information Elements already available in the IPFIX IANA Information Elements registry, these can be used to export information about SIP Messages. 2.1. sipObservationType Description: Denotes whether the entry was corresponds to a SIP message received, sent, or merely seen by a passive observer, as follows: 0: unknown: The Metering Process does not specify the observation type. 1: receiver: The Metering Process is, or is co-located with, the receiver of the SIP message. 2: sender: The Metering Process is, or is co-located with, the sender of the SIP message. 3: passive: The Metering Process passively observed the SIP message. Data Type: unsigned8 Data Type Semantics: identifier ElementId: 419 2.2. sipMethod Description: The SIP method from the CSeq header, encoded as per the IPFIX sipMethod subregistry. Data Type: unsigned8 Data Type Semantics: identifier ElementId: 402 2.3. sipSequenceNumber Description: The sequence number from the CSeq header. Data Type: unsigned32 Data Type Semantics: identifier ElementId: 409 2.4. sipRequestURI Description: The SIP Request URI, including any parameters, as a UTF-8 string, escaped according to SIP rules as received by the metering process. Trammell, et al. Expires October 13, 2011 [Page 4] Internet-Draft SIP Messages in IPFIX April 2011 Data Type: string ElementId: 403 2.5. sipFromURI Description: The URI from the SIP From: header Data Type: string ElementId: 404 2.6. sipFromTag Description: The Tag parameter value from the SIP From: header Data Type: string ElementId: 405 2.7. sipToURI Description: The URI from the SIP To: header Data Type: string ElementId: 406 2.8. sipToTag Description: The Tag parameter value from the SIP To: header Data Type: string ElementId: 407 2.9. sipCallId Description: The value of the SIP Call-ID: header Data Type: string ElementId: 408 2.10. sipResponseStatus Description: The SIP Response code. The presence of this Information Element in a SIP Message record marks it as describing a SIP response; if absent, the record describes a SIP request. Data Type: unsigned16 Data Type Semantics: identifier ElementId: 412 2.11. sipServerTransaction Trammell, et al. Expires October 13, 2011 [Page 5] Internet-Draft SIP Messages in IPFIX April 2011 Description: The transaction identifier associated with the server transaction. Data Type: string Data Type Semantics: identifier ElementId: 413 2.12. sipClientTransaction Description: The transaction identifier associated with the client transaction. Data Type: string Data Type Semantics: identifier ElementId: 414 2.13. sipMethod subregistry [EDITOR'S NOTE: frontmatter] +----------+------------+-----------+ | Number | Method | Reference | +----------+------------+-----------+ | 0 | Unknown | | | 1 | ACK | [RFC3261] | | 2 | BYE | [RFC3261] | | 3 | CANCEL | [RFC3261] | | 4 | INFO | [RFC2976] | | 5 | INVITE | [RFC3261] | | 6 | MESSAGE | [RFC3428] | | 7 | NOTIFY | [RFC3265] | | 8 | OPTIONS | [RFC3261] | | 9 | PRACK | [RFC3262] | | 10 | PUBLISH | [RFC3903] | | 11 | REFER | [RFC3515] | | 12 | REGISTER | [RFC3261] | | 13 | SUBSCRIBE | [RFC3265] | | 14 | UPDATE | [RFC3311] | | 15-65535 | Unassigned | | +----------+------------+-----------+ 3. Recommended Templates for SIP Message Information Export The SIPCLF data model represents SIP requests and SIP responses with separate records. The following Templates are defined as recommended base Templates for records describing requests and responses. Optional Information Elements MAY be added to them, and the IPv4 addresses within these Templates MUST be replaced with IPv6 addresses for logging IPv6 transport of SIP messages. A sipServerTransaction Trammell, et al. Expires October 13, 2011 [Page 6] Internet-Draft SIP Messages in IPFIX April 2011 Information Element SHOULD be added for all messages logged by a User Agent Server, and a sipClientTransaction Information Element SHOULD be added for all messages logged by a User Agent Client. These templates follow the recommended fields for request and response logging in [I-D.ietf-sipclf-problem-statement], and are defined using the representation in section 9 of [I-D.trammell-ipfix-ie-doctors]. observationTimeMilliseconds(323)[8] sipSequenceNumber(35566/409)[4] sourceIPv4Address(8)[4] destinationIPv4Address(12)[4] sourceTransportPort(7)[2] destinationTransportPort(11)[2] protocolIdentifier(4)[1] sipMethod(35566/402)[1] sipObservationType(35566/419)[1] sipRequestURI(35566/403)[v] sipToURI(35566/406)[v] sipToTag(35566/407)[v] sipFromURI(35566/404)[v] sipFromTag(35566/405)[v] sipCallId(35566/408)[v] Figure 1: Base Request Template (IPv4) observationTimeMilliseconds(323)[8] sipSequenceNumber(35566/409)[4] sourceIPv4Address(8)[4] destinationIPv4Address(12)[4] sourceTransportPort(7)[2] destinationTransportPort(11)[2] protocolIdentifier(4)[1] sipMethod(35566/402)[1] sipObservationType(35566/419)[1] sipResponseStatus(35566/412)[2] sipToURI(35566/406)[v] sipToTag(35566/407)[v] sipFromURI(35566/404)[v] sipFromTag(35566/405)[v] sipCallId(35566/408)[v] Figure 2: Base Response Template (IPv4) Note that the Information Elements in these templates are ordered to place the fixed-length elements before the variable-length ones, which speeds random access to fixed-length elements. However, since element order within a record is unimportant in IPFIX, any ordering Trammell, et al. Expires October 13, 2011 [Page 7] Internet-Draft SIP Messages in IPFIX April 2011 of the mandatory Information Elements within a record MUST be accepted by a Collecting Process as a valid SIP request or response record for that record type. The record type is determined by the presence of the sipResponseStatus field. If present in the Template, the Template describes a response record. If absent, it describes a request record. 