Export of GTP-U Information in IP Flow Information Export (IPFIX)
draft-ietf-opsawg-ipfix-gtpu-12

Operations                                                      D. Voyer
Internet-Draft                                         S. Gopalakrishnan
Intended status: Standards Track                           Cisco Systems
Expires: 12 December 2026                                        T. Graf
                                                                Swisscom
                                                        V. Satyanarayana
                                                                     HPE
                                                               C. Staicu
                                                             Bell Canada
                                                            10 June 2026

   Export of GTP-U Information in IP Flow Information Export (IPFIX)
                    draft-ietf-opsawg-ipfix-gtpu-12

Abstract

   This document introduces IP Flow Information Export (IPFIX)
   Information Elements to report information contained in the Generic
   Packet Radio Service Tunneling Protocol(GTP) User Plane header such
   as Tunnel Endpoint Identifier, and data contained in its session
   container extension header.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 12 December 2026.

Copyright Notice

   Copyright (c) 2026 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.

Voyer, et al.           Expires 12 December 2026                [Page 1]
Internet-Draft           IPFIX support for GTP-U               June 2026

   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Revised BSD License text as
   described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Revised BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  IPFIX GTP-U Information Elements  . . . . . . . . . . . . . .   4
   4.  Sample Use Cases  . . . . . . . . . . . . . . . . . . . . . .   5
   5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   6
     5.1.  gtpuFlags . . . . . . . . . . . . . . . . . . . . . . . .   7
     5.2.  gtpuMsgType . . . . . . . . . . . . . . . . . . . . . . .   8
     5.3.  gtpuTEid  . . . . . . . . . . . . . . . . . . . . . . . .   8
     5.4.  gtpuSequenceNum . . . . . . . . . . . . . . . . . . . . .   9
     5.5.  gtpuQFI . . . . . . . . . . . . . . . . . . . . . . . . .   9
     5.6.  gtpuPduType . . . . . . . . . . . . . . . . . . . . . . .  10
     5.7.  gtpuTotalHdrLength  . . . . . . . . . . . . . . . . . . .  11
     5.8.  gtpuHeaderSection . . . . . . . . . . . . . . . . . . . .  12
   6.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  12
   7.  Contributors  . . . . . . . . . . . . . . . . . . . . . . . .  12
   8.  Implementation Status . . . . . . . . . . . . . . . . . . . .  12
     8.1.  Cisco IOS XR  . . . . . . . . . . . . . . . . . . . . . .  12
   9.  Security Considerations . . . . . . . . . . . . . . . . . . .  13
   10. Operational Considerations  . . . . . . . . . . . . . . . . .  13
   11. References  . . . . . . . . . . . . . . . . . . . . . . . . .  13
     11.1.  Normative References . . . . . . . . . . . . . . . . . .  13
     11.2.  Informative References . . . . . . . . . . . . . . . . .  14
   Appendix A.  IPFIX Encoding Examples  . . . . . . . . . . . . . .  15
     A.1.  Template Record . . . . . . . . . . . . . . . . . . . . .  15
       A.1.1.  Template Record and Data Set  . . . . . . . . . . . .  15
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  17

1.  Introduction

   A dedicated header, called GPRS Tunneling Protocol (GTP) Header, is
   defined by 3GPP for the GTP User Plane (GTP-U) [TS.29281] traffic of
   mobile subscribers.

   This document specifies eight IPFIX Information Elements (IEs)
   [RFC7012] to export GTP-U information.

   Specifically, these IEs are used to export the GTP-U Tunnel Endpoint
   Identifier (TEID), QoS Flow Identifier (QFI), and PDU Type from the
   PDU Session Container extension header.

Voyer, et al.           Expires 12 December 2026                [Page 2]
Internet-Draft           IPFIX support for GTP-U               June 2026

   Some examples are provided in Appendix A.

2.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in BCP
   14 [RFC8174] when, and only when, they appear in all capitals, as
   shown here.

