IPFIX Information Elements for inspecting network security issues

Document Type Expired Internet-Draft (individual)
Authors Tianfu Fu  , Dacheng Zhang  , ana.hedanping@huawei.com  , Liang Xia 
Last updated 2015-11-02 (latest revision 2015-04-28)
Stream (None)
Intended RFC status (None)
Expired & archived
pdf htmlized (tools) htmlized bibtex
Stream Stream state (No stream defined)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state Expired
Telechat date
Responsible AD (None)
Send notices to (None)

This Internet-Draft is no longer active. A copy of the expired Internet-Draft can be found at


IPFIX protocol has been used to carry Information Elements, which are defined to measure the traffic information and information related to the traffic observation point, traffic metering process and the exporting process. Network or device status are checked through analysing neccessary observed information. Although most of the existing Information Elements are useful for network security inspection, they are still not sufficient to determine the reasons behind observed events such as for DDOS attack, ICMP attack, and fragment attack. To allow administrators making effective and quick response to the attacks, this document extends the standard Information Elements and describes the formats for inspecting network security.


Tianfu Fu (futianfu@huawei.com)
Dacheng Zhang (dacheng.zhang@gmail.com)
ana.hedanping@huawei.com (ana.hedanping@huawei.com)
Liang Xia (frank.xialiang@huawei.com)

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)