4. Examples [EDITOR'S NOTE: use rfdump more] This section presents several views of an example SIP messages exported using the IPFIX templates described in this document. We present both binary and textual forms. The tools to generate this section are based upon the open-source ripfix [ripfix] implementation of IPFIX, maintained by one of the authors of this draft. Here we show the IPFIX Messages generated by the situations in sections 9.1 through 9.4 of [I-D.ietf-sipclf-problem-statement]. 4.1. Base Template Export Before exporting any Request or Response records, the Templates describing them must be exported. In this example, the templates These Templates are derived from the base Templates as shown in Figure 1 and Figure 2, with the sipClientTransaction and sipServerTransaction Information Elements appended. We use two templates here, one each for request and response for IPv4. Exporting these Templates results in the following IPFIX message, illustrated as an annotated hexdump in Figure 3. Trammell, et al. Expires October 13, 2011 [Page 8] Internet-Draft SIP Messages in IPFIX April 2011 0000: 00 0a 00 fc 4c c0 2a a2 00 00 00 00 00 00 30 39 ....L.*.......09 [ IPFIX message header, length 252 ] 0010: 00 02 00 ec .... [ Template set (ID 2) header, length 236 ] 0014: 01 01 00 11 01 43 00 08 81 99 00 04 .....C...... 0020: 00 00 8a ee 00 08 00 04 00 0c 00 04 00 07 00 02 ................ 0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee ................ 0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee ................ 0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee ................ 0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee ................ 0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee ................ 0080: 81 9d ff ff 00 00 8a ee ........ [ Template 257, 17 elements (v4 request) ] 0088: 01 02 00 11 01 43 00 08 .....C.. 0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 0c 00 04 ................ 00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01 ................ 00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02 ................ 00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff ................ 00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff ................ 00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff ................ 00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee ............ [ Template 258, 17 elements (v4 response) ] Figure 3: Base template message export 4.2. UAC registration Having exported templates, now we create a simple IPFIX Message representing a UAC registration as seen from the UAC, corresponding to example 9.1 in [I-D.ietf-sipclf-problem-statement]. This message contains two records, including the UAS registration request, and the response received. This is shown in the annotated hexdump in Figure 4. Trammell, et al. Expires October 13, 2011 [Page 9] Internet-Draft SIP Messages in IPFIX April 2011 0000: 00 0a 00 d8 4c 90 7f c1 00 00 00 00 00 00 30 39 ....L.........09 [ IPFIX message header, length 218 ] 0010: 01 01 00 6b ...k [ Data set (ID 257) header, length 107 ] 0014: 00 00 01 29 13 66 13 93 00 00 00 01 ...).f...... 0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 0c 02 0f .3d..3d......... 0030: 73 69 70 3a 65 78 61 6d 70 6c 65 2e 63 6f 6d 00 sip:example.com. 0040: 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d ..sip:alice@exam 0050: 70 6c 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 ple.com.76yhh.f8 0060: 31 2d 64 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 1-d4-f6@example. 0070: 63 6f 6d 06 63 2d 74 72 2d 31 00 com.c-tr-1. [ Request record content ] 007b: 01 02 00 5d ...] [ Data set (ID 258) header, length 93 ] 007f: 00 . 0080: 00 01 29 13 66 15 24 00 00 00 01 c6 33 64 0a c6 ..).f.$.....3d.. 0090: 33 64 01 13 c4 13 c4 11 0c 01 00 c8 00 00 15 73 3d.............s 00a0: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 ip:alice@example 00b0: 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 31 2d 64 .com.76yhh.f81-d 00c0: 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 4-f6@example.com 00d0: 06 63 2d 74 72 2d 31 00 .c-tr-1. [ Response record content ] Figure 4: Message containing two log entries for UAC registration While this demonstrates the binary nature of the SIPCLF-IPFIX format, and shows the content framing for this message, it is not readable for illustration purposes. In Figure 5, we run the message through the rfdump tool provided with ripfix to provide a more human-readable view. Note that the sipMethod and sipObservationType are encoded according to the registries in Section 2. Trammell, et al. Expires October 13, 2011 [Page 10] Internet-Draft SIP Messages in IPFIX April 2011 ==== message sequence 0 in domain 12345 at 2010-08-11 11:53:27 UTC ==== ---- record 12345/257 ---- observationTimeMilliseconds => 2010-06-07 17:12:23 UTC sipSequenceNumber => 1 sourceIPv4Address => 198.51.100.1 destinationIPv4Address => 198.51.100.10 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 12 sipObservationType => 2 sipRequestURI => sip:example.com sipToURI => sipToTag => sipFromURI => sip:alice@example.com sipFromTag => 76yhh sipCallId => f81-d4-f6@example.com sipClientTransaction => c-tr-1 sipServerTransaction => ---- record 12345/258 ---- observationTimeMilliseconds => 2010-06-07 17:12:24 UTC sipSequenceNumber => 1 sourceIPv4Address => 198.51.100.10 destinationIPv4Address => 198.51.100.1 sourceTransportPort => 5060 destinationTransportPort => 5060 sipResponseStatus => 200 protocolIdentifier => 17 sipMethod => 12 sipObservationType => 1 sipToURI => sipToTag => sipFromURI => sip:alice@example.com sipFromTag => 76yhh sipCallId => f81-d4-f6@example.com sipClientTransaction => c-tr-1 sipServerTransaction => Figure 5: Message containing two log entries for UAC registration 4.3. Direct Call This example demonstrates the export of a direct call from Alice to Bob, as seen by Bob's agent, corresponding to example 9.2 in [I-D.ietf-sipclf-problem-statement]. Here we have four records: an INVITE received from Alice, a 180 Ringing sent back followed by a 200 OK, and an ACK received from Alice. This is shown in the hexdump in Figure 6; message headers, set headers, and data records are Trammell, et al. Expires October 13, 2011 [Page 11] Internet-Draft SIP Messages in IPFIX April 2011 separated by '|' characters here for compactness. Note here that each record has its own data set to support high-speed seeking to a specific record, even when two messages using the same are adjacent in the message. 