   This document makes use of the terms defined in [RFC7011]

   *  IPFIX

   *  IPFIX Information Element

   *  Template

   *  Template Record

   *  Options Template

   *  Options Template Record

   *  Data Record

   *  Data Set

   This document uses the term "User Plane" as used by 3GPP GTP-U in
   [TS.29281] and the term "Uplink Classifier" as used in [TS.23501].

   The document uses the following abbreviations:

   *  IE: Information Element

   *  GTP: GPRS Tunneling Protocol

   *  GTP-U: GTP User Plane

   *  GTP-C: GTP Control Plane

   *  PDU: Protocol Data Unit

   *  TEID: Tunnel Endpoint Identifier

   *  UPF: User Plane Function

   *  QFI: QoS Flow Identifier

Voyer, et al.           Expires 12 December 2026                [Page 3]
Internet-Draft           IPFIX support for GTP-U               June 2026

3.  IPFIX GTP-U Information Elements

   This section defines IPFIX IEs corresponding to various fields in the
   GTP-U header.  When 3GPP specifications state that a field shall not
   be interpreted, the same guidance as Section 8 [RFC7011] applies: the
   Exporting Process MAY use a Template that omits the corresponding IE.
   If operational constraints require use of a fixed Template, the
   Exporting Process MAY export a value of zero for that IE, and the
   Collecting Process MAY treat that value in this context as "field not
   available".  Reserved bits in exported gtpuQFI and gtpuPduType values
   MUST be set to zero by the Exporting Process and MUST be ignored by
   the Collecting Process.

   gtpuFlags
      8-bit flags field indicating the version of GTP-U header, protocol
      type, and presence of extension header, sequence number and N-PDU
      number defined in Section 5.1 of the 3GPP specification
      [TS.29281].  The bits are exported as observed.

   gtpuMsgType
      8-bit field which indicates the type of the GTP-U message as
      mentioned in section 5.1 of 3GPP specification [TS.29281].

   gtpuTEid
      32-bit tunnel endpoint identifier field unambiguously identifies a
      tunnel endpoint in the receiving GTP-U protocol entity for a given
      UDP/IP endpoint.

   gtpuSequenceNum
      16-bit sequence number field defined in the GTP-U.  This field is
      interpreted based on the sequence number flag value from
      gtpuFlags.

   gtpuQFI
      6-bit QoS flow identifier field defined in PDU Session Container
      extension header of GTP-U.  This may be used to determine the QoS
      flow and QoS profile which are associated with the received
      packet.  The presence of this extension header is interpreted
      based on the extension header flag value from gtpuFlags.

   gtpuPduType
      4-bit PDU type field defined in PDU Session Container extension
      header of GTP-U.  This field indicates the structure of the PDU
      session user plane frame.  The presence of this extension header
      is interpreted based on the extension header flag value from
      gtpuFlags.

Voyer, et al.           Expires 12 December 2026                [Page 4]
Internet-Draft           IPFIX support for GTP-U               June 2026

   gtpuTotalHdrLength
      8-bit field indicating the total length of the GTP-U header which
      includes mandatory fields and all the optional headers as defined
      in Sections 5.1 and 5.2 of the 3GPP specification [TS.29281].
      This IE is derived from the observed packet header and does not
      export the GTP-U Length field defined in Section 5.1 of
      [TS.29281].

   gtpuHeaderSection
      This Information Element carries a series of n octets from the
      GTP-U header mandatory fields and all the following optional
      headers if any, defined in Section 5 of the 3GPP specification
      [TS.29281] as a series of octets in IPFIX.

4.  Sample Use Cases

   The GTP-U related IPFIX IEs are helpful in order to identify the
   transport performance of PDU Sessions, e.g., with specific QoS class
   within a network slice (refer to [RFC9889]) or within a group of
   network slices hosted on the same User Plane Function (UPF).

