An Update to the tcpControlBits IP Flow Information Export (IPFIX) Information Element
obsoletes
- rfc-7125 — Revision of the tcpControlBits IP Flow Information Export (IPFIX) Information Element
Extracted elements (13)
Requiring export of all TCP control bits, including unassigned ones, enhances network observability: operators can identify packets with unassigned flags set and detect applications that have not yet been upgraded to reflect changes introduced by documents like RFC 8311.
RFC 7125 updated tcpControlBits to reflect changes since RFC 793, but that revision became problematic because the NS (Nonce Sum) bit was later deprecated by RFC 8311. This document removes stale information and defers to the authoritative 'TCP Header Flags' registry to avoid future conflicts from hardcoding flag definitions in the IPFIX IE.
RFC 9293 introduced 'Bit Offset' as a way to reference each TCP header flag's position within the 16-bit aligned view of the TCP header. This document adopts that bit-offset notation throughout the IE description to align with the authoritative TCP Header Flags registry and remove ambiguity from named-flag references.
Previous revisions of the tcpControlBits definition required that bits at offset positions 8 and 9 be exported as zero even if observed. Collectors should therefore not assume that a value of zero for these bits indicates those bits were never set in observed traffic, especially if they are consistently zero in every Flow Record from a given Exporter.
The 'TCP Header Flags' registry indexes bit offset from the most significant bit of octet 12 to the least significant bit of octet 13 in the TCP header, whereas tcpControlBits is encoded as a regular unsigned 16-bit integer. Implementers must account for this difference when mapping between the two representations.
When tcpControlBits is exported as a single octet using reduced-size encoding (RFC 7011 Section 6.2), only the low-order octet is covered, corresponding to bit offset positions 8 to 15 per the TCP Header Flags registry. A Collector receiving this reduced-size encoding must not assume anything about the content of the four bits at positions 4 to 7.
All TCP control bits, including those that are currently unassigned, MUST be exported as observed in the TCP headers of the packets of a Flow. This stronger requirement replaces the weaker language in RFC 7125.
Exporting Processes acting on behalf of a Metering Process that cannot observe flags at bit offset positions 4 to 7 SHOULD use reduced-size encoding and export only the least significant 8 bits of the tcpControlBits Information Element.
The most significant 4 bits of the tcpControlBits Information Element (corresponding to the TCP Data Offset field) MUST be reported by the Exporter with a value of zero and MUST be ignored by the Collector. The tcpHeaderLength Information Element should be used to encode the TCP header length value instead.
The tcpControlBits IPFIX Information Element (ElementID 6) is an unsigned16 with flags semantics that records all TCP control bits observed for the packets of a Flow. A bit is set to 1 if any observed packet in the Flow has the corresponding TCP control bit set to 1; otherwise it is cleared to 0.
IANA updated the 'tcpControlBits' entry (ElementID 6) in the 'IPFIX Information Elements' registry to reflect the revised definition in Section 3, removing stale flag references and pointing to the authoritative 'TCP Header Flags' registry for current TCP control bit assignments.
Because TCP control bits may be misused in flows such as DDoS attacks, an Exporter must report all observed control bits even if no assigned meaning is associated with a given flag. This document uses stronger normative language than RFC 7125 to ensure full observability of potentially malicious flag patterns.
tcpControlBits is encoded as a regular unsigned 16-bit integer. The most significant 4 bits of octets 12 and 13 of the TCP header carry the Data Offset field, so the corresponding bits (offsets 0–3) in this IE must be zero. The 'TCP Header Flags' registry indexes bits from MSB of octet 12 to LSB of octet 13, which differs from this unsigned 16-bit encoding.