Information Elements for Data Link Layer Traffic Measurement
Extracted elements (30)
Both a full-blob IE (dot1qServiceInstanceTag, 16 octets) and decomposed field IEs (dot1qServiceInstanceId, dot1qServiceInstancePriority, dot1qCustomerSourceMacAddress, dot1qCustomerDestinationMacAddress) are defined for I-TAG to accommodate exporters that parse the TCI in hardware versus those that cannot.
dataLinkFrameType uses bit-flag semantics rather than a simple enumeration so that multiple simultaneous frame type observations can be OR'd into a single IE value without requiring multiple IEs or a new encoding.
The sectionOffset and sectionExportedOctets IEs are defined generically and extended to all existing packet section IEs (ipHeaderPacketSection, ipPayloadPacketSection, mplsLabelStackSection, mplsPayloadPacketSection) to provide a uniform offset mechanism across all layers.
Adding Data Type Semantics 'quantity' to dataLinkFrameSize and extending dataLinkFrameSection with a reference to sectionOffset are both classified as interoperable changes per RFC 7013 Section 5.2 #4, introducing no backward-compatibility issues.
B-TAG (Backbone VLAN Tag) reuses existing dot1qVlanId and dot1qPriority IEs because its structure and semantics are identical to C-TAG and S-TAG. New IEs are required only for I-TAG, whose structure is fundamentally different.
E-channel (E-TAG) and S-channel (S-TAG) frame tags have only local meaning identifying virtual ports; accordingly IPFIX does not need to monitor data based on these tags, and Flows are reported as arriving on the corresponding virtual ports.
If no sectionOffset field corresponding to dataLinkFrameSection is present, a sectionOffset of zero applies, and the octets MUST be from the start of the data link frame.
When sectionExportedOctets does not exist for a packet section IE (dataLinkFrameSection, ipHeaderPacketSection, etc.), the section SHOULD have a variable length and MUST NOT be padded.
When sectionExportedOctets exists and the packet section IE has a fixed length larger than sectionExportedOctets, octets beyond sectionExportedOctets MUST follow RFC 7011 padding rules (zero-valued octets).
dataLinkFrameSection (ElementId 315) carries n octets from the data link frame starting sectionOffset octets into the frame. Abstract Data Type is octetArray. It requires companion IEs dataLinkFrameType and dataLinkFrameSize to fully describe the captured section.
dataLinkFrameSize (ElementId 312) specifies the length of the selected data link frame as unsigned16 with Data Type Semantics of quantity. This document adds the missing Data Type Semantics to the existing IE definition.
dataLinkFrameType (ElementId 408) specifies the type of the selected data link frame as unsigned16 with flags semantics. Defined values: 0x01 = IEEE 802.3 Ethernet, 0x02 = IEEE 802.11 MAC Frame. Additional values may be assigned by IANA.
dot1qCustomerSourceMacAddress (ElementId 414) and dot1qCustomerDestinationMacAddress (ElementId 415) are macAddress IEs carrying the Encapsulated Customer Source Address (C-SA) and Destination Address (C-DA) subfields of the I-TAG TCI field.
dot1qServiceInstanceId (ElementId 412) carries the 24-bit Backbone Service Instance Identifier (I-SID) from the I-TAG TCI field as unsigned32; valid range is 0–16777215.
dot1qServiceInstancePriority (ElementId 413) carries the 3-bit Backbone Service Instance Priority Code Point (I-PCP) from the I-TAG TCI field as unsigned8; valid range is 0–7.
dot1qServiceInstanceTag (ElementId 411) is a 16-octet octetArray representing the full Backbone Service Instance Tag (I-TAG) TCI field of an IEEE 802.1Q Ethernet frame, encoding I-PCP, I-DEI, UCAs, I-SID (24-bit), encapsulated C-DA, and C-SA.
droppedL2OctetDeltaCount (424), droppedL2OctetTotalCount (425), ignoredL2OctetTotalCount (426), and notSentL2OctetTotalCount (427) count L2 octets in packets dropped, ignored, or not sent by the Metering Process; all unsigned64 totalCounter or deltaCounter.