   For example, when a set of UPFs are deployed per 5G slice, the slice
   is identified first using a list of gNodeB IP addresses composing the
   slice and a list of IP addresses of UPFs dedicated for the slice.
   The gNodeB and the UPF form the tunnel endpoints.  The traffic for
   each individual PDU Session per direction is identified using the
   GTP-U TEID, GTP-U PDU Type together with the above mentioned IP
   tunnel endpoints.  Furthermore, the traffic for a specific QoS class
   within a PDU Session per traffic direction is identified using the
   combination of GTP-U TEID, GTP-U PDU Type, and GTP-U QFI attributes.
   It is possible that for a single PDU session there might be multiple
   IP flows with different GTP-U QFI but with same GTP-U TEID.

   In another scenario when multiple 5G slices share the same UPF, each
   slice is identified using a separated list of gNodeB IPv4 or IPv6
   addresses per slice.  If an Uplink Classifier (refer to section 3.1
   of [TS.23501]) is deployed there is an addition of a GTP-U tunnel
   between the Intermediate/Uplink-Classifier UPF and the final UPF.
   This brings a challenge for identifying the end-to-end path for a
   certain PDU Session - the GTP-U PDU Type and GTP-U QFI attributes
   from the gNodeB and Intermediate/Uplink-Classifier UPF tunnel will be
   the same on the Intermediate/Uplink-Classifier and final UPF tunnels,
   however the GTP-U TEIDs will be different since on each tunnel.

   The use of the IPFIX GTP-U IEs is to identify either a particular PDU
   Session on a particular slice (using GTP-U TEID in combination with
   the gNodeB and the UPF IP addresses) or all the IP traffic flows for
   a 3GPP QoS flow on a slice (using GTP-U QFI in combination with the

Voyer, et al.           Expires 12 December 2026                [Page 5]
Internet-Draft           IPFIX support for GTP-U               June 2026

   gNodeB and the UPF IP addresses) or a 3GPP QoS flow for a particular
   PDU Session on a slice (using both GTP-U TEID and GTP-U QFI in
   combination with the gNodeB and UPF IP addresses).

   Additionally, exporting GTP-U IEs together with the transportChecksum
   IE 503 registered in the IANA IPFIX registry [IANA-IPFIX] can help
   detect misbehaving nodes, particularly when using GTP-U over IPv6.

5.  IANA Considerations

   IANA has registered the following IEs in the "IPFIX Information
   Elements" registry available at [IANA-IPFIX].

   Table 1 lists the GTP-U IEs:

        +-------+-------------------+
        |Element| Name              |
        |       |                   |
        |   ID  |                   |
        |       |                   |
        +-------+-------------------+
        | 505   | gtpuFlags         |
        |       |                   |
        +-------+-------------------+
        | 506   | gtpuMsgType       |
        |       |                   |
        +-------+-------------------+
        | 507   | gtpuTEid          |
        |       |                   |
        +-------+-------------------+
        | 508   | gtpuSequenceNum   |
        |       |                   |
        +-------+-------------------+
        | 509   | gtpuQFI           |
        |       |                   |
        +-------+-------------------+
        | 510   | gtpuPduType       |
        |       |                   |
        +-------+-------------------+

     Table 1: GTP-U IEs in the "IPFIX Information Elements" Registry

   Table 2 lists the GTP-U IEs to be allocated:

Voyer, et al.           Expires 12 December 2026                [Page 6]
Internet-Draft           IPFIX support for GTP-U               June 2026

     +-------+-------------------+
     |Element| Name              |
     |       |                   |
     |   ID  |                   |
     |       |                   |
     +-------+-------------------+
     | TBD1  | gtpuTotalHdrLength|
     |       |                   |
     +-------+-------------------+
     | TBD2  | gtpuHeaderSection |
     |       |                   |
     +-------+-------------------+

  Table 2: GTP-U IEs to be allocated in the "IPFIX Information Elements" Registry

   IANA is requested to update the references for the existing GTP-U
   Information Elements listed in Table 1 to point to this RFC and
   update their descriptions.  IANA is also requested to allocate two
   new Information Element IDs listed in Table 2 for gtpuTotalHdrLength
   and gtpuHeaderSection in the "IPFIX Information Elements" registry.

