Definitions of Managed Objects for IP Flow Information Export
obsoleted by
- rfc-6615 — Definitions of Managed Objects for IP Flow Information Export
Extracted elements (27)
The Export Table was designed to support advanced exporter topologies — failover (primary + secondary sessions), duplicate parallel export to multiple Collectors, and load-balancing — by grouping Transport Sessions under a shared ipfixExportIndex with typed membership roles, rather than hardcoding a single export destination.
The IPFIX SELECTOR MIB is intentionally minimal and IANA-controlled: since IPFIX itself (RFC 5101) defines no packet selection functions beyond 'select all', the MIB provides only a structural template and a placeholder subtree so that PSAMP and enterprise-specific sampling methods can be added later without changing the base MIB.
For SCTP transport sessions, the MIB uses ipfixTransportSessionSctpAssocId (equal to sctpAssocId in the SCTP MIB, RFC 3873) as the session identifier rather than address/port tuples; port objects for SCTP are populated by copying sctpAssocLocalPort or sctpAssocRemPort depending on device mode.
The Observation Point table references the ENTITY MIB (RFC 4133) and IF MIB (RFC 2863) to identify physical observation points. Implementors who want to specify physical entities SHOULD also implement those MIB modules; if they do not, the respective reference columns MUST be zero.
All Transport Sessions referenced in the Export Table MUST have ipfixTransportSessionDeviceMode set to exporting(1). If an Exporter does not use Transport Session grouping, the single session in each export index MUST have member type primary(1).
Extensions to the IPFIX SELECTOR MIB are governed by Expert Review; the group of experts MUST check requested MIB objects for completeness and accuracy. Requests duplicating existing functionality SHOULD be declined, the smallest available OID SHOULD be assigned, and new objects MUST be published via a well-established and persistent publication medium.
If an Observation Point is not specified for a Metering Process cache, ipfixMeteringProcessObservationPointGroupRef MUST be zero. Similarly, the special value 0 MUST NOT be used as an ipfixObservationPointGroupId within the Observation Point table itself.
If both ipfixObservationPointPhysicalEntity and ipfixObservationPointPhysicalInterface are non-zero, they MUST both point to the same physical interface; if neither can be specified, both MUST be zero and the direction MUST be unknown(0).
If no Filtering or Sampling function is used for a Metering Process, an entry for that Metering Process SHOULD be created in the Selection Process Table pointing to the Select All function (ipfixFuncSelectAll).
In the ipfixTemplateDefinitionFlags bitmask, bits scope(0) and flowKey(1) MUST NOT be set simultaneously; an Information Element cannot simultaneously be a scope field and a Flow Key.
Most objects defined by the IPFIX MIB module MUST be implemented; some objects MAY be implemented corresponding to the functionality present in the equipment (e.g., Collector-only or Exporter-only objects).
The ipfixTransportSessionSctpAssocId MUST be zero for all non-SCTP transport sessions; conversely, for non-port-based protocols, ipfixTransportSessionSourcePort and DestinationPort MUST be set to zero.
The template and options-template refresh timeout and packet-count objects (ipfixTransportSessionTemplateRefreshTimeout, etc.) MUST be zero for any transport protocol other than UDP (17), since template refresh applies only to unreliable transports.
When SCTP (protocol 132) or any protocol without address semantics is used, ipfixTransportSessionSourceAddressType and DestinationAddressType MUST be set to unknown(0) and the corresponding address objects MUST be set to a zero-length string.
Withdrawn or invalidated (Options) Templates MUST be removed from the ipfixTemplateTable, ensuring the table reflects only currently valid templates.
Four Statistical Tables augment the Transport Session, Template, Metering Process, and Selection Process tables. The Transport Session stats include byte/packet/message/record/template rates and counts plus a discard counter; all statistical tables carry a discontinuity timestamp to signal counter resets to the management system.
The Export Table (ipfixExportTable) groups Transport Sessions on an Exporter into Transport Session groups via ipfixExportIndex. Each group member carries a type of unknown(0), primary(1), secondary(2), parallel(3), or loadBalancing(4) to express failover, duplicate export, or load-balancing relationships. This table is not needed on Collectors.
The IPFIX-MIB module (OID mib-2 193) defines two MIB modules: IPFIX-MIB for monitoring IPFIX Exporters and Collectors, and IPFIX-SELECTOR-MIB for standardized filtering and sampling selector functions. The IPFIX-MIB consists of seven main tables plus augmenting statistical tables.
The IPFIX SELECTOR MIB defines the ipfixSelectorFunctions subtree as a placeholder for standard Filtering and Sampling functions. It currently contains only ipfixFuncSelectAll. Each function subtree SHOULD contain an availability TruthValue (ipfixFuncFxAvail) and, if parameterized, an ipfixFuncFxParameters table whose entries are referenced by the Selection Process Table.
The Metering Process Table (ipfixMeteringProcessTable) is indexed by cache IDs and records the Observation Point group reference, active timeout (seconds after which an active Flow is force-expired), and inactive timeout (seconds of no matching packets before expiry). A zero inactive timeout means every packet immediately produces a Data Record.
The Observation Point Table (ipfixObservationPointTable) groups physical Observation Points under an Observation Point Group Id. Each entry references the physical entity via the ENTITY MIB (PhysicalIndexOrZero) or the interface via the IF MIB (InterfaceIndexOrZero) and specifies monitoring direction: unknown(0), ingress(1), egress(2), or both(3).
The Selection Process Table (ipfixSelectionProcessTable) links ordered lists of Selector Functions to a Metering Process cache. Functions are applied in ascending ipfixSelectionProcessSelectorIndex order; each entry points via an OID to either the root of a parameterless function subtree or a specific parameter table entry.
The Template Definition Table (ipfixTemplateDefinitionTable) enumerates, in order, the Information Elements composing each Template or Options Template. Each entry records the IE Id (1–65535), encoded length, enterprise number (0 for IANA-registered IEs), and flags indicating whether the IE is used for scoping or as a Flow Key.
The Template Table (ipfixTemplateTable) lists all Templates and Options Templates transmitted or received, indexed by Transport Session, Observation Domain Id, and Template Id. It records the Set Id (2 for Templates, 3 for Options Templates) and the last access time used to manage UDP template refresh and expiry.
The Transport Session Table (ipfixTransportSessionTable) lists all established Transport Sessions between Exporters and Collectors. Each entry captures transport protocol, source/destination addresses and ports (for TCP/UDP), SCTP association ID, device mode (exporting or collecting), template refresh parameters (UDP only), IPFIX version, and session status (unknown/inactive/active).
The IPFIX SELECTOR MIB module (ipfixSelectorFunctions subtree) is maintained by IANA and extended through Expert Review per RFC 5226. It currently defines only ipfixFuncSelectAll; future standard Filtering and Sampling functions (e.g., from PSAMP) can be added to this subtree.
The IPFIX MIB and IPFIX SELECTOR MIB define read-only objects that expose potentially sensitive operational information about flow export infrastructure (IP addresses, ports, template structures, flow rates). Implementations MUST use SNMPv3 with authentication and privacy to protect management access, applying SNMP access control to restrict which managers can read these objects.