0000: 00 0a 02 1a 4c c0 2c b3 00 00 00 00 00 00 30 39 ....L.,.......09 0010: 01 01 00 88 00 00 01 29 13 66 13 93 00 00 00 20 .......).f..... 0020: c6 33 64 01 cb 00 71 01 13 c4 13 c4 11 05 02 18 .3d...q......... 0030: 73 69 70 3a 62 6f 62 40 62 6f 62 31 2e 65 78 61 sip:bob@bob1.exa 0040: 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 mple.net.sip:bob 0050: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 @example.net..si 0060: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example. 0070: 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d 64 34 com.76yhh.f82-d4 0080: 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 07 -f7@example.com. 0090: 63 2d 31 2d 78 74 36 00 01 02 00 79 00 00 01 29 c-1-xt6....y...) 00a0: 13 66 18 aa 00 00 00 20 cb 00 71 01 c6 33 64 01 .f..... ..q..3d. 00b0: 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 6f ..........sip:bo 00c0: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 08 62 2d b@example.net.b- 00d0: 69 6e 36 2d 69 75 15 73 69 70 3a 61 6c 69 63 65 in6-iu.sip:alice 00e0: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 05 37 36 79 @example.com.76y 00f0: 68 68 15 66 38 32 2d 64 34 2d 66 37 40 65 78 61 hh.f82-d4-f7@exa 0100: 6d 70 6c 65 2e 63 6f 6d 07 63 2d 31 2d 78 74 36 mple.com.c-1-xt6 0110: 00 01 02 00 79 00 00 01 29 13 66 1c f4 00 00 00 ....y...).f..... 0120: 20 cb 00 71 01 c6 33 64 01 13 c4 13 c4 11 05 01 ..q..3d........ 0130: 00 c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 ...sip:bob@examp 0140: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15 le.net.b-in6-iu. 0150: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl 0160: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d e.com.76yhh.f82- 0170: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f d4-f7@example.co 0180: 6d 07 63 2d 31 2d 78 74 36 00 01 01 00 90 00 00 m.c-1-xt6....... 0190: 01 29 13 66 1d 08 00 00 00 20 c6 33 64 01 cb 00 .).f..... .3d... 01a0: 71 01 13 c4 13 c4 11 01 02 18 73 69 70 3a 62 6f q.........sip:bo 01b0: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n 01c0: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp 01d0: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15 le.net.b-in6-iu. 01e0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl 01f0: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d e.com.76yhh.f82- 0200: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f d4-f7@example.co 0210: 6d 07 63 2d 31 2d 78 74 36 00 m.c-1-xt6. Figure 6: Message containing four log entries for a simple call 4.4. Single Downstream Branch Call The example in Figure 7 demonstrates the export of a call with a downstream branch to Bob, as seen by the proxy which the call traverses, corresponding to example 9.3 in [I-D.ietf-sipclf-problem-statement]. See this example in the problem Trammell, et al. Expires October 13, 2011 [Page 12] Internet-Draft SIP Messages in IPFIX April 2011 statement for more details. 0000: 00 0a 04 e1 4c c0 2c e5 00 00 00 00 00 00 30 39 ....L.,.......09 0010: 01 01 00 7e 00 00 01 29 13 66 13 93 00 00 00 2b ...~...).f.....+ 0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 05 01 13 .3d..3d......... 0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example. 0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d net.sip:bob@exam 0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali 0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a 0070: 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 l-1.tr-87h@examp 0080: 6c 65 2e 63 6f 6d 00 06 73 2d 78 2d 74 72 01 02 le.com..s-x-tr.. 0090: 00 6c 00 00 01 29 13 66 14 c1 00 00 00 2b c6 33 .l...).f.....+.3 00a0: 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13 d..3d.........d. 00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example. 00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 net..sip:alice@e 00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 xample.com.al-1. 00e0: 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 tr-87h@example.c 00f0: 6f 6d 00 06 73 2d 78 2d 74 72 01 01 00 89 00 00 om..s-x-tr...... 0100: 01 29 13 66 18 a6 00 00 00 2b c6 33 64 0a cb 00 .).f.....+.3d... 0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f q.........sip:bo 0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n 0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp 0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 le.net..sip:alic 0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c e@example.com.al 0160: 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c -1.tr-87h@exampl 0170: 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 e.com.c-x-tr.s-x 0180: 2d 74 72 01 02 00 76 00 00 01 29 13 66 19 70 00 -tr...v...).f.p. 0190: 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 c4 11 ..+..q..3d...... 01a0: 05 01 00 64 13 73 69 70 3a 62 6f 62 40 65 78 61 ...d.sip:bob@exa 01b0: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 mple.net.b1-1.si 01c0: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example. 01d0: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40 com.al-1.tr-87h@ 01e0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d example.com.c-x- 01f0: 74 72 06 73 2d 78 2d 74 72 01 02 00 76 00 00 01 tr.s-x-tr...v... 0200: 29 13 66 1b c8 00 00 00 2b cb 00 71 01 c6 33 64 ).f.....