5.1.  gtpuFlags

   Name:  gtpuFlags

   ElementID:  505

   Description:  8-bit flags field indicating the version of GTP-U
      header, protocol type, and presence of extension header, sequence
      number and N-PDU number defined in Section 5.1 of the 3GPP
      specification [TS.29281].  The bits are exported as observed.

      The basic encoding is 8 bits.  The layout of the encoding is as
      follows:

                MSB -   0     1     2     3    4    5    6    7   - LSB
                      +----+----+----+----+----+----+----+----+
                      | Version(3b)  | PT | 0  | E  | S  | PN |
                      +----+----+----+----+----+----+----+----+

      Examples:

      value : 0x34

      binary: 00110100

      decode: Version=1, PT=1, spare=0, E=1, S=0, PN=0

Voyer, et al.           Expires 12 December 2026                [Page 7]
Internet-Draft           IPFIX support for GTP-U               June 2026

      value : 0x36

      binary: 00110110

      decode: Version=1, PT=1, spare=0, E=1, S=1, PN=0

   Abstract Data Type:  unsigned8

   Data Type Semantics:  flags

   Additional Information:  Refer to Section 5.1 of [TS.29281].

   Reference:  [RFC-to-be]

5.2.  gtpuMsgType

   Name:  gtpuMsgType

   ElementID:  506

   Description:  8-bit field which indicates the type of the GTP-U
      message as mentioned in Section 5.1 of the 3GPP specification
      [TS.29281].

   Abstract Data Type:  unsigned8

   Data Type Semantics:  identifier

   Additional Information:  Refer to Section 5.1 of the 3GPP
      specification [TS.29281].

   Reference:  [RFC-to-be]

5.3.  gtpuTEid

   Name:  gtpuTEid

   ElementID:  507

   Description:  32-bit tunnel endpoint identifier field unambiguously
      identifies a tunnel endpoint in the receiving GTP-U protocol
      entity for a given UDP/IP endpoint.

   Abstract Data Type:  unsigned32

   Data Type Semantics:  identifier

   Additional Information:  Refer to Section 5.1 of the 3GPP

Voyer, et al.           Expires 12 December 2026                [Page 8]
Internet-Draft           IPFIX support for GTP-U               June 2026

      specification [TS.29281].

   Reference:  [RFC-to-be]

5.4.  gtpuSequenceNum

   Name:  gtpuSequenceNum

   ElementID:  508

   Description:  16-bit sequence number field defined in the GTP-U.
      This field is interpreted based on the sequence number flag value
      from gtpuFlags.  When the S flag is not set, this IE is not
      meaningful.

   Abstract Data Type:  unsigned16

   Data Type Semantics:  identifier

   Additional Information:  Refer to Section 5.1 of the 3GPP
      specification [TS.29281].

   Reference:  [RFC-to-be]

5.5.  gtpuQFI

   Name:  gtpuQFI

   ElementID:  509

   Description:  6-bit QoS flow identifier field defined in PDU Session
      Container extension header of GTP-U.  This may be used to
      determine the QoS flow and QoS profile which are associated with
      the received packet.  The presence of this extension header is
      interpreted based on the extension header flag value from
      gtpuFlags.  When the PDU Session Container extension header is not
      present, this IE is not meaningful.  The two most significant bits
      are reserved, MUST be exported as zero, and MUST be ignored on
      receipt.

      The basic encoding is 8 bits.  The layout of basic encoding is as
      follows:

                MSB -   0     1    2    3    4    5    6    7   - LSB
                      +----+----+----+----+----+----+----+----+
                      |Reserved |       6 bit QFI value       |
                      +----+----+----+----+----+----+----+----+

Voyer, et al.           Expires 12 December 2026                [Page 9]
Internet-Draft           IPFIX support for GTP-U               June 2026

      Examples:

      value : 0x08

      binary: 00001000

      decode: 001000 - QFI value

      value : 0x3e

      binary: 00111110

      decode: 111110 - QFI value

   Abstract Data Type:  unsigned8

   Data Type Semantics:  identifier

   Additional Information:  Refer to Section 5.5.3.3 of the 3GPP
      specification [TS.38415] and Section 5.7.1.1 of the 3GPP
      specification [TS.23501].  The reserved bits in the exported octet
      are set to zero.

