Network Working Group B. Trammell
Internet-Draft ETH Zurich
Intended status: Informational S. Niccolini
Expires: April 29, 2012 NEC
B. Claise
Cisco Systems Inc.
H. Kaplan
Acme Packet
October 27, 2011
SIP Message Information Export using IPFIX
draft-trammell-ipfix-sip-msg-02
Abstract
This draft defines a set of Information Elements and example
Templates for IP Flow Information Export (IPFIX) based on the SIP
Common Log Format data model, as well as additional useful SIP
Information Elements, to allow IPFIX export of application-layer
information about SIP messages.
Status of this Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on April 29, 2012.
Copyright Notice
Copyright (c) 2011 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
Trammell, et al. Expires April 29, 2012 [Page 1]
Internet-Draft SIP Messages in IPFIX October 2011
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
2. Base Information Elements for SIP Message Information
Export . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.1. sipObservationType . . . . . . . . . . . . . . . . . . . . 5
2.2. sipMethod . . . . . . . . . . . . . . . . . . . . . . . . 5
2.3. sipSequenceNumber . . . . . . . . . . . . . . . . . . . . 5
2.4. sipRequestURI . . . . . . . . . . . . . . . . . . . . . . 5
2.5. sipFromURI . . . . . . . . . . . . . . . . . . . . . . . . 6
2.6. sipFromTag . . . . . . . . . . . . . . . . . . . . . . . . 6
2.7. sipToURI . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.8. sipToTag . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.9. sipCallId . . . . . . . . . . . . . . . . . . . . . . . . 6
2.10. sipResponseStatus . . . . . . . . . . . . . . . . . . . . 6
2.11. sipServerTransaction . . . . . . . . . . . . . . . . . . . 7
2.12. sipClientTransaction . . . . . . . . . . . . . . . . . . . 7
2.13. sipMethod subregistry . . . . . . . . . . . . . . . . . . 7
3. Additional Information Elements for SIP Message
Information Export . . . . . . . . . . . . . . . . . . . . . . 8
3.1. sipContactURI . . . . . . . . . . . . . . . . . . . . . . 8
3.2. sipRouteURI . . . . . . . . . . . . . . . . . . . . . . . 8
3.3. sipPaiURI . . . . . . . . . . . . . . . . . . . . . . . . 9
3.4. sipPpiURI . . . . . . . . . . . . . . . . . . . . . . . . 9
3.5. sipPAssocURI . . . . . . . . . . . . . . . . . . . . . . . 9
3.6. sipPCalledPartyURI . . . . . . . . . . . . . . . . . . . . 9
3.7. sipVia . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.8. sipAuthUsername . . . . . . . . . . . . . . . . . . . . . 10
3.9. sipSubscriptionEvent . . . . . . . . . . . . . . . . . . . 10
3.10. sipSubscriptionState . . . . . . . . . . . . . . . . . . . 10
3.11. sipExpires . . . . . . . . . . . . . . . . . . . . . . . . 10
3.12. sipPVisitedNetworkID . . . . . . . . . . . . . . . . . . . 11
3.13. sipPAccessNetworkInfo . . . . . . . . . . . . . . . . . . 11
3.14. sipPChargingFunctionAddr . . . . . . . . . . . . . . . . . 11
3.15. sipPChargingVector . . . . . . . . . . . . . . . . . . . . 11
4. Recommended Templates for SIP Message Information Export . . . 12
5. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
5.1. Base Template Export . . . . . . . . . . . . . . . . . . . 13
5.2. UAC registration . . . . . . . . . . . . . . . . . . . . . 14
5.3. Direct Call . . . . . . . . . . . . . . . . . . . . . . . 16
5.4. Single Downstream Branch Call . . . . . . . . . . . . . . 19
Trammell, et al. Expires April 29, 2012 [Page 2]
Internet-Draft SIP Messages in IPFIX October 2011
5.5. Forked Call . . . . . . . . . . . . . . . . . . . . . . . 25
6. Security Considerations . . . . . . . . . . . . . . . . . . . 35
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 35
8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 35
9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 35
9.1. Normative References . . . . . . . . . . . . . . . . . . . 35
9.2. Informative References . . . . . . . . . . . . . . . . . . 36
Appendix A. Definition of Base SIP Message Information
Elements in IANA XML Registry format . . . . . . . . 37
Appendix B. Definition of sipMethod registry in IANA XML
Registry format . . . . . . . . . . . . . . . . . . . 40
Appendix C. Definition of Additional SIP Message Information
Elements in IANA XML Registry format . . . . . . . . 43
Appendix D. Example messages in base64 . . . . . . . . . . . . . 47
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 50
Trammell, et al. Expires April 29, 2012 [Page 3]
Internet-Draft SIP Messages in IPFIX October 2011
1. Introduction
IPFIX [RFC5101] provides a standardized means of exporting flow
information from IPFIX exporters to IPFIX collectors. This allows
collectors to analyze flows from one or more sources for numerous
uses, such as traffic patterns/trends, anomalies, failures, attacks,
and much more. IPFIX supports exporting data in near real-time, in a
secure manner, over multiple transports; as well as in local storage
with a defined file format. The core IPFIX information model is
maintained by IANA as a registry of Information Elements at
http://www.iana.org/assignments/ipfix/. In addition to these, which
cover many network measurement and management applications,
enterprise-specific Information Elements may be defined, scoped to an
SMI private enterprise number, for vendor-proprietary Information
Elements.
Session Initiation Protocol (SIP), defined by [RFC3261] and its
extensions, is used by many devices to perform a rendezvous service,
initiate and manage real-time communication sessions, install and
monitor state information, and more. In many deployments, SIP
messages cross multiple systems managed by the same administrative
entity, and thus providing a means of exporting and collecting SIP
message information from such systems using a standard protocol is
highly desirable.
This document defines a set of IPFIX Information Elements to enable
SIP devices, such as user agents and proxies, to export SIP message
information to IPFIX collectors using the IPFIX protocol. The
purpose of doing so is to enable collectors to analyze the SIP
"traffic", for similar purposes as those for any other IPFIX flows.
Defining IANA-registered (i.e., well-known) IPFIX IE fields enables
IPFIX records of SIP message information to be generated and consumed
by different vendors. Within the context of this document's IPFIX IE
fields, a single SIP message is a complete IPFIX Flow as defined in
[RFC5101]
The SIPCLF Working Group has defined a data model
[I-D.ietf-sipclf-problem-statement] for logging information about SIP
messages to ASCII-based SIPCLF files. While useful for on-box
storage and analysis with ASCII-based tools, SIPCLF does not provide
a means of exporting such information, nor is that its goal. This
document borrows the data model from SIPCLF and represents these in
IPFIX Information Elements. It additionally provides examples for
IPFIX representation of the example SIP Messages provided in the
SIPCLF problem statement.
Trammell, et al. Expires April 29, 2012 [Page 4]
Internet-Draft SIP Messages in IPFIX October 2011
2. Base Information Elements for SIP Message Information Export
The following Information Elements represent SIP-specific mandatory
fields defined in [I-D.ietf-sipclf-problem-statement], many
themselves taken from [RFC3261]. Together with Information Elements
already available in the IPFIX IANA Information Elements registry,
these can be used to export information about SIP Messages.
2.1. sipObservationType
Description: Denotes whether the entry was corresponds to a SIP
message received, sent, or merely seen by a passive observer, as
follows:
0: unknown: The Metering Process does not specify the observation
type.
1: receiver: The Metering Process is, or is co-located with, the
receiver of the SIP message.
2: sender: The Metering Process is, or is co-located with, the
sender of the SIP message.
3: passive: The Metering Process passively observed the SIP
message.
Data Type: unsigned8
Data Type Semantics: identifier
PEN (provisional): 35566 (trammell.ch)
ElementId (provisional): 419
2.2. sipMethod
Description: The SIP method from the CSeq header, encoded as per
the IPFIX sipMethod subregistry.
Data Type: unsigned8
Data Type Semantics: identifier
PEN (provisional): 35566 (trammell.ch)
ElementId (provisional): 402
2.3. sipSequenceNumber
Description: The sequence number from the CSeq header.
Data Type: unsigned32
Data Type Semantics: identifier
PEN (provisional): 35566 (trammell.ch)
ElementId (provisional): 409
2.4. sipRequestURI
Trammell, et al. Expires April 29, 2012 [Page 5]
Internet-Draft SIP Messages in IPFIX October 2011
Description: The SIP Request URI, including any parameters, as a
UTF-8 string, escaped according to SIP rules as received by the
metering process.
Data Type: string
PEN (provisional): 35566 (trammell.ch)
ElementId (provisional): 403
2.5. sipFromURI
Description: The URI from the SIP From: header
Data Type: string
PEN (provisional): 35566 (trammell.ch)
ElementId (provisional): 404
2.6. sipFromTag
Description: The Tag parameter value from the SIP From: header
Data Type: string
PEN (provisional): 35566 (trammell.ch)
ElementId (provisional): 405
2.7. sipToURI
Description: The URI from the SIP To: header
Data Type: string
PEN (provisional): 35566 (trammell.ch)
ElementId (provisional): 406
2.8. sipToTag
Description: The Tag parameter value from the SIP To: header
Data Type: string
PEN (provisional): 35566 (trammell.ch)
ElementId (provisional): 407
2.9. sipCallId
Description: The value of the SIP Call-ID: header
Data Type: string
PEN (provisional): 35566 (trammell.ch)
ElementId (provisional): 408
2.10. sipResponseStatus
Trammell, et al. Expires April 29, 2012 [Page 6]
Internet-Draft SIP Messages in IPFIX October 2011
Description: The SIP Response code. The presence of this
Information Element in a SIP Message record marks it as describing
a SIP response; if absent, the record describes a SIP request.
Data Type: unsigned16
Data Type Semantics: identifier
PEN (provisional): 35566 (trammell.ch)
ElementId (provisional): 412
2.11. sipServerTransaction
Description: The transaction identifier associated with the server
transaction.
