IPFIX Information Elements for inspecting network security issues
draft-fu-ipfix-network-security-01
| Document | Type | Expired Internet-Draft (individual) | |
|---|---|---|---|
| Authors | Tianfu Fu , Dacheng Zhang , ana.hedanping@huawei.com , Liang Xia | ||
| Last updated | 2015-11-02 (Latest revision 2015-04-28) | ||
| Stream | (None) | ||
| Formats |
Expired & archived
plain text
xml
htmlized
pdfized
bibtex
|
||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | Expired | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
https://www.ietf.org/archive/id/draft-fu-ipfix-network-security-01.txt
Abstract
IPFIX protocol has been used to carry Information Elements, which are defined to measure the traffic information and information related to the traffic observation point, traffic metering process and the exporting process. Network or device status are checked through analysing neccessary observed information. Although most of the existing Information Elements are useful for network security inspection, they are still not sufficient to determine the reasons behind observed events such as for DDOS attack, ICMP attack, and fragment attack. To allow administrators making effective and quick response to the attacks, this document extends the standard Information Elements and describes the formats for inspecting network security.
Authors
Tianfu Fu
Dacheng Zhang
ana.hedanping@huawei.com
Liang Xia
(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)