   Reference:  [RFC-to-be]

5.6.  gtpuPduType

   Name:  gtpuPduType

   ElementID:  510

   Description:  4-bit PDU type field defined in PDU Session Container
      extension header of GTP-U.  This field indicates the structure of
      the PDU session user plane frame.  The presence of this extension
      header is interpreted based on the extension header flag value
      from gtpuFlags.  When the PDU Session Container extension header
      is not present, this IE is not meaningful and is exported as
      specified in Section 3.  The four most significant bits are
      reserved, MUST be exported as zero, and MUST be ignored on
      receipt.

      The basic encoding is 8 bits.  The layout of basic encoding is as
      follows:

Voyer, et al.           Expires 12 December 2026               [Page 10]
Internet-Draft           IPFIX support for GTP-U               June 2026

                MSB -   0     1    2    3    4    5    6    7   - LSB
                      +----+----+----+----+----+----+----+----+
                      |     Reserved      |  4 bit PDU Type   |
                      +----+----+----+----+----+----+----+----+

      Examples:

      value : 0x01

      binary: 00000001

      decode: 0001 - PDU Type value

   Abstract Data Type:  unsigned8

   Data Type Semantics:  identifier

   Additional Information:  Refer to Section 5.5.3 of the 3GPP
      specification [TS.38415].  The reserved bits in the exported octet
      are set to zero.

   Reference:  [RFC-to-be]

5.7.  gtpuTotalHdrLength

   Name:  gtpuTotalHdrLength

   ElementID:  TBD1

   Description:  8-bit field indicating the total length in octets of
      the observed GTP-U header, including the mandatory 8-octet header
      and any optional fields and extension headers defined in Sections
      5.1 and 5.2 of the 3GPP specification [TS.29281].  This IE is
      derived from the observed packet header and does not export the
      GTP-U Length field defined in Section 5.1 of [TS.29281].

   Abstract Data Type:  unsigned8

   Data Type Semantics:  quantity

   Additional Information:  Refer to Sections 5.1 and 5.2 of [TS.29281].

   Reference:  [RFC-to-be]

Voyer, et al.           Expires 12 December 2026               [Page 11]
Internet-Draft           IPFIX support for GTP-U               June 2026

5.8.  gtpuHeaderSection

   Name:  gtpuHeaderSection

   ElementID:  TBD2

   Description:  This Information Element carries a series of n octets
      from the observed GTP-U header, including the mandatory header and
      any optional fields and extension headers defined in Sections 5.1
      and 5.2 of the 3GPP specification [TS.29281], as a series of
      octets in IPFIX.

   Abstract Data Type:  octetArray

   Data Type Semantics:  default

   Additional Information:  Refer to Section 5 of [TS.29281].

   Reference:  [RFC-to-be]

6.  Acknowledgements

   The authors would like to thank Benoit Claise, Ketan Talaulikar,
   Dhananjay Patki, Paul Aitken, Shraddha Hegde, Chongfeng Liu, and
   Mahesh Jethanandani for their reviews and valuable comments.

7.  Contributors

   Kandhla Chandi
   Bell Canada
   Email: kandhla.chandi@bell.ca

   Ralu Johny
   Cisco
   Email: rjohny@cisco.com

8.  Implementation Status

   Note to the RFC-Editor: Please remove this section before publishing.