+..q..3d 0210: 0a 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 ...........sip:b 0220: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 ob@example.net.b 0230: 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 1-1.sip:alice@ex 0240: 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 ample.com.al-1.t 0250: 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 6f r-87h@example.co 0260: 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 72 01 m.c-x-tr.s-x-tr. 0270: 02 00 76 00 00 01 29 13 66 1c 98 00 00 00 2b c6 ..v...).f.....+. 0280: 33 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 b4 3d..3d.......... 0290: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 .sip:bob@example 02a0: 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 6c .net.b1-1.sip:al 02b0: 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 ice@example.com. 02c0: 61 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d al-1.tr-87h@exam 02d0: 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 ple.com.c-x-tr.s Trammell, et al. Expires October 13, 2011 [Page 13] Internet-Draft SIP Messages in IPFIX April 2011 02e0: 2d 78 2d 74 72 01 02 00 76 00 00 01 29 13 66 20 -x-tr...v...).f 02f0: f0 00 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 ....+..q..3d.... 0300: c4 11 05 01 00 c8 13 73 69 70 3a 62 6f 62 40 65 .......sip:bob@e 0310: 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 xample.net.b1-1. 0320: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl 0330: 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 e.com.al-1.tr-87 0340: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d h@example.com.c- 0350: 78 2d 74 72 06 73 2d 78 2d 74 72 01 02 00 76 00 x-tr.s-x-tr...v. 0360: 00 01 29 13 66 21 a4 00 00 00 2b c6 33 64 0a c6 ..).f!....+.3d.. 0370: 33 64 01 13 c4 13 c4 11 05 02 00 c8 13 73 69 70 3d...........sip 0380: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 :bob@example.net 0390: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 .b1-1.sip:alice@ 03a0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 example.com.al-1 03b0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e .tr-87h@example. 03c0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 com.c-x-tr.s-x-t 03d0: 72 01 01 00 88 00 00 01 29 13 66 28 ac 00 00 00 r.......).f(.... 03e0: 2b c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 01 01 +.3d..3d........ 03f0: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 .sip:bob@example 0400: 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 .net.sip:bob@exa 0410: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 mple.net.b1-1.si 0420: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example. 0430: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40 com.al-1.tr-87h@ 0440: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d example.com.c-x- 0450: 74 72 06 73 2d 78 2d 74 72 01 01 00 88 00 00 01 tr.s-x-tr....... 0460: 29 13 66 28 ac 00 00 00 2b c6 33 64 0a cb 00 71 ).f(....+.3d...q 0470: 01 13 c4 13 c4 11 01 02 13 73 69 70 3a 62 6f 62 .........sip:bob 0480: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 @example.net.sip 0490: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 :bob@example.net 04a0: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 .b1-1.sip:alice@ 04b0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 example.com.al-1 04c0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e .tr-87h@example. 04d0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 com.c-x-tr.s-x-t 04e0: 72 Figure 7: Message containing ten log entries for a downstream branch call 4.5. Forked Call The example in Figure 9 demonstrates the export of forked call to Bob, as seen by one of Bob's instances which forks the call traverses, corresponding to example 9.4 in [I-D.ietf-sipclf-problem-statement]. See this example for more details. Note that, since Bob's first instance is multihomed IPv4- IPv6, this example requires additional templates: request and response templates for IPv4 to IPv6 and back, these are shown in Figure 8. Trammell, et al. Expires October 13, 2011 [Page 14] Internet-Draft SIP Messages in IPFIX April 2011 0000: 00 0a 01 e4 4c c0 2d 9b 00 00 00 00 00 00 30 39 ....L.-.......09 0010: 00 02 01 d4 01 05 00 11 01 43 00 08 81 99 00 04 .........C...... 0020: 00 00 8a ee 00 08 00 04 00 1c 00 10 00 07 00 02 ................ 0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee ................ 0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee ................ 0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee ................ 0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee ................ 0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee ................ 0080: 81 9d ff ff 00 00 8a ee 01 06 00 11 01 43 00 08 .............C.. 0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 1c 00 10 ................ 00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01 ................ 00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02 ................ 00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff ................ 00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff ................ 00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff ................ 00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee 01 07 00 11 ................ 0100: 01 43 00 08 81 99 00 04 00 00 8a ee 00 1b 00 10 .C.............. 0110: 00 0c 00 04 00 07 00 02 00 0b 00 02 00 04 00 01 ................ 0120: 81 92 00 01 00 00 8a ee 81 a3 00 01 00 00 8a ee ................ 0130: 81 93 ff ff 00 00 8a ee 81 96 ff ff 00 00 8a ee ................ 0140: 81 97 ff ff 00 00 8a ee 81 94 ff ff 00 00 8a ee ................ 0150: 81 95 ff ff 00 00 8a ee 81 98 ff ff 00 00 8a ee ................ 0160: 81 9e ff ff 00 00 8a ee 81 9d ff ff 00 00 8a ee ................ 