IPFIX

Unanswered Question
Nov 3rd, 2008
User Badges:

Hi all, does anyone know much about IPFIX, I have seen it on some Nortel Equipment, I believe its similar to Netflow, When we talk about flows, does this mean showing you the traffics source and destination info ?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Giuseppe Larosa Mon, 11/03/2008 - 10:24
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Carl,

your understanding is correct.


IPFIX is defined in RFC 5101 of January 2008


http://www.ietf.org/rfc/rfc5101.txt


and it is thought to be used for the same purposes as Netflow.

The network device will export flow based statistics data to a Collector.


the flow is defined based on the following:

A Flow is defined as a set of IP packets passing an Observation

Point in the network during a certain time interval. All packets

belonging to a particular Flow have a set of common properties.

Each property is defined as the result of applying a function to

the values of:


1. one or more packet header fields (e.g., destination IP

address), transport header fields (e.g., destination port

number), or application header fields (e.g., RTP header

fields [RFC3550]).


2. one or more characteristics of the packet itself (e.g.,

number of MPLS labels, etc...).

3. one or more of fields derived from packet treatment (e.g.,

next hop IP address, the output interface, etc...).


A packet is defined as belonging to a Flow if it completely

satisfies all the defined properties of the Flow.




Hope to help

Giuseppe


Actions

This Discussion