Export of UDP Options Information in IP Flow Information Export (IPFIX)
Extracted elements (16)
SAFE and UNSAFE UDP Options are reported in separate IPFIX IEs (udpSafeOptions and udpUnsafeOptions) rather than a single multiplexed IE. A single IE would require at least 24 octets to cover both Kind ranges, negating the benefits of reduced-size encoding; the split allows mandatory SAFE Options to be reported in as little as one octet.
udpSafeExIDList presence takes precedence over setting the EXP bit in udpSafeOptions for the same Flow. This design avoids redundant signaling and preserves reduced-size encoding benefits, since setting the EXP bit would force a larger encoding even when the ExID list already conveys the information.
udpSafeOptions uses the unsigned256 abstract data type introduced in RFC 9740 (New IPFIX IEs for TCP Options and IPv6 Extension Headers). Implementations must support this new data type to export or collect udpSafeOptions records.
When udpSafeExIDList is present for a Flow, the Exporter MUST NOT set the EXP flag of the udpSafeOptions IE reported for the same Flow to 1, in order to optimize reduced-size encoding.
When udpUnsafeExIDList is present for a Flow, the Exporter MUST NOT set the UEXP flag of the udpUnsafeOptions IE reported for the same Flow to 1, in order to optimize reduced-size encoding.
RFC 9868 reserves Kind=127 (EXP) for SAFE experimental options and Kind=254 (UEXP) for UNSAFE experimental options. Both use 16-bit Experiment Identifiers (ExIDs) to differentiate concurrent experimental option uses; ExIDs are expected to be registered with IANA.
UDP Options (defined in RFC 9868) are placed in the 'surplus area'—the IP payload region following the UDP packet—identified by a 1-byte Kind field. Kind 0-191 are SAFE Options (silently ignorable by legacy receivers); Kind 192-255 are UNSAFE Options (alter UDP user data and must not be silently ignored).
udpExID (ElementID 527) is a 16-bit unsigned identifier IE used to export an observed ExID in an EXP (Kind=127) or UEXP (Kind=254) UDP Option. It serves as the element type within basicList IEs udpSafeExIDList and udpUnsafeExIDList.
udpSafeExIDList (ElementID 528) is a basicList IPFIX IE that exports all ExIDs observed in SAFE Experimental (EXP, Kind=127) Options within a Flow. Each list entry is a udpExID (unsigned16) element.
udpSafeOptions (ElementID 525) is a new IPFIX Information Element that exports observed SAFE UDP Options in a Flow. Options with Kind 0-191 are mapped to bits in an unsigned256 bitmap, with Kind 0 at the least significant bit and Kind 191 at the 65th most significant bit; the 64 most significant bits MUST be set to 0.
udpUnsafeExIDList (ElementID 529) is a basicList IPFIX IE that exports all ExIDs observed in UNSAFE Experimental (UEXP, Kind=254) Options within a Flow. Each list entry is a udpExID (unsigned16) element.
udpUnsafeOptions (ElementID 526) is a new IPFIX IE that exports observed UNSAFE UDP Options (Kind 192-255) in a Flow as a 64-bit bitmap. Kind 192 maps to the least significant bit and Kind 255 to the most significant bit.
This document adds five new Information Elements to the IANA 'IPFIX Information Elements' registry: udpSafeOptions (525), udpUnsafeOptions (526), udpExID (527), udpSafeExIDList (528), and udpUnsafeExIDList (529).
This document introduces no new security considerations beyond those already discussed in RFC 7011 Section 11 and RFC 7012 Section 8. For security considerations specific to UDP Options themselves, readers are referred to RFC 9868 Section 24.
udpSafeOptions uses the abstract data type unsigned256 with flags semantics. Reduced-size encoding per RFC 7011 Section 6.2 is applied, so if only Kinds <= 31 are observed the IE can be encoded as unsigned32; if only Kinds <= 63 are observed, as unsigned64. For mandatory SAFE Options (EOL, APC), one octet suffices.
udpUnsafeOptions uses abstract data type unsigned64 with flags semantics. Reduced-size encoding per RFC 7011 Section 6.2 is applied whenever fewer octets are needed.