0170: 01 08 00 11 01 43 00 08 81 99 00 04 00 00 8a ee .....C.......... 0180: 00 1b 00 10 00 0c 00 04 00 07 00 02 00 0b 00 02 ................ 0190: 00 04 00 01 81 92 00 01 00 00 8a ee 81 a3 00 01 ................ 01a0: 00 00 8a ee 81 9c 00 02 00 00 8a ee 81 96 ff ff ................ 01b0: 00 00 8a ee 81 97 ff ff 00 00 8a ee 81 94 ff ff ................ 01c0: 00 00 8a ee 81 95 ff ff 00 00 8a ee 81 98 ff ff ................ 01d0: 00 00 8a ee 81 9e ff ff 00 00 8a ee 81 9d ff ff ................ 01e0: 00 00 8a ee .... Figure 8: Message containing templates for IPv4 to IPv6 requests and responses, and vice versa 0000: 00 0a 07 8c 4c c0 2d 9b 00 00 00 00 00 00 30 39 ....L.-.......09 0010: 01 01 00 7e 00 00 01 29 13 66 13 93 00 00 00 2b ...~...).f.....+ 0020: c6 33 64 01 cb 00 71 c8 13 c4 13 c4 11 05 01 13 .3d...q......... 0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example. 0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d net.sip:bob@exam 0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali 0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a 0070: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 1-1.tr-88h@examp 0080: 6c 65 2e 63 6f 6d 00 06 73 2d 31 2d 74 72 01 02 le.com..s-1-tr.. 0090: 00 6c 00 00 01 29 13 66 14 c1 00 00 00 2b cb 00 .l...).f.....+.. 00a0: 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13 q..3d.........d. 00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example. Trammell, et al. Expires October 13, 2011 [Page 15] Internet-Draft SIP Messages in IPFIX April 2011 00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 net..sip:alice@e 00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1. 00e0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c 00f0: 6f 6d 00 06 73 2d 31 2d 74 72 01 01 00 89 00 00 om..s-1-tr...... 0100: 01 29 13 66 18 a6 00 00 00 2b cb 00 71 c8 cb 00 .).f.....+..q... 0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f q.........sip:bo 0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n 0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp 0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 le.net..sip:alic 0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 e@example.com.a1 0160: 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c -1.tr-88h@exampl 0170: 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 e.com.c-1-tr.s-1 0180: 2d 74 72 01 05 00 95 00 00 01 29 13 66 1a 9c 00 -tr.......).f... 0190: 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 00 00 00 ..+..q. ........ 01a0: 00 00 00 00 00 00 09 13 c4 13 c4 11 05 02 18 73 ...............s 01b0: 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 78 61 6d ip:bob@bob2.exam 01c0: 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 ple.net.sip:bob@ 01d0: 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 70 example.net..sip 01e0: 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 :alice@example.c 01f0: 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 om.a1-1.tr-88h@e 0200: 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 xample.com.c-2-t 0210: 72 06 73 2d 31 2d 74 72 01 02 00 76 00 00 01 29 r.s-1-tr...v...) 0220: 13 66 1b c8 00 00 00 2b cb 00 71 01 cb 00 71 c8 .f.....+..q...q. 0230: 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a 62 6f ........d.sip:bo 0240: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 b@example.net.b1 0250: 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 -1.sip:alice@exa 0260: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 mple.com.a1-1.tr 0270: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d -88h@example.com 0280: 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72 01 08 .c-1-tr.s-1-tr.. 0290: 00 82 00 00 01 29 13 66 1c f4 00 00 00 2b 20 01 .....).f.....+ . 02a0: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00 ................ 02b0: 71 c8 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a q.........d.sip: 02c0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 bob@example.net. 02d0: 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 40 65 b2-2.sip:alice@e 02e0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1. 02f0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c 0300: 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72 om.c-2-tr.s-1-tr 0310: 01 08 00 82 00 00 01 29 13 66 1f 4c 00 00 00 2b .......).f.L...+ 0320: 20 01 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 ............... 0330: cb 00 71 c8 13 c4 13 c4 11 05 01 00 b4 13 73 69 ..q...........si 0340: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 p:bob@example.ne 0350: 74 04 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 t.b2-2.sip:alice 0360: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d @example.com.a1- 0370: 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 1.tr-88h@example 0380: 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d .com.c-2-tr.s-1- 0390: 74 72 01 02 00 72 00 00 01 29 13 66 20 6e 00 00 tr...r...).f n.. 03a0: 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 .+..q..3d....... 03b0: 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 61 6d ....sip:bob@exam Trammell, et al. Expires October 13, 2011 [Page 16] Internet-Draft SIP Messages in IPFIX April 2011 03c0: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali 03d0: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a 03e0: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 1-1.tr-88h@examp 03f0: 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d le.com.c-2-tr.s- 0400: 31 2d 74 72 01 02 00 76 00 00 01 29 13 66 21 a4 1-tr...v...).f!. 0410: 00 00 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 ...