Data Type: string
Data Type Semantics: identifier
PEN (provisional): 35566 (trammell.ch)
ElementId (provisional): 413
2.12. sipClientTransaction
Description: The transaction identifier associated with the client
transaction.
Data Type: string
Data Type Semantics: identifier
PEN (provisional): 35566 (trammell.ch)
ElementId (provisional): 414
2.13. sipMethod subregistry
The sipMethod subregistry assigns a number to encode each of the SIP
methods encoded in the Methods and Response Codes registry at
http://www.iana.org/assignments/sip-parameters in a 16-bit integer
Information Element. These numbers are assigned from 1 in
alphabetical order for the Methods defined as of the publication time
of this document; subsequent Methods added to the Methods and
Response Codes registry will be added to the IPFIX sipMethod
subregistry at such time they are added to the Methods and Response
Codes registry, using the lowest available unassigned number at the
time of addition.
Trammell, et al. Expires April 29, 2012 [Page 7]
Internet-Draft SIP Messages in IPFIX October 2011
+----------+------------+-----------+
| Number | Method | Reference |
+----------+------------+-----------+
| 0 | Unknown | |
| 1 | ACK | [RFC3261] |
| 2 | BYE | [RFC3261] |
| 3 | CANCEL | [RFC3261] |
| 4 | INFO | [RFC6086] |
| 5 | INVITE | [RFC3261] |
| 6 | MESSAGE | [RFC3428] |
| 7 | NOTIFY | [RFC3265] |
| 8 | OPTIONS | [RFC3261] |
| 9 | PRACK | [RFC3262] |
| 10 | PUBLISH | [RFC3903] |
| 11 | REFER | [RFC3515] |
| 12 | REGISTER | [RFC3261] |
| 13 | SUBSCRIBE | [RFC3265] |
| 14 | UPDATE | [RFC3311] |
| 15-65535 | Unassigned | |
+----------+------------+-----------+
3. Additional Information Elements for SIP Message Information Export
[TODO frontmatter]
3.1. sipContactURI
Description: The addr-spec URI, including any URI parameters, of
the first/top-most SIP Contact header, as a UTF-8 string, escaped
according to SIP rules as received by the metering process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 415
3.2. sipRouteURI
Description: The addr-spec URI, including any URI parameters, of
the first/top-most SIP Route header, as a UTF-8 string, escaped
according to SIP rules as received by the metering process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
Trammell, et al. Expires April 29, 2012 [Page 8]
Internet-Draft SIP Messages in IPFIX October 2011
ElementId (provisional): 416
3.3. sipPaiURI
Description: The addr-spec URI, including any URI parameters, of
the first/top-most SIP P-Asserted-Identity header, as a UTF-8
string, escaped according to SIP rules as received by the metering
process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 417
3.4. sipPpiURI
Description: The addr-spec URI, including any URI parameters, of
the first/top-most SIP P-Preferred-Identity header, as a UTF-8
string, escaped according to SIP rules as received by the metering
process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 418
3.5. sipPAssocURI
Description: The addr-spec URI, including any URI parameters, of
the first/top-most SIP P-Associated-Identity header, as a UTF-8
string, escaped according to SIP rules as received by the metering
process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 430
3.6. sipPCalledPartyURI
Description: The addr-spec URI, including any URI parameters, of
the SIP P-Called-Party-ID header, as a UTF-8 string, escaped
according to SIP rules as received by the metering process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 420
Trammell, et al. Expires April 29, 2012 [Page 9]
Internet-Draft SIP Messages in IPFIX October 2011
3.7. sipVia
Description: The value of the first/top-most Via header as a UTF-8
string, escaped according to SIP rules as received by the metering
process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 421
3.8. sipAuthUsername
Description: The value of the username field of the first/top-most
Authorization header as a UTF-8 string, escaped according to SIP
rules as received by the metering process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 422
3.9. sipSubscriptionEvent
Description: The value of the Event header as a UTF-8 string,
escaped according to SIP rules as received by the metering
process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 423
3.10. sipSubscriptionState
Description: The value of the Subscription-State header as a UTF-8
string, escaped according to SIP rules as received by the metering
process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 424
3.11. sipExpires
Description: The numeric value of the expires parameter of the
first/top-most Contact header of a REGISTER request or response,
or Subscription-State header of a SUBSCRIBE or NOTIFY request or
response, or the Expires header if the expires parameter does not
exist, as received by the metering process.
Trammell, et al. Expires April 29, 2012 [Page 10]
Internet-Draft SIP Messages in IPFIX October 2011
Data Type: unsigned32
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 425
3.12. sipPVisitedNetworkID
Description: The value of the first/top-most P-Visited-Network-ID
header as a UTF-8 string, escaped according to SIP rules as
received by the metering process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 426
3.13. sipPAccessNetworkInfo
Description: The value of the P-Access-Network-Info header as a
UTF-8 string, escaped according to SIP rules as received by the
metering process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 427
3.14. sipPChargingFunctionAddr
Description: The value of the first/top-most P-Charging-Function-
Addresses header as a UTF-8 string, escaped according to SIP rules
as received by the metering process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 428
3.15. sipPChargingVector
Description: The value of the P-Charging-Vector header as a UTF-8
string, escaped according to SIP rules as received by the metering
process.
Data Type: string
Data Type Semantics:
PEN (provisional): 35566
ElementId (provisional): 429
Trammell, et al. Expires April 29, 2012 [Page 11]
Internet-Draft SIP Messages in IPFIX October 2011
4. Recommended Templates for SIP Message Information Export
The SIPCLF data model represents SIP requests and SIP responses with
separate records. The following Templates are defined as recommended
base Templates for records describing requests and responses.
Optional Information Elements MAY be added to them, and the IPv4
addresses within these Templates MUST be replaced with IPv6 addresses
for logging IPv6 transport of SIP messages. A sipServerTransaction
Information Element SHOULD be added for all messages logged by a User
Agent Server, and a sipClientTransaction Information Element SHOULD
be added for all messages logged by a User Agent Client. These
templates follow the recommended fields for request and response
logging in [I-D.ietf-sipclf-problem-statement], and are defined using
the representation in section 9 of [I-D.trammell-ipfix-ie-doctors].
observationTimeMilliseconds(323)[8]
sipSequenceNumber(35566/409)[4]
sourceIPv4Address(8)[4]
destinationIPv4Address(12)[4]
sourceTransportPort(7)[2]
destinationTransportPort(11)[2]
protocolIdentifier(4)[1]
sipMethod(35566/402)[1]
sipObservationType(35566/419)[1]
sipRequestURI(35566/403)[v]
sipToURI(35566/406)[v]
sipToTag(35566/407)[v]
sipFromURI(35566/404)[v]
sipFromTag(35566/405)[v]
sipCallId(35566/408)[v]
Figure 1: Base Request Template (IPv4)
Trammell, et al. Expires April 29, 2012 [Page 12]
Internet-Draft SIP Messages in IPFIX October 2011
observationTimeMilliseconds(323)[8]
sipSequenceNumber(35566/409)[4]
sourceIPv4Address(8)[4]
destinationIPv4Address(12)[4]
sourceTransportPort(7)[2]
destinationTransportPort(11)[2]
protocolIdentifier(4)[1]
sipMethod(35566/402)[1]
sipObservationType(35566/419)[1]
sipResponseStatus(35566/412)[2]
sipToURI(35566/406)[v]
sipToTag(35566/407)[v]
sipFromURI(35566/404)[v]
sipFromTag(35566/405)[v]
sipCallId(35566/408)[v]
Figure 2: Base Response Template (IPv4)
Note that the Information Elements in these templates are ordered to
place the fixed-length elements before the variable-length ones,
which speeds random access to fixed-length elements. However, since
element order within a record is unimportant in IPFIX, any ordering
of the mandatory Information Elements within a record MUST be
accepted by a Collecting Process as a valid SIP request or response
record for that record type.
The record type is determined by the presence of the
sipResponseStatus field. If present in the Template, the Template
describes a response record. If absent, it describes a request
record.
5. Examples
This section presents several views of an example SIP messages
exported using the IPFIX templates described in this document. We
present both binary and textual forms. The tools to generate this
section are based upon the open-source ripfix [ripfix] implementation
of IPFIX, maintained by one of the authors of this draft.
Here we show the IPFIX Messages generated by the situations in
sections 9.1 through 9.4 of [I-D.ietf-sipclf-problem-statement].
5.1. Base Template Export
Before exporting any Request or Response records, the Templates
describing them must be exported. In this example, the templates
These Templates are derived from the base Templates as shown in
Trammell, et al. Expires April 29, 2012 [Page 13]
Internet-Draft SIP Messages in IPFIX October 2011
Figure 1 and Figure 2, with the sipClientTransaction and
sipServerTransaction Information Elements appended. We use two
templates here, one each for request and response for IPv4.
Exporting these Templates results in the following IPFIX message,
illustrated as an annotated hexdump in Figure 3.
0000: 00 0a 00 fc 4c c0 2a a2 00 00 00 00 00 00 30 39 ....L.*.......09
[ IPFIX message header, length 252 ]
0010: 00 02 00 ec ....
[ Template set (ID 2) header, length 236 ]
0014: 01 01 00 11 01 43 00 08 81 99 00 04 .....C......
0020: 00 00 8a ee 00 08 00 04 00 0c 00 04 00 07 00 02 ................
0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee ................
0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee ................
0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee ................
0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee ................
0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee ................
0080: 81 9d ff ff 00 00 8a ee ........
[ Template 257, 17 elements (v4 request) ]
0088: 01 02 00 11 01 43 00 08 .....C..
0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 0c 00 04 ................
00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01 ................
00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02 ................
00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff ................
00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff ................
00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff ................
00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee ............
