draft-gao-opsawg-ipfix-term-and-app
Export of TLS Handshake Information in IPFIX
This document defines a set of new Information Elements (IEs) in the
IPFIX Information Model for exporting raw TLS ClientHello handshake
fields. These IEs enable the collection of standardized client
behavioral fingerprints from network traffic without decryption of
the encrypted payload. The exported fields facilitate network
anomaly detection, threat identification, and fault diagnosis in
encrypted traffic environments.