+..q..3d..... 0420: 11 05 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 ......sip:bob@ex 0430: 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 ample.net.b1-1.s 0440: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 ip:alice@example 0450: 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 .com.a1-1.tr-88h 0460: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 @example.com.c-1 0470: 2d 74 72 06 73 2d 31 2d 74 72 01 02 00 76 00 00 -tr.s-1-tr...v.. 0480: 01 29 13 66 23 98 00 00 00 2b cb 00 71 01 cb 00 .).f#....+..q... 0490: 71 c8 13 c4 13 c4 11 05 01 00 c8 13 73 69 70 3a q...........sip: 04a0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 bob@example.net. 04b0: 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 b1-1.sip:alice@e 04c0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1. 04d0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c 04e0: 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72 om.c-1-tr.s-1-tr 04f0: 01 02 00 76 00 00 01 29 13 66 24 60 00 00 00 2b ...v...).f$`...+ 0500: cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 ..q..3d......... 0510: c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c ..sip:bob@exampl 0520: 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 e.net.b1-1.sip:a 0530: 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d lice@example.com 0540: 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 .a1-1.tr-88h@exa 0550: 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 mple.com.c-1-tr. 0560: 73 2d 31 2d 74 72 01 05 00 95 00 00 01 29 13 66 s-1-tr.......).f 0570: 25 29 00 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 %)...+..q. ..... 0580: 00 00 00 00 00 00 00 00 00 09 13 c4 13 c4 11 03 ................ 0590: 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 ..sip:bob@bob2.e 05a0: 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 xample.net.sip:b 05b0: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 ob@example.net.. 05c0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl 05d0: 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 e.com.a1-1.tr-88 05e0: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d h@example.com.c- 05f0: 32 2d 74 72 06 73 2d 31 2d 74 72 01 08 00 7e 00 2-tr.s-1-tr...~. 0600: 00 01 29 13 66 28 3f 00 00 00 2b 20 01 0d b8 00 ..).f(?...+ .... 0610: 00 00 00 00 00 00 00 00 00 00 09 cb 00 71 c8 13 .............q.. 0620: c4 13 c4 11 05 01 01 e7 13 73 69 70 3a 62 6f 62 .........sip:bob 0630: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 @example.net..si 0640: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example. 0650: 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 com.a1-1.tr-88h@ 0660: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d example.com.c-2- 0670: 74 72 06 73 2d 31 2d 74 72 01 05 00 95 00 00 01 tr.s-1-tr....... 0680: 29 13 66 2a 0f 00 00 00 2b cb 00 71 c8 20 01 0d ).f*....+..q. .. 0690: b8 00 00 00 00 00 00 00 00 00 00 00 09 13 c4 13 ................ 06a0: c4 11 01 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 .....sip:bob@bob 06b0: 32 2e 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 2.example.net.si Trammell, et al. Expires October 13, 2011 [Page 17] Internet-Draft SIP Messages in IPFIX April 2011 06c0: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 p:bob@example.ne 06d0: 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 t..sip:alice@exa 06e0: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 mple.com.a1-1.tr 06f0: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d -88h@example.com 0700: 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72 01 08 .c-2-tr.s-1-tr.. 0710: 00 7e 00 00 01 29 13 66 2c 31 00 00 00 2b 20 01 .~...).f,1...+ . 0720: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00 ................ 0730: 71 c8 13 c4 13 c4 11 03 01 00 c8 13 73 69 70 3a q...........sip: 0740: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 bob@example.net. 0750: 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 .sip:alice@examp 0760: 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 le.com.a1-1.tr-8 0770: 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 8h@example.com.c 0780: 2d 32 2d 74 72 06 73 2d 31 2d 74 72 -2-tr.s-1-tr Figure 9: Message containing sixteen log entries for a forked call 5. Security Considerations [TODO] 6. IANA Considerations [EDITOR'S NOTE: IANA has added the new Information Elements defined in this document and replaced all Information Element numbers in PEN 34455 with ...] 7. Acknowledgments Thanks to Cullen Jennings for his provided insightful discussions, specific comments and much needed corrections, and to Nico d'Heureuse for his help with the RFC 3665 examples. 8. References 8.1. Normative References [I-D.ietf-sipclf-problem-statement] Gurbani, V., Burger, E., Anjali, T., Abdelnur, H., and O. Festor, "The Common Log Format (CLF) for the Session Initiation Protocol (SIP)", draft-ietf-sipclf-problem-statement-05 (work in progress), March 2011. [RFC5101] Claise, B., "Specification of the IP Flow Information Trammell, et al. Expires October 13, 2011 [Page 18] Internet-Draft SIP Messages in IPFIX April 2011 Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information", RFC 5101, January 2008. [RFC5655] Trammell, B., Boschi, E., Mark, L., Zseby, T., and A. Wagner, "Specification of the IP Flow Information Export (IPFIX) File Format", RFC 5655, October 2009. 