datatracker.ietf.org
Sign in
Version 5.3.0, 2014-04-12
Report a bug

Specification of the IP Flow Information Export (IPFIX) File Format
RFC 5655

Network Working Group                                        B. Trammell
Request for Comments: 5655                                     E. Boschi
Category: Standards Track                                 Hitachi Europe
                                                                 L. Mark
                                                         Fraunhofer IFAM
                                                                T. Zseby
                                                        Fraunhofer FOKUS
                                                               A. Wagner
                                                              ETH Zurich
                                                            October 2009

  Specification of the IP Flow Information Export (IPFIX) File Format

Abstract

   This document describes a file format for the storage of flow data
   based upon the IP Flow Information Export (IPFIX) protocol.  It
   proposes a set of requirements for flat-file, binary flow data file
   formats, then specifies the IPFIX File format to meet these
   requirements based upon IPFIX Messages.  This IPFIX File format is
   designed to facilitate interoperability and reusability among a wide
   variety of flow storage, processing, and analysis tools.

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (c) 2009 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the BSD License.

Trammell, et al.            Standards Track                     [Page 1]
RFC 5655                      IPFIX Files                   October 2009

Table of Contents

   1. Introduction ....................................................4
      1.1. IPFIX Documents Overview ...................................4
   2. Terminology .....................................................5
   3. Design Overview .................................................6
   4. Motivation ......................................................7
   5. Requirements ...................................................10
      5.1. Record Format Flexibility .................................10
      5.2. Self-Description ..........................................10
      5.3. Data Compression ..........................................11
      5.4. Indexing and Searching ....................................11
      5.5. Error Recovery ............................................12
      5.6. Authentication, Confidentiality, and Integrity ............12
      5.7. Anonymization and Obfuscation .............................13
      5.8. Session Auditability and Replayability ....................13
      5.9. Performance Characteristics ...............................14
   6. Applicability ..................................................14
      6.1. Storage of IPFIX-Collected Flow Data ......................14
      6.2. Storage of NetFlow-V9-Collected Flow Data .................15
      6.3. Testing IPFIX Collecting Processes ........................15
      6.4. IPFIX Device Diagnostics ..................................16
   7. Detailed File Format Specification .............................16
      7.1. File Reader Specification .................................16
      7.2. File Writer Specification .................................17
      7.3. Specific File Writer Use Cases ............................18
           7.3.1. Collocating a File Writer with a Collecting
                  Process ............................................18
           7.3.2. Collocating a File Writer with a Metering Process ..19
           7.3.3. Using IPFIX Files for Archival Storage .............20
           7.3.4. Using IPFIX Files as Documents .....................20
           7.3.5. Using IPFIX Files for Testing ......................21
           7.3.6. Writing IPFIX Files for Device Diagnostics .........22
           7.3.7. IPFIX File Manipulation ............................22

[include full document text]