                                               IP Flow Information Export (IPFIX) Information Elements

   Created
           2007-05-10

   Last Updated
           2008-11-18

   This registry is also available in XML and plain text formats.

   Registries included below

     * IPFIX Information Elements

          * IPFIX MPLS label type (Value 46)

     * IPFIX Version Numbers
     * IPFIX Set IDs

IPFIX Information Elements

   Reference
           [RFC5102]

     Range   Registration Procedures                                          Notes
       0     Reserved
     1-127   Expert Review           Information Element identifiers compatible with NetFlow version 9 field types [RFC3954].
   128-32767 Expert Review           Further Information Element identifiers.

   Note

 New assignments for IPFIX Information Elements will be administered
 by IANA, on a First Come First Served basis [RFC2434], subject to
 Expert Review [RFC2434], i.e. review by one of a group of experts
 designated by an IETF Operations and Management Area Director.

  Value                 Name                    Data Type        Data Type   Status                                Description                                  Units     Range                     References                                  Requester
                                                                 Semantics
                                                                                     The number of octets since the previous report (if any) in incoming
    1     octetDeltaCount                  unsigned64           deltaCounter current packets for this Flow at the Observation Point. The number of octets    octets                                                                 [RFC5102]
                                                                                     includes IP header(s) and IP payload.
    2     packetDeltaCount                 unsigned64           deltaCounter current The number of incoming packets since the previous report (if any) for   packets                                                                [RFC5102]
                                                                                     this Flow at the Observation Point.
    3     Reserved                                                                                                                                                                                                                  [RFC5102]
                                                                                     The value of the protocol number in the IP packet header. The protocol
                                                                                     number identifies the IP packet payload type. Protocol numbers are                         See [RFC791] for the specification of the IPv4
                                                                                     defined in the IANA Protocol Numbers registry.                                             protocol field. See [RFC2460] for the specification
    4     protocolIdentifier               unsigned8            identifier   current                                                                                            of the IPv6 protocol field. See the list of         [RFC5102]
                                                                                     In Internet Protocol version 4 (IPv4), this is carried in the Protocol                     protocol numbers assigned by IANA at [IANA registry
                                                                                     field. In Internet Protocol version 6 (IPv6), this is carried in the                       protocol-numbers].
                                                                                     Next Header field in the last extension header of the packet.
                                                                                     For IPv4 packets, this is the value of the TOS field in the IPv4 packet                    See [RFC1812] (Section 5.3.2) and [RFC791] for the
    5     ipClassOfService                 unsigned8            identifier   current header. For IPv6 packets, this is the value of the Traffic Class field                     definition of the IPv4 TOS field. See [RFC2460] for [RFC5102]
                                                                                     in the IPv6 packet header.                                                                 the definition of the IPv6 Traffic Class field.
                                                                                     TCP control bits observed for packets of this Flow. The information is
                                                                                     encoded in a set of bit fields. For each TCP control bit, there is a
                                                                                     bit in this set. A bit is set to 1 if any observed packet of this Flow
                                                                                     has the corresponding TCP control bit set to 1. A value of 0 for a bit
                                                                                     indicates that the corresponding bit was not set in any of the observed
                                                                                     packets of this Flow.

                                                                                               0     1     2     3     4     5     6     7
                                                                                           +-----+-----+-----+-----+-----+-----+-----+-----+
    6     tcpControlBits                   unsigned8            flags        current       |  Reserved | URG | ACK | PSH | RST | SYN | FIN |                                    See [RFC793] for the definition of the TCP control  [RFC5102]
                                                                                           +-----+-----+-----+-----+-----+-----+-----+-----+                                    bits in the TCP header.

                                                                                           Reserved:  Reserved for future use by TCP.  Must be zero.
                                                                                                URG:  Urgent Pointer field significant
                                                                                                ACK:  Acknowledgment field significant
                                                                                                PSH:  Push Function
                                                                                                RST:  Reset the connection
                                                                                                SYN:  Synchronize sequence numbers
                                                                                                FIN:  No more data from sender

                                                                                                                                                                                See [RFC768] for the definition of the UDP source
                                                                                                                                                                                port field. See [RFC793] for the definition of the
                                                                                     The source port identifier in the transport header. For the transport                      TCP source port field. See [RFC4960] for the
    7     sourceTransportPort              unsigned16           identifier   current protocols UDP, TCP, and SCTP, this is the source port number given in                      definition of SCTP.                                 [RFC5102]
                                                                                     the respective header. This field MAY also be used for future transport
                                                                                     protocols that have 16-bit source port identifiers.                                        Additional information on defined UDP and TCP port
                                                                                                                                                                                numbers can be found at [IANA registry
                                                                                                                                                                                port-numbers].
    8     sourceIPv4Address                ipv4Address          identifier   current The IPv4 source address in the IP packet header.                                           See [RFC791] for the definition of the IPv4 source  [RFC5102]
                                                                                                                                                                                address field.
    9     sourceIPv4PrefixLength           unsigned8                         current The number of contiguous bits that are relevant in the sourceIPv4Prefix bits         0-32                                                      [RFC5102]
                                                                                     Information Element.
                                                                                     The index of the IP interface where packets of this Flow are being
                                                                                     received. The value matches the value of managed object 'ifIndex' as
   10     ingressInterface                 unsigned32           identifier   current defined in RFC 2863. Note that ifIndex values are not assigned                             See [RFC2863] for the definition of the ifIndex     [RFC5102]
                                                                                     statically to an interface and that the interfaces may be renumbered                       object.
                                                                                     every time the device's management system is re-initialized, as
                                                                                     specified in RFC 2863.
                                                                                                                                                                                See [RFC768] for the definition of the UDP
                                                                                     The destination port identifier in the transport header. For the                           destination port field. See [RFC793] for the
                                                                                     transport protocols UDP, TCP, and SCTP, this is the destination port                       definition of the TCP destination port field. See
   11     destinationTransportPort         unsigned16           identifier   current number given in the respective header. This field MAY also be used for                     [RFC4960] for the definition of SCTP.               [RFC5102]
                                                                                     future transport protocols that have 16-bit destination port
                                                                                     identifiers.                                                                               Additional information on defined UDP and TCP port
                                                                                                                                                                                numbers can be found at [IANA registry
                                                                                                                                                                                port-numbers].
   12     destinationIPv4Address           ipv4Address          identifier   current The IPv4 destination address in the IP packet header.                                      See [RFC791] for the definition of the IPv4         [RFC5102]
                                                                                                                                                                                destination address field.
   13     destinationIPv4PrefixLength      unsigned8                         current The number of contiguous bits that are relevant in the                  bits         0-32                                                      [RFC5102]
                                                                                     destinationIPv4Prefix Information Element.
                                                                                     The index of the IP interface where packets of this Flow are being
                                                                                     sent. The value matches the value of managed object 'ifIndex' as
   14     egressInterface                  unsigned32           identifier   current defined in RFC 2863. Note that ifIndex values are not assigned                             See [RFC2863] for the definition of the ifIndex     [RFC5102]
                                                                                     statically to an interface and that the interfaces may be renumbered                       object.
                                                                                     every time the device's management system is re-initialized, as
                                                                                     specified in RFC 2863.
   15     ipNextHopIPv4Address             ipv4Address          identifier   current The IPv4 address of the next IPv4 hop.                                                                                                         [RFC5102]
                                                                                     The autonomous system (AS) number of the source IP address. If AS path
   16     bgpSourceAsNumber                unsigned32           identifier   current information for this Flow is only available as an unordered AS set (and                    See [RFC4271] for a description of BGP-4, and see   [RFC5102]
                                                                                     not as an ordered AS sequence), then the value of this Information                         [RFC1930] for the definition of the AS number.
                                                                                     Element is 0.
                                                                                     The autonomous system (AS) number of the destination IP address. If AS
   17     bgpDestinationAsNumber           unsigned32           identifier   current path information for this Flow is only available as an unordered AS set                    See [RFC4271] for a description of BGP-4, and see   [RFC5102]
                                                                                     (and not as an ordered AS sequence), then the value of this Information                    [RFC1930] for the definition of the AS number.
                                                                                     Element is 0.
   18     bgpNextHopIPv4Address            ipv4Address          identifier   current The IPv4 address of the next (adjacent) BGP hop.                                           See [RFC4271] for a description of BGP-4.           [RFC5102]
                                                                                     The number of outgoing multicast packets since the previous report (if
   19     postMCastPacketDeltaCount        unsigned64           deltaCounter current any) sent for packets of this Flow by a multicast daemon within the     packets                                                                [RFC5102]
                                                                                     Observation Domain. This property cannot necessarily be observed at the
                                                                                     Observation Point, but may be retrieved by other means.
                                                                                     The number of octets since the previous report (if any) in outgoing
                                                                                     multicast packets sent for packets of this Flow by a multicast daemon
   20     postMCastOctetDeltaCount         unsigned64           deltaCounter current within the Observation Domain. This property cannot necessarily be      octets                                                                 [RFC5102]
                                                                                     observed at the Observation Point, but may be retrieved by other means.
                                                                                     The number of octets includes IP header(s) and IP payload.
                                                                                     The relative timestamp of the last packet of this Flow. It indicates
   21     flowEndSysUpTime                 unsigned32                        current the number of milliseconds since the last (re-)initialization of the    milliseconds                                                           [RFC5102]
                                                                                     IPFIX Device (sysUpTime).
                                                                                     The relative timestamp of the first packet of this Flow. It indicates
   22     flowStartSysUpTime               unsigned32                        current the number of milliseconds since the last (re-)initialization of the    milliseconds                                                           [RFC5102]
                                                                                     IPFIX Device (sysUpTime).
                                                                                     The definition of this Information Element is identical to the
   23     postOctetDeltaCount              unsigned64           deltaCounter current definition of Information Element 'octetDeltaCount', except that it     octets                                                                 [RFC5102]
                                                                                     reports a potentially modified value caused by a middlebox function
                                                                                     after the packet passed the Observation Point.
                                                                                     The definition of this Information Element is identical to the
   24     postPacketDeltaCount             unsigned64           deltaCounter current definition of Information Element 'packetDeltaCount', except that it    packets                                                                [RFC5102]
                                                                                     reports a potentially modified value caused by a middlebox function
                                                                                     after the packet passed the Observation Point.
                                                                                                                                                                                See [RFC791] for the specification of the IPv4
   25     minimumIpTotalLength             unsigned64                        current Length of the smallest packet observed for this Flow. The packet length octets             total length. See [RFC2460] for the specification   [RFC5102]
                                                                                     includes the IP header(s) length and the IP payload length.                                of the IPv6 payload length. See [RFC2675] for the
                                                                                                                                                                                specification of the IPv6 jumbo payload length.
                                                                                                                                                                                See [RFC791] for the specification of the IPv4
   26     maximumIpTotalLength             unsigned64                        current Length of the largest packet observed for this Flow. The packet length  octets             total length. See [RFC2460] for the specification   [RFC5102]
                                                                                     includes the IP header(s) length and the IP payload length.                                of the IPv6 payload length. See [RFC2675] for the
                                                                                                                                                                                specification of the IPv6 jumbo payload length.
   27     sourceIPv6Address                ipv6Address          identifier   current The IPv6 source address in the IP packet header.                                           See [RFC2460] for the definition of the Source      [RFC5102]
                                                                                                                                                                                Address field in the IPv6 header.
   28     destinationIPv6Address           ipv6Address          identifier   current The IPv6 destination address in the IP packet header.                                      See [RFC2460] for the definition of the Destination [RFC5102]
                                                                                                                                                                                Address field in the IPv6 header.
   29     sourceIPv6PrefixLength           unsigned8                         current The number of contiguous bits that are relevant in the sourceIPv6Prefix bits         0-128                                                     [RFC5102]
                                                                                     Information Element.
   30     destinationIPv6PrefixLength      unsigned8                         current The number of contiguous bits that are relevant in the                  bits         0-128                                                     [RFC5102]
                                                                                     destinationIPv6Prefix Information Element.
   31     flowLabelIPv6                    unsigned32           identifier   current The value of the IPv6 Flow Label field in the IP packet header.                            See [RFC2460] for the definition of the Flow Label  [RFC5102]
                                                                                                                                                                                field in the IPv6 packet header.
   32     icmpTypeCodeIPv4                 unsigned16           identifier   current Type and Code of the IPv4 ICMP message. The combination of both values                     See [RFC792] for the definition of the IPv4 ICMP    [RFC5102]
                                                                                     is reported as (ICMP type * 256) + ICMP code.                                              type and code fields.
   33     igmpType                         unsigned8            identifier   current The type field of the IGMP message.                                                        See [RFC3376] for the definition of the IGMP type   [RFC5102]
                                                                                                                                                                                field.
  34-35   Reserved                                                                                                                                                                                                                  [RFC5102]
   36     flowActiveTimeout                unsigned16                        current The number of seconds after which an active Flow is timed out anyway,   seconds                                                                [RFC5102]
                                                                                     even if there is still a continuous flow of packets.
                                                                                     A Flow is considered to be timed out if no packets belonging to the
   37     flowIdleTimeout                  unsigned16                        current Flow have been observed for the number of seconds specified by this     seconds                                                                [RFC5102]
                                                                                     field.
  38-39   Reserved                                                                                                                                                                                                                  [RFC5102]
                                                                                     The total number of octets that the Exporting Process has sent since
                                                                                     the Exporting Process (re-)initialization to a particular Collecting
                                                                                     Process. The value of this Information Element is calculated by summing
                                                                                     up the IPFIX Message Header length values of all IPFIX Messages that
   40     exportedOctetTotalCount          unsigned64           totalCounter current were successfully sent to the Collecting Process. The reported number   octets                                                                 [RFC5102]
                                                                                     excludes octets in the IPFIX Message that carries the counter value. If
                                                                                     this Information Element is sent to a particular Collecting Process,
                                                                                     then by default it specifies the number of octets sent to this
                                                                                     Collecting Process.
                                                                                     The total number of IPFIX Messages that the Exporting Process has sent
                                                                                     since the Exporting Process (re-)initialization to a particular
   41     exportedMessageTotalCount        unsigned64           totalCounter current Collecting Process. The reported number excludes the IPFIX Message that messages                                                               [RFC5102]
                                                                                     carries the counter value. If this Information Element is sent to a
                                                                                     particular Collecting Process, then by default it specifies the number
                                                                                     of IPFIX Messages sent to this Collecting Process.
                                                                                     The total number of Flow Records that the Exporting Process has sent as
                                                                                     Data Records since the Exporting Process (re-)initialization to a
   42     exportedFlowRecordTotalCount     unsigned64           totalCounter current particular Collecting Process. The reported number excludes Flow        flows                                                                  [RFC5102]
                                                                                     Records in the IPFIX Message that carries the counter value. If this
                                                                                     Information Element is sent to a particular Collecting Process, then by
                                                                                     default it specifies the number of Flow Records sent to this process.
   43     Reserved                                                                                                                                                                                                                  [RFC5102]
   44     sourceIPv4Prefix                 ipv4Address                       current IPv4 source address prefix.                                                                                                                    [RFC5102]
   45     destinationIPv4Prefix            ipv4Address                       current IPv4 destination address prefix.                                                                                                               [RFC5102]
                                                                                     This field identifies the control protocol that allocated the
                                                                                     top-of-stack label. Initial values for this field are listed below.
                                                                                     Further values may be assigned by IANA in the MPLS label type registry.                    See [RFC3031] for the MPLS label structure. See
                                                                                                                                                                                [RFC4364] for the association of MPLS labels with
                                                                                             - 0x01 TE-MIDPT: Any TE tunnel mid-point or tail label                             Virtual Private Networks (VPNs). See [RFC4271] for
   46     mplsTopLabelType                 unsigned8            identifier   current         - 0x02 Pseudowire: Any PWE3 or Cisco AToM based label                              BGP and BGP routing. See [RFC5036] for Label        [RFC5102]
                                                                                             - 0x03 VPN: Any label associated with VPN                                          Distribution Protocol (LDP). See the list of MPLS
                                                                                             - 0x04 BGP: Any label associated with BGP or BGP routing                           label types assigned by IANA at [IANA registry
                                                                                             - 0x05 LDP: Any label associated with dynamically assigned                         mpls-label-values].
                                                                                                         labels using LDP

   47     mplsTopLabelIPv4Address          ipv4Address          identifier   current The IPv4 address of the system that the MPLS top label will cause this                     See [RFC3031] for the association between MPLS      [RFC5102]
                                                                                     Flow to be forwarded to.                                                                   labels and IP addresses.
  48-51   Reserved                                                                                                                                                                                                                  [RFC5102]
                                                                                                                                                                                See [RFC791] for the definition of the IPv4 Time to
   52     minimumTTL                       unsigned8                         current Minimum TTL value observed for any packet in this Flow.                 hops               Live field. See [RFC2460] for the definition of the [RFC5102]
                                                                                                                                                                                IPv6 Hop Limit field.
                                                                                                                                                                                See [RFC791] for the definition of the IPv4 Time to
   53     maximumTTL                       unsigned8                         current Maximum TTL value observed for any packet in this Flow.                 hops               Live field. See [RFC2460] for the definition of the [RFC5102]
                                                                                                                                                                                IPv6 Hop Limit field.
                                                                                     The value of the Identification field in the IPv4 packet header or in                      See [RFC791] for the definition of the IPv4
   54     fragmentIdentification           unsigned32           identifier   current the IPv6 Fragment header, respectively. The value is 0 for IPv6 if                         Identification field. See [RFC2460] for the         [RFC5102]
                                                                                     there is no fragment header.                                                               definition of the Identification field in the IPv6
                                                                                                                                                                                Fragment header.
                                                                                     The definition of this Information Element is identical to the                             See [RFC791] for the definition of the IPv4 TOS
   55     postIpClassOfService             unsigned8            identifier   current definition of Information Element 'ipClassOfService', except that it                       field. See [RFC2460] for the definition of the IPv6 [RFC5102]
                                                                                     reports a potentially modified value caused by a middlebox function                        Traffic Class field. See [RFC3234] for the
                                                                                     after the packet passed the Observation Point.                                             definition of middleboxes.
   56     sourceMacAddress                 macAddress           identifier   current The IEEE 802 source MAC address field.                                                     See IEEE.802-3.2002.                                [RFC5102]
                                                                                     The definition of this Information Element is identical to the
   57     postDestinationMacAddress        macAddress           identifier   current definition of Information Element 'destinationMacAddress', except that                     See IEEE.802-3.2002.                                [RFC5102]
                                                                                     it reports a potentially modified value caused by a middlebox function
                                                                                     after the packet passed the Observation Point.
   58     vlanId                           unsigned16           identifier   current The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control                       See IEEE.802-1Q.2003.                               [RFC5102]
                                                                                     Information field that was attached to the IP packet.
                                                                                     The definition of this Information Element is identical to the
   59     postVlanId                       unsigned16           identifier   current definition of Information Element 'vlanId', except that it reports a                       See IEEE.802-1Q.2003.                               [RFC5102]
                                                                                     potentially modified value caused by a middlebox function after the
                                                                                     packet passed the Observation Point.
                                                                                                                                                                                See [RFC791] for the definition of the version
                                                                                                                                                                                field in the IPv4 packet header. See [RFC2460] for
   60     ipVersion                        unsigned8            identifier   current The IP version field in the IP packet header.                                              the definition of the version field in the IPv6     [RFC5102]
                                                                                                                                                                                packet header. Additional information on defined
                                                                                                                                                                                version numbers can be found at [IANA registry
                                                                                                                                                                                version-numbers].
                                                                                     The direction of the Flow observed at the Observation Point. There are
                                                                                     only two values defined.
   61     flowDirection                    unsigned8            identifier   current                                                                                                                                                [RFC5102]
                                                                                              0x00: ingress flow
                                                                                              0x01: egress flow

   62     ipNextHopIPv6Address             ipv6Address          identifier   current The IPv6 address of the next IPv6 hop.                                                                                                         [RFC5102]
   63     bgpNextHopIPv6Address            ipv6Address          identifier   current The IPv6 address of the next (adjacent) BGP hop.                                           See [RFC4271] for a description of BGP-4.           [RFC5102]
                                                                                     IPv6 extension headers observed in packets of this Flow. The
                                                                                     information is encoded in a set of bit fields. For each IPv6 option
                                                                                     header, there is a bit in this set. The bit is set to 1 if any observed
                                                                                     packet of this Flow contains the corresponding IPv6 extension header.
                                                                                     Otherwise, if no observed packet of this Flow contained the respective
                                                                                     IPv6 extension header, the value of the corresponding bit is 0.

                                                                                                   0     1     2     3     4     5     6     7
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+
                                                                                               | Res | FRA1| RH  | FRA0| UNK | Res | HOP | DST |  ...
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+

                                                                                                   8     9    10    11    12    13    14    15
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+
                                                                                           ... | PAY | AH  | ESP |         Reserved            | ...
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+
                                                                                                                                                                                See [RFC2460] for the general definition of IPv6
                                                                                                  16    17    18    19    20    21    22    23                                  extension headers and for the specification of the
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+                                hop-by-hop options header, the routing header, the
                                                                                           ... |                  Reserved                     | ...                            fragment header, and the destination options
   64     ipv6ExtensionHeaders             unsigned32           flags        current           +-----+-----+-----+-----+-----+-----+-----+-----+                                header. See [RFC4302] for the specification of the  [RFC5102]
                                                                                                  24    25    26    27    28    29    30    31                                  authentication header. See [RFC4303] for the
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+                                specification of the encapsulating security
                                                                                           ... |                  Reserved                     |                                payload.
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+

                                                                                             Bit    IPv6 Option   Description
                                                                                            0, Res               Reserved
                                                                                            1, FRA1     44       Fragmentation header - not first fragment
                                                                                            2, RH       43       Routing header
                                                                                            3, FRA0     44       Fragment header - first fragment
                                                                                            4, UNK               Unknown Layer 4 header
                                                                                                                 (compressed, encrypted, not supported)
                                                                                            5, Res               Reserved
                                                                                            6, HOP       0       Hop-by-hop option header
                                                                                            7, DST      60       Destination option header
                                                                                            8, PAY     108       Payload compression header
                                                                                            9, AH       51       Authentication Header
                                                                                           10, ESP      50       Encrypted security payload
                                                                                           11 to 31              Reserved

  65-69   Reserved                                                                                                                                                                                                                  [RFC5102]
                                                                                     The Label, Exp, and S fields from the top MPLS label stack entry, i.e.,
                                                                                     from the last label that was pushed.

                                                                                     The size of this Information Element is 3 octets.

                                                                                            0                   1                   2
                                                                                            0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
   70     mplsTopLabelStackSection         octetArray           identifier   current       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                                    See [RFC3032].                                      [RFC5102]
                                                                                           |                Label                  | Exp |S|
                                                                                           +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                                                                                           Label:  Label Value, 20 bits
                                                                                           Exp:    Experimental Use, 3 bits
                                                                                           S:      Bottom of Stack, 1 bit

                                                                                     The Label, Exp, and S fields from the label stack entry that was pushed
                                                                                     immediately before the label stack entry that would be reported by
   71     mplsLabelStackSection2           octetArray           identifier   current mplsTopLabelStackSection. See the definition of                                            See [RFC3032].                                      [RFC5102]
                                                                                     mplsTopLabelStackSection for further details.

                                                                                     The size of this Information Element is 3 octets.
                                                                                     The Label, Exp, and S fields from the label stack entry that was pushed
                                                                                     immediately before the label stack entry that would be reported by
   72     mplsLabelStackSection3           octetArray           identifier   current mplsLabelStackSection2. See the definition of mplsTopLabelStackSection                     See [RFC3032].                                      [RFC5102]
                                                                                     for further details.

                                                                                     The size of this Information Element is 3 octets.
                                                                                     The Label, Exp, and S fields from the label stack entry that was pushed
                                                                                     immediately before the label stack entry that would be reported by
   73     mplsLabelStackSection4           octetArray           identifier   current mplsLabelStackSection3. See the definition of mplsTopLabelStackSection                     See [RFC3032].                                      [RFC5102]
                                                                                     for further details.

                                                                                     The size of this Information Element is 3 octets.
                                                                                     The Label, Exp, and S fields from the label stack entry that was pushed
                                                                                     immediately before the label stack entry that would be reported by
   74     mplsLabelStackSection5           octetArray           identifier   current mplsLabelStackSection4. See the definition of mplsTopLabelStackSection                     See [RFC3032].                                      [RFC5102]
                                                                                     for further details.

                                                                                     The size of this Information Element is 3 octets.
                                                                                     The Label, Exp, and S fields from the label stack entry that was pushed
                                                                                     immediately before the label stack entry that would be reported by
   75     mplsLabelStackSection6           octetArray           identifier   current mplsLabelStackSection5. See the definition of mplsTopLabelStackSection                     See [RFC3032].                                      [RFC5102]
                                                                                     for further details.

                                                                                     The size of this Information Element is 3 octets.
                                                                                     The Label, Exp, and S fields from the label stack entry that was pushed
                                                                                     immediately before the label stack entry that would be reported by
   76     mplsLabelStackSection7           octetArray           identifier   current mplsLabelStackSection6. See the definition of mplsTopLabelStackSection                     See [RFC3032].                                      [RFC5102]
                                                                                     for further details.

                                                                                     The size of this Information Element is 3 octets.
                                                                                     The Label, Exp, and S fields from the label stack entry that was pushed
                                                                                     immediately before the label stack entry that would be reported by
   77     mplsLabelStackSection8           octetArray           identifier   current mplsLabelStackSection7. See the definition of mplsTopLabelStackSection                     See [RFC3032].                                      [RFC5102]
                                                                                     for further details.

                                                                                     The size of this Information Element is 3 octets.
                                                                                     The Label, Exp, and S fields from the label stack entry that was pushed
                                                                                     immediately before the label stack entry that would be reported by
   78     mplsLabelStackSection9           octetArray           identifier   current mplsLabelStackSection8. See the definition of mplsTopLabelStackSection                     See [RFC3032].                                      [RFC5102]
                                                                                     for further details.

                                                                                     The size of this Information Element is 3 octets.
                                                                                     The Label, Exp, and S fields from the label stack entry that was pushed
                                                                                     immediately before the label stack entry that would be reported by
   79     mplsLabelStackSection10          octetArray           identifier   current mplsLabelStackSection9. See the definition of mplsTopLabelStackSection                     See [RFC3032].                                      [RFC5102]
                                                                                     for further details.

                                                                                     The size of this Information Element is 3 octets.
   80     destinationMacAddress            macAddress           identifier   current The IEEE 802 destination MAC address field.                                                See IEEE.802-3.2002.                                [RFC5102]
                                                                                     The definition of this Information Element is identical to the
   81     postSourceMacAddress             macAddress           identifier   current definition of Information Element 'sourceMacAddress', except that it                       See IEEE.802-3.2002.                                [RFC5102]
                                                                                     reports a potentially modified value caused by a middlebox function
                                                                                     after the packet passed the Observation Point.
   82     interfaceName                    string                            current A short name uniquely describing an interface, eg "Eth1/0".                                See [RFC2863] for the definition of the ifName      [draft-aitken-ipfix-new-infos-03]
                                                                                                                                                                                object.
   83     interfaceDescription             string                            current The description of an interface, eg "FastEthernet 1/0" or "ISP                             See [RFC2863] for the definition of the ifDescr
                                                                                     connection".                                                                               object.
   84     Reserved                                                                                                                                                                                                                  [RFC5102]
                                                                                     The total number of octets in incoming packets for this Flow at the
   85     octetTotalCount                  unsigned64           totalCounter current Observation Point since the Metering Process (re-)initialization for    octets                                                                 [RFC5102]
                                                                                     this Observation Point. The number of octets includes IP header(s) and
                                                                                     IP payload.
                                                                                     The total number of incoming packets for this Flow at the Observation
   86     packetTotalCount                 unsigned64           totalCounter current Point since the Metering Process (re-)initialization for this           packets                                                                [RFC5102]
                                                                                     Observation Point.
   87     Reserved                                                                                                                                                                                                                  [RFC5102]
                                                                                     The value of the IP fragment offset field in the IPv4 packet header or                     See [RFC791] for the specification of the fragment
   88     fragmentOffset                   unsigned16           identifier   current the IPv6 Fragment header, respectively. The value is 0 for IPv6 if                         offset in the IPv4 header. See [RFC2460] for the    [RFC5102]
                                                                                     there is no fragment header.                                                               specification of the fragment offset in the IPv6
                                                                                                                                                                                Fragment header.
   89     Reserved
                                                                                     The value of the VPN route distinguisher of a corresponding entry in a
                                                                                     VPN routing and forwarding table. Route distinguisher ensures that the
                                                                                     same address can be used in several different MPLS VPNs and that it is
                                                                                     possible for BGP to carry several completely different routes to that
                                                                                     address, one for each VPN. According to RFC 4364, the size of                              See [RFC4364] for the specification of the route
   90     mplsVpnRouteDistinguisher        octetArray           identifier   current mplsVpnRouteDistinguisher is 8 octets. However, in RFC 4382 an octet                       distinguisher. See [RFC4382] for the specification  [RFC5102]
                                                                                     string with flexible length was chosen for representing a VPN route                        of the MPLS/BGP Layer 3 Virtual Private Network
                                                                                     distinguisher by object MplsL3VpnRouteDistinguisher. This choice was                       (VPN) Management Information Base.
                                                                                     made in order to be open to future changes of the size. This idea was
                                                                                     adopted when choosing octetArray as abstract data type for this
                                                                                     Information Element. The maximum length of this Information Element is
                                                                                     256 octets.
                                                                                                                                                                                See [RFC3260] for the definition of the
                                                                                     The definition of this Information Element is identical to the                             Differentiated Services Field. See section 5.3.2 of
                                                                                     definition of Information Element 'ipDiffServCodePoint', except that it                    [RFC1812] and [RFC791] for the definition of the
   91     mplsTopLabelPrefixLength         unsigned8            identifier   current reports a potentially modified value caused by a middlebox function                  0-63  IPv4 TOS field. See [RFC2460] for the definition of [draft-aitken-ipfix-new-infos-03]
                                                                                     after the packet passed the Observation Point.                                             the IPv6 Traffic Class field. See the IPFIX
                                                                                                                                                                                Informaiton Model [RFC5102] for the
                                                                                                                                                                                'ipDiffServCodePoint' specification.
  92-97   Reserved                                                                                                                                                                                                                  [RFC5102]
                                                                                                                                                                                See [RFC3260] for the definition of the
                                                                                     The definition of this Information Element is identical to the                             Differentiated Services Field. See section 5.3.2 of
                                                                                     definition of Information Element 'ipDiffServCodePoint', except that it                    [RFC1812] and [RFC791] for the definition of the
   98     postIpDiffServCodePoint          unsigned8            identifier   current reports a potentially modified value caused by a middlebox function                  0-63  IPv4 TOS field. See [RFC2460] for the definition of [draft-aitken-ipfix-new-infos-03]
                                                                                     after the packet passed the Observation Point.                                             the IPv6 Traffic Class field. See the IPFIX
                                                                                                                                                                                Informaiton Model [RFC5102] for the
                                                                                                                                                                                'ipDiffServCodePoint' specification.
                                                                                                                                                                                See [RFC1112] for the specification of reserved
   99     multicastReplicationFactor                                         current The amount of multicast replication that's applied to a traffic stream.                    IPv4 multicast addresses. See [RFC4291] for the     [draft-aitken-ipfix-new-infos-03]
                                                                                                                                                                                specification of reserved IPv6 multicast addresses.
 100-127  Reserved                                                                                                                                                                                                                  [RFC5102]
                                                                                     The autonomous system (AS) number of the first AS in the AS path to the
                                                                                     destination IP address. The path is deduced by looking up the
   128    bgpNextAdjacentAsNumber          unsigned32           identifier   current destination IP address of the Flow in the BGP routing information base.                    See [RFC4271] for a description of BGP-4, and see   [RFC5102]
                                                                                     If AS path information for this Flow is only available as an unordered                     [RFC1930] for the definition of the AS number.
                                                                                     AS set (and not as an ordered AS sequence), then the value of this
                                                                                     Information Element is 0.
                                                                                     The autonomous system (AS) number of the last AS in the AS path from
                                                                                     the source IP address. The path is deduced by looking up the source IP
                                                                                     address of the Flow in the BGP routing information base. If AS path                        See [RFC4271] for a description of BGP-4, and see
   129    bgpPrevAdjacentAsNumber          unsigned32           identifier   current information for this Flow is only available as an unordered AS set (and                    [RFC1930] for the definition of the AS number.      [RFC5102]
                                                                                     not as an ordered AS sequence), then the value of this Information
                                                                                     Element is 0. In case of BGP asymmetry, the bgpPrevAdjacentAsNumber
                                                                                     might not be able to report the correct value.
                                                                                     The IPv4 address used by the Exporting Process. This is used by the
   130    exporterIPv4Address              ipv4Address          identifier   current Collector to identify the Exporter in cases where the identity of the                                                                          [RFC5102]
                                                                                     Exporter may have been obscured by the use of a proxy.
                                                                                     The IPv6 address used by the Exporting Process. This is used by the
   131    exporterIPv6Address              ipv6Address          identifier   current Collector to identify the Exporter in cases where the identity of the                                                                          [RFC5102]
                                                                                     Exporter may have been obscured by the use of a proxy.
                                                                                     The number of octets since the previous report (if any) in packets of
   132    droppedOctetDeltaCount           unsigned64           deltaCounter current this Flow dropped by packet treatment. The number of octets includes IP octets                                                                 [RFC5102]
                                                                                     header(s) and IP payload.
   133    droppedPacketDeltaCount          unsigned64           deltaCounter current The number of packets since the previous report (if any) of this Flow   packets                                                                [RFC5102]
                                                                                     dropped by packet treatment.
                                                                                     The total number of octets in packets of this Flow dropped by packet
   134    droppedOctetTotalCount           unsigned64           totalCounter current treatment since the Metering Process (re-)initialization for this       octets                                                                 [RFC5102]
                                                                                     Observation Point. The number of octets includes IP header(s) and IP
                                                                                     payload.
   135    droppedPacketTotalCount          unsigned64           totalCounter current The number of packets of this Flow dropped by packet treatment since    packets                                                                [RFC5102]
                                                                                     the Metering Process (re-)initialization for this Observation Point.
                                                                                     The reason for Flow termination. The range of values includes the
                                                                                     following:

                                                                                           0x01: idle timeout
                                                                                                 The Flow was terminated because it was considered to be
                                                                                                 idle.
                                                                                           0x02: active timeout
                                                                                                 The Flow was terminated for reporting purposes while it was
                                                                                                 still active, for example, after the maximum lifetime of
                                                                                                 unreported Flows was reached.
                                                                                           0x03: end of Flow detected
   136    flowEndReason                    unsigned8            identifier   current             The Flow was terminated because the Metering Process                                                                               [RFC5102]
                                                                                                 detected signals indicating the end of the Flow,
                                                                                                 for example, the TCP FIN flag.
                                                                                           0x04: forced end
                                                                                                 The Flow was terminated because of some external event,
                                                                                                 for example, a shutdown of the Metering Process initiated
                                                                                                 by a network management application.
                                                                                           0x05: lack of resources
                                                                                                 The Flow was terminated because of lack of resources
                                                                                                 available to the Metering Process and/or the Exporting
                                                                                                 Process.

                                                                                     An identifier of a set of common properties that is unique per
   137    commonPropertiesId               unsigned64           identifier   current Observation Domain and Transport Session. Typically, this Information                                                                          [RFC5102]
                                                                                     Element is used to link to information reported in separate Data
                                                                                     Records.
                                                                                     An identifier of an Observation Point that is unique per Observation
   138    observationPointId               unsigned32           identifier   current Domain. It is RECOMMENDED that this identifier is also unique per IPFIX                                                                        [RFC5102]
                                                                                     Device. Typically, this Information Element is used for limiting the
                                                                                     scope of other Information Elements.
   139    icmpTypeCodeIPv6                 unsigned16           identifier   current Type and Code of the IPv6 ICMP message. The combination of both values                     See [RFC4443] for the definition of the IPv6 ICMP   [RFC5102]
                                                                                     is reported as (ICMP type * 256) + ICMP code.                                              type and code fields.
   140    mplsTopLabelIPv6Address          ipv6Address          identifier   current The IPv6 address of the system that the MPLS top label will cause this                     See [RFC3031] for the association between MPLS      [RFC5102]
                                                                                     Flow to be forwarded to.                                                                   labels and IP addresses.
                                                                                     An identifier of a line card that is unique per IPFIX Device hosting an
   141    lineCardId                       unsigned32           identifier   current Observation Point. Typically, this Information Element is used for                                                                             [RFC5102]
                                                                                     limiting the scope of other Information Elements.
                                                                                     An identifier of a line port that is unique per IPFIX Device hosting an
   142    portId                           unsigned32           identifier   current Observation Point. Typically, this Information Element is used for                                                                             [RFC5102]
                                                                                     limiting the scope of other Information Elements.
                                                                                     An identifier of a Metering Process that is unique per IPFIX Device.
                                                                                     Typically, this Information Element is used for limiting the scope of
   143    meteringProcessId                unsigned32           identifier   current other Information Elements. Note that process identifiers are typically                                                                        [RFC5102]
                                                                                     assigned dynamically. The Metering Process may be re-started with a
                                                                                     different ID.
                                                                                     An identifier of an Exporting Process that is unique per IPFIX Device.
                                                                                     Typically, this Information Element is used for limiting the scope of
   144    exportingProcessId               unsigned32           identifier   current other Information Elements. Note that process identifiers are typically                                                                        [RFC5102]
                                                                                     assigned dynamically. The Exporting Process may be re-started with a
                                                                                     different ID.
                                                                                     An identifier of a Template that is locally unique within a combination
                                                                                     of a Transport session and an Observation Domain.

                                                                                     Template IDs 0-255 are reserved for Template Sets, Options Template
   145    templateId                       unsigned16           identifier   current Sets, and other reserved Sets yet to be created. Template IDs of Data                                                                          [RFC5102]
                                                                                     Sets are numbered from 256 to 65535.

                                                                                     Typically, this Information Element is used for limiting the scope of
                                                                                     other Information Elements. Note that after a re-start of the Exporting
                                                                                     Process Template identifiers may be re-assigned.
   146    wlanChannelId                    unsigned8            identifier   current The identifier of the 802.11 (Wi-Fi) channel used.                                         See IEEE.802-11.1999.                               [RFC5102]
                                                                                     The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi) network
   147    wlanSSID                         string                            current used. According to IEEE.802-11.1999, the SSID is encoded into a string                     See IEEE.802-11.1999.                               [RFC5102]
                                                                                     of up to 32 characters.
                                                                                     An identifier of a Flow that is unique within an Observation Domain.
   148    flowId                           unsigned64           identifier   current This Information Element can be used to distinguish between different                                                                          [RFC5102]
                                                                                     Flows if Flow Keys such as IP addresses and port numbers are not
                                                                                     reported or are reported in separate records.
                                                                                     An identifier of an Observation Domain that is locally unique to an
                                                                                     Exporting Process. The Exporting Process uses the Observation Domain ID
                                                                                     to uniquely identify to the Collecting Process the Observation Domain
                                                                                     where Flows were metered. It is RECOMMENDED that this identifier is
                                                                                     also unique per IPFIX Device.
   149    observationDomainId              unsigned32           identifier   current                                                                                                                                                [RFC5102]
                                                                                     A value of 0 indicates that no specific Observation Domain is
                                                                                     identified by this Information Element.

                                                                                     Typically, this Information Element is used for limiting the scope of
                                                                                     other Information Elements.
   150    flowStartSeconds                 dateTimeSeconds                   current The absolute timestamp of the first packet of this Flow.                seconds                                                                [RFC5102]
   151    flowEndSeconds                   dateTimeSeconds                   current The absolute timestamp of the last packet of this Flow.                 seconds                                                                [RFC5102]
   152    flowStartMilliseconds            dateTimeMilliseconds              current The absolute timestamp of the first packet of this Flow.                milliseconds                                                           [RFC5102]
   153    flowEndMilliseconds              dateTimeMilliseconds              current The absolute timestamp of the last packet of this Flow.                 milliseconds                                                           [RFC5102]
   154    flowStartMicroseconds            dateTimeMicroseconds              current The absolute timestamp of the first packet of this Flow.                microseconds                                                           [RFC5102]
   155    flowEndMicroseconds              dateTimeMicroseconds              current The absolute timestamp of the last packet of this Flow.                 microseconds                                                           [RFC5102]
   156    flowStartNanoseconds             dateTimeNanoseconds               current The absolute timestamp of the first packet of this Flow.                nanoseconds                                                            [RFC5102]
   157    flowEndNanoseconds               dateTimeNanoseconds               current The absolute timestamp of the last packet of this Flow.                 nanoseconds                                                            [RFC5102]
                                                                                     This is a relative timestamp only valid within the scope of a single
   158    flowStartDeltaMicroseconds       unsigned32                        current IPFIX Message. It contains the negative time offset of the first        microseconds       See the [IPFIX protocol specification] for the      [RFC5102]
                                                                                     observed packet of this Flow relative to the export time specified in                      definition of the IPFIX Message Header.
                                                                                     the IPFIX Message Header.
                                                                                     This is a relative timestamp only valid within the scope of a single
   159    flowEndDeltaMicroseconds         unsigned32                        current IPFIX Message. It contains the negative time offset of the last         microseconds       See the [IPFIX protocol specification] for the      [RFC5102]
                                                                                     observed packet of this Flow relative to the export time specified in                      definition of the IPFIX Message Header.
                                                                                     the IPFIX Message Header.
   160    systemInitTimeMilliseconds       dateTimeMilliseconds              current The absolute timestamp of the last (re-)initialization of the IPFIX     milliseconds                                                           [RFC5102]
                                                                                     Device.
   161    flowDurationMilliseconds         unsigned32                        current The difference in time between the first observed packet of this Flow   milliseconds                                                           [RFC5102]
                                                                                     and the last observed packet of this Flow.
   162    flowDurationMicroseconds         unsigned32                        current The difference in time between the first observed packet of this Flow   microseconds                                                           [RFC5102]
                                                                                     and the last observed packet of this Flow.
   163    observedFlowTotalCount           unsigned64           totalCounter current The total number of Flows observed in the Observation Domain since the  flows                                                                  [RFC5102]
                                                                                     Metering Process (re-)initialization for this Observation Point.
   164    ignoredPacketTotalCount          unsigned64           totalCounter current The total number of observed IP packets that the Metering Process did   packets                                                                [RFC5102]
                                                                                     not process since the (re-)initialization of the Metering Process.
                                                                                     The total number of octets in observed IP packets (including the IP
   165    ignoredOctetTotalCount           unsigned64           totalCounter current header) that the Metering Process did not process since the             octets                                                                 [RFC5102]
                                                                                     (re-)initialization of the Metering Process.
                                                                                     The total number of Flow Records that were generated by the Metering
                                                                                     Process and dropped by the Metering Process or by the Exporting Process
   166    notSentFlowTotalCount            unsigned64           totalCounter current instead of being sent to the Collecting Process. There are several      flows                                                                  [RFC5102]
                                                                                     potential reasons for this including resource shortage and special Flow
                                                                                     export policies.
                                                                                     The total number of packets in Flow Records that were generated by the
                                                                                     Metering Process and dropped by the Metering Process or by the
   167    notSentPacketTotalCount          unsigned64           totalCounter current Exporting Process instead of being sent to the Collecting Process.      packets                                                                [RFC5102]
                                                                                     There are several potential reasons for this including resource
                                                                                     shortage and special Flow export policies.
                                                                                     The total number of octets in packets in Flow Records that were
                                                                                     generated by the Metering Process and dropped by the Metering Process
   168    notSentOctetTotalCount           unsigned64           totalCounter current or by the Exporting Process instead of being sent to the Collecting     octets                                                                 [RFC5102]
                                                                                     Process. There are several potential reasons for this including
                                                                                     resource shortage and special Flow export policies.
   169    destinationIPv6Prefix            ipv6Address                       current IPv6 destination address prefix.                                                                                                               [RFC5102]
   170    sourceIPv6Prefix                 ipv6Address                       current IPv6 source address prefix.                                                                                                                    [RFC5102]
                                                                                     The definition of this Information Element is identical to the
   171    postOctetTotalCount              unsigned64           totalCounter current definition of Information Element 'octetTotalCount', except that it     octets                                                                 [RFC5102]
                                                                                     reports a potentially modified value caused by a middlebox function
                                                                                     after the packet passed the Observation Point.
                                                                                     The definition of this Information Element is identical to the
   172    postPacketTotalCount             unsigned64           totalCounter current definition of Information Element 'packetTotalCount', except that it    packets                                                                [RFC5102]
                                                                                     reports a potentially modified value caused by a middlebox function
                                                                                     after the packet passed the Observation Point.
                                                                                     This set of bit fields is used for marking the Information Elements of
                                                                                     a Data Record that serve as Flow Key. Each bit represents an
                                                                                     Information Element in the Data Record with the n-th bit representing
                                                                                     the n-th Information Element. A bit set to value 1 indicates that the
                                                                                     corresponding Information Element is a Flow Key of the reported Flow. A
                                                                                     bit set to value 0 indicates that this is not the case.
   173    flowKeyIndicator                 unsigned64           flags        current                                                                                                                                                [RFC5102]
                                                                                     If the Data Record contains more than 64 Information Elements, the
                                                                                     corresponding Template SHOULD be designed such that all Flow Keys are
                                                                                     among the first 64 Information Elements, because the flowKeyIndicator
                                                                                     only contains 64 bits. If the Data Record contains less than 64
                                                                                     Information Elements, then the bits in the flowKeyIndicator for which
                                                                                     no corresponding Information Element exists MUST have the value 0.
                                                                                     The total number of outgoing multicast packets sent for packets of this
                                                                                     Flow by a multicast daemon within the Observation Domain since the
   174    postMCastPacketTotalCount        unsigned64           totalCounter current Metering Process (re-)initialization. This property cannot necessarily  packets                                                                [RFC5102]
                                                                                     be observed at the Observation Point, but may be retrieved by other
                                                                                     means.
                                                                                     The total number of octets in outgoing multicast packets sent for
                                                                                     packets of this Flow by a multicast daemon in the Observation Domain
   175    postMCastOctetTotalCount         unsigned64           totalCounter current since the Metering Process (re-)initialization. This property cannot    octets                                                                 [RFC5102]
                                                                                     necessarily be observed at the Observation Point, but may be retrieved
                                                                                     by other means. The number of octets includes IP header(s) and IP
                                                                                     payload.
   176    icmpTypeIPv4                     unsigned8            identifier   current Type of the IPv4 ICMP message.                                                             See [RFC792] for the definition of the IPv4 ICMP    [RFC5102]
                                                                                                                                                                                type field.
   177    icmpCodeIPv4                     unsigned8            identifier   current Code of the IPv4 ICMP message.                                                             See [RFC792] for the definition of the IPv4 ICMP    [RFC5102]
                                                                                                                                                                                code field.
   178    icmpTypeIPv6                     unsigned8            identifier   current Type of the IPv6 ICMP message.                                                             See [RFC4443] for the definition of the IPv6 ICMP   [RFC5102]
                                                                                                                                                                                type field.
   179    icmpCodeIPv6                     unsigned8            identifier   current Code of the IPv6 ICMP message.                                                             See [RFC4443] for the definition of the IPv6 ICMP   [RFC5102]
                                                                                                                                                                                code field.
                                                                                                                                                                                See [RFC768] for the definition of the UDP source
   180    udpSourcePort                    unsigned16           identifier   current The source port identifier in the UDP header.                                              port field. Additional information on defined UDP   [RFC5102]
                                                                                                                                                                                port numbers can be found at [IANA registry
                                                                                                                                                                                port-numbers].
                                                                                                                                                                                See [RFC768] for the definition of the UDP
   181    udpDestinationPort               unsigned16           identifier   current The destination port identifier in the UDP header.                                         destination port field. Additional information on   [RFC5102]
                                                                                                                                                                                defined UDP port numbers can be found at [IANA
                                                                                                                                                                                registry port-numbers].
                                                                                                                                                                                See [RFC793] for the definition of the TCP source
   182    tcpSourcePort                    unsigned16           identifier   current The source port identifier in the TCP header.                                              port field. Additional information on defined TCP   [RFC5102]
                                                                                                                                                                                port numbers can be found at [IANA registry
                                                                                                                                                                                port-numbers].
                                                                                                                                                                                See [RFC793] for the definition of the TCP
   183    tcpDestinationPort               unsigned16           identifier   current The destination port identifier in the TCP header.                                         destination port field. Additional information on   [RFC5102]
                                                                                                                                                                                defined TCP port numbers can be found at [IANA
                                                                                                                                                                                registry port-numbers].
   184    tcpSequenceNumber                unsigned32                        current The sequence number in the TCP header.                                                     See [RFC793] for the definition of the TCP sequence [RFC5102]
                                                                                                                                                                                number.
   185    tcpAcknowledgementNumber         unsigned32                        current The acknowledgement number in the TCP header.                                              See [RFC793] for the definition of the TCP          [RFC5102]
                                                                                                                                                                                acknowledgement number.
                                                                                     The window field in the TCP header. If the TCP window scale is                             See [RFC793] for the definition of the TCP window
   186    tcpWindowSize                    unsigned16                        current supported, then TCP window scale must be known to fully interpret the                      field. See [RFC1323] for the definition of the TCP  [RFC5102]
                                                                                     value of this information.                                                                 window scale.
   187    tcpUrgentPointer                 unsigned16                        current The urgent pointer in the TCP header.                                                      See [RFC793] for the definition of the TCP urgent   [RFC5102]
                                                                                                                                                                                pointer.
                                                                                     The length of the TCP header. Note that the value of this Information
                                                                                     Element is different from the value of the Data Offset field in the TCP
   188    tcpHeaderLength                  unsigned8                         current header. The Data Offset field indicates the length of the TCP header in octets             See [RFC793] for the definition of the TCP header.  [RFC5102]
                                                                                     units of 4 octets. This Information Elements specifies the length of
                                                                                     the TCP header in units of octets.
                                                                                     The length of the IP header. For IPv6, the value of this Information                       See [RFC791] for the definition of the IPv4 header.
   189    ipHeaderLength                   unsigned8                         current Element is 40.                                                          octets             See [RFC2460] for the definition of the IPv6        [RFC5102]
                                                                                                                                                                                header.
   190    totalLengthIPv4                  unsigned16                        current The total length of the IPv4 packet.                                    octets             See [RFC791] for the specification of the IPv4      [RFC5102]
                                                                                                                                                                                total length.
                                                                                     This Information Element reports the value of the Payload Length field
                                                                                     in the IPv6 header. Note that IPv6 extension headers belong to the                         See [RFC2460] for the specification of the IPv6
   191    payloadLengthIPv6                unsigned16                        current payload. Also note that in case of a jumbo payload option the value of  octets             payload length. See [RFC2675] for the specification [RFC5102]
                                                                                     the Payload Length field in the IPv6 header is zero and so will be the                     of the IPv6 jumbo payload option.
                                                                                     value reported by this Information Element.
                                                                                     For IPv4, the value of the Information Element matches the value of the                    See [RFC791] for the definition of the IPv4 Time to
   192    ipTTL                            unsigned8                         current Time to Live (TTL) field in the IPv4 packet header. For IPv6, the value hops               Live field. See [RFC2675] for the definition of the [RFC5102]
                                                                                     of the Information Element matches the value of the Hop Limit field in                     IPv6 Hop Limit field.
                                                                                     the IPv6 packet header.
                                                                                     The value of the Next Header field of the IPv6 header. The value                           See [RFC2460] for the definition of the IPv6 Next
   193    nextHeaderIPv6                   unsigned8                         current identifies the type of the following IPv6 extension header or of the                       Header field. See the list of protocol numbers      [RFC5102]
                                                                                     following IP payload. Valid values are defined in the IANA Protocol                        assigned by IANA at [IANA registry
                                                                                     Numbers registry.                                                                          protocol-numbers].
                                                                                                                                                                                See [RFC3031] for the specification of MPLS
   194    mplsPayloadLength                unsigned32                        current The size of the MPLS packet without the label stack.                    octets             packets. See [RFC3032] for the specification of the [RFC5102]
                                                                                                                                                                                MPLS label stack.
                                                                                     The value of a Differentiated Services Code Point (DSCP) encoded in the
                                                                                     Differentiated Services field. The Differentiated Services field spans                     See [RFC3260] for the definition of the
                                                                                     the most significant 6 bits of the IPv4 TOS field or the IPv6 Traffic                      Differentiated Services field. See [RFC1812]
   195    ipDiffServCodePoint              unsigned8            identifier   current Class field, respectively.                                                           0-63  (Section 5.3.2) and [RFC791] for the definition of  [RFC5102]
                                                                                                                                                                                the IPv4 TOS field. See [RFC2460] for the
                                                                                     This Information Element encodes only the 6 bits of the Differentiated                     definition of the IPv6 Traffic Class field.
                                                                                     Services field. Therefore, its value may range from 0 to 63.
                                                                                     The value of the IP Precedence. The IP Precedence value is encoded in                      See [RFC1812] (Section 5.3.3) and [RFC791] for the
                                                                                     the first 3 bits of the IPv4 TOS field or the IPv6 Traffic Class field,                    definition of the IP Precedence. See [RFC1812]
   196    ipPrecedence                     unsigned8            identifier   current respectively.                                                                        0-7   (Section 5.3.2) and [RFC791] for the definition of  [RFC5102]
                                                                                                                                                                                the IPv4 TOS field. See [RFC2460] for the
                                                                                     This Information Element encodes only these 3 bits. Therefore, its                         definition of the IPv6 Traffic Class field.
                                                                                     value may range from 0 to 7.
                                                                                     Fragmentation properties indicated by flags in the IPv4 packet header
                                                                                     or the IPv6 Fragment header, respectively.


                                                                                              Bit 0:    (RS) Reserved.
                                                                                                        The value of this bit MUST be 0 until specified
                                                                                                        otherwise.
                                                                                              Bit 1:    (DF) 0 = May Fragment,  1 = Don't Fragment.
                                                                                                        Corresponds to the value of the DF flag in the
                                                                                                        IPv4 header.  Will always be 0 for IPv6 unless
                                                                                                        a "don't fragment" feature is introduced to IPv6.
                                                                                              Bit 2:    (MF) 0 = Last Fragment, 1 = More Fragments.                             See [RFC791] for the specification of the IPv4
   197    fragmentFlags                    unsigned8            flags        current                    Corresponds to the MF flag in the IPv4 header                           fragment flags. See [RFC2460] for the specification [RFC5102]
                                                                                                        or to the M flag in the IPv6 Fragment header,                           of the IPv6 Fragment header.
                                                                                                        respectively.  The value is 0 for IPv6 if there
                                                                                                        is no fragment header.
                                                                                              Bits 3-7: (DC) Don't Care.
                                                                                                        The values of these bits are irrelevant.

                                                                                                  0   1   2   3   4   5   6   7
                                                                                                +---+---+---+---+---+---+---+---+
                                                                                                | R | D | M | D | D | D | D | D |
                                                                                                | S | F | F | C | C | C | C | C |
                                                                                                +---+---+---+---+---+---+---+---+

                                                                                     The sum of the squared numbers of octets per incoming packet since the
   198    octetDeltaSumOfSquares           unsigned64                        current previous report (if any) for this Flow at the Observation Point. The                                                                           [RFC5102]
                                                                                     number of octets includes IP header(s) and IP payload.
                                                                                     The total sum of the squared numbers of octets in incoming packets for
   199    octetTotalSumOfSquares           unsigned64                        current this Flow at the Observation Point since the Metering Process           octets                                                                 [RFC5102]
                                                                                     (re-)initialization for this Observation Point. The number of octets
                                                                                     includes IP header(s) and IP payload.
   200    mplsTopLabelTTL                  unsigned8                         current The TTL field from the top MPLS label stack entry, i.e., the last label hops               See [RFC3032] for the specification of the TTL      [RFC5102]
                                                                                     that was pushed.                                                                           field.
   201    mplsLabelStackLength             unsigned32                        current The length of the MPLS label stack in units of octets.                  octets             See [RFC3032] for the specification of the MPLS     [RFC5102]
                                                                                                                                                                                label stack.
   202    mplsLabelStackDepth              unsigned32                        current The number of labels in the MPLS label stack.                           label stack        See [RFC3032] for the specification of the MPLS     [RFC5102]
                                                                                                                                                             entries            label stack.
                                                                                     The Exp field from the top MPLS label stack entry, i.e., the last label
                                                                                     that was pushed.

                                                                                              Bits 0-4:  Don't Care, value is irrelevant.
                                                                                              Bits 5-7:  MPLS Exp field.                                                        See [RFC3032] for the specification of the Exp
   203    mplsTopLabelExp                  unsigned8            flags        current                                                                                            field. See [RFC3270] for usage of the Exp field.    [RFC5102]
                                                                                                  0   1   2   3   4   5   6   7
                                                                                                +---+---+---+---+---+---+---+---+
                                                                                                |     don't care    |    Exp    |
                                                                                                +---+---+---+---+---+---+---+---+

                                                                                     The effective length of the IP payload.

                                                                                     For IPv4 packets, the value of this Information Element is the
                                                                                     difference between the total length of the IPv4 packet (as reported by                     See [RFC791] for the specification of IPv4 packets.
                                                                                     Information Element totalLengthIPv4) and the length of the IPv4 header                     See [RFC2460] for the specification of the IPv6
   204    ipPayloadLength                  unsigned32                        current (as reported by Information Element headerLengthIPv4).                  octets             payload length. See [RFC2675] for the specification [RFC5102]
                                                                                                                                                                                of the IPv6 jumbo payload length.
                                                                                     For IPv6, the value of the Payload Length field in the IPv6 header is
                                                                                     reported except in the case that the value of this field is zero and
                                                                                     that there is a valid jumbo payload option. In this case, the value of
                                                                                     the Jumbo Payload Length field in the jumbo payload option is reported.
   205    udpMessageLength                 unsigned16                        current The value of the Length field in the UDP header.                        octets             See [RFC768] for the specification of the UDP       [RFC5102]
                                                                                                                                                                                header.
                                                                                     If the IP destination address is not a reserved multicast address, then
                                                                                     the value of all bits of the octet (including the reserved ones) is
                                                                                     zero.

                                                                                     The first bit of this octet is set to 1 if the Version field of the IP
                                                                                     header has the value 4 and if the Destination Address field contains a
                                                                                     reserved multicast address in the range from 224.0.0.0 to
                                                                                     239.255.255.255. Otherwise, this bit is set to 0.

                                                                                     The second and third bits of this octet are reserved for future use.

                                                                                     The remaining bits of the octet are only set to values other than zero                     See [RFC1112] for the specification of reserved
                                                                                     if the IP Destination Address is a reserved IPv6 multicast address.                        IPv4 multicast addresses. See [RFC4291] for the
   206    isMulticast                      unsigned8            flags        current Then the fourth bit of the octet is set to the value of the T flag in                      specification of reserved IPv6 multicast addresses  [RFC5102]
                                                                                     the IPv6 multicast address and the remaining four bits are set to the                      and the definition of the T flag and the IPv6
                                                                                     value of the scope field in the IPv6 multicast address.                                    multicast scope.

                                                                                                  0      1      2      3      4      5      6      7
                                                                                               +------+------+------+------+------+------+------+------+
                                                                                               | MCv4 | RES. | RES. |  T   |   IPv6 multicast scope    |
                                                                                               +------+------+------+------+------+------+------+------+

                                                                                               Bit  0:    set to 1 if IPv4 multicast
                                                                                               Bits 1-2:  reserved for future use
                                                                                               Bit  4:    set to value of T flag, if IPv6 multicast
                                                                                               Bits 4-7:  set to value of multicast scope if IPv6 multicast

                                                                                     The value of the Internet Header Length (IHL) field in the IPv4 header.
   207    ipv4IHL                          unsigned8                         current It specifies the length of the header in units of 4 octets. Please note 4 octets           See [RFC791] for the specification of the IPv4      [RFC5102]
                                                                                     that its unit is different from most of the other Information Elements                     header.
                                                                                     reporting length values.
                                                                                     IPv4 options in packets of this Flow. The information is encoded in a
                                                                                     set of bit fields. For each valid IPv4 option type, there is a bit in
                                                                                     this set. The bit is set to 1 if any observed packet of this Flow
                                                                                     contains the corresponding IPv4 option type. Otherwise, if no observed
                                                                                     packet of this Flow contained the respective IPv4 option type, the
                                                                                     value of the corresponding bit is 0.

                                                                                     The list of valid IPv4 options is maintained by IANA. Note that for
                                                                                     identifying an option not just the 5-bit Option Number, but all 8 bits
                                                                                     of the Option Type need to match one of the IPv4 options specified at
                                                                                     http://www.iana.org/assignments/ip-parameters.

                                                                                     Options are mapped to bits according to their option numbers. Option
                                                                                     number X is mapped to bit X. The mapping is illustrated by the figure
                                                                                     below.

                                                                                                0      1      2      3      4      5      6      7
                                                                                            +------+------+------+------+------+------+------+------+
                                                                                            | EOOL | NOP  | SEC  | LSR  |  TS  |E-SEC |CIPSO |  RR  | ...
                                                                                            +------+------+------+------+------+------+------+------+

                                                                                                8      9     10     11     12     13     14     15
                                                                                            +------+------+------+------+------+------+------+------+
                                                                                        ... | SID  | SSR  | ZSU  | MTUP | MTUR | FINN | VISA |ENCODE| ...
                                                                                            +------+------+------+------+------+------+------+------+

                                                                                               16     17     18     19     20     21     22     23
                                                                                            +------+------+------+------+------+------+------+------+
                                                                                        ... |IMITD | EIP  |  TR  |ADDEXT|RTRALT| SDB  |NSAPA | DPS  | ...
                                                                                            +------+------+------+------+------+------+------+------+

                                                                                               24     25     26     27     28     29     30     31
                                                                                            +------+------+------+------+------+------+------+------+
                                                                                        ... | UMP  |  QS  |   to be assigned by IANA  | EXP  |      |
                                                                                            +------+------+------+------+------+------+------+------+
                                                                                                                                                                                See [RFC791] for the definition of IPv4 options.
   208    ipv4Options                      unsigned32           flags        current            Type   Option                                                                   See the list of IPv4 option numbers assigned by     [RFC5102]
                                                                                            Bit Value  Name    Reference                                                        IANA at [IANA registry ip-parameters].
                                                                                            ---+-----+-------+------------------------------------
                                                                                             0     0   EOOL    End of Options List, RFC 791
                                                                                             1     1   NOP     No Operation, RFC 791
                                                                                             2   130   SEC     Security, RFC 1108
                                                                                             3   131   LSR     Loose Source Route, RFC 791
                                                                                             4    68   TS      Time Stamp, RFC 791
                                                                                             5   133   E-SEC   Extended Security, RFC 1108
                                                                                             6   134   CIPSO   Commercial Security
                                                                                             7     7   RR      Record Route, RFC 791
                                                                                             8   136   SID     Stream ID, RFC 791
                                                                                             9   137   SSR     Strict Source Route, RFC 791
                                                                                            10    10   ZSU     Experimental Measurement
                                                                                            11    11   MTUP    (obsoleted) MTU Probe, RFC 1191
                                                                                            12    12   MTUR    (obsoleted) MTU Reply, RFC 1191
                                                                                            13   205   FINN    Experimental Flow Control
                                                                                            14   142   VISA    Experimental Access Control
                                                                                            15    15   ENCODE
                                                                                            16   144   IMITD   IMI Traffic Descriptor
                                                                                            17   145   EIP     Extended Internet Protocol, RFC 1385
                                                                                            18    82   TR      Traceroute, RFC 3193
                                                                                            19   147   ADDEXT  Address Extension
                                                                                            20   148   RTRALT  Router Alert, RFC 2113
                                                                                            21   149   SDB     Selective Directed Broadcast
                                                                                            22   150   NSAPA   NSAP Address
                                                                                            23   151   DPS     Dynamic Packet State
                                                                                            24   152   UMP     Upstream Multicast Pkt.
                                                                                            25    25   QS      Quick-Start
                                                                                            30    30   EXP     RFC3692-style Experiment
                                                                                            30    94   EXP     RFC3692-style Experiment
                                                                                            30   158   EXP     RFC3692-style Experiment
                                                                                            30   222   EXP     RFC3692-style Experiment
                                                                                            ...  ...   ...     Further options numbers
                                                                                                               may be assigned by IANA


                                                                                     TCP options in packets of this Flow. The information is encoded in a
                                                                                     set of bit fields. For each TCP option, there is a bit in this set. The
                                                                                     bit is set to 1 if any observed packet of this Flow contains the
                                                                                     corresponding TCP option. Otherwise, if no observed packet of this Flow
                                                                                     contained the respective TCP option, the value of the corresponding bit
                                                                                     is 0.

                                                                                     Options are mapped to bits according to their option numbers. Option
                                                                                     number X is mapped to bit X. TCP option numbers are maintained by IANA.

                                                                                                   0     1     2     3     4     5     6     7
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+
                                                                                               |   0 |   1 |   2 |   3 |   4 |   5 |   6 |   7 |  ...
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+
                                                                                                                                                                                See [RFC793] for the definition of TCP options. See
   209    tcpOptions                       unsigned64           flags        current               8     9    10    11    12    13    14    15                                  the list of TCP option numbers assigned by IANA at  [RFC5102]
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+                                [IANA registry tcp-parameters].
                                                                                           ... |   8 |   9 |  10 |  11 |  12 |  13 |  14 |  15 |...
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+

                                                                                                  16    17    18    19    20    21    22    23
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+
                                                                                           ... |  16 |  17 |  18 |  19 |  20 |  21 |  22 |  23 |...
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+

                                                                                                                     . . .

                                                                                                  56    57    58    59    60    61    62    63
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+
                                                                                           ... |  56 |  57 |  58 |  59 |  60 |  61 |  62 |  63 |
                                                                                               +-----+-----+-----+-----+-----+-----+-----+-----+

   210    paddingOctets                    octetArray                        current The value of this Information Element is always a sequence of 0x00                                                                             [RFC5102]
                                                                                     values.
   211    collectorIPv4Address             ipv4Address          identifier   current An IPv4 address to which the Exporting Process sends Flow information.                                                                         [RFC5102]
   212    collectorIPv6Address             ipv6Address          identifier   current An IPv6 address to which the Exporting Process sends Flow information.                                                                         [RFC5102]
                                                                                     The index of the interface from which IPFIX Messages sent by the
                                                                                     Exporting Process to a Collector leave the IPFIX Device. The value
   213    exportInterface                  unsigned32           identifier   current matches the value of managed object 'ifIndex' as defined in RFC 2863.                      See [RFC2863] for the definition of the ifIndex     [RFC5102]
                                                                                     Note that ifIndex values are not assigned statically to an interface                       object.
                                                                                     and that the interfaces may be renumbered every time the device's
                                                                                     management system is re-initialized, as specified in RFC 2863.
                                                                                     The protocol version used by the Exporting Process for sending Flow
                                                                                     information. The protocol version is given by the value of the Version                     See the [IPFIX protocol specification] for the
   214    exportProtocolVersion            unsigned8            identifier   current Number field in the Message Header.                                                        definition of the IPFIX Message Header. See         [RFC5102]
                                                                                                                                                                                [RFC3954] for the definition of the NetFlow version
                                                                                     The protocol version is 10 for IPFIX and 9 for NetFlow version 9. A                        9 message header.
                                                                                     value of 0 indicates that no export protocol is in use.
                                                                                     The value of the protocol number used by the Exporting Process for
                                                                                     sending Flow information. The protocol number identifies the IP packet                     See [RFC791] for the specification of the IPv4
                                                                                     payload type. Protocol numbers are defined in the IANA Protocol Numbers                    protocol field. See [RFC2460] for the specification
   215    exportTransportProtocol          unsigned8            identifier   current registry.                                                                                  of the IPv6 protocol field. See the list of         [RFC5102]
                                                                                                                                                                                protocol numbers assigned by IANA at [IANA registry
                                                                                     In Internet Protocol version 4 (IPv4), this is carried in the Protocol                     protocol-numbers].
                                                                                     field. In Internet Protocol version 6 (IPv6), this is carried in the
                                                                                     Next Header field in the last extension header of the packet.
                                                                                                                                                                                See [RFC768] for the definition of the UDP
                                                                                                                                                                                destination port field. See [RFC793] for the
                                                                                     The destination port identifier to which the Exporting Process sends                       definition of the TCP destination port field. See
   216    collectorTransportPort           unsigned16           identifier   current Flow information. For the transport protocols UDP, TCP, and SCTP, this                     [RFC4960] for the definition of SCTP.               [RFC5102]
                                                                                     is the destination port number. This field MAY also be used for future
                                                                                     transport protocols that have 16-bit source port identifiers.                              Additional information on defined UDP and TCP port
                                                                                                                                                                                numbers can be found at [IANA registry
                                                                                                                                                                                port-numbers].
                                                                                                                                                                                See [RFC768] for the definition of the UDP source
                                                                                     The source port identifier from which the Exporting Process sends Flow                     port field. See [RFC793] for the definition of the
                                                                                     information. For the transport protocols UDP, TCP, and SCTP, this is                       TCP source port field. See [RFC4960] for the
   217    exporterTransportPort            unsigned16           identifier   current the source port number. This field MAY also be used for future                             definition of SCTP.                                 [RFC5102]
                                                                                     transport protocols that have 16-bit source port identifiers. This
                                                                                     field may be useful for distinguishing multiple Exporting Processes                        Additional information on defined UDP and TCP port
                                                                                     that use the same IP address.                                                              numbers can be found at [IANA registry
                                                                                                                                                                                port-numbers].
   218    tcpSynTotalCount                 unsigned64           totalCounter current The total number of packets of this Flow with TCP "Synchronize sequence packets            See [RFC793] for the definition of the TCP SYN      [RFC5102]
                                                                                     numbers" (SYN) flag set.                                                                   flag.
   219    tcpFinTotalCount                 unsigned64           totalCounter current The total number of packets of this Flow with TCP "No more data from    packets            See [RFC793] for the definition of the TCP FIN      [RFC5102]
                                                                                     sender" (FIN) flag set.                                                                    flag.
   220    tcpRstTotalCount                 unsigned64           totalCounter current The total number of packets of this Flow with TCP "Reset the            packets            See [RFC793] for the definition of the TCP RST      [RFC5102]
                                                                                     connection" (RST) flag set.                                                                flag.
   221    tcpPshTotalCount                 unsigned64           totalCounter current The total number of packets of this Flow with TCP "Push Function" (PSH) packets            See [RFC793] for the definition of the TCP PSH      [RFC5102]
                                                                                     flag set.                                                                                  flag.
   222    tcpAckTotalCount                 unsigned64           totalCounter current The total number of packets of this Flow with TCP "Acknowledgment field packets            See [RFC793] for the definition of the TCP ACK      [RFC5102]
                                                                                     significant" (ACK) flag set.                                                               flag.
   223    tcpUrgTotalCount                 unsigned64           totalCounter current The total number of packets of this Flow with TCP "Urgent Pointer field packets            See [RFC793] for the definition of the TCP URG      [RFC5102]
                                                                                     significant" (URG) flag set.                                                               flag.
                                                                                                                                                                                See [RFC791] for the specification of the IPv4
   224    ipTotalLength                    unsigned64                        current The total length of the IP packet.                                      octets             total length. See [RFC2460] for the specification   [RFC5102]
                                                                                                                                                                                of the IPv6 payload length. See [RFC2675] for the
                                                                                                                                                                                specification of the IPv6 jumbo payload length.
                                                                                     The definition of this Information Element is identical to the                             See [RFC791] for the definition of the IPv4 source
   225    postNATSourceIPv4Address         ipv4Address          identifier   current definition of Information Element 'sourceIPv4Address', except that it                      address field. See [RFC3022] for the definition of
                                                                                     reports a modified value caused by a NAT middlebox function after the                      NAT. See [RFC3234] for the definition of
                                                                                     packet passed the Observation Point.                                                       middleboxes.
                                                                                     The definition of this Information Element is identical to the                             See [RFC791] for the definition of the IPv4
   226    postNATDestinationIPv4Address    ipv4Address          identifier   current definition of Information Element 'destinationIPv4Address', except that                    destination address field. See [RFC3022] for the
                                                                                     it reports a modified value caused by a NAT middlebox function after                       definition of NAT. See [RFC3234] for the definition
                                                                                     the packet passed the Observation Point.                                                   of middleboxes.
                                                                                                                                                                                See [RFC768] for the definition of the UDP source
                                                                                     The definition of this Information Element is identical to the                             port field. See [RFC793] for the definition of the
                                                                                     definition of Information Element 'sourceTransportPort', except that it                    TCP source port field. See [RFC4960] for the
   227    postNAPTSourceTransportPort      unsigned16           identifier   current reports a modified value caused by a Network Address Port Translation                      definition of SCTP. See [RFC3022] for the
                                                                                     (NAPT) middlebox function after the packet passed the Observation                          definition of NAPT. See [RFC3234] for the
                                                                                     Point.                                                                                     definition of middleboxes. Additional information
                                                                                                                                                                                on defined UDP and TCP port numbers can be found at
                                                                                                                                                                                http://www.iana.org/assignments/port-numbers.
                                                                                                                                                                                See [RFC768] for the definition of the UDP source
                                                                                     The definition of this Information Element is identical to the                             port field. See [RFC793] for the definition of the
                                                                                     definition of Information Element 'destinationTransportPort', except                       TCP source port field. See [RFC4960] for the
   228    postNAPTDestinationTransportPort unsigned16           identifier   current that it reports a modified value caused by a Network Address Port                          definition of SCTP. See [RFC3022] for the
                                                                                     Translation (NAPT) middlebox function after the packet passed the                          definition of NAPT. See [RFC3234] for the
                                                                                     Observation Point.                                                                         definition of middleboxes. Additional information
                                                                                                                                                                                on defined UDP and TCP port numbers can be found at
                                                                                                                                                                                http://www.iana.org/assignments/port-numbers.
                                                                                     Indicates whether the session was created because traffic originated in
                                                                                     the private or public address realm. postNATSourceIPv4Address,
   229    natOriginatingAddressRealm       unsigned8            flags        current postNATDestinationIPv4Address, postNAPTSourceTransportPort, and                            See [RFC3022] for the definition of NAT.
                                                                                     postNAPTDestinationTransportPort are qualified with the address realm
                                                                                     in perspective. The allowed values are: Private: 1 Public: 2
                                                                                     Indicates a NAT event. The allowed values are: 1 - Create event. 2 -
   230    natEvent                         unsigned8                         current Delete event. A Create event is generated when a NAT translation is                        See [RFC3022] for the definition of NAT.
                                                                                     created, whether dynamically or statically. A Delete event is generated
                                                                                     when a NAT translation is deleted.
                                                                                     The total number of layer 4 payload bytes in a flow from the initiator.
   231    initiatorOctets                  unsigned64                        current The initiator is the device which triggered the session creation, and
                                                                                     remains the same for the life of the session.
                                                                                     The total number of layer 4 payload bytes in a flow from the responder.
   232    responderOctets                  unsigned64                        current The responder is the device which replies to the initiator, and remains
                                                                                     the same for the life of the session.
                                                                                     Indicates a firewall event. The allowed values are: 0 - Ignore
   233    firewallEvent                    unsigned8                         current (invalid) 1 - Flow Created 2 - Flow Deleted 3 - Flow Denied 4 - Flow
                                                                                     Alert
   234    ingressVRFID                     unsigned32                        current An unique identifier of the VRFname where the packets of this flow are
                                                                                     being received. This identifier is unique per Metering Process
   235    egressVRFID                      unsigned32                        current An unique identifier of the VRFname where the packets of this flow are
                                                                                     being sent. This identifier is unique per Metering Process
   236    VRFname                          string                            current The name of a VPN Routing and Forwarding table (VRF).                                      See [RFC4364] for the definition of VRF.
                                                                                     The definition of this Information Element is identical to the
   237    postMplsTopLabelExp              unsigned8            flags        current definition of Information Element 'mplsTopLabelExp', except that it                        See [RFC3032] for the specification of the Exp      [RFC5102]
                                                                                     reports a potentially modified value caused by a middlebox function                        field. See [RFC3270] for usage of the Exp field.
                                                                                     after the packet passed the Observation Point.
   238    tcpWindowScale                   unsigned16                        current The scale of the window field in the TCP header.                                           See [RFC1323] for the definition of the TCP window  [RFC5102]
                                                                                                                                                                                scale.
                                                                                     A description of the direction assignment method used to assign the
                                                                                     Biflow Source and Destination. This Information Element MAY be present
                                                                                     in a Flow Data Record, or applied to all flows exported from an
                                                                                     Exporting Process or Observation Domain using IPFIX Options. If this
                                                                                     Information Element is not present in a Flow Record or associated with
                                                                                     a Biflow via scope, it is assumed that the configuration of the
                                                                                     direction assignment method is done out-of-band. Note that when using
                                                                                     IPFIX Options to apply this Information Element to all flows within an
                                                                                     Observation Domain or from an Exporting Process, the Option SHOULD be
                                                                                     sent reliably. If reliable transport is not available (i.e., when using
                                                                                     UDP), this Information Element SHOULD appear in each Flow Record. This
                                                                                     field may take the following values:

                                                                                      +-------+------------------+----------------------------------------+
                                                                                      | Value | Name             | Description                            |
                                                                                      +-------+------------------+----------------------------------------+
                                                                                      | 0x00  | arbitrary        | Direction was assigned arbitrarily.    |
                                                                                      | 0x01  | initiator        | The Biflow Source is the flow          |
   239    biflowDirection                  unsigned8            identifier   current  |       |                  | initiator, as determined by the        |                                                                         [RFC5103]
                                                                                      |       |                  | Metering Process' best effort to       |
                                                                                      |       |                  | detect the initiator.                  |
                                                                                      | 0x02  | reverseInitiator | The Biflow Destination is the flow     |
                                                                                      |       |                  | initiator, as determined by the        |
                                                                                      |       |                  | Metering Process' best effort to       |
                                                                                      |       |                  | detect the initiator.  This value is   |
                                                                                      |       |                  | provided for the convenience of        |
                                                                                      |       |                  | Exporting Processes to revise an       |
                                                                                      |       |                  | initiator estimate without re-encoding |
                                                                                      |       |                  | the Biflow Record.                     |
                                                                                      | 0x03  | perimeter        | The Biflow Source is the endpoint      |
                                                                                      |       |                  | outside of a defined perimeter.  The   |
                                                                                      |       |                  | perimeter's definition is implicit in  |
                                                                                      |       |                  | the set of Biflow Source and Biflow    |
                                                                                      |       |                  | Destination addresses exported in the  |
                                                                                      |       |                  | Biflow Records.                        |
                                                                                      +-------+------------------+----------------------------------------+

                                                                                     The difference between the length of an Ethernet frame (minus the FCS)
   240    ethernetHeaderLength             unsigned8            identifier   current and the length of its MAC Client Data section (including any padding)   octets             [IEEE.802-3.2005]
                                                                                     as defined in section 3.1 of [IEEE.802-3.2005]. It does not include the
                                                                                     Preamble, SFD and Extension field lengths.
   241    ethernetPayloadLength            unsigned16           identifier   current The length of the MAC Client Data section (including any padding) of a  octets             [IEEE.802-3.2005]
                                                                                     frame as defined in section 3.1 of [IEEE.802-3.2005].
                                                                                     The total length of the Ethernet frame (excluding the Preamble, SFD,
   242    ethernetTotalLength              unsigned16           identifier   current Extension and FCS fields) as described in section 3.1 of                octets             [IEEE.802-3.2005]
                                                                                     [IEEE.802-3.2005].
                                                                                     The value of the 12-bit VLAN Identifier portion of the Tag Control
                                                                                     Information field of an Ethernet frame as described in section 3.5.5 of
                                                                                     [IEEE.802-3.2005]. The structure and semantics within the Tag Control
   243    dot1qVlanId                      unsigned16           identifier   current Information field are defined in IEEE P802.1Q. In case of a QinQ frame, octets             [IEEE.802-3.2005]
                                                                                     it represents the outer tag's VLAN identifier and in case of an IEEE
                                                                                     802.1ad frame it represents the Service VLAN identifier in the S-TAG
                                                                                     Tag Control Information (TCI) field as described in
                                                                                     [IEEE.802-1ad.2005].
                                                                                     The value of the 3-bit User Priority portion of the Tag Control
                                                                                     Information field of an Ethernet frame as described in section 3.5.5 of
                                                                                     [IEEE.802-3.2005]. The structure and semantics within the Tag Control
   244    dot1qPriority                    unsigned8            identifier   current Information field are defined in IEEE P802.1Q. In case of a QinQ frame,                    [IEEE.802-3.2005] [IEEE.802-1ad.2005]
                                                                                     it represents the outer tag's 3-bit Class of Service (CoS) identifier
                                                                                     and in case of an IEEE 802.1ad frame it represents the 3-bit Priority
                                                                                     Code Point (PCP) portion of the S-TAG Tag Control Information (TCI)
                                                                                     field as described in [IEEE.802-1ad.2005].
                                                                                     In case of a QinQ frame, it represents the inner tag's (*) VLAN
                                                                                     identifier and in case of an IEEE 802.1ad frame it represents the
   245    dot1qCustomerVlanId              unsigned16           identifier   current Customer VLAN identifier in the C-TAG Tag Control Information (TCI)                        [IEEE.802-1ad.2005] [IEEE.802-1Q.2003]
                                                                                     field as described in [IEEE.802-1ad.2005]. (*) Note: the 801.2Q tag
                                                                                     directly following the outer one.
                                                                                     In case of a QinQ frame, it represents the inner tag's (*) Class of
                                                                                     Service (CoS) identifier and in case of an IEEE 802.1ad frame it
   246    dot1qCustomerPriority            unsigned8            identifier   current represents the 3-bit Priority Code Point (PCP) portion of the C-TAG Tag                    [IEEE.802-1ad.2005] [IEEE.802-1Q.2003]
                                                                                     Control Information (TCI) field as described in [IEEE.802-1ad.2005].
                                                                                     (*) Note: the 801.2Q tag directly following the outer one.
                                                                                     The EVC Service Attribute which uniquely identifies the Ethernet
   247    metroEvcId                       string                            current Virtual Connection (EVC) within a Metro Ethernet Network, as defined in                    MEF 10.1 (Ethernet Services Attributes Phase 2)
                                                                                     section 6.2 of MEF 10.1. The MetroEVCID is encoded in a string of up to                    MEF16 (Ethernet Local Management Interface)
                                                                                     100 characters.
   248    metroEvcType                     unsigned8            identifier   current The 3-bit EVC Service Attribute which identifies the type of service                       MEF 10.1 (Ethernet Services Attributes Phase 2)
                                                                                     provided by an EVC.                                                                        MEF16 (Ethernet Local Management Interface)
                                                                                     A 32-bit non-zero connection identifier, which together with the
   249    pseudoWireId                     unsigned32           identifier   current pseudoWireType, identifies the Pseudo Wire (PW) as defined in RFC 4447                     See [RFC4447] for pseudowire definitions.
                                                                                     [RFC4447].
                                                                                     The value of this information element identifies the type of MPLS                          See [RFC4446] for the pseudowire type definition,
   250    pseudoWireType                   unsigned16           identifier   current Pseudo Wire (PW) as defined in RFC 4446.                                                   and http://www.iana.org/assignments/pwe3-parameters
                                                                                                                                                                                for the IANA Pseudowire Types Registry.
   251    pseudoWireControlWord            unsigned32           identifier   current The 32-bit Preferred Pseudo Wire (PW) MPLS Control Word as defined in                      See [RFC4385] for the Pseudo Wire Control Word
                                                                                     Section 3 of .                                                                             definition.
   252    ingressPhysicalInterface         unsigned32           identifier   current The index of a networking device's physical interface (example, a                          See [RFC2863] for the definition of the ifIndex
                                                                                     switch port) where packets of this flow are being received.                                object.
   253    egressPhysicalInterface          unsigned32           identifier   current The index of a networking device's physical interface (example, a                          See [RFC2863] for the definition of the ifIndex
                                                                                     switch port) where packets of this flow are being sent.                                    object.
                                                                                     The definition of this Information Element is identical to the
   254    postDot1qVlanId                  unsigned16           identifier   current definition of Information Element 'dot1qVlanId', except that it reports                    [IEEE.802-3.2005] [IEEE.802-1ad.2005]
                                                                                     a potentially modified value caused by a middlebox function after the
                                                                                     packet passed the Observation Point.
                                                                                     The definition of this Information Element is identical to the
   255    postDot1qCustomerVlanId          unsigned16           identifier   current definition of Information Element 'dot1qCustomerVlanId', except that it                    [IEEE.802-1ad.2005] [IEEE.802-1Q.2003]
                                                                                     reports a potentially modified value caused by a middlebox function
                                                                                     after the packet passed the Observation Point.
                                                                                     The Ethernet type field of an Ethernet frame that identifies the MAC                       [IEEE.802-3.2005] Ethertype registry available at
   256    ethernetType                     unsigned16           identifier   current client protocol carried in the payload as defined in paragraph 1.4.349                     http://standards.ieee.org/regauth/ethertype/eth.txt
                                                                                     of [IEEE.802-3.2005].
 257-334  Unassigned
   335    selectorName                     string                            current The name of a selector identified by a selectorID. Globally unique per
                                                                                     Metering Process.
336-32767 Unassigned

  IPFIX MPLS label type (Value 46)

   Registration Procedures
           Expert Review

   Reference
           [RFC5102]

   Note

 New assignments for MPLS label types will be administered by IANA, on
 a First Come First Served basis [RFC2434], subject to Expert Review
 [RFC2434], i.e. review by one of a group of experts designated by an
 IETF Operations and Management Area Director. The group of experts
 must double check the label type definitions with already defined
 label types for completeness, accuracy, and redundancy. The
 specification of new MPLS label types MUST be published using a well
 established and persistent publication medium.

   Value                             Description                              Reference
     1   TE-MIDPT: Any TE tunnel mid-point or tail label                      [RFC5102]
     2   Pseudowire: Any PWE3 or Cisco AToM based label                       [RFC5102]
     3   VPN: Any label associated with VPN                                   [RFC5102]
     4   BGP: Any label associated with BGP or BGP routing                    [RFC5102]
     5   LDP: Any label associated with dynamically assigned labels using LDP [RFC5102]
   6-255 Unassigned                                                           [RFC5102]

IPFIX Version Numbers

   Registration Procedures
           Standards Action

   Reference
           [RFC5101]

    Value                    Version                   Reference
      0     Reserved
     1-8    Reserved (historic)
      9     Cisco Systems NetFlow Version 9 (historic) [RFC3954]
      10    IPFIX as documented in RFC5101             [RFC5101]
   11-65535 Unassigned

IPFIX Set IDs

   Registration Procedures
           Standards Action

   Reference
           [RFC5101]

     Value       Set Identifier     Reference
      0-1    Not used (historic)    [RFC3954]
       2     Template Set           [RFC5101]
       3     Option Template Set    [RFC5101]
     4-255   Unassigned             [RFC5101]
   256-65535 Reserved for Data Sets [RFC5101]