8.2. Informative References [I-D.kaplan-dispatch-session-id] Kaplan, H., "A Session Identifier for the Session Initiation Protocol (SIP)", draft-kaplan-dispatch-session-id-03 (work in progress), March 2011. [I-D.trammell-ipfix-ie-doctors] Trammell, B. and B. Claise, "Guidelines for Authors and Reviewers of IPFIX Information Elements", draft-trammell-ipfix-ie-doctors-01 (work in progress), March 2011. [RFC2976] Donovan, S., "The SIP INFO Method", RFC 2976, October 2000. [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002. [RFC3262] Rosenberg, J. and H. Schulzrinne, "Reliability of Provisional Responses in Session Initiation Protocol (SIP)", RFC 3262, June 2002. [RFC3265] Roach, A., "Session Initiation Protocol (SIP)-Specific Event Notification", RFC 3265, June 2002. [RFC3311] Rosenberg, J., "The Session Initiation Protocol (SIP) UPDATE Method", RFC 3311, October 2002. [RFC3428] Campbell, B., Rosenberg, J., Schulzrinne, H., Huitema, C., and D. Gurle, "Session Initiation Protocol (SIP) Extension for Instant Messaging", RFC 3428, December 2002. [RFC3515] Sparks, R., "The Session Initiation Protocol (SIP) Refer Method", RFC 3515, April 2003. [RFC3665] Johnston, A., Donovan, S., Sparks, R., Cunningham, C., and K. Summers, "Session Initiation Protocol (SIP) Basic Call Trammell, et al. Expires October 13, 2011 [Page 19] Internet-Draft SIP Messages in IPFIX April 2011 Flow Examples", BCP 75, RFC 3665, December 2003. [RFC3903] Niemi, A., "Session Initiation Protocol (SIP) Extension for Event State Publication", RFC 3903, October 2004. [RFC4475] Sparks, R., Hawrylyshen, A., Johnston, A., Rosenberg, J., and H. Schulzrinne, "Session Initiation Protocol (SIP) Torture Test Messages", RFC 4475, May 2006. [ripfix] Trammell, B., "ripfix: IPFIX for Ruby", available at http://ripfix.rubyforge.org/. Appendix A. Definition of SIP Message Information Elements in IANA XML Registry format [EDITOR'S NOTE: frontmatter] sipObservationType unsigned8 identifier 35566 419 current Denotes whether the entry was corresponds to a SIP message received, sent, or merely seen by a passive observer, as follows: 0: unknown: The Metering Process does not specify the observation type. 1: receiver: The Metering Process is, or is co-located with, the receiver of the SIP message. 2: sender: The Metering Process is, or is co-located with, the sender of the SIP message. 3: passive: The Metering Process passively observed the SIP message. sipMethod unsigned8 identifier 35566 Trammell, et al. Expires October 13, 2011 [Page 20] Internet-Draft SIP Messages in IPFIX April 2011 402 current The SIP method from the CSeq header, encoded as per the IPFIX sipMethod subregistry. sipSequenceNumber unsigned32 identifier 35566 409 current The sequence number from the CSeq header. sipRequestURI string 35566 403 current The SIP Request URI, including any parameters, as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipFromURI string 35566 404 current The URI from the SIP From: header sipFromTag string 35566 405 current Trammell, et al. Expires October 13, 2011 [Page 21] Internet-Draft SIP Messages in IPFIX April 2011 The Tag parameter value from the SIP From: header sipToURI string 35566 406 current The URI from the SIP To: header sipToTag string 35566 407 current The Tag parameter value from the SIP To: header sipCallId string 35566 408 current The value of the SIP Call-ID: header sipResponseStatus unsigned16 identifier 35566 412 current The SIP Response code. The presence of this Information Element in a SIP Message record marks it as describing a SIP response; if absent, the record describes a SIP request. Trammell, et al. Expires October 13, 2011 [Page 22] Internet-Draft SIP Messages in IPFIX April 2011 sipServerTransaction string identifier 35566 413 current The transaction identifier associated with the server transaction. sipClientTransaction string identifier 35566 414 current The transaction identifier associated with the client transaction. SIP Message Information Element definitions Appendix B. Definition of sipMethod registry in IANA XML Registry format [EDITOR'S NOTE: frontmatter] IPFIX sipMethod Expert Review 0 Unknown The Metering Process did not recognize the SIP method. Trammell, et al. Expires October 13, 2011 [Page 23] Internet-Draft SIP Messages in IPFIX April 2011 1 ACK 2 BYE 3 CANCEL 4 INFO 5 INVITE 6 MESSAGE 7 NOTIFY 8 OPTIONS Trammell, et al. Expires October 13, 2011 [Page 24] Internet-Draft SIP Messages in IPFIX April 2011 9 PRACK 10 PUBLISH 11 REFER 12 REGISTER 13 SUBSCRIBE 14 UPDATE 15-65535 Unassigned sipMethod subregistry Trammell, et al. Expires October 13, 2011 [Page 25] Internet-Draft SIP Messages in IPFIX April 2011 Appendix C. Example messages in base64 This section contains the example messages from this revision of this draft in base64 encoding, for ease of processing by automated tools. The base templates are in this message: AAoA/EzALZsAAAAAAAAwOQACAOwBAQARAUMACIGZAAQAAIruAAgABAAMAAQA BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX //8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK 7gECABEBQwAIgZkABAAAiu4ACAAEAAwABAAHAAIACwACAAQAAYGSAAEAAIru gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIru The extended 4to6 and 6to4 templates are in this message: AAoB5EzALZsAAAAAAAAwOQACAdQBBQARAUMACIGZAAQAAIruAAgABAAcABAA BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX //8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK 7gEGABEBQwAIgZkABAAAiu4ACAAEABwAEAAHAAIACwACAAQAAYGSAAEAAIru gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIruAQcAEQFDAAiBmQAEAACK7gAb ABAADAAEAAcAAgALAAIABAABgZIAAQAAiu6BowABAACK7oGT//8AAIrugZb/ /wAAiu6Bl///AACK7oGU//8AAIrugZX//wAAiu6BmP//AACK7oGe//8AAIru gZ3// wAAiu4BCAARAUMACIGZAAQAAIruABsAEAAMAAQABwACAAsAAgAEAAGB kgABAACK7oGjAAEAAIrugZwAAgAAiu6Blv//AACK7oGX//8AAIrugZT//wAA iu6Blf// AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK7g== The UAC registration in Section 4.2 is in this message: AAoA2EzAO88AAAAAAAAwOQEBAGsAAAEpE2YTkwAAAAHGM2QBxjNkChPEE8QR DAIPc2lwOmV4YW1wbGUuY29tAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2 eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEAAQIAXQAAASkTZhUk AAAAAcYzZArGM2QBE8QTxBEMAQDIAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t BTc2eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEA The direct call in Section 4.3 is in this message: AAoCGkzAPA8AAAAAAAAwOQEBAIgAAAEpE2YTkwAAACDGM2QBywBxARPEE8QR BQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5u ZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQU3NnloaBVmODItZDQtZjdAZXhh bXBsZS5jb20HYy0xLXh0NgABAgB5AAABKRNmGKoAAAAgywBxAcYzZAETxBPE