Export of Microburst Information in IP Flow Information Export
draft-han-opsawg-ipfix-microburst-00
This document is an Internet-Draft (I-D).
Anyone may submit an I-D to the IETF.
This I-D is not endorsed by the IETF and has no formal standing in the
IETF standards process.
| Document | Type | Active Internet-Draft (individual) | |
|---|---|---|---|
| Authors | Mengyao Han , Zheng Ruan , Gao xing , Quan Xiong | ||
| Last updated | 2026-11-02 | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | I-D Exists | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-han-opsawg-ipfix-microburst-00
opsawg M. Han, Ed.
Internet-Draft Z. Ruan
Intended status: Standards Track X. Gao
Expires: 6 May 2027 China Unicom
Q. Xiong
ZTE Corporation
2 November 2026
Export of Microburst Information in IP Flow Information Export
draft-han-opsawg-ipfix-microburst-00
Abstract
A microburst is a phenomenon in which arriving traffic exceeds the
service capacity of an egress interface within a short period of
time, causing queue occupancy to rise rapidly. It may result in
transient queuing and packet loss even when the average link
utilization is low, and is therefore difficult to detect through low-
frequency interface statistics.
This document defines a set of IPFIX Information Elements for
exporting aggregated microburst statistics per egress interface,
egress queue, and measurement window. Network operators can use
these statistics to identify interfaces and queues where microbursts
occur frequently, and apply the results to capacity planning, QoS
optimization, and the remediation of critical links.
This document does not specify microburst detection algorithms,
threshold selection methods, or remediation policies.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 6 May 2027.
Han, et al. Expires 6 May 2027 [Page 1]
Internet-Draft Export of Microburst Information in IPFI November 2026
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Conventions and Definitions . . . . . . . . . . . . . . . . . 3
3. Microburst Definition . . . . . . . . . . . . . . . . . . . . 3
4. Measurement Model . . . . . . . . . . . . . . . . . . . . . . 3
4.1. Observation Point . . . . . . . . . . . . . . . . . . . . 3
4.2. Detection . . . . . . . . . . . . . . . . . . . . . . . . 4
4.3. Aggregation and Statistics . . . . . . . . . . . . . . . 4
5. IPFIX Information Elements . . . . . . . . . . . . . . . . . 4
5.1. Reused Information Elements . . . . . . . . . . . . . . . 4
5.2. Proposed New Information Elements . . . . . . . . . . . . 5
6. Data or Option Template . . . . . . . . . . . . . . . . . . . 5
7. Use Cases . . . . . . . . . . . . . . . . . . . . . . . . . . 5
7.1. Network Planning . . . . . . . . . . . . . . . . . . . . 5
7.2. Distributed Training and Inference Networks . . . . . . . 6
8. relationship to FANN . . . . . . . . . . . . . . . . . . . . 6
9. Security Considerations . . . . . . . . . . . . . . . . . . . 6
10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6
11. Normative References . . . . . . . . . . . . . . . . . . . . 6
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 7
1. Introduction
A microburst is a phenomenon in which arriving traffic exceeds the
service capacity of an egress interface within a short period of
time, causing queue occupancy to rise rapidly. It may result in
transient queuing and packet loss even when the average link
utilization is low, and is therefore difficult to detect through low-
frequency interface statistics.
This document defines a set of IPFIX Information Elements for
exporting aggregated microburst statistics per egress interface,
egress queue, and measurement window. Network operators can use
Han, et al. Expires 6 May 2027 [Page 2]
Internet-Draft Export of Microburst Information in IPFI November 2026
these statistics to identify interfaces and queues where microbursts
occur frequently, and apply the results to capacity planning, QoS
optimization, and the remediation of critical links.
This document does not specify microburst detection algorithms,
threshold selection methods, or remediation policies.
2. Conventions and Definitions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
IPFIX terminology as defined in [RFC7011] is used in this document.
3. Microburst Definition
A microburst is defined in this document as a condition in which,
within a short period of time, the traffic arrival rate exceeds the
service rate of an egress queue, causing the occupancy of that queue
to reach a locally configured detection condition. A microburst may
occur while the average link utilization remains within its normal
operating range, and it may result in transient congestion, packet
loss, increased latency, or jitter. See
[I-D.ruan-lsr-isis-te-extensions-for-microburst] for related
descriptions.
The microburst described above does not necessarily result in network
congestion; it may only cause the queue to be transiently filled. It
may nevertheless indicate the occurrence of congestion, or a high
probability that congestion will occur.
4. Measurement Model
4.1. Observation Point
Microburst statistics are measured at the egress queue. A monitoring
instance is identified by the Observation Domain ID carried in the
IPFIX Message Header, together with the observationPointId,
egressInterface, and egressQueueId Information Elements.
Han, et al. Expires 6 May 2027 [Page 3]
Internet-Draft Export of Microburst Information in IPFI November 2026
4.2. Detection
A microburst is detected when, for a given egress queue, the queue
occupancy reaches a locally configured condition. Common
implementations use a queue buffer occupancy threshold (e.g., rising
and falling thresholds expressed in octets or as a percentage of the
buffer allocated to, or referenced by, the queue), where the rising
threshold starts an event and the falling threshold ends the event.
This document does not mandate any specific threshold, percentage, or
buffer allocation model.
4.3. Aggregation and Statistics
The Exporter aggregates statistics on the device side over a
measurement window; The Exporter may identify events locally and
derive, from them, the number of events within the window and the
number of events with packet loss.
5. IPFIX Information Elements
This document follows [RFC7013] and reuses existing Information
Elements (IEs) where applicable.