Four incoming layer 2 traffic counters: layer2OctetDeltaCount (352, deltaCounter), layer2OctetTotalCount (353, totalCounter), layer2FrameDeltaCount (430, deltaCounter), and layer2FrameTotalCount (431, totalCounter) — all unsigned64, counting from the Observation Point including L2 headers and payload.
layer2OctetDeltaSumOfSquares (428) and layer2OctetTotalSumOfSquares (429) carry the sum of squared L2 octet counts per packet, enabling variance and standard-deviation computation for L2 flow traffic; analogous to octetDeltaSumOfSquares (198) and octetTotalSumOfSquares (199).
minimumL2TotalLength (422) and maximumL2TotalLength (423) are unsigned64 IEs for the smallest and largest layer 2 packet lengths (header + payload) observed for a Flow; analogous to minimumIpTotalLength (25) and maximumIpTotalLength (26).
Multiple sectionOffset IEs within a single IPFIX Template apply positionally to packet section IEs in declaration order. If there are fewer sectionOffset IEs than packet section IEs, the remaining packet sections have an implied offset of zero; extra sectionOffset IEs beyond the count of packet section IEs are meaningless.
postL2OctetDeltaCount (417) and postL2OctetTotalCount (420) are unsigned64 IEs reporting potentially modified L2 octet counts after a middlebox function, analogous to postOctetDeltaCount (23) and postOctetTotalCount (171) at layer 3.
postMCastL2OctetDeltaCount (418) and postMCastL2OctetTotalCount (421) count layer 2 octets in outgoing multicast packets for a Flow; these may not be observable at the Observation Point and may need to be retrieved by other means.
sectionExportedOctets (ElementId 410) is an unsigned16 specifying the observed length of the exported packet section when padding is present; the packet section field may be fixed-length but contain fewer meaningful octets than its allocated size.
sectionOffset (ElementId 409) specifies the offset in octets into a packet section IE (dataLinkFrameSection, ipHeaderPacketSection, ipPayloadPacketSection, mplsLabelStackSection, mplsPayloadPacketSection). Encoded as unsigned16; defaults to zero if omitted.
IANA's IPFIX registry was updated to add 20 new Information Elements (ElementIds 408–415, 417–418, 420–429) and to modify existing IEs 312, 313, 314, 315, 316, 317, 243, 244, 245, 246. Each modified IE had its Revision incremented and Requester updated to RFC 7133.
Reporting more granular data link layer information may increase the risk of DoS attacks against a Collector. Protection is discussed in RFC 7011 Section 11.4; this document introduces no additional security issues beyond those already covered by RFC 7011 and RFC 5477.
E-TAG (TPID=0x893F) encodes E-PCP (3 bits), DEI (1 bit), Ingress_E-CID_base (12 bits), Res (2 bits), GRP (2 bits), E-CID_base (12 bits), Ingress_E-CID_ext (8 bits), and E-CID_ext (8 bits) to identify virtual ports in Bridge Port Extension environments.
S-TAG uses TPID=0x88a8 with S-PCP (3 bits), DEI (1 bit), and S-VID (12 bits); C-TAG uses TPID=0x8100 with C-PCP (3 bits), DEI (1 bit), and C-VID (12 bits); B-TAG uses TPID=0x88a8 with the same sub-field layout as S-TAG (B-PCP, B-DEI, B-VID).
The Backbone Service Instance Tag (I-TAG) on-wire format is 16 octets: TPID=0x88e7 (16 bits), I-PCP (3 bits), I-DEI (1 bit), UCAs (1 bit), reserved (3 bits), I-SID (24 bits), encapsulated C-DA (48 bits), and encapsulated C-SA (48 bits), as shown in Figure A-5.