<pre>Internet Engineering Task Force (IETF)                     T. Dietz, Ed.
Request for Comments: 5815                              NEC Europe, Ltd.
Category: Standards Track                                   A. Kobayashi
ISSN: 2070-1721                                             NTT PF Labs.
                                                               B. Claise
                                                     Cisco Systems, Inc.
                                                                G. Muenz
                                        Technische Universitaet Muenchen
                                                              April 2010


     <span class="h1">Definitions of Managed Objects for IP Flow Information Export</span>

Abstract

   This document defines managed objects for IP Flow Information eXport
   (IPFIX).  These objects provide information for monitoring IPFIX
   Exporters and IPFIX Collectors including the basic configuration
   information.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in <a href="./rfc5741#section-2">Section&nbsp;2 of RFC 5741</a>.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   <a href="http://www.rfc-editor.org/info/rfc5815">http://www.rfc-editor.org/info/rfc5815</a>.

Copyright Notice

   Copyright (c) 2010 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.



<span class="grey">Dietz, et al.                Standards Track                    [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


Table of Contents

   <a href="#section-1">1</a>. Introduction ....................................................<a href="#page-3">3</a>
   <a href="#section-2">2</a>. IPFIX Documents Overview ........................................<a href="#page-3">3</a>
   <a href="#section-3">3</a>. The Internet-Standard Management Framework ......................<a href="#page-4">4</a>
   <a href="#section-4">4</a>. Terminology .....................................................<a href="#page-4">4</a>
   <a href="#section-5">5</a>. Structure of the IPFIX MIB ......................................<a href="#page-4">4</a>
      <a href="#section-5.1">5.1</a>. The Transport Session Table ................................<a href="#page-4">4</a>
      <a href="#section-5.2">5.2</a>. The Template Table .........................................<a href="#page-7">7</a>
      <a href="#section-5.3">5.3</a>. The Template Definition Table ..............................<a href="#page-9">9</a>
      <a href="#section-5.4">5.4</a>. The Export Table ..........................................<a href="#page-11">11</a>
      <a href="#section-5.5">5.5</a>. The Metering Process Table ................................<a href="#page-12">12</a>
      <a href="#section-5.6">5.6</a>. The Observation Point Table ...............................<a href="#page-13">13</a>
      <a href="#section-5.7">5.7</a>. The Selection Process Table ...............................<a href="#page-14">14</a>
      <a href="#section-5.8">5.8</a>. The Statistical Tables ....................................<a href="#page-15">15</a>
           <a href="#section-5.8.1">5.8.1</a>. The Transport Session Statistical Table ............<a href="#page-15">15</a>
           <a href="#section-5.8.2">5.8.2</a>. The Template Statistical Table .....................<a href="#page-15">15</a>
           <a href="#section-5.8.3">5.8.3</a>. The Metering Process Statistical Table .............<a href="#page-15">15</a>
           <a href="#section-5.8.4">5.8.4</a>. The Selection Process Statistical Table ............<a href="#page-15">15</a>
   <a href="#section-6">6</a>. Structure of the IPFIX SELECTOR MIB ............................<a href="#page-15">15</a>
      <a href="#section-6.1">6.1</a>. The Selector Functions ....................................<a href="#page-16">16</a>
   <a href="#section-7">7</a>. Relationship to Other MIB Modules ..............................<a href="#page-18">18</a>
      <a href="#section-7.1">7.1</a>. Relationship to the ENTITY MIB and IF MIB .................<a href="#page-18">18</a>
      <a href="#section-7.2">7.2</a>. MIB Modules Required for IMPORTS ..........................<a href="#page-18">18</a>
   <a href="#section-8">8</a>. MIB Definitions ................................................<a href="#page-18">18</a>
      <a href="#section-8.1">8.1</a>. IPFIX MIB Definition ......................................<a href="#page-19">19</a>
      <a href="#section-8.2">8.2</a>. IPFIX SELECTOR MIB Definition .............................<a href="#page-56">56</a>
   <a href="#section-9">9</a>. Security Considerations ........................................<a href="#page-60">60</a>
   <a href="#section-10">10</a>. IANA Considerations ...........................................<a href="#page-61">61</a>
   <a href="#section-11">11</a>. Acknowledgments ...............................................<a href="#page-61">61</a>
   <a href="#section-12">12</a>. References ....................................................<a href="#page-62">62</a>
      <a href="#section-12.1">12.1</a>. Normative References .....................................<a href="#page-62">62</a>
      <a href="#section-12.2">12.2</a>. Informative References ...................................<a href="#page-63">63</a>


