5.1. Reused Information Elements
+=====================================+========================+
| IE | Usage |
+=====================================+========================+
| observationPointId (138) | Observation Point |
+-------------------------------------+------------------------+
| egressInterface (14) | Egress interface |
+-------------------------------------+------------------------+
| interfaceName (82) | Optional; provides the |
| | interface name |
+-------------------------------------+------------------------+
| monitoringIntervalStartMilliSeconds | Start time of the |
| (359) | measurement window |
+-------------------------------------+------------------------+
| monitoringIntervalEndMilliSeconds | End time of the |
| (360) | measurement window |
+-------------------------------------+------------------------+
| droppedPacketDeltaCount (133) | Congestion-related |
| | packet loss within the |
| | measurement window |
+-------------------------------------+------------------------+
Table 1
Han, et al. Expires 6 May 2027 [Page 4]
Internet-Draft Export of Microburst Information in IPFI November 2026
The Observation Domain ID is carried in the IPFIX Message Header and
need not be repeated in the record. The measurement window is
represented by monitoringIntervalStartMilliSeconds and
monitoringIntervalEndMilliSeconds.
5.2. Proposed New Information Elements
Counter values represent increments within the corresponding
measurement window.
+===============================+==============================+
| Name | Definition |
+===============================+==============================+
| egressQueueId | Device-local queue |
| | identifier on the egress |
| | interface |
+-------------------------------+------------------------------+
| microburstEventDeltaCount | Number of microburst events |
| | detected within the |
| | measurement window |
+-------------------------------+------------------------------+
| microburstLossEventDeltaCount | Number of microburst events |
| | within the measurement |
| | window during which at least |
| | one congestion-related |
| | packet loss occurred |
+-------------------------------+------------------------------+
Table 2
6. Data or Option Template
TBD
7. Use Cases
7.1. Network Planning
* Identify interfaces and queues where microburst events or
associated packet loss are frequent despite low average
utilization;
* Combine microburst statistics with average utilization, queue
loss, and traffic growth trends to evaluate capacity expansion,
ECMP, or QoS adjustment requirements;
* Use long-term aggregated statistics to determine the links and
queues that require focused attention.
Han, et al. Expires 6 May 2027 [Page 5]
Internet-Draft Export of Microburst Information in IPFI November 2026
7.2. Distributed Training and Inference Networks
* Correlate periodic microbursts with training job time windows to
analyze their relationship with collective communication
performance;
* Identify the upstream interfaces and queues where microbursts are
concentrated;
* Analyze microburst statistics together with PFC, ECN, and queue
loss data [I-D.ietf-opsawg-ipfix-ecn].
8. relationship to FANN
FANN addresses forwarding-plane event notification at millisecond
time scales to trigger reactions; this document addresses management-
plane aggregated statistics export at second time scales for analysis
and planning [I-D.ietf-fann-problem-statement]. The two are
complementary.
9. Security Considerations
TBD
10. IANA Considerations
TBD
11. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC7011] Claise, B., Ed., Trammell, B., Ed., and P. Aitken,
"Specification of the IP Flow Information Export (IPFIX)
Protocol for the Exchange of Flow Information", STD 77,
RFC 7011, DOI 10.17487/RFC7011, September 2013,
<https://www.rfc-editor.org/info/rfc7011>.
Han, et al. Expires 6 May 2027 [Page 6]
Internet-Draft Export of Microburst Information in IPFI November 2026
[RFC7013] Trammell, B. and B. Claise, "Guidelines for Authors and
Reviewers of IP Flow Information Export (IPFIX)
Information Elements", BCP 184, RFC 7013,
DOI 10.17487/RFC7013, September 2013,
<https://www.rfc-editor.org/info/rfc7013>.
[I-D.ruan-lsr-isis-te-extensions-for-microburst]
Ruan, Z., Han, M., Huang, H., and R. Pang, "IS-IS Traffic
Engineering Extensions For Microburst", Work in Progress,
Internet-Draft, draft-ruan-lsr-isis-te-extensions-for-
microburst-01, 19 July 2026,
<https://datatracker.ietf.org/doc/html/draft-ruan-lsr-
isis-te-extensions-for-microburst-01>.
[I-D.ietf-fann-problem-statement]
Dong, J., McBride, M., Clad, F., Zhang, Z. J., Zhu, Y.,
Xu, X., Zhuang, R., Pang, R., Lu, H., Liu, Y., Contreras,
L. M., Mehmet, D., and R. Rahman, "Fast Network
Notifications Problem Statement", Work in Progress,
Internet-Draft, draft-ietf-fann-problem-statement-01, 26
October 2026, <https://datatracker.ietf.org/doc/html/
draft-ietf-fann-problem-statement-01>.
[I-D.ietf-opsawg-ipfix-ecn]
Song, X., Moeller, S., Liu, Y., Newton, J., and J.
Livingood, "Export of ECN Information in IPFIX", Work in
Progress, Internet-Draft, draft-ietf-opsawg-ipfix-ecn-01,
30 October 2026, <https://datatracker.ietf.org/doc/html/
draft-ietf-opsawg-ipfix-ecn-01>.
Authors' Addresses
Mengyao Han (editor)
China Unicom
Beijing
China
Email: hanmy12@chinaunicom.cn
Zheng Ruan
China Unicom
Beijing
China
Email: ruanz6@chinaunicom.cn
Han, et al. Expires 6 May 2027 [Page 7]
Internet-Draft Export of Microburst Information in IPFI November 2026
Xing Gao
China Unicom
Beijing
China
Email: gaox60@chinaunicom.cn
Quan Xiong
ZTE Corporation
Beijing
China
Email: xiong.quan@zte.com.cn
Han, et al. Expires 6 May 2027 [Page 8]