Bidirectional Flow Export Using IP Flow Information Export (IPFIX)
RFC 5103
Network Working Group B. Trammell
Request for Comments: 5103 CERT/NetSA
Category: Standards Track E. Boschi
Hitachi Europe
January 2008
Bidirectional Flow Export Using IP Flow Information Export (IPFIX)
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Abstract
This document describes an efficient method for exporting
bidirectional flow (Biflow) information using the IP Flow Information
Export (IPFIX) protocol, representing each Biflow using a single Flow
Record.
Trammell & Boschi Standards Track [Page 1]
RFC 5103 IPFIX Biflow Export January 2008
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. IPFIX Documents Overview . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Rationale and History . . . . . . . . . . . . . . . . . . . . 5
4. Biflow Semantics . . . . . . . . . . . . . . . . . . . . . . . 6
5. Direction Assignment . . . . . . . . . . . . . . . . . . . . . 8
5.1. Direction by Initiator . . . . . . . . . . . . . . . . . . 9
5.2. Direction by Perimeter . . . . . . . . . . . . . . . . . . 10
5.3. Arbitrary Direction . . . . . . . . . . . . . . . . . . . 10
6. Record Representation . . . . . . . . . . . . . . . . . . . . 11
6.1. Reverse Information Element Private Enterprise Number . . 11
6.2. Enterprise-Specific Reverse Information Elements . . . . . 13
6.3. biflowDirection Information Element . . . . . . . . . . . 13
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 14
8. Security Considerations . . . . . . . . . . . . . . . . . . . 15
9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 15
10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 15
10.1. Normative References . . . . . . . . . . . . . . . . . . . 15
10.2. Informative References . . . . . . . . . . . . . . . . . . 15
Appendix A. Examples . . . . . . . . . . . . . . . . . . . . . . 17
Appendix B. XML Specification of biflowDirection Information
Element . . . . . . . . . . . . . . . . . . . . . . . 21
Trammell & Boschi Standards Track [Page 2]
RFC 5103 IPFIX Biflow Export January 2008
1. Introduction
Many flow analysis tasks benefit from association of the upstream and
downstream flows of a bidirectional communication, e.g., separating
answered and unanswered TCP requests, calculating round trip times,
etc. Metering processes that are not part of an asymmetric routing
infrastructure, especially those deployed at a single point through
which bidirectional traffic flows, are well positioned to observe
bidirectional flows (Biflows). In such topologies, the total
resource requirements for Biflow assembly are often lower if the
Biflows are assembled at the measurement interface as opposed to the
Collector. The IPFIX Protocol requires only information model
extensions to be complete as a solution for exporting Biflow data.
To that end, we propose a Biflow export method using a single Flow
Record per Biflow in this document. We explore the semantics of
bidirectional flow data in Section 4, "Biflow Semantics"; examine the
various possibilities for determining the direction of Biflows in
Section 5, "Direction Assignment"; then define the Biflow export
method in Section 6, "Record Representation".
This export method requires additional Information Elements to
represent data values for the reverse direction of each Biflow, and a
single additional Information Element to represent direction
assignment information, as described in Sections 6.1 through 6.3.
The selection of this method was motivated by an exploration of other
possible methods of Biflow export using IPFIX; however, these methods
have important drawbacks, as discussed in Section 3, "Rationale and
History".
1.1. IPFIX Documents Overview
"Specification of the IPFIX Protocol for the Exchange of IP Traffic
Show full document text