Configuration Data Model for the IP Flow Information Export (IPFIX) and Packet Sampling (PSAMP) Protocols
Extracted elements (30)
Consistency between the configuration data model and the IPFIX MIB module (RFC 6615) and PSAMP MIB module (RFC 6727) is an explicit design goal. Parameters in the data model are named to match corresponding MIB managed objects, and certain IPFIX MIB state objects are adopted as read-only state parameters.
Incomplete configurations—where a functional block lacks a reference to a downstream block (e.g., a SelectionProcess without a Cache reference)—are intentionally not treated as invalid. This allows multi-step configuration and pre-configuration of device functions; absent output references cause output to be dropped without error.
The Metering Process is decomposed into two independently configurable functional blocks: a Selection Process (handles packet sampling and filtering) and a Cache (generates Flow Records or Packet Reports). This separation enables flexible combination of these blocks and supports both IPFIX and PSAMP deployments.
YANG (RFC 6020) is used as the formal specification language to ensure NETCONF compatibility, while UML class diagrams serve as human-readable documentation. The YANG module can be converted to XML Schema or DSDL using tools such as pyang.
A CacheField with ieEnterpriseNumber set to 29305 denotes a Reverse Information Element for bidirectional flow export. When such fields are present, the Cache MUST generate Data Records in accordance with RFC 5103.
The ExportingProcess exportMode values map to the IPFIX MIB ipfixExportMemberType object: "parallel" → parallel(3), "loadBalancing" → loadBalancing(4), "fallback" → primary(1) for the first destination and secondary(2) for remaining ones. The IPFIX MIB defines no value for tertiary or further fallback destinations.
A Cache MUST NOT aggregate packets observed at different Observation Domains into the same Flow. When a Cache is configured to receive packets from multiple Observation Domains, it must maintain distinct Flow Records per Observation Domain.
For flow-generating Caches (TimeoutCache, NaturalCache, PermanentCache), every Flow Key field in the CacheLayout MUST be included in the Flow Record unless not applicable. A CacheField whose ieEnterpriseNumber is 29305 (Reverse Information Element) MUST NOT be configured as a Flow Key.
For ImmediateCache (Packet Report generation), every field specified in the CacheLayout MUST be included in the resulting Packet Report unless the corresponding Information Element is not applicable or cannot be derived from the incoming packet.
For parameters with the {opt.} property (device-set optional), the Monitoring Device MUST set an appropriate value at configuration time, and that value MUST NOT subsequently be changed by the device. The user MUST NOT expect a static device-specific default.
If a parameter has a specified default value and is not explicitly configured by the user, the Monitoring Device MUST use that default value.
If maxFlows is configured on a Cache, the Monitoring Device MUST ensure sufficient resources are available to store the configured maximum number of simultaneous Flows.
Interface indices (ifIndex) and physical entity indices (entPhysicalIndex) SHOULD only be used as ObservationPoint identifiers when an SNMP agent on the same Monitoring Device enables access to the corresponding IF-MIB or ENTITY-MIB tables.
Name key values used as identifiers in UML associations and multi-occurrence aggregations MUST be unique within the given XML subtree. This uniqueness requirement is mandated by YANG for list keys and enables individual NETCONF addressability.
The templateRefreshTimeout and optionsTemplateRefreshTimeout values configured in the UdpExporter MUST be adapted to match the templateLifeTime and optionsTemplateLifeTime settings at the receiving Collecting Process to avoid template expiry.
When SctpExporter timedReliability is set to zero, reliable SCTP transport MUST be used for all Data Records. Regardless of timedReliability, the Exporting Process MAY use reliable transport for Data Sets associated with certain Options Templates.
The Cache class has four subtypes with distinct expiration semantics: ImmediateCache (one Packet Report per arriving packet), TimeoutCache (flow expires on active or idle timeout), NaturalCache (timeout or natural termination such as TCP FIN/RST), and PermanentCache (flows never expire; periodically exported at exportInterval). Each subtype aggregates a CacheLayout.
The CacheLayout class defines the superset of fields in Packet Reports or Flow Records via one or more CacheField objects. Each CacheField specifies an Information Element by ieId or ieName plus ieEnterpriseNumber (default 0 for IANA-registered IEs), an optional ieLength (65535 for variable-length), and an optional isFlowKey flag unavailable on ImmediateCache.
The CollectingProcess class configures a Collecting Process accepting IPFIX messages via SctpCollector, UdpCollector, TcpCollector, or FileReader subclasses. A CollectingProcess object may reference one or more ExportingProcess objects, enabling re-export or file-writing of received IPFIX Messages.
The ExportingProcess class supports three export modes: "parallel" (all destinations receive every record), "loadBalancing" (device-specific policy), and "fallback" (ordered primary/secondary/tertiary failover). Default is "parallel". The order of Destination objects is significant only in fallback mode.
The FilterHash class configures hash-based packet filtering with parameters: hashFunction (BOB, IPSX, or CRC; default BOB), initializerValue, ipPayloadOffset (default 0), ipPayloadSize (default 8 bytes), and digestOutput. One or more SelectedRange sub-objects define accepted hash value ranges via min/max.
The ObservationPoint class specifies a monitoring location via interface name or index (ifName/ifIndex) or physical entity name or index (entPhysicalName/entPhysicalIndex), an observationDomainId, and a traffic direction parameter ("ingress", "egress", or "both"; default "both"). observationPointId is a read-only state parameter assigned by the device.
The SctpExporter class configures SCTP export with timedReliability (PR-SCTP lifetime in milliseconds for Data-Set-only messages; 0 forces fully reliable transport), optional DTLS via TransportLayerSecurity, rateLimit, and sendBufferSize. Default destination ports are 4739 (without TLS) and 4740 (with TLS/DTLS).
The SelectionProcess class contains an ordered list of one or more Selector objects applied sequentially to the packet stream. It carries read-only SelectionSequence state as a list of (observationDomainId, selectionSequenceId) tuples assigned by the Monitoring Device, enabling correlation with PSAMP protocol Selection Sequence report interpretations.
The Selector class wraps exactly one sampling or filtering method—SelectAll, SampCountBased, SampTimeBased, SampRandOutOfN, SampUniProb, FilterMatch, or FilterHash—and exposes read-only aggregate statistics: packetsObserved, packetsDropped, and selectorDiscontinuityTime (absolute timestamp, not relative to sysUpTime).
The TransportLayerSecurity class enables and configures TLS (for TCP) or DTLS (for SCTP/UDP) on an export or collect destination. It is an optional aggregate sub-object of the transport-specific exporter and collector classes, covering certificate, private key, and CA configuration.
The UdpCollector class includes templateLifeTime and optionsTemplateLifeTime parameters specifying how long (Options) Templates received from a UDP exporter remain valid. These must be coordinated with the corresponding refresh timeout settings on the sending UdpExporter.
The UdpExporter class includes four template refresh parameters: templateRefreshTimeout and optionsTemplateRefreshTimeout (both default 600 s) control time-based periodic resending of Templates and Options Templates; templateRefreshPacket and optionsTemplateRefreshPacket optionally trigger resending after a given count of IPFIX Messages.
This document registers the YANG module "ietf-ipfix-psamp" in the IANA YANG Module Names registry with namespace urn:ietf:params:xml:ns:yang:ietf-ipfix-psamp and prefix "ipfix".
The IPFIX/PSAMP YANG module controls sensitive configuration data including export destinations, TLS credentials, and rate limits. NETCONF sessions carrying this data MUST be protected using SSH or TLS as required by RFC 6241. Unauthorized write access could redirect or disable traffic monitoring; unauthorized read access could expose network topology and measurement policy.