IPFIX Monitoring – Which Field Indicates Bytes?

ipfixmonitoringnetflow

In netflow there are in_bytes and in_pkts fields. What are the equivalent values in IPFIX?

I'm shipping IPFIX data with softflowd and I'm getting these fields:

destinationIPv4Address
destinationTransportPort
egressInterface
flowEndMilliseconds
flowStartMilliseconds
icmpTypeCodeIPv4
ingressInterface
ipClassOfService
ipVersion
octetDeltaCount
packetDeltaCount
protocolIdentifier
sourceIPv4Address
sourceTransportPort
tcpControlBits
version
vlanId

Is octetDeltaCount and packetDeltaCount the equivalent of in_bytes and in_pkts?

Best Answer

IPFIX is defined in RFC 7011, Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information. Much of what you do or do not have in your records is up to the specific implementation. Your application is off-topic, but if you look at Appendix A. IPFIX Encoding Examples, it will give you some example templates, and the meanings of the fields for those templates. For example:

A.2. Template Set Examples

A.2.1. Template Set Using IANA Information Elements

We want to report the following Information Elements:

  • IPv4 source IP address: sourceIPv4Address [IANA-IPFIX], with a length of 4 octets

  • IPv4 destination IP address: destinationIPv4Address [IANA-IPFIX], with a length of 4 octets

  • Next-hop IP address (IPv4): ipNextHopIPv4Address [IANA-IPFIX], with a length of 4 octets

  • Number of packets of the Flow: packetDeltaCount [IANA-IPFIX], with a length of 4 octets

  • Number of octets of the Flow: octetDeltaCount [IANA-IPFIX], with a length of 4 octets

Therefore, the Template Set will be composed of the following:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |         Set ID = 2            |      Length = 28 octets       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Template ID 256         |       Field Count = 5         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|    sourceIPv4Address = 8    |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0| destinationIPv4Address = 12 |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|  ipNextHopIPv4Address = 15  |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|    packetDeltaCount = 2     |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|    octetDeltaCount = 1      |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Related Topic