<span class="grey">Dietz, et al.                Standards Track                    [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>.  Introduction</span>

   This document defines two MIB modules for monitoring IP Flow
   Information eXport (IPFIX) Devices including Exporters and
   Collectors.  Most of the objects defined by the IPFIX MIB module MUST
   be implemented.  Some objects MAY be implemented corresponding to the
   functionality implemented in the equipment.  Since the IPFIX
   architecture [<a href="./rfc5470" title="&quot;Architecture for IP Flow Information Export&quot;">RFC5470</a>] foresees the possibility of using Filtering
   and/or Sampling functions to reduce the data volume, this document
   also provides the IPFIX SELECTOR MIB module, which contains the
   standardized selection methods and is controlled by IANA.  The full
   configuration of the IPFIX Metering Process is out of the scope of
   these MIB modules.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in <a href="./rfc2119">RFC 2119</a> [<a href="./rfc2119" title="&quot;Key words for use in RFCs to Indicate Requirement Levels&quot;">RFC2119</a>].

<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>.  IPFIX Documents Overview</span>

   The IPFIX protocol provides network administrators with access to IP
   Flow information.  The architecture for the export of measured IP
   Flow information out of an IPFIX Exporting Process to a Collecting
   Process is defined in [<a href="./rfc5470" title="&quot;Architecture for IP Flow Information Export&quot;">RFC5470</a>], per the requirements defined in
   [<a href="./rfc3917" title="&quot;Requirements for IP Flow Information Export (IPFIX)&quot;">RFC3917</a>].  The protocol document [<a href="./rfc5101" title="&quot;Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information&quot;">RFC5101</a>] specifies how IPFIX Data
   Records and Templates are carried via a congestion-aware transport
   protocol from IPFIX Exporting Processes to IPFIX Collecting
   Processes.  IPFIX has a formal description of IPFIX Information
   Elements, their name, type and additional semantic information, as
   specified in [<a href="./rfc5102" title="&quot;Information Model for IP Flow Information Export&quot;">RFC5102</a>].  Finally, [<a href="./rfc5472" title="&quot;IP Flow Information Export (IPFIX) Applicability&quot;">RFC5472</a>] describes what type of
   applications can use the IPFIX protocol and how they can use the
   information provided.  It furthermore shows how the IPFIX framework
   relates to other architectures and frameworks.

   It is assumed that Flow metering, export, and collection is performed
   according to the IPFIX architecture defined in [<a href="./rfc5470" title="&quot;Architecture for IP Flow Information Export&quot;">RFC5470</a>].  The
   monitored configuration parameters of the export and collection of
   Flow Templates and Data Records is modeled according to [<a href="./rfc5101" title="&quot;Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information&quot;">RFC5101</a>].
   Packet selection methods that may be optionally used by the IPFIX
   Metering Process are not considered in this MIB module.  They are
   defined in the Packet Sampling (PSAMP) framework [<a href="./rfc5474" title="&quot;A Framework for Packet Selection and Reporting&quot;">RFC5474</a>] and
   Sampling techniques [<a href="./rfc5475" title="&quot;Sampling and Filtering Techniques for IP Packet Selection&quot;">RFC5475</a>] documents.  Nevertheless, the basis for
   defining Sampling and Filtering functions is given with the IPFIX
   SELECTOR MIB module.  Since the PSAMP export protocol [<a href="./rfc5476" title="&quot;Packet Sampling (PSAMP) Protocol Specifications&quot;">RFC5476</a>] is
   based on the IPFIX protocol, the Sampling and Filtering functions can
   be added to the IPFIX SELECTOR MIB module as needed.





<span class="grey">Dietz, et al.                Standards Track                    [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>.  The Internet-Standard Management Framework</span>

   For a detailed overview of the documents that describe the current
   Internet-Standard Management Framework, please refer to <a href="./rfc3410#section-7">section&nbsp;7 of
   RFC 3410</a> [<a href="./rfc3410" title="&quot;Introduction and Applicability Statements for Internet- Standard Management Framework&quot;">RFC3410</a>].