8.1.  Cisco IOS XR

   Cisco implemented the following IEs as part of a test implementation
   in the IOS XR platform.  This implementation currently covers six of
   the eight IEs defined in this document; it does not yet cover
   gtpuTotalHdrLength or gtpuHeaderSection:

Voyer, et al.           Expires 12 December 2026               [Page 12]
Internet-Draft           IPFIX support for GTP-U               June 2026

   *  gtpuFlags

   *  gtpuMsgType

   *  gtpuTEid

   *  gtpuSequenceNum

   *  gtpuQFI

   *  gtpuPduType

9.  Security Considerations

   The IEs described in this document export GTP user plane information
   about packet forwarding in a 3GPP network.  In particular, TEIDs,
   QFIs, PDU types, and GTP-U header sections can enable correlation of
   traffic with individual PDU sessions and, depending on deployment,
   with subscriber activity.  Implementations and operators therefore
   MUST treat this data as sensitive network telemetry data.

   Applications and operators using the IEs specified in this document
   SHOULD evaluate the sensitivity of this information in their
   deployment context, and apply the data-at-rest storage guidance in
   Section 11.8 of [RFC7011] as appropriate.

   Operators SHOULD restrict access to these exported IEs, apply
   retention limits appropriate to sensitive operational telemetry, and
   SHOULD NOT export gtpuHeaderSection unless required by the
   operational use case.  An Exporting Process MUST NOT include octets
   beyond the observed GTP-U header in gtpuHeaderSection.

10.  Operational Considerations

   The IPFIX IEs defined in this document require extraction of fields
   from packets.  There may exist older devices in the network that do
   not support extensions defined in this document.  For those devices
   [RFC7133] defines dataLinkFrameSection which is a useful mechanism to
   export the packet header as a fallback scenario.  However, when
   dataLinkFrameSection is used, Flow aggregation as per [RFC7015] can't
   be applied.  This document will serve as a guideline to extract the
   necessary fields from the GTP-U header for the above scenarios.

11.  References

11.1.  Normative References

Voyer, et al.           Expires 12 December 2026               [Page 13]
Internet-Draft           IPFIX support for GTP-U               June 2026

   [RFC7011]  Claise, B., Ed., Trammell, B., Ed., and P. Aitken,
              "Specification of the IP Flow Information Export (IPFIX)
              Protocol for the Exchange of Flow Information", STD 77,
              RFC 7011, DOI 10.17487/RFC7011, September 2013,
              <https://www.rfc-editor.org/info/rfc7011>.

   [RFC7012]  Claise, B., Ed. and B. Trammell, Ed., "Information Model
              for IP Flow Information Export (IPFIX)", RFC 7012,
              DOI 10.17487/RFC7012, September 2013,
              <https://www.rfc-editor.org/info/rfc7012>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

   [TS.23501] 3GPP, "5G; System architecture for the 5G System (5GS)",
              Version 17.11.0, 3GPP TS 23.501, January 2024.

   [TS.29281] 3GPP, "General Packet Radio System (GPRS) Tunnelling
              Protocol User Plane (GTPv1-U)", Version 17.4.0, 3GPP
              TS 29.281, October 2022.

   [TS.38415] 3GPP, "NG-RAN; PDU Session User Plane Protocol)", Version
              17.1.0, 3GPP TS 38.415, February 2024.

11.2.  Informative References

   [IANA-IPFIX]
              "IANA, "IP Flow Information Export (IPFIX) Entities"",
              <https://www.iana.org/assignments/ipfix/ipfix.xhtml>.

   [RFC7015]  Trammell, B., Wagner, A., and B. Claise, "Flow Aggregation
              for the IP Flow Information Export (IPFIX) Protocol",
              RFC 7015, DOI 10.17487/RFC7015, September 2013,
              <https://www.rfc-editor.org/info/rfc7015>.

   [RFC7133]  Kashima, S., Kobayashi, A., Ed., and P. Aitken,
              "Information Elements for Data Link Layer Traffic
              Measurement", RFC 7133, DOI 10.17487/RFC7133, May 2014,
              <https://www.rfc-editor.org/info/rfc7133>.

   [RFC9889]  Szarkowicz, K. G., Ed., Roberts, R., Ed., Lucek, J.,
              Boucadair, M., Ed., and L. M. Contreras, "A Realization of
              Network Slices for 5G Networks Using Current IP/MPLS
              Technologies", RFC 9889, November 2025,
              <https://www.rfc-editor.org/info/rfc9889>.

