Information Model for IP Flow Information Export

Abstract

Information Model for IP Flow Information Export Status of This MemoThis document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. AbstractThis memo defines an information model for the IP Flow Information eXport (IPFIX) protocol. It is used by the IPFIX protocol for encoding measured traffic information and information related to the traffic Observation Point, the traffic Metering Process, and the Exporting Process. Although developed for the IPFIX protocol, the model is defined in an open way that easily allows using it in other protocols, interfaces, and applications.

IP Flow Anonymization Support

“…See [RFC5101] for more information. The IPFIX information model [RFC5102] defines a large number of standard Information Elements (IEs) that provide the necessary { type } information for Templates. The use of standard elements enables interoperability among different vendors' implementations.…”

“…"Information Model for IP Flow Information Export" [RFC5102] describes the Information Elements used by IPFIX, including details on Information Element naming, numbering, and data type encoding. Finally, "IP Flow Information Export (IPFIX) Applicability" [RFC5472] describes the various applications of the IPFIX protocol and their use of information exported via IPFIX and relates the IPFIX architecture to other measurement architectures and frameworks.…”

“…It then describes the applicability of each technique to commonly anonymizable fields of IP flow data, organized by information element data type and semantics as in [RFC5102]; enumerates the parameters required by each of the applicable anonymization techniques; and provides guidelines for the use of each of these techniques in accordance with current best practices in data protection. Finally, it specifies a mechanism for exporting anonymized data and binding anonymization metadata to Templates and Options Templates using IPFIX Options.…”

Gathering Sensor Data in Home Networks with IPFIX

“…IPFIX standardized several IDs which are necessary to exchange traffic measurement data like sourceIPv4Address or destinationIPv4Address. The ID field consists of 16 Bits, where IDs 1-32767 are reserved for these traffic measurement data types [21].…”

Real-Time and Resilient Intrusion Detection: A Flow-Based Approach

“…Exporters send flow records to Collectors after expiration. Several expiration rules can be implemented [1,8], but timeout-based expiration rules are required. As a consequence, data analysis applications, which retrieve flow data from a Collector, always receive the data after a certain delay.…”