[ Template 258, 17 elements (v4 response) ]
Figure 3: Base template message export
5.2. UAC registration
Having exported templates, now we create a simple IPFIX Message
representing a UAC registration as seen from the UAC, corresponding
to example 9.1 in [I-D.ietf-sipclf-problem-statement]. This message
contains two records, including the UAS registration request, and the
response received. This is shown in the annotated hexdump in
Figure 4.
Trammell, et al. Expires April 29, 2012 [Page 14]
Internet-Draft SIP Messages in IPFIX October 2011
0000: 00 0a 00 d8 4c 90 7f c1 00 00 00 00 00 00 30 39 ....L.........09
[ IPFIX message header, length 218 ]
0010: 01 01 00 6b ...k
[ Data set (ID 257) header, length 107 ]
0014: 00 00 01 29 13 66 13 93 00 00 00 01 ...).f......
0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 0c 02 0f .3d..3d.........
0030: 73 69 70 3a 65 78 61 6d 70 6c 65 2e 63 6f 6d 00 sip:example.com.
0040: 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d ..sip:alice@exam
0050: 70 6c 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 ple.com.76yhh.f8
0060: 31 2d 64 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 1-d4-f6@example.
0070: 63 6f 6d 06 63 2d 74 72 2d 31 00 com.c-tr-1.
[ Request record content ]
007b: 01 02 00 5d ...]
[ Data set (ID 258) header, length 93 ]
007f: 00 .
0080: 00 01 29 13 66 15 24 00 00 00 01 c6 33 64 0a c6 ..).f.$.....3d..
0090: 33 64 01 13 c4 13 c4 11 0c 01 00 c8 00 00 15 73 3d.............s
00a0: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 ip:alice@example
00b0: 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 31 2d 64 .com.76yhh.f81-d
00c0: 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 4-f6@example.com
00d0: 06 63 2d 74 72 2d 31 00 .c-tr-1.
[ Response record content ]
Figure 4: Message containing two log entries for UAC registration
While this demonstrates the binary nature of the SIPCLF-IPFIX format,
and shows the content framing for this message, it is not readable
for illustration purposes. In Figure 5, we run the message through
the ripcollect tool provided with ripfix to provide a more human-
readable view. Note that the sipMethod and sipObservationType are
encoded according to the registries in Section 2.
Trammell, et al. Expires April 29, 2012 [Page 15]
Internet-Draft SIP Messages in IPFIX October 2011
==== message sequence 0 in domain 12345 at 2010-08-11 11:53:27 UTC ====
---- record 12345/257 ----
observationTimeMilliseconds => 2010-06-07 17:12:23 UTC
sipSequenceNumber => 1
sourceIPv4Address => 198.51.100.1
destinationIPv4Address => 198.51.100.10
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 12
sipObservationType => 2
sipRequestURI => sip:example.com
sipToURI =>
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => 76yhh
sipCallId => f81-d4-f6@example.com
sipClientTransaction => c-tr-1
sipServerTransaction =>
---- record 12345/258 ----
observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
sipSequenceNumber => 1
sourceIPv4Address => 198.51.100.10
destinationIPv4Address => 198.51.100.1
sourceTransportPort => 5060
destinationTransportPort => 5060
sipResponseStatus => 200
protocolIdentifier => 17
sipMethod => 12
sipObservationType => 1
sipToURI =>
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => 76yhh
sipCallId => f81-d4-f6@example.com
sipClientTransaction => c-tr-1
sipServerTransaction =>
Figure 5: Message containing two log entries for UAC registration
5.3. Direct Call
This example demonstrates the export of a direct call from Alice to
Bob, as seen by Bob's agent, corresponding to example 9.2 in
[I-D.ietf-sipclf-problem-statement]. Here we have four records: an
INVITE received from Alice, a 180 Ringing sent back followed by a 200
OK, and an ACK received from Alice. This is shown in the ripfix dump
in Figure 6 and the hexdump in Figure 7. In the hexdump, message
Trammell, et al. Expires April 29, 2012 [Page 16]
Internet-Draft SIP Messages in IPFIX October 2011
headers, set headers, and data records are separated by '|'
characters for compactness. Note here that each record has its own
data set to support high-speed seeking to a specific record, even
when two messages using the same template are adjacent in the
message.
===== message 12345/0 @2010-10-21 13:11:43 UTC (#2) =====
--- record 12345/257 (#1)---
observationTimeMilliseconds => 2010-06-07 17:12:23 UTC
sipSequenceNumber => 32
sourceIPv4Address => 198.51.100.1
destinationIPv4Address => 203.0.113.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 2
sipRequestURI => sip:bob@bob1.example.net
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => 76yhh
sipCallId => f82-d4-f7@example.com
sipClientTransaction => c-1-xt6
sipServerTransaction =>
--- record 12345/258 (#2)---
observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
sipSequenceNumber => 32
sourceIPv4Address => 203.0.113.1
destinationIPv4Address => 198.51.100.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 1
sipResponseStatus => 180
sipToURI => sip:bob@example.net
sipToTag => b-in6-iu
sipFromURI => sip:alice@example.com
sipFromTag => 76yhh
sipCallId => f82-d4-f7@example.com
sipClientTransaction => c-1-xt6
sipServerTransaction =>
--- record 12345/258 (#3)---
observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
sipSequenceNumber => 32
sourceIPv4Address => 203.0.113.1
destinationIPv4Address => 198.51.100.1
Trammell, et al. Expires April 29, 2012 [Page 17]
Internet-Draft SIP Messages in IPFIX October 2011
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 1
sipResponseStatus => 200
sipToURI => sip:bob@example.net
sipToTag => b-in6-iu
sipFromURI => sip:alice@example.com
sipFromTag => 76yhh
sipCallId => f82-d4-f7@example.com
sipClientTransaction => c-1-xt6
sipServerTransaction =>
--- record 12345/257 (#4)---
observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
sipSequenceNumber => 32
sourceIPv4Address => 198.51.100.1
destinationIPv4Address => 203.0.113.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 1
sipObservationType => 2
sipRequestURI => sip:bob@bob1.example.net
sipToURI => sip:bob@example.net
sipToTag => b-in6-iu
sipFromURI => sip:alice@example.com
sipFromTag => 76yhh
sipCallId => f82-d4-f7@example.com
sipClientTransaction => c-1-xt6
sipServerTransaction =>
Figure 6: Message containing four records for a simple call (ripfix
dump)
Trammell, et al. Expires April 29, 2012 [Page 18]
Internet-Draft SIP Messages in IPFIX October 2011
0000: 00 0a 02 1a 4c c0 2c b3 00 00 00 00 00 00 30 39| ....L.,.......09
0010: 01 01 00 88|00 00 01 29 13 66 13 93 00 00 00 20 .......).f.....
0020: c6 33 64 01 cb 00 71 01 13 c4 13 c4 11 05 02 18 .3d...q.........
0030: 73 69 70 3a 62 6f 62 40 62 6f 62 31 2e 65 78 61 sip:bob@bob1.exa
0040: 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 mple.net.sip:bob
0050: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 @example.net..si
0060: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example.
0070: 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d 64 34 com.76yhh.f82-d4
0080: 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 07 -f7@example.com.
0090: 63 2d 31 2d 78 74 36 00|01 02 00 79|00 00 01 29 c-1-xt6....y...)
00a0: 13 66 18 aa 00 00 00 20 cb 00 71 01 c6 33 64 01 .f..... ..q..3d.
00b0: 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 6f ..........sip:bo
00c0: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 08 62 2d b@example.net.b-
00d0: 69 6e 36 2d 69 75 15 73 69 70 3a 61 6c 69 63 65 in6-iu.sip:alice
00e0: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 05 37 36 79 @example.com.76y
00f0: 68 68 15 66 38 32 2d 64 34 2d 66 37 40 65 78 61 hh.f82-d4-f7@exa
0100: 6d 70 6c 65 2e 63 6f 6d 07 63 2d 31 2d 78 74 36 mple.com.c-1-xt6
0110: 00|01 02 00 79|00 00 01 29 13 66 1c f4 00 00 00 ....y...).f.....
0120: 20 cb 00 71 01 c6 33 64 01 13 c4 13 c4 11 05 01 ..q..3d........
0130: 00 c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 ...sip:bob@examp
0140: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15 le.net.b-in6-iu.
0150: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl
0160: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d e.com.76yhh.f82-
0170: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f d4-f7@example.co
0180: 6d 07 63 2d 31 2d 78 74 36 00|01 01 00 90|00 00 m.c-1-xt6.......
0190: 01 29 13 66 1d 08 00 00 00 20 c6 33 64 01 cb 00 .).f..... .3d...
01a0: 71 01 13 c4 13 c4 11 01 02 18 73 69 70 3a 62 6f q.........sip:bo
01b0: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n
01c0: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp
01d0: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15 le.net.b-in6-iu.
01e0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl
01f0: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d e.com.76yhh.f82-
0200: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f d4-f7@example.co
0210: 6d 07 63 2d 31 2d 78 74 36 00 m.c-1-xt6.
Figure 7: Message containing four records for a simple call (hexdump)
5.4. Single Downstream Branch Call
The example in Figure 8and Figure 9 demonstrates the export of a call
with a downstream branch to Bob, as seen by the proxy which the call
traverses, corresponding to example 9.3 in
[I-D.ietf-sipclf-problem-statement]. See this example in the problem
statement for more details.
