Export of BGP Community Information in IP Flow Information Export (IPFIX)
Extracted elements (21)
BGP community granularity fills a gap between per-IP-address (too fine) and per-ASN (too coarse) traffic analysis, enabling operators to measure and engineer traffic at the level of customer groups, service types, or geographical regions as defined by their BGP community plans.
The Exporter is the preferred entity to export BGP community information rather than an IPFIX Mediator or Collector, because the Exporter already holds the up-to-date BGP routing table and performs lookups for existing BGP-related IEs; the additional load of exporting community information is minimal. Correlation on the Exporter is also more accurate since the BGP routing table may be updated by the time Collectors receive the flow information.
This document does not update the IPFIX protocol specification (RFC 7011) or information model (RFC 7012); the new IEs are added only to the 'IPFIX Information Elements' registry. Both Exporters and IPFIX Mediators may use the new IEs.
A Collector that receives an IPFIX message at maximum length with BGP communities in its data set SHOULD generate a warning or log message indicating that BGP communities may be truncated.
BGP speakers that support extended BGP messages (up to 65535 bytes) SHOULD convey only as many communities as fit within the 65535-byte IPFIX message limit.
It is RECOMMENDED that BGP community information be exported by the Exporter directly using IPFIX rather than through an IPFIX Mediator.
The Exporter SHOULD obtain BGP community information via a BGP lookup using the source or destination IP address of the flow, and SHOULD include the corresponding BGP communities in the IPFIX message when exporting.
The size of the bgpExtendedCommunity IE MUST be 8 octets; if not, the IPFIX Collector SHOULD ignore it to protect BGP parsing routines from invalid lengths.
The size of the bgpLargeCommunity IE MUST be 12 octets; if not, the IPFIX Collector SHOULD ignore it.
bgpCommunity (ElementID 483) is a new IPFIX IE of type unsigned32 with identifier semantics, used to carry a single BGP Standard Community value as defined in RFC 1997.
bgpDestinationCommunityList (ElementID 485) is a basicList of bgpCommunity IEs carrying all BGP Standard Communities corresponding to a specific flow's destination IP address.
bgpExtendedCommunity (ElementID 486) is a new IPFIX IE of type octetArray used to carry a single BGP Extended Community as defined in RFC 4360; its size MUST be 8 octets.
bgpLargeCommunity (ElementID 489) is a new IPFIX IE of type octetArray used to carry a single BGP Large Community as defined in RFC 8092; its size MUST be 12 octets.
bgpSourceCommunityList (ElementID 484) is a basicList of bgpCommunity IEs carrying all BGP Standard Communities corresponding to a specific flow's source IP address.
bgpSourceExtendedCommunityList (ElementID 487) and bgpDestinationExtendedCommunityList (ElementID 488) are basicList IEs of bgpExtendedCommunity, carrying BGP Extended Communities for a flow's source and destination IP address respectively.
bgpSourceLargeCommunityList (ElementID 490) and bgpDestinationLargeCommunityList (ElementID 491) are basicList IEs of bgpLargeCommunity, carrying BGP Large Communities for a flow's source and destination IP address respectively.
This document assigns nine new ElementIDs (483–491) in the IANA 'IPFIX Information Elements' registry for bgpCommunity, bgpSourceCommunityList, bgpDestinationCommunityList, bgpExtendedCommunity, bgpSourceExtendedCommunityList, bgpDestinationExtendedCommunityList, bgpLargeCommunity, bgpSourceLargeCommunityList, and bgpDestinationLargeCommunityList.
BGP communities can be used as an attack vector ('weaponizing BGP'); systems processing IPFIX-collected BGP community information MUST NOT blindly trust it. It is RECOMMENDED to use only community information from consecutive neighboring ASes within the same trust domain as the processing system.
The same security considerations from the IPFIX protocol specification (RFC 7011) and information model (RFC 7012) apply, including protections for stored flow data and mechanisms for confidentiality, integrity, and authentication of IPFIX data transfers.
bgpCommunity is encoded as a 32-bit unsigned integer (4 octets) per RFC 1997. bgpExtendedCommunity is encoded as an 8-octet array per RFC 4360. bgpLargeCommunity is encoded as a 12-octet array per RFC 8092.
Community list IEs (bgpSourceCommunityList, bgpDestinationCommunityList, etc.) use the basicList format from RFC 6313, with field length 0xFFFF in the IPFIX template record to indicate variable length; the actual length is given by the List Length field in the basicList structure.