   Managed objects are accessed via a virtual information store, termed
   the Management Information Base or MIB.  MIB objects are generally
   accessed through the Simple Network Management Protocol (SNMP).
   Objects in the MIB are defined using the mechanisms defined in the
   Structure of Management Information (SMI).  This memo specifies MIB
   modules that are compliant to the SMIv2, which is described in STD
   58, <a href="./rfc2578">RFC 2578</a> [<a href="./rfc2578" title="&quot;Structure of Management Information Version 2 (SMIv2)&quot;">RFC2578</a>], STD 58, <a href="./rfc2579">RFC 2579</a> [<a href="./rfc2579" title="&quot;Textual Conventions for SMIv2&quot;">RFC2579</a>] and STD 58, <a href="./rfc2580">RFC</a>
   <a href="./rfc2580">2580</a> [<a href="./rfc2580" title="&quot;Conformance Statements for SMIv2&quot;">RFC2580</a>].

<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>.  Terminology</span>

   The definitions of the basic terms like IP Traffic Flow, Exporting
   Process, Collecting Process, Observation Points, etc. can be found in
   the IPFIX protocol document [<a href="./rfc5101" title="&quot;Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information&quot;">RFC5101</a>].

<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>.  Structure of the IPFIX MIB</span>

   The IPFIX MIB module consists of seven main tables, the Transport
   Session table, the Template table and the corresponding Template
   Definition table, the Export table, the Metering Process table, the
   Observation Point table, and the Selection Process table.  Since the
   IPFIX architecture [<a href="./rfc5470" title="&quot;Architecture for IP Flow Information Export&quot;">RFC5470</a>] foresees the possibility of using
   Filtering and/or Sampling functions to reduce the data volume, the
   MIB module provides the basic objects for these functions with the
   Selection Process table.  The IPFIX SELECTOR MIB module defined in
   the next section provides the standard Filtering and Sampling
   functions that can be referenced in the ipfixSelectionProcessTable.

   All remaining objects contain statistical values for the different
   tables contained in the MIB module.

   The following subsections describe all tables in the IPFIX MIB
   module.

<span class="h3"><a class="selflink" id="section-5.1" href="#section-5.1">5.1</a>.  The Transport Session Table</span>

   The Transport Session is the basis of the MIB module.  The Transport
   Session table (ipfixTransportSessionTable) contains all Transport
   Sessions between Exporter and Collector.  The table specifies the
   transport layer protocol of the Transport Session and, depending on
   that protocol, further parameters for the Transport Session.  In the
   case of UDP and TCP, these are the source and destination address as



<span class="grey">Dietz, et al.                Standards Track                    [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   well as the source and destination port.  For Stream Control
   Transmission Protocol (SCTP), the table contains the SCTP Assoc Id,
   which is the index for the SCTP association in the SCTP MIB module
   [<a href="./rfc3873" title="&quot;Stream Control Transmission Protocol (SCTP) Management Information Base (MIB)&quot;">RFC3873</a>].  The mode of operation of the device, i.e., if the
   Transport Session is used for collecting or exporting is given in the
   ipfixTransportSessionDeviceMode object.  Further on, it contains the
   configured refresh parameters for Templates and Options Templates
   that are used across unreliable connections as UDP.  Finally, the
   IPFIX version that is exported or collected by this Transport Session
   and a status of the Transport Session is given in the table.

   To illustrate the use of the above tables, let us assume the
   following scenario: we have an Exporter on IP address 192.0.2.22 and
   a Collector on IP address 192.0.2.37.  The Exporter uses TCP to
   export Templates and Data Records.  The same Exporter also exports,
   with UDP, to a Collector with the IP address of 192.0.2.44.  This
   would lead to the following Transport Session table on the Exporter:


































<span class="grey">Dietz, et al.                Standards Track                    [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


    ipfixTransportSessionTable (1)
    |
    +- ipfixTransportSessionEntry (1)
       |
       +- index (5) (ipfixTransportSessionIndex)
       |  +- ipfixTransportSessionIndex (1) = 5
       |  +- ipfixTransportSessionProtocol (2) = 6 (TCP)
       |  +- ipfixTransportSessionSourceAddressType (3) = 1 (ipv4)
       |  +- ipfixTransportSessionSourceAddress (4) = 192.0.2.22
       |  +- ipfixTransportSessionDestinationAddressType (5) = 1 (ipv4)
       |  +- ipfixTransportSessionDestinationAddress (6) = 192.0.2.37
       |  +- ipfixTransportSessionSourcePort (7) = 7653
       |  +- ipfixTransportSessionDestinationPort (8) = 4739
       |  +- ipfixTransportSessionSctpAssocId (9) = 0
       |  +- ipfixTransportSessionDeviceMode (10) = exporