Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information
obsoleted by
- rfc-7011 — Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information
Extracted elements (31)
PR-SCTP is preferred over TCP because TCP's stream orientation creates back pressure on Exporters that can cause record loss, whereas PR-SCTP's message orientation and partial-reliability capability allow the Exporting Process to discard individual messages under load rather than stalling the entire export pipeline.
Reduced size encoding allows Exporters to send IEs in fewer octets than the canonical type when actual values fit, reducing export bandwidth. The Template records the reduced size, alerting the Collector; for example, an unsigned64 byteCount may be sent as 4 octets on an access router where values never exceed 2^32-1.
Set IDs 0 and 1 are not used for historical reasons inherited from NetFlow v9 (RFC 3954). The IPFIX version number 0x000a (10) also directly increments the NetFlow v9 version number to signal backward incompatibility.
A Collecting Process MUST NOT assume Data Sets and their associated Template Sets are exported in the same IPFIX Message. If Template Records have not yet arrived, the Collector MAY store Data Records temporarily and decode them once the Template is received.
If the Collecting Process receives a Template Record with an already-received and non-withdrawn Template ID on the same SCTP association and Observation Domain, it MUST shut down the association. Receiving a Withdrawal for an unknown Template ID is also a fatal error requiring association reset.
Template ID uniqueness is scoped per Transport Session and per Observation Domain. Different Observation Domains on the same SCTP association may use the same Template ID for different Templates; Collectors MUST account for this when demultiplexing.
A Template Withdrawal Message MUST NOT be sent until sufficient time has elapsed (configurable, default 5 seconds after the last Data Record using that Template). The withdrawn Template ID MUST NOT be reused until sufficient time has elapsed for the Collector to process the withdrawal.
All binary integers in the IPFIX Message Header and Sets MUST be encoded in network-byte order (big-endian). Information Elements MUST also be sent in canonical format in network-byte order.
Padding octets MUST be composed of zero (0) valued octets for security reasons, and the padding length MUST be shorter than any allowable record in the Set.
Reduced size encoding MUST only be applied to integer types unsigned64, signed64, unsigned32, signed32, unsigned16, and signed16, preserving the signed/unsigned property with only leading zeroes dropped. It MUST NOT be applied to dateTimeMicroseconds or dateTimeNanoseconds as these have an inherent structure.
SCTP (RFC 4960) with the PR-SCTP extension (RFC 3758) MUST be implemented by all compliant IPFIX implementations. UDP and TCP MAY also be implemented.
Template Sets and Options Template Sets MUST be sent reliably using SCTP-ordered delivery. The Collecting Process MUST store Template Records for the duration of the SCTP association to decode subsequent Data Records.
The dateTimeSeconds type MUST be encoded as a 32-bit Unix timestamp; dateTimeMilliseconds as a 64-bit integer of milliseconds since epoch; dateTimeMicroseconds and dateTimeNanoseconds MUST be encoded as 64-bit integers in NTP format (RFC 1305).
The Scope Field Count in an Options Template Record MUST NOT be zero. The Observation Domain ID in the IPFIX Message Header MUST be zero when the message contains Data Records with different Observation Domain ID values defined as scopes.
When UDP is used as transport, IPFIX traffic MUST run in an environment where it has been provisioned for or contained through other means, because UDP provides no congestion avoidance.
The Exporting Process Reliability Statistics Option Template reports dropped export data: Exporting Process ID (scope, via exporterIPv4Address, exporterIPv6Address, or exportingProcessId), notSentFlowTotalCount, notSentPacketTotalCount, notSentOctetTotalCount, and drop timestamps.
The Flow Keys Option Template identifies which Information Elements in a referenced Template serve as Flow Keys, using templateId as mandatory scope and a flowKeyIndicator bitmap to mark key positions in the Data Record.
The Metering Process Reliability Statistics Option Template reports dropped observation data: observationDomainId (scope), ignoredPacketTotalCount, ignoredOctetTotalCount, and timestamps for first and last ignored packets.
The Metering Process Statistics Option Template reports per-Observation Domain export activity: observationDomainId (mandatory scope), exportedMessageTotalCount, exportedFlowTotalCount, and exportedOctetTotalCount. If multiple Metering Processes exist, meteringProcessId MUST be an additional scope.
IANA assigns IPFIX Set IDs: 2 (Template Set), 3 (Options Template Set), 4–255 reserved for future use, and values above 255 for Data Sets (matching Template IDs 256–65535). Set IDs 0 and 1 are permanently unused.
IANA has assigned port 4739 for IPFIX (non-secure, SCTP and TCP) and port 4740 for IPFIX over TLS/DTLS (secure). Both ports must be configurable on Exporting and Collecting Processes.
IPFIX Collectors are vulnerable to DoS attacks via flooding of IPFIX messages and injection of spoofed messages that distort Sequence Numbers or corrupt Template mappings. Protection requires network-level provisioning, rate limiting, and authenticated transport sessions.
TLS MUST be used to secure IPFIX over TCP; DTLS MUST be used for IPFIX over UDP and SCTP. The default port for secure IPFIX connections is 4740 (versus 4739 for non-secure). Mutual authentication between Exporter and Collector is required to prevent injection of false IPFIX messages.
Template lifecycle: allocated (Template ID assigned, Template Record transmitted) → active (in use by Data Records) → withdrawn (Template Withdrawal Message sent after configurable delay from last Data Record) → retired (Template ID reusable after Collector processes withdrawal). SCTP association shutdown discards all Templates and requires reassignment on reconnect.
Field Specifier encodes an Enterprise bit (1 bit), Information Element identifier (15 bits), and Field Length (16 bits). When Enterprise bit is 1, a 32-bit Enterprise Number follows. Field Length value 65535 is reserved to signal a variable-length IE.
IPFIX Message Header is 16 octets: Version Number (16-bit, value 0x000a), Length (16-bit, total message octets including header and Sets), Export Time (32-bit, seconds since 0000 UTC Jan 1 1970), Sequence Number (32-bit, modulo 2^32 count of Data Records), and Observation Domain ID (32-bit).
Options Template Record Header contains Template ID (16-bit, >255), Field Count (16-bit, total fields including scope), and Scope Field Count (16-bit, MUST NOT be zero). Scope Fields appear first in the Field Specifier list.
Set Header is 4 octets: Set ID (16-bit, 2=Template Set, 3=Options Template Set, >255=Data Set) and Length (16-bit, total Set length including header, records, and optional padding).
Template Record Header contains Template ID (16-bit, values 256–65535; IDs 0–255 are reserved) and Field Count (16-bit, number of Field Specifiers that follow).
Template Withdrawal Message is a Template Record with Field Count = 0; Set ID MUST be 2 for Template Set Withdrawal or 3 for Options Template Set Withdrawal. Multiple Template IDs may be withdrawn in one message. An all-Templates withdrawal uses Template ID equal to the Set ID value.
Variable-length IEs use a 1-octet length prefix when length < 255 octets (Figure R). For lengths 255–65535 octets, a 3-octet prefix is used: first octet is 0xFF, the 16-bit length follows (Figure S). Length-prefix octets are not counted in the IE length.