===== message 12345/0 @2010-10-21 13:12:42 UTC (#2) =====
--- record 12345/257 (#1)---
observationTimeMilliseconds => 2010-06-07 17:12:23 UTC
Trammell, et al. Expires April 29, 2012 [Page 19]
Internet-Draft SIP Messages in IPFIX October 2011
sipSequenceNumber => 43
sourceIPv4Address => 198.51.100.1
destinationIPv4Address => 198.51.100.10
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 1
sipRequestURI => sip:bob@example.net
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => al-1
sipCallId => tr-87h@example.com
sipClientTransaction =>
sipServerTransaction => s-x-tr
--- record 12345/258 (#2)---
observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
sipSequenceNumber => 43
sourceIPv4Address => 198.51.100.10
destinationIPv4Address => 198.51.100.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 2
sipResponseStatus => 100
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => al-1
sipCallId => tr-87h@example.com
sipClientTransaction =>
sipServerTransaction => s-x-tr
--- record 12345/257 (#3)---
observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
sipSequenceNumber => 43
sourceIPv4Address => 198.51.100.10
destinationIPv4Address => 203.0.113.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 2
sipRequestURI => sip:bob@bob1.example.net
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
Trammell, et al. Expires April 29, 2012 [Page 20]
Internet-Draft SIP Messages in IPFIX October 2011
sipFromTag => al-1
sipCallId => tr-87h@example.com
sipClientTransaction => c-x-tr
sipServerTransaction => s-x-tr
--- record 12345/258 (#4)---
observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.1
destinationIPv4Address => 198.51.100.10
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 1
sipResponseStatus => 100
sipToURI => sip:bob@example.net
sipToTag => b1-1
sipFromURI => sip:alice@example.com
sipFromTag => al-1
sipCallId => tr-87h@example.com
sipClientTransaction => c-x-tr
sipServerTransaction => s-x-tr
--- record 12345/258 (#5)---
observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.1
destinationIPv4Address => 198.51.100.10
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 1
sipResponseStatus => 180
sipToURI => sip:bob@example.net
sipToTag => b1-1
sipFromURI => sip:alice@example.com
sipFromTag => al-1
sipCallId => tr-87h@example.com
sipClientTransaction => c-x-tr
sipServerTransaction => s-x-tr
--- record 12345/258 (#6)---
observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
sipSequenceNumber => 43
sourceIPv4Address => 198.51.100.10
destinationIPv4Address => 198.51.100.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
Trammell, et al. Expires April 29, 2012 [Page 21]
Internet-Draft SIP Messages in IPFIX October 2011
sipMethod => 5
sipObservationType => 2
sipResponseStatus => 180
sipToURI => sip:bob@example.net
sipToTag => b1-1
sipFromURI => sip:alice@example.com
sipFromTag => al-1
sipCallId => tr-87h@example.com
sipClientTransaction => c-x-tr
sipServerTransaction => s-x-tr
--- record 12345/258 (#7)---
observationTimeMilliseconds => 2010-06-07 17:12:27 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.1
destinationIPv4Address => 198.51.100.10
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 1
sipResponseStatus => 200
sipToURI => sip:bob@example.net
sipToTag => b1-1
sipFromURI => sip:alice@example.com
sipFromTag => al-1
sipCallId => tr-87h@example.com
sipClientTransaction => c-x-tr
sipServerTransaction => s-x-tr
--- record 12345/258 (#8)---
observationTimeMilliseconds => 2010-06-07 17:12:27 UTC
sipSequenceNumber => 43
sourceIPv4Address => 198.51.100.10
destinationIPv4Address => 198.51.100.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 2
sipResponseStatus => 200
sipToURI => sip:bob@example.net
sipToTag => b1-1
sipFromURI => sip:alice@example.com
sipFromTag => al-1
sipCallId => tr-87h@example.com
sipClientTransaction => c-x-tr
sipServerTransaction => s-x-tr
--- record 12345/257 (#9)---
observationTimeMilliseconds => 2010-06-07 17:12:29 UTC
Trammell, et al. Expires April 29, 2012 [Page 22]
Internet-Draft SIP Messages in IPFIX October 2011
sipSequenceNumber => 43
sourceIPv4Address => 198.51.100.1
destinationIPv4Address => 198.51.100.10
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 1
sipObservationType => 1
sipRequestURI => sip:bob@example.net
sipToURI => sip:bob@example.net
sipToTag => b1-1
sipFromURI => sip:alice@example.com
sipFromTag => al-1
sipCallId => tr-87h@example.com
sipClientTransaction => c-x-tr
sipServerTransaction => s-x-tr
--- record 12345/257 (#10)---
observationTimeMilliseconds => 2010-06-07 17:12:29 UTC
sipSequenceNumber => 43
sourceIPv4Address => 198.51.100.10
destinationIPv4Address => 203.0.113.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 1
sipObservationType => 2
sipRequestURI => sip:bob@example.net
sipToURI => sip:bob@example.net
sipToTag => b1-1
sipFromURI => sip:alice@example.com
sipFromTag => al-1
sipCallId => tr-87h@example.com
sipClientTransaction => c-x-tr
sipServerTransaction => s-x-tr
Figure 8: Message containing ten records for a downstream branch call
(ripfix dump)
0000: 00 0a 04 e1|4c c0 2c e5 00 00 00 00 00 00 30 39| ....L.,.......09
0010: 01 01 00 7e|00 00 01 29 13 66 13 93 00 00 00 2b ...~...).f.....+
0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 05 01 13 .3d..3d.........
0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example.
0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d net.sip:bob@exam
0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali
0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a
0070: 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 l-1.tr-87h@examp
0080: 6c 65 2e 63 6f 6d 00 06 73 2d 78 2d 74 72|01 02 le.com..s-x-tr..
Trammell, et al. Expires April 29, 2012 [Page 23]
Internet-Draft SIP Messages in IPFIX October 2011
0090: 00 6c|00 00 01 29 13 66 14 c1 00 00 00 2b c6 33 .l...).f.....+.3
00a0: 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13 d..3d.........d.
00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example.
00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 net..sip:alice@e
00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 xample.com.al-1.
00e0: 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 tr-87h@example.c
00f0: 6f 6d 00 06 73 2d 78 2d 74 72|01 01 00 89|00 00 om..s-x-tr......
0100: 01 29 13 66 18 a6 00 00 00 2b c6 33 64 0a cb 00 .).f.....+.3d...
0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f q.........sip:bo
0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n
0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp
0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 le.net..sip:alic
0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c e@example.com.al
0160: 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c -1.tr-87h@exampl
0170: 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 e.com.c-x-tr.s-x
0180: 2d 74 72|01 02 00 76|00 00 01 29 13 66 19 70 00 -tr...v...).f.p.
0190: 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 c4 11 ..+..q..3d......
01a0: 05 01 00 64 13 73 69 70 3a 62 6f 62 40 65 78 61 ...d.sip:bob@exa
01b0: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 mple.net.b1-1.si
01c0: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example.
01d0: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40 com.al-1.tr-87h@
01e0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d example.com.c-x-
01f0: 74 72 06 73 2d 78 2d 74 72|01 02 00 76|00 00 01 tr.s-x-tr...v...
0200: 29 13 66 1b c8 00 00 00 2b cb 00 71 01 c6 33 64 ).f.....+..q..3d
0210: 0a 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 ...........sip:b
0220: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 ob@example.net.b
0230: 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 1-1.sip:alice@ex
0240: 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 ample.com.al-1.t
0250: 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 6f r-87h@example.co
0260: 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 72|01 m.c-x-tr.s-x-tr.
0270: 02 00 76|00 00 01 29 13 66 1c 98 00 00 00 2b c6 ..v...).f.....+.
0280: 33 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 b4 3d..3d..........
0290: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 .sip:bob@example
02a0: 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 6c .net.b1-1.sip:al
02b0: 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 ice@example.com.
02c0: 61 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d al-1.tr-87h@exam
02d0: 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 ple.com.c-x-tr.s
02e0: 2d 78 2d 74 72|01 02 00 76|00 00 01 29 13 66 20 -x-tr...v...).f
02f0: f0 00 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 ....+..q..3d....
0300: c4 11 05 01 00 c8 13 73 69 70 3a 62 6f 62 40 65 .......sip:bob@e
0310: 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 xample.net.b1-1.
0320: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl
0330: 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 e.com.al-1.tr-87
0340: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d h@example.com.c-
0350: 78 2d 74 72 06 73 2d 78 2d 74 72|01 02 00 76|00 x-tr.s-x-tr...v.
0360: 00 01 29 13 66 21 a4 00 00 00 2b c6 33 64 0a c6 ..).f!....+.3d..
0370: 33 64 01 13 c4 13 c4 11 05 02 00 c8 13 73 69 70 3d...........sip
0380: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 :bob@example.net
Trammell, et al. Expires April 29, 2012 [Page 24]
Internet-Draft SIP Messages in IPFIX October 2011
0390: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 .b1-1.sip:alice@
03a0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 example.com.al-1
03b0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e .tr-87h@example.
03c0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 com.c-x-tr.s-x-t
03d0: 72|01 01 00 88|00 00 01 29 13 66 28 ac 00 00 00 r.......).f(....
03e0: 2b c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 01 01 +.3d..3d........
03f0: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 .sip:bob@example
0400: 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 .net.sip:bob@exa
0410: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 mple.net.b1-1.si
0420: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example.
0430: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40 com.al-1.tr-87h@
0440: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d example.com.c-x-
0450: 74 72 06 73 2d 78 2d 74 72|01 01 00 88|00 00 01 tr.s-x-tr.......
0460: 29 13 66 28 ac 00 00 00 2b c6 33 64 0a cb 00 71 ).f(....+.3d...q
0470: 01 13 c4 13 c4 11 01 02 13 73 69 70 3a 62 6f 62 .........sip:bob
0480: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 @example.net.sip
0490: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 :bob@example.net
04a0: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 .b1-1.sip:alice@
04b0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 example.com.al-1
04c0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e .tr-87h@example.
04d0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 com.c-x-tr.s-x-t
04e0: 72 r
Figure 9: Message containing ten log entries for a downstream branch
call (hexdump)
5.5. Forked Call
The example in Figure 11 and Figure 12 demonstrates the export of
forked call to Bob, as seen by one of Bob's instances which forks the
call traverses, corresponding to example 9.4 in
[I-D.ietf-sipclf-problem-statement]. See this example for more
details. Note that, since Bob's first instance is multihomed IPv4-
IPv6, this example requires additional templates: request and
response templates for IPv4 to IPv6 and back, these are shown in
Figure 10.
Trammell, et al. Expires April 29, 2012 [Page 25]
Internet-Draft SIP Messages in IPFIX October 2011
0000: 00 0a 01 e4 4c c0 2d 9b 00 00 00 00 00 00 30 39 ....L.-.......09
0010: 00 02 01 d4 01 05 00 11 01 43 00 08 81 99 00 04 .........C......
0020: 00 00 8a ee 00 08 00 04 00 1c 00 10 00 07 00 02 ................
0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee ................
0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee ................
0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee ................
0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee ................
0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee ................
0080: 81 9d ff ff 00 00 8a ee 01 06 00 11 01 43 00 08 .............C..
0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 1c 00 10 ................
00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01 ................
00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02 ................
00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff ................
00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff ................
00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff ................
00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee 01 07 00 11 ................
0100: 01 43 00 08 81 99 00 04 00 00 8a ee 00 1b 00 10 .C..............
0110: 00 0c 00 04 00 07 00 02 00 0b 00 02 00 04 00 01 ................
0120: 81 92 00 01 00 00 8a ee 81 a3 00 01 00 00 8a ee ................
0130: 81 93 ff ff 00 00 8a ee 81 96 ff ff 00 00 8a ee ................
0140: 81 97 ff ff 00 00 8a ee 81 94 ff ff 00 00 8a ee ................
0150: 81 95 ff ff 00 00 8a ee 81 98 ff ff 00 00 8a ee ................
0160: 81 9e ff ff 00 00 8a ee 81 9d ff ff 00 00 8a ee ................
0170: 01 08 00 11 01 43 00 08 81 99 00 04 00 00 8a ee .....C..........
0180: 00 1b 00 10 00 0c 00 04 00 07 00 02 00 0b 00 02 ................
0190: 00 04 00 01 81 92 00 01 00 00 8a ee 81 a3 00 01 ................
01a0: 00 00 8a ee 81 9c 00 02 00 00 8a ee 81 96 ff ff ................
01b0: 00 00 8a ee 81 97 ff ff 00 00 8a ee 81 94 ff ff ................
01c0: 00 00 8a ee 81 95 ff ff 00 00 8a ee 81 98 ff ff ................
01d0: 00 00 8a ee 81 9e ff ff 00 00 8a ee 81 9d ff ff ................
01e0: 00 00 8a ee ....
Figure 10: Message containing templates for IPv4 to IPv6 requests and
responses, and vice versa
===== message 12345/0 @2010-10-21 13:13:01 UTC (#3) =====
--- record 12345/257 (#1)---
observationTimeMilliseconds => 2010-06-07 17:12:23 UTC
sipSequenceNumber => 43
sourceIPv4Address => 198.51.100.1
destinationIPv4Address => 203.0.113.200
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 1
sipRequestURI => sip:bob@example.net
Trammell, et al. Expires April 29, 2012 [Page 26]
Internet-Draft SIP Messages in IPFIX October 2011
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction =>
sipServerTransaction => s-1-tr
--- record 12345/258 (#2)---
observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.200
destinationIPv4Address => 198.51.100.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 2
sipResponseStatus => 100
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction =>
sipServerTransaction => s-1-tr
--- record 12345/257 (#3)---
observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.200
destinationIPv4Address => 203.0.113.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 2
sipRequestURI => sip:bob@bob1.example.net
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-1-tr
sipServerTransaction => s-1-tr
--- record 12345/261 (#4)---
observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.200
destinationIPv6Address => 2001:db8::9
Trammell, et al. Expires April 29, 2012 [Page 27]
Internet-Draft SIP Messages in IPFIX October 2011
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 2
sipRequestURI => sip:bob@bob2.example.net
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-2-tr
sipServerTransaction => s-1-tr
--- record 12345/258 (#5)---
observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.1
destinationIPv4Address => 203.0.113.200
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 1
sipResponseStatus => 100
sipToURI => sip:bob@example.net
sipToTag => b1-1
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-1-tr
sipServerTransaction => s-1-tr
--- record 12345/264 (#6)---
observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
sipSequenceNumber => 43
sourceIPv6Address => 2001:db8::9
destinationIPv4Address => 203.0.113.200
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 1
sipResponseStatus => 100
sipToURI => sip:bob@example.net
sipToTag => b2-2
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-2-tr
Trammell, et al. Expires April 29, 2012 [Page 28]
Internet-Draft SIP Messages in IPFIX October 2011
sipServerTransaction => s-1-tr
--- record 12345/264 (#7)---
observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
sipSequenceNumber => 43
sourceIPv6Address => 2001:db8::9
destinationIPv4Address => 203.0.113.200
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 1
sipResponseStatus => 180
sipToURI => sip:bob@example.net
sipToTag => b2-2
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-2-tr
sipServerTransaction => s-1-tr
--- record 12345/258 (#8)---
observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.200
destinationIPv4Address => 198.51.100.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 2
sipResponseStatus => 180
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-2-tr
sipServerTransaction => s-1-tr
--- record 12345/258 (#9)---
observationTimeMilliseconds => 2010-06-07 17:12:27 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.200
destinationIPv4Address => 198.51.100.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 2
sipResponseStatus => 180
Trammell, et al. Expires April 29, 2012 [Page 29]
Internet-Draft SIP Messages in IPFIX October 2011
sipToURI => sip:bob@example.net
sipToTag => b1-1
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-1-tr
sipServerTransaction => s-1-tr
--- record 12345/258 (#10)---
observationTimeMilliseconds => 2010-06-07 17:12:27 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.1
destinationIPv4Address => 203.0.113.200
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 1
sipResponseStatus => 200
sipToURI => sip:bob@example.net
sipToTag => b1-1
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-1-tr
sipServerTransaction => s-1-tr
--- record 12345/258 (#11)---
observationTimeMilliseconds => 2010-06-07 17:12:28 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.200
destinationIPv4Address => 198.51.100.1
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 2
sipResponseStatus => 200
sipToURI => sip:bob@example.net
sipToTag => b1-1
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-1-tr
sipServerTransaction => s-1-tr
--- record 12345/261 (#12)---
observationTimeMilliseconds => 2010-06-07 17:12:28 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.200
destinationIPv6Address => 2001:db8::9
Trammell, et al. Expires April 29, 2012 [Page 30]
Internet-Draft SIP Messages in IPFIX October 2011
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 3
sipObservationType => 2
sipRequestURI => sip:bob@bob2.example.net
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-2-tr
sipServerTransaction => s-1-tr
--- record 12345/264 (#13)---
observationTimeMilliseconds => 2010-06-07 17:12:28 UTC
sipSequenceNumber => 43
sourceIPv6Address => 2001:db8::9
destinationIPv4Address => 203.0.113.200
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 5
sipObservationType => 1
sipResponseStatus => 487
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-2-tr
sipServerTransaction => s-1-tr
--- record 12345/261 (#14)---
observationTimeMilliseconds => 2010-06-07 17:12:29 UTC
sipSequenceNumber => 43
sourceIPv4Address => 203.0.113.200
destinationIPv6Address => 2001:db8::9
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 1
sipObservationType => 2
sipRequestURI => sip:bob@bob2.example.net
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-2-tr
Trammell, et al. Expires April 29, 2012 [Page 31]
Internet-Draft SIP Messages in IPFIX October 2011
sipServerTransaction => s-1-tr
--- record 12345/264 (#15)---
observationTimeMilliseconds => 2010-06-07 17:12:30 UTC
sipSequenceNumber => 43
sourceIPv6Address => 2001:db8::9
destinationIPv4Address => 203.0.113.200
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 3
sipObservationType => 1
sipResponseStatus => 200
sipToURI => sip:bob@example.net
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => a1-1
sipCallId => tr-88h@example.com
sipClientTransaction => c-2-tr
sipServerTransaction => s-1-tr
Figure 11: Message containing fifteen records for a forked call
0000: 00 0a 07 8c 4c c0 2d 9b 00 00 00 00 00 00 30 39| ....L.-.......09
0010: 01 01 00 7e|00 00 01 29 13 66 13 93 00 00 00 2b ...~...).f.....+
0020: c6 33 64 01 cb 00 71 c8 13 c4 13 c4 11 05 01 13 .3d...q.........
0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example.
0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d net.sip:bob@exam
0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali
0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a
0070: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 1-1.tr-88h@examp
0080: 6c 65 2e 63 6f 6d 00 06 73 2d 31 2d 74 72|01 02 le.com..s-1-tr..
0090: 00 6c|00 00 01 29 13 66 14 c1 00 00 00 2b cb 00 .l...).f.....+..
00a0: 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13 q..3d.........d.
00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example.
00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 net..sip:alice@e
00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1.
00e0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c
00f0: 6f 6d 00 06 73 2d 31 2d 74 72|01 01 00 89|00 00 om..s-1-tr......
0100: 01 29 13 66 18 a6 00 00 00 2b cb 00 71 c8 cb 00 .).f.....+..q...
0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f q.........sip:bo
0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n
0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp
0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 le.net..sip:alic
0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 e@example.com.a1
0160: 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c -1.tr-88h@exampl
0170: 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 e.com.c-1-tr.s-1
0180: 2d 74 72|01 05 00 95|00 00 01 29 13 66 1a 9c 00 -tr.......).f...
Trammell, et al. Expires April 29, 2012 [Page 32]
Internet-Draft SIP Messages in IPFIX October 2011
0190: 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 00 00 00 ..+..q. ........
01a0: 00 00 00 00 00 00 09 13 c4 13 c4 11 05 02 18 73 ...............s
01b0: 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 78 61 6d ip:bob@bob2.exam
01c0: 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 ple.net.sip:bob@
01d0: 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 70 example.net..sip
01e0: 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 :alice@example.c
01f0: 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 om.a1-1.tr-88h@e
0200: 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 xample.com.c-2-t
0210: 72 06 73 2d 31 2d 74 72|01 02 00 76|00 00 01 29 r.s-1-tr...v...)
0220: 13 66 1b c8 00 00 00 2b cb 00 71 01 cb 00 71 c8 .f.....+..q...q.
0230: 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a 62 6f ........d.sip:bo
0240: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 b@example.net.b1
0250: 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 -1.sip:alice@exa
0260: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 mple.com.a1-1.tr
0270: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d -88h@example.com
0280: 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72|01 08 .c-1-tr.s-1-tr..
0290: 00 82|00 00 01 29 13 66 1c f4 00 00 00 2b 20 01 .....).f.....+ .
02a0: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00 ................
02b0: 71 c8 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a q.........d.sip:
02c0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 bob@example.net.
02d0: 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 40 65 b2-2.sip:alice@e
02e0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1.
02f0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c
0300: 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72| om.c-2-tr.s-1-tr
0310: 01 08 00 82|00 00 01 29 13 66 1f 4c 00 00 00 2b .......).f.L...+
0320: 20 01 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 ...............
0330: cb 00 71 c8 13 c4 13 c4 11 05 01 00 b4 13 73 69 ..q...........si
0340: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 p:bob@example.ne
0350: 74 04 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 t.b2-2.sip:alice
0360: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d @example.com.a1-
0370: 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 1.tr-88h@example
0380: 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d .com.c-2-tr.s-1-
0390: 74 72|01 02 00 72|00 00 01 29 13 66 20 6e 00 00 tr...r...).f n..
03a0: 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 .+..q..3d.......
03b0: 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 61 6d ....sip:bob@exam
03c0: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali
03d0: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a
03e0: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 1-1.tr-88h@examp
03f0: 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d le.com.c-2-tr.s-
0400: 31 2d 74 72|01 02 00 76|00 00 01 29 13 66 21 a4 1-tr...v...).f!.
0410: 00 00 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 ...+..q..3d.....
0420: 11 05 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 ......sip:bob@ex
0430: 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 ample.net.b1-1.s
0440: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 ip:alice@example
0450: 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 .com.a1-1.tr-88h
0460: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 @example.com.c-1
0470: 2d 74 72 06 73 2d 31 2d 74 72|01 02 00 76|00 00 -tr.s-1-tr...v..
0480: 01 29 13 66 23 98 00 00 00 2b cb 00 71 01 cb 00 .).f#....+..q...
Trammell, et al. Expires April 29, 2012 [Page 33]
Internet-Draft SIP Messages in IPFIX October 2011
0490: 71 c8 13 c4 13 c4 11 05 01 00 c8 13 73 69 70 3a q...........sip:
04a0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 bob@example.net.
04b0: 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 b1-1.sip:alice@e
04c0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1.
04d0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c
04e0: 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72| om.c-1-tr.s-1-tr
04f0: 01 02 00 76|00 00 01 29 13 66 24 60 00 00 00 2b ...v...).f$`...+
0500: cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 ..q..3d.........
0510: c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c ..sip:bob@exampl
0520: 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 e.net.b1-1.sip:a
0530: 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d lice@example.com
0540: 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 .a1-1.tr-88h@exa
0550: 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 mple.com.c-1-tr.
0560: 73 2d 31 2d 74 72|01 05 00 95|00 00 01 29 13 66 s-1-tr.......).f
0570: 25 29 00 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 %)...+..q. .....
0580: 00 00 00 00 00 00 00 00 00 09 13 c4 13 c4 11 03 ................
0590: 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 ..sip:bob@bob2.e
05a0: 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 xample.net.sip:b
05b0: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 ob@example.net..
05c0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl
05d0: 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 e.com.a1-1.tr-88
05e0: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d h@example.com.c-
05f0: 32 2d 74 72 06 73 2d 31 2d 74 72|01 08 00 7e|00 2-tr.s-1-tr...~.
0600: 00 01 29 13 66 28 3f 00 00 00 2b 20 01 0d b8 00 ..).f(?...+ ....
0610: 00 00 00 00 00 00 00 00 00 00 09 cb 00 71 c8 13 .............q..
0620: c4 13 c4 11 05 01 01 e7 13 73 69 70 3a 62 6f 62 .........sip:bob
0630: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 @example.net..si
0640: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example.
0650: 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 com.a1-1.tr-88h@
0660: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d example.com.c-2-
0670: 74 72 06 73 2d 31 2d 74 72|01 05 00 95|00 00 01 tr.s-1-tr.......
0680: 29 13 66 2a 0f 00 00 00 2b cb 00 71 c8 20 01 0d ).f*....+..q. ..
0690: b8 00 00 00 00 00 00 00 00 00 00 00 09 13 c4 13 ................
06a0: c4 11 01 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 .....sip:bob@bob
06b0: 32 2e 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 2.example.net.si
06c0: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 p:bob@example.ne
06d0: 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 t..sip:alice@exa
06e0: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 mple.com.a1-1.tr
06f0: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d -88h@example.com
0700: 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72|01 08 .c-2-tr.s-1-tr..
0710: 00 7e|00 00 01 29 13 66 2c 31 00 00 00 2b 20 01 .~...).f,1...+ .
0720: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00 ................
0730: 71 c8 13 c4 13 c4 11 03 01 00 c8 13 73 69 70 3a q...........sip:
0740: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 bob@example.net.
0750: 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 .sip:alice@examp
0760: 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 le.com.a1-1.tr-8
0770: 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 8h@example.com.c
0780: 2d 32 2d 74 72 06 73 2d 31 2d 74 72 -2-tr.s-1-tr
Trammell, et al. Expires April 29, 2012 [Page 34]
Internet-Draft SIP Messages in IPFIX October 2011
Figure 12: Message containing sixteen log entries for a forked call
6. Security Considerations
[TODO]
7. IANA Considerations
This document defines the sipMethod subregistry for the IANA IPFIX
Information Element registry at http://www.iana.org/assignments/ipfix
for the values taken by the sipMethod Information Element. The
initial content of this subregistry is specified in Section 2.13.
Entries may be added to this subregistry subject to the same
Standards Action [RFC5226] that adds new Methods to the Methods and
Response Codes registry at
http://www.iana.org/assignments/sip-parameters.
At such time as this document is prepared for publication as an RFC,
the Information Elements defined herein will be defined for inclusion
in the IANA IPFIX Information Element registry at
http://www.iana.org/assignments/ipfix. Until such time, the
Information Elements within this document are defined within Private
Enterprise Number 35566, belonging to one of the authors.
8. Acknowledgments
Thanks to Cullen Jennings for his provided insightful discussions,
specific comments and much needed corrections, and to Nico d'Heureuse
for his help with the RFC 3665 examples.
9. References
9.1. Normative References
[I-D.ietf-sipclf-problem-statement]
Gurbani, V., Burger, E., Anjali, T., Abdelnur, H., and O.
Festor, "The Common Log Format (CLF) for the Session
Initiation Protocol (SIP)",
draft-ietf-sipclf-problem-statement-07 (work in progress),
June 2011.
[RFC5101] Claise, B., "Specification of the IP Flow Information
Export (IPFIX) Protocol for the Exchange of IP Traffic
Flow Information", RFC 5101, January 2008.
Trammell, et al. Expires April 29, 2012 [Page 35]
Internet-Draft SIP Messages in IPFIX October 2011
[RFC5655] Trammell, B., Boschi, E., Mark, L., Zseby, T., and A.
Wagner, "Specification of the IP Flow Information Export
(IPFIX) File Format", RFC 5655, October 2009.
9.2. Informative References
[I-D.kaplan-dispatch-session-id]
Kaplan, H., "A Session Identifier for the Session
Initiation Protocol (SIP)",
draft-kaplan-dispatch-session-id-03 (work in progress),
March 2011.
[I-D.trammell-ipfix-ie-doctors]
Trammell, B. and B. Claise, "Guidelines for Authors and
Reviewers of IPFIX Information Elements",
draft-trammell-ipfix-ie-doctors-02 (work in progress),
June 2011.
[RFC2976] Donovan, S., "The SIP INFO Method", RFC 2976,
October 2000.
[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
A., Peterson, J., Sparks, R., Handley, M., and E.
Schooler, "SIP: Session Initiation Protocol", RFC 3261,
June 2002.
[RFC3262] Rosenberg, J. and H. Schulzrinne, "Reliability of
Provisional Responses in Session Initiation Protocol
(SIP)", RFC 3262, June 2002.
[RFC3265] Roach, A., "Session Initiation Protocol (SIP)-Specific
Event Notification", RFC 3265, June 2002.
[RFC3311] Rosenberg, J., "The Session Initiation Protocol (SIP)
UPDATE Method", RFC 3311, October 2002.
[RFC3428] Campbell, B., Rosenberg, J., Schulzrinne, H., Huitema, C.,
and D. Gurle, "Session Initiation Protocol (SIP) Extension
for Instant Messaging", RFC 3428, December 2002.
[RFC3515] Sparks, R., "The Session Initiation Protocol (SIP) Refer
Method", RFC 3515, April 2003.
[RFC3665] Johnston, A., Donovan, S., Sparks, R., Cunningham, C., and
K. Summers, "Session Initiation Protocol (SIP) Basic Call
Flow Examples", BCP 75, RFC 3665, December 2003.
[RFC3903] Niemi, A., "Session Initiation Protocol (SIP) Extension
Trammell, et al. Expires April 29, 2012 [Page 36]
Internet-Draft SIP Messages in IPFIX October 2011
for Event State Publication", RFC 3903, October 2004.
[RFC4475] Sparks, R., Hawrylyshen, A., Johnston, A., Rosenberg, J.,
and H. Schulzrinne, "Session Initiation Protocol (SIP)
Torture Test Messages", RFC 4475, May 2006.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 5226,
May 2008.
[RFC6026] Sparks, R. and T. Zourzouvillys, "Correct Transaction
Handling for 2xx Responses to Session Initiation Protocol
(SIP) INVITE Requests", RFC 6026, September 2010.
[RFC6086] Holmberg, C., Burger, E., and H. Kaplan, "Session
Initiation Protocol (SIP) INFO Method and Package
Framework", RFC 6086, January 2011.
[ripfix] Trammell, B., "ripfix: IPFIX for Ruby", available at
http://ripfix.rubyforge.org/.
Appendix A. Definition of Base SIP Message Information Elements in IANA
XML Registry format
[EDITOR'S NOTE: frontmatter]
<registry xmlns="http://www.iana.org/assignments" id="ipfix">
<registry id="ipfix-information-element-definitions">
<record>
<name>sipObservationType</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<enterpriseId>35566</enterpriseId>
<elementId>419</elementId>
<status>current</status>
<description>
<paragraph>
Denotes whether the entry was
corresponds to a SIP message received, sent, or merely
seen by a passive observer, as follows:
</paragraph>
<paragraph>0: unknown: The Metering Process does not
specify the observation type.</paragraph>
<paragraph>1: receiver: The Metering Process is, or is
co-located with, the receiver of the SIP message.</paragraph>
<paragraph>2: sender: The Metering Process is, or is
co-located with, the sender of the SIP message.</paragraph>
Trammell, et al. Expires April 29, 2012 [Page 37]
Internet-Draft SIP Messages in IPFIX October 2011
<paragraph>3: passive: The Metering Process passively
observed the SIP message.</paragraph>
</description>
</record>
<record>
<name>sipMethod</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<enterpriseId>35566</enterpriseId>
<elementId>402</elementId>
<status>current</status>
<description>
<paragraph>
The SIP method from the CSeq header, encoded as per
the IPFIX sipMethod subregistry.
</paragraph>
</description>
</record>
<record>
<name>sipSequenceNumber</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<enterpriseId>35566</enterpriseId>
<elementId>409</elementId>
<status>current</status>
<description>
<paragraph>The sequence number from the CSeq header.</paragraph>
</description>
</record>
<record>
<name>sipRequestURI</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>403</elementId>
<status>current</status>
<description>
<paragraph>The SIP Request URI, including any parameters,
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipFromURI</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>404</elementId>
<status>current</status>
<description>
Trammell, et al. Expires April 29, 2012 [Page 38]
Internet-Draft SIP Messages in IPFIX October 2011
<paragraph>The URI from the SIP From: header</paragraph>
</description>
</record>
<record>
<name>sipFromTag</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>405</elementId>
<status>current</status>
<description>
<paragraph>The Tag parameter value from the SIP
From: header</paragraph>
</description>
</record>
<record>
<name>sipToURI</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>406</elementId>
<status>current</status>
<description>
<paragraph>The URI from the SIP To: header</paragraph>
</description>
</record>
<record>
<name>sipToTag</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>407</elementId>
<status>current</status>
<description>
<paragraph>The Tag parameter value from the SIP To:
header</paragraph>
</description>
</record>
<record>
<name>sipCallId</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>408</elementId>
<status>current</status>
<description>
<paragraph>The value of the SIP Call-ID: header</paragraph>
</description>
</record>
<record>
<name>sipResponseStatus</name>
<dataType>unsigned16</dataType>
Trammell, et al. Expires April 29, 2012 [Page 39]
Internet-Draft SIP Messages in IPFIX October 2011
<dataTypeSemantics>identifier</dataTypeSemantics>
<enterpriseId>35566</enterpriseId>
<elementId>412</elementId>
<status>current</status>
<description>
<paragraph>The SIP Response code. The presence of this
Information Element in a SIP Message record marks it as
describing a SIP response; if absent, the record describes
a SIP request.</paragraph>
</description>
</record>
<record>
<name>sipServerTransaction</name>
<dataType>string</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<enterpriseId>35566</enterpriseId>
<elementId>413</elementId>
<status>current</status>
<description>
<paragraph>The transaction identifier associated with
the server transaction.</paragraph>
</description>
</record>
<record>
<name>sipClientTransaction</name>
<dataType>string</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<enterpriseId>35566</enterpriseId>
<elementId>414</elementId>
<status>current</status>
<description>
<paragraph>The transaction identifier associated with
the client transaction.</paragraph>
</description>
</record>
</registry>
</registry>
SIP Message Information Element definitions
Appendix B. Definition of sipMethod registry in IANA XML Registry
format
[EDITOR'S NOTE: frontmatter]
<registry xmlns="http://www.iana.org/assignments" id="ipfix">
<registry id="sipMethod">
Trammell, et al. Expires April 29, 2012 [Page 40]
Internet-Draft SIP Messages in IPFIX October 2011
<title>IPFIX sipMethod</title>
<registration_rule>Expert Review</registration_rule>
<record>
<value>0</value>
<description>Unknown</description>
<comments>The Metering Process did not
recognize the SIP method.</comments>
</record>
<record>
<value>1</value>
<description>ACK</description>
<comments/>
<xref type="rfc" data="rfc3261"/>
</record>
<record>
<value>2</value>
<description>BYE</description>
<comments/>
<xref type="rfc" data="rfc3261"/>
</record>
<record>
<value>3</value>
<description>CANCEL</description>
<comments/>
<xref type="rfc" data="rfc3261"/>
</record>
<record>
<value>4</value>
<description>INFO</description>
<comments/>
<xref type="rfc" data="rfc6086"/>
</record>
<record>
<value>5</value>
<description>INVITE</description>
<comments/>
<xref type="rfc" data="rfc3261"/>
</record>
<record>
<value>6</value>
<description>MESSAGE</description>
<comments/>
<xref type="rfc" data="rfc3428"/>
</record>
<record>
<value>7</value>
<description>NOTIFY</description>
<comments/>
Trammell, et al. Expires April 29, 2012 [Page 41]
Internet-Draft SIP Messages in IPFIX October 2011
<xref type="rfc" data="rfc3265"/>
</record>
<record>
<value>8</value>
<description>OPTIONS</description>
<comments/>
<xref type="rfc" data="rfc3261"/>
</record>
<record>
<value>9</value>
<description>PRACK</description>
<comments/>
<xref type="rfc" data="rfc3262"/>
</record>
<record>
<value>10</value>
<description>PUBLISH</description>
<comments/>
<xref type="rfc" data="rfc3903"/>
</record>
<record>
<value>11</value>
<description>REFER</description>
<comments/>
<xref type="rfc" data="rfc3515"/>
</record>
<record>
<value>12</value>
<description>REGISTER</description>
<comments/>
<xref type="rfc" data="rfc3261"/>
</record>
<record>
<value>13</value>
<description>SUBSCRIBE</description>
<comments/>
<xref type="rfc" data="rfc3265"/>
</record>
<record>
<value>14</value>
<description>UPDATE</description>
<comments/>
<xref type="rfc" data="rfc3311"/>
</record>
<record>
<value>15-65535</value>
<description>Unassigned</description>
<comments></comments>
Trammell, et al. Expires April 29, 2012 [Page 42]
Internet-Draft SIP Messages in IPFIX October 2011
</record>
</registry>
</registry>
sipMethod subregistry
Appendix C. Definition of Additional SIP Message Information Elements
in IANA XML Registry format
[EDITOR'S NOTE: frontmatter]
<?xml version="1.0" encoding="UTF-8"?>
<registry xmlns="http://www.iana.org/assignments" id="ipfix">
<registry id="ipfix-information-element-definitions">
<record>
<name>sipContactURI</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>415</elementId>
<status>current</status>
<description>
<paragraph>The addr-spec URI, including any URI parameters,
of the first/top-most SIP Contact header,
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipRouteURI</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>416</elementId>
<status>current</status>
<description>
<paragraph>The addr-spec URI, including any URI parameters,
of the first/top-most SIP Route header,
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipPaiURI</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>417</elementId>
Trammell, et al. Expires April 29, 2012 [Page 43]
Internet-Draft SIP Messages in IPFIX October 2011
<status>current</status>
<description>
<paragraph>The addr-spec URI, including any URI parameters,
of the first/top-most SIP P-Asserted-Identity header,
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipPpiURI</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>418</elementId>
<status>current</status>
<description>
<paragraph>The addr-spec URI, including any URI parameters,
of the first/top-most SIP P-Preferred-Identity header,
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipPAssocURI</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>430</elementId>
<status>current</status>
<description>
<paragraph>The addr-spec URI, including any URI parameters,
of the first/top-most SIP P-Associated-Identity header,
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipPCalledPartyURI</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>420</elementId>
<status>current</status>
<description>
<paragraph>The addr-spec URI, including any URI parameters,
of the SIP P-Called-Party-ID header,
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
Trammell, et al. Expires April 29, 2012 [Page 44]
Internet-Draft SIP Messages in IPFIX October 2011
<name>sipVia</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>421</elementId>
<status>current</status>
<description>
<paragraph>The value of the first/top-most Via header
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipAuthUsername</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>422</elementId>
<status>current</status>
<description>
<paragraph>The value of the username field
of the first/top-most Authorization header
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipSubscriptionEvent</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>423</elementId>
<status>current</status>
<description>
<paragraph>The value of the Event header
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipSubscriptionState</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>424</elementId>
<status>current</status>
<description>
<paragraph>The value of the Subscription-State header
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
Trammell, et al. Expires April 29, 2012 [Page 45]
Internet-Draft SIP Messages in IPFIX October 2011
<record>
<name>sipExpires</name>
<dataType>unsigned32</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>425</elementId>
<status>current</status>
<description>
<paragraph>The numeric value of the expires parameter of the
first/top-most Contact header of a REGISTER request
or response, or Subscription-State header of a SUBSCRIBE
or NOTIFY request or response, or the Expires header
if the expires parameter does not exist, as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipPVisitedNetworkID</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>426</elementId>
<status>current</status>
<description>
<paragraph>The value of the first/top-most P-Visited-Network-ID
header as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipPAccessNetworkInfo</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>427</elementId>
<status>current</status>
<description>
<paragraph>The value of the P-Access-Network-Info header
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipPChargingFunctionAddr</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>428</elementId>
<status>current</status>
<description>
<paragraph>The value of the first/top-most
P-Charging-Function-Addresses header
Trammell, et al. Expires April 29, 2012 [Page 46]
Internet-Draft SIP Messages in IPFIX October 2011
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
<record>
<name>sipPChargingVector</name>
<dataType>string</dataType>
<enterpriseId>35566</enterpriseId>
<elementId>429</elementId>
<status>current</status>
<description>
<paragraph>The value of the P-Charging-Vector header
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.</paragraph>
</description>
</record>
</registry>
</registry>
Additional SIP Message Information Element definitions
Appendix D. Example messages in base64
This section contains the example messages from this revision of this
draft in base64 encoding, for ease of processing by automated tools.
The base templates are in this message:
AAoA/EzALZsAAAAAAAAwOQACAOwBAQARAUMACIGZAAQAAIruAAgABAAMAAQA
BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX
//8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK
7gECABEBQwAIgZkABAAAiu4ACAAEAAwABAAHAAIACwACAAQAAYGSAAEAAIru
gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A
AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIru
The extended 4to6 and 6to4 templates are in this message:
AAoB5EzALZsAAAAAAAAwOQACAdQBBQARAUMACIGZAAQAAIruAAgABAAcABAA
BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX
//8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK
7gEGABEBQwAIgZkABAAAiu4ACAAEABwAEAAHAAIACwACAAQAAYGSAAEAAIru
gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A
AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIruAQcAEQFDAAiBmQAEAACK7gAb
ABAADAAEAAcAAgALAAIABAABgZIAAQAAiu6BowABAACK7oGT//8AAIrugZb/
/wAAiu6Bl///AACK7oGU//8AAIrugZX//wAAiu6BmP//AACK7oGe//8AAIru gZ3//
wAAiu4BCAARAUMACIGZAAQAAIruABsAEAAMAAQABwACAAsAAgAEAAGB
kgABAACK7oGjAAEAAIrugZwAAgAAiu6Blv//AACK7oGX//8AAIrugZT//wAA iu6Blf//
Trammell, et al. Expires April 29, 2012 [Page 47]
Internet-Draft SIP Messages in IPFIX October 2011
AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK7g==
The UAC registration in Section 5.2 is in this message:
AAoA2EzAO88AAAAAAAAwOQEBAGsAAAEpE2YTkwAAAAHGM2QBxjNkChPEE8QR
DAIPc2lwOmV4YW1wbGUuY29tAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2
eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEAAQIAXQAAASkTZhUk
AAAAAcYzZArGM2QBE8QTxBEMAQDIAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t
BTc2eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEA
The direct call in Section 5.3 is in this message:
AAoCGkzAPA8AAAAAAAAwOQEBAIgAAAEpE2YTkwAAACDGM2QBywBxARPEE8QR
BQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5u
ZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQU3NnloaBVmODItZDQtZjdAZXhh
bXBsZS5jb20HYy0xLXh0NgABAgB5AAABKRNmGKoAAAAgywBxAcYzZAETxBPE
EQUBALQTc2lwOmJvYkBleGFtcGxlLm5ldAhiLWluNi1pdRVzaXA6YWxpY2VA
ZXhhbXBsZS5jb20FNzZ5aGgVZjgyLWQ0LWY3QGV4YW1wbGUuY29tB2MtMS14
dDYAAQIAeQAAASkTZhz0AAAAIMsAcQHGM2QBE8QTxBEFAQDIE3NpcDpib2JA
ZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2
eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AAEBAJAAAAEpE2Yd
CAAAACDGM2QBywBxARPEE8QRAQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0
E3NpcDpib2JAZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1w
bGUuY29tBTc2eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AA==
The downstream branch call in Section 5.4 is in this message:
AAoE4UzAPEoAAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBxjNkChPEE8QR
BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz
aXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20A
BnMteC10cgECAGwAAAEpE2YUwQAAACvGM2QKxjNkARPEE8QRBQIAZBNzaXA6
Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0
ci04N2hAZXhhbXBsZS5jb20ABnMteC10cgEBAIkAAAEpE2YYpgAAACvGM2QK
ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA
ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3
aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZhlwAAAAK8sA
cQHGM2QKE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6
YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14
LXRyBnMteC10cgECAHYAAAEpE2YbyAAAACvLAHEBxjNkChPEE8QRBQEAtBNz
aXA6Ym9iQGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29t
BGFsLTESdHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAgB2AAAB
KRNmHJgAAAArxjNkCsYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l
dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3aEBleGFt
cGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZiDwAAAAK8sAcQHGM2QK
E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA
ZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMt
eC10cgECAHYAAAEpE2YhpAAAACvGM2QKxjNkARPEE8QRBQIAyBNzaXA6Ym9i
QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGFsLTES
Trammell, et al. Expires April 29, 2012 [Page 48]
Internet-Draft SIP Messages in IPFIX October 2011
dHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAQCIAAABKRNmKKwA
AAArxjNkAcYzZAoTxBPEEQEBE3NpcDpib2JAZXhhbXBsZS5uZXQTc2lwOmJv
YkBleGFtcGxlLm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0x
EnRyLTg3aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQEAiAAAASkTZiis
AAAAK8YzZArLAHEBE8QTxBEBAhNzaXA6Ym9iQGV4YW1wbGUubmV0E3NpcDpi
b2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwt
MRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMteC10cg==
The forked call in Section 5.5 is in this message:
AAoHjEzAPF0AAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBywBxyBPEE8QR
BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz
aXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20A
BnMtMS10cgECAGwAAAEpE2YUwQAAACvLAHHIxjNkARPEE8QRBQIAZBNzaXA6
Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0
ci04OGhAZXhhbXBsZS5jb20ABnMtMS10cgEBAIkAAAEpE2YYpgAAACvLAHHI
ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA
ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4
aEBleGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQUAlQAAASkTZhqcAAAAK8sA
ccggAQ24AAAAAAAAAAAAAAAJE8QTxBEFAhhzaXA6Ym9iQGJvYjIuZXhhbXBs
ZS5uZXQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUu
Y29tBGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2
AAABKRNmG8gAAAArywBxAcsAccgTxBPEEQUBAGQTc2lwOmJvYkBleGFtcGxl
Lm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBl
eGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQgAggAAASkTZhz0AAAAKyABDbgA
AAAAAAAAAAAAAAnLAHHIE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQE
YjItMhVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBs
ZS5jb20GYy0yLXRyBnMtMS10cgEIAIIAAAEpE2YfTAAAACsgAQ24AAAAAAAA
AAAAAAAJywBxyBPEE8QRBQEAtBNzaXA6Ym9iQGV4YW1wbGUubmV0BGIyLTIV
c2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTESdHItODhoQGV4YW1wbGUuY29t
BmMtMi10cgZzLTEtdHIBAgByAAABKRNmIG4AAAArywBxyMYzZAETxBPEEQUC
ALQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t
BGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2AAAB
KRNmIaQAAAArywBxyMYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l
dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFt
cGxlLmNvbQZjLTEtdHIGcy0xLXRyAQIAdgAAASkTZiOYAAAAK8sAcQHLAHHI
E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA
ZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0xLXRyBnMt
MS10cgECAHYAAAEpE2YkYAAAACvLAHHIxjNkARPEE8QRBQIAyBNzaXA6Ym9i
QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTES
dHItODhoQGV4YW1wbGUuY29tBmMtMS10cgZzLTEtdHIBBQCVAAABKRNmJSkA
AAArywBxyCABDbgAAAAAAAAAAAAAAAkTxBPEEQMCGHNpcDpib2JAYm9iMi5l
eGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhh
bXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10
cgEIAH4AAAEpE2YoPwAAACsgAQ24AAAAAAAAAAAAAAAJywBxyBPEE8QRBQEB
5xNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20E
YTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10cgEFAJUAAAEp
E2YqDwAAACvLAHHIIAENuAAAAAAAAAAAAAAACRPEE8QRAQIYc2lwOmJvYkBi
Trammell, et al. Expires April 29, 2012 [Page 49]
Internet-Draft SIP Messages in IPFIX October 2011
b2IyLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGlj
ZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIG
cy0xLXRyAQgAfgAAASkTZiwxAAAAKyABDbgAAAAAAAAAAAAAAAnLAHHIE8QT
xBEDAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxl
LmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIGcy0xLXRy
Authors' Addresses
Brian Trammell
Swiss Federal Institute of Technology Zurich
Gloriastrasse 35
8092 Zurich
Switzerland
Email: trammell@tik.ee.ethz.ch
Saverio Niccolini
NEC Laboratories Europe, NEC Europe Ltd.
Kurfuersten-Anlage 36
Heidelberg 69115
Germany
Phone: +49 (0) 6221 4342 118
Email: niccolini@neclab.eu
URI: http://www.neclab.eu
Benoit Claise
Cisco Systems Inc.
De Kleetlaan 6a b1
Diegem, 1813
Belgium
Phone: +32 2 704 5622
Fax:
Email: bclaise@cisco.com
URI:
Trammell, et al. Expires April 29, 2012 [Page 50]
Internet-Draft SIP Messages in IPFIX October 2011
Hadriel Kaplan
Acme Packet
71 Third Ave.
Burlington, MA 01803
USA
Phone:
Email: hkaplan@acmepacket.com
Trammell, et al. Expires April 29, 2012 [Page 51]