Bidirectional Flow Export Using IP Flow Information Export (IPFIX)
RFC 5103

Network Working Group                                        B. Trammell
Request for Comments: 5103                                    CERT/NetSA
Category: Standards Track                                      E. Boschi
                                                          Hitachi Europe
                                                            January 2008

   Bidirectional Flow Export Using IP Flow Information Export (IPFIX)

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Abstract

   This document describes an efficient method for exporting
   bidirectional flow (Biflow) information using the IP Flow Information
   Export (IPFIX) protocol, representing each Biflow using a single Flow
   Record.

Trammell & Boschi           Standards Track                     [Page 1]
RFC 5103                  IPFIX Biflow Export               January 2008

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
     1.1.  IPFIX Documents Overview . . . . . . . . . . . . . . . . .  3
   2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  4
   3.  Rationale and History  . . . . . . . . . . . . . . . . . . . .  5
   4.  Biflow Semantics . . . . . . . . . . . . . . . . . . . . . . .  6
   5.  Direction Assignment . . . . . . . . . . . . . . . . . . . . .  8
     5.1.  Direction by Initiator . . . . . . . . . . . . . . . . . .  9
     5.2.  Direction by Perimeter . . . . . . . . . . . . . . . . . . 10
     5.3.  Arbitrary Direction  . . . . . . . . . . . . . . . . . . . 10
   6.  Record Representation  . . . . . . . . . . . . . . . . . . . . 11
     6.1.  Reverse Information Element Private Enterprise Number  . . 11
     6.2.  Enterprise-Specific Reverse Information Elements . . . . . 13
     6.3.  biflowDirection Information Element  . . . . . . . . . . . 13
   7.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 14
   8.  Security Considerations  . . . . . . . . . . . . . . . . . . . 15
   9.  Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 15
   10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 15
     10.1. Normative References . . . . . . . . . . . . . . . . . . . 15
     10.2. Informative References . . . . . . . . . . . . . . . . . . 15
   Appendix A.  Examples  . . . . . . . . . . . . . . . . . . . . . . 17
   Appendix B.  XML Specification of biflowDirection Information
                Element . . . . . . . . . . . . . . . . . . . . . . . 21

Trammell & Boschi           Standards Track                     [Page 2]
RFC 5103                  IPFIX Biflow Export               January 2008

1.  Introduction

   Many flow analysis tasks benefit from association of the upstream and
   downstream flows of a bidirectional communication, e.g., separating
   answered and unanswered TCP requests, calculating round trip times,
   etc.  Metering processes that are not part of an asymmetric routing
   infrastructure, especially those deployed at a single point through
   which bidirectional traffic flows, are well positioned to observe
   bidirectional flows (Biflows).  In such topologies, the total
   resource requirements for Biflow assembly are often lower if the
   Biflows are assembled at the measurement interface as opposed to the
   Collector.  The IPFIX Protocol requires only information model
   extensions to be complete as a solution for exporting Biflow data.

   To that end, we propose a Biflow export method using a single Flow
   Record per Biflow in this document.  We explore the semantics of
   bidirectional flow data in Section 4, "Biflow Semantics"; examine the
   various possibilities for determining the direction of Biflows in
   Section 5, "Direction Assignment"; then define the Biflow export
   method in Section 6, "Record Representation".

   This export method requires additional Information Elements to
   represent data values for the reverse direction of each Biflow, and a
   single additional Information Element to represent direction
   assignment information, as described in Sections 6.1 through 6.3.
   The selection of this method was motivated by an exploration of other
   possible methods of Biflow export using IPFIX; however, these methods
   have important drawbacks, as discussed in Section 3, "Rationale and
   History".

1.1.  IPFIX Documents Overview

   "Specification of the IPFIX Protocol for the Exchange of IP Traffic