Voyer, et al.           Expires 12 December 2026               [Page 14]
Internet-Draft           IPFIX support for GTP-U               June 2026

Appendix A.  IPFIX Encoding Examples

   In this section, an example is provided to show IPFIX encoding format
   for the GTP-U introduced IEs.  Template definition and data set
   corresponding to an observed GTP-U header is illustrated below.

             Observed GTP-U Header:
             Flags = 0x36, Message Type = 0xff, GTP-U Length = 0x0064,
             TEID = 0x00000001, Sequence Number = 0x0000,
             N-PDU Number = 0x00,
             Next Extension Header Type = 0x85 (PDU Session Container),
             PDU Session Container bytes = 0x01 0x10 0x08 0x00,
             PDU Type = 1, QFI = 8, gtpuTotalHdrLength = 16

A.1.  Template Record

A.1.1.  Template Record and Data Set

   Sample template consisting of the GTP-U IEs:

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |          SET ID = 2           |       Length = 40             |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      Template ID = 256        |      Field Count = 8          |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |0|  gtpuFlags = 505            |      Field Length = 1         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |0|  gtpuMsgType = 506          |      Field Length = 1         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |0|  gtpuSequenceNum = 508      |      Field Length = 2         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |0|  gtpuTEid = 507             |      Field Length = 4         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |0|  gtpuQFI = 509              |      Field Length = 1         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |0|  gtpuPduType = 510          |      Field Length = 1         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |0|  gtpuTotalHdrLength = TBD1  |      Field Length = 1         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |0|  gtpuHeaderSection = TBD2   |      Field Length = 0xFFFF    |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

           Figure 1: Sample Template Record

Voyer, et al.           Expires 12 December 2026               [Page 15]
Internet-Draft           IPFIX support for GTP-U               June 2026

   In this example, the Template ID is 256, which will be used in the
   Data Record.

   The data set is represented as follows:

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |         SET ID = 256          |           Length = 52         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      | gtpuFlags     |  gtpuMsgType  |   gtpuSequenceNum= 0x0000     |
      | = 0x36        |  = 0xff       |                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                   gtpuTEid = 0x00000001                       |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      | gtpuQFI = 8   | gtpuPduType   |  gtpuTotalHdr |  Length = 36  |
      |               | = 1           |  Length = 16  |               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      0x36            0xff           0x00             0x64     |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      0x00            0x00           0x00             0x01     |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      0x05            0x01           0xd0             0x85     |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      0x01            0x10           0x08             0x00     |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      0x45            0x00           0x00             0x5c     |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      0x03            0xec           0x00             0x00     |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      0x40            0x01           0x7a             0x88     |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      0xc0            0x00           0x02             0x01     |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      0xc0            0x00           0x02             0x02     |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

              Figure 2: Data Set Encoding Format

      The gtpuHeaderSection octets in this example are:
      0x34 0xff 0x00 0x64 0x00 0x00 0x00 0x01
      0x05 0x01 0xd0 0x85 0x01 0x10 0x08 0x00
      0x45 0x00 0x00 0x5c 0x03 0xec 0x00 0x00
      0x40 0x01 0x7a 0x88 0xc0 0x00 0x02 0x01
      0xc0 0x00 0x02 0x02

Voyer, et al.           Expires 12 December 2026               [Page 16]
Internet-Draft           IPFIX support for GTP-U               June 2026

Authors' Addresses

   Daniel Voyer
   Cisco Systems
   Email: davoyer@cisco.com

   Sriram Gopalakrishnan
   Cisco Systems
   India
   Email: sriragop@cisco.com

   Thomas Graf
   Swisscom
   Email: thomas.graf@swisscom.com

   Vyasraj Satyanarayana
   HPE
   Email: vyasraj.satyanarayana@hpe.com

   Cristian Staicu
   Bell Canada
   Email: cristian.staicu@bell.ca

Voyer, et al.           Expires 12 December 2026               [Page 17]