EQUBALQTc2lwOmJvYkBleGFtcGxlLm5ldAhiLWluNi1pdRVzaXA6YWxpY2VA ZXhhbXBsZS5jb20FNzZ5aGgVZjgyLWQ0LWY3QGV4YW1wbGUuY29tB2MtMS14 dDYAAQIAeQAAASkTZhz0AAAAIMsAcQHGM2QBE8QTxBEFAQDIE3NpcDpib2JA ZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2 eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AAEBAJAAAAEpE2Yd CAAAACDGM2QBywBxARPEE8QRAQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0 Trammell, et al. Expires October 13, 2011 [Page 26] Internet-Draft SIP Messages in IPFIX April 2011 E3NpcDpib2JAZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1w bGUuY29tBTc2eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AA== The downstream branch call in Section 4.4 is in this message: AAoE4UzAPEoAAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBxjNkChPEE8QR BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz aXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20A BnMteC10cgECAGwAAAEpE2YUwQAAACvGM2QKxjNkARPEE8QRBQIAZBNzaXA6 Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0 ci04N2hAZXhhbXBsZS5jb20ABnMteC10cgEBAIkAAAEpE2YYpgAAACvGM2QK ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3 aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZhlwAAAAK8sA cQHGM2QKE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6 YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14 LXRyBnMteC10cgECAHYAAAEpE2YbyAAAACvLAHEBxjNkChPEE8QRBQEAtBNz aXA6Ym9iQGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29t BGFsLTESdHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAgB2AAAB KRNmHJgAAAArxjNkCsYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3aEBleGFt cGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZiDwAAAAK8sAcQHGM2QK E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA ZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMt eC10cgECAHYAAAEpE2YhpAAAACvGM2QKxjNkARPEE8QRBQIAyBNzaXA6Ym9i QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGFsLTES dHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAQCIAAABKRNmKKwA AAArxjNkAcYzZAoTxBPEEQEBE3NpcDpib2JAZXhhbXBsZS5uZXQTc2lwOmJv YkBleGFtcGxlLm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0x EnRyLTg3aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQEAiAAAASkTZiis AAAAK8YzZArLAHEBE8QTxBEBAhNzaXA6Ym9iQGV4YW1wbGUubmV0E3NpcDpi b2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwt MRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMteC10cg== The forked call in Section 4.5 is in this message: AAoHjEzAPF0AAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBywBxyBPEE8QR BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz aXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20A BnMtMS10cgECAGwAAAEpE2YUwQAAACvLAHHIxjNkARPEE8QRBQIAZBNzaXA6 Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0 ci04OGhAZXhhbXBsZS5jb20ABnMtMS10cgEBAIkAAAEpE2YYpgAAACvLAHHI ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4 aEBleGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQUAlQAAASkTZhqcAAAAK8sA ccggAQ24AAAAAAAAAAAAAAAJE8QTxBEFAhhzaXA6Ym9iQGJvYjIuZXhhbXBs ZS5uZXQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUu Y29tBGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2 Trammell, et al. Expires October 13, 2011 [Page 27] Internet-Draft SIP Messages in IPFIX April 2011 AAABKRNmG8gAAAArywBxAcsAccgTxBPEEQUBAGQTc2lwOmJvYkBleGFtcGxl Lm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBl eGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQgAggAAASkTZhz0AAAAKyABDbgA AAAAAAAAAAAAAAnLAHHIE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQE YjItMhVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBs ZS5jb20GYy0yLXRyBnMtMS10cgEIAIIAAAEpE2YfTAAAACsgAQ24AAAAAAAA AAAAAAAJywBxyBPEE8QRBQEAtBNzaXA6Ym9iQGV4YW1wbGUubmV0BGIyLTIV c2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTESdHItODhoQGV4YW1wbGUuY29t BmMtMi10cgZzLTEtdHIBAgByAAABKRNmIG4AAAArywBxyMYzZAETxBPEEQUC ALQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t BGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2AAAB KRNmIaQAAAArywBxyMYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFt cGxlLmNvbQZjLTEtdHIGcy0xLXRyAQIAdgAAASkTZiOYAAAAK8sAcQHLAHHI E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA ZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0xLXRyBnMt MS10cgECAHYAAAEpE2YkYAAAACvLAHHIxjNkARPEE8QRBQIAyBNzaXA6Ym9i QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTES dHItODhoQGV4YW1wbGUuY29tBmMtMS10cgZzLTEtdHIBBQCVAAABKRNmJSkA AAArywBxyCABDbgAAAAAAAAAAAAAAAkTxBPEEQMCGHNpcDpib2JAYm9iMi5l eGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhh bXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10 cgEIAH4AAAEpE2YoPwAAACsgAQ24AAAAAAAAAAAAAAAJywBxyBPEE8QRBQEB 5xNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20E YTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10cgEFAJUAAAEp E2YqDwAAACvLAHHIIAENuAAAAAAAAAAAAAAACRPEE8QRAQIYc2lwOmJvYkBi b2IyLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGlj ZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIG cy0xLXRyAQgAfgAAASkTZiwxAAAAKyABDbgAAAAAAAAAAAAAAAnLAHHIE8QT xBEDAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxl LmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIGcy0xLXRy Authors' Addresses Brian Trammell Swiss Federal Institute of Technology Zurich Gloriastrasse 35 8092 Zurich Switzerland Email: trammell@tik.ee.ethz.ch Trammell, et al. Expires October 13, 2011 [Page 28] Internet-Draft SIP Messages in IPFIX April 2011 Saverio Niccolini NEC Laboratories Europe, NEC Europe Ltd. Kurfuersten-Anlage 36 Heidelberg 69115 Germany Phone: +49 (0) 6221 4342 118 Email: niccolini@neclab.eu URI: http://www.neclab.eu Benoit Claise Cisco Systems Inc. De Kleetlaan 6a b1 Diegem, 1813 Belgium Phone: +32 2 704 5622 Fax: Email: bclaise@cisco.com URI: Hadriel Kaplan Acme Packet 71 Third Ave. Burlington, MA 01803 USA Phone: Email: hkaplan@acmepacket.com Trammell, et al. Expires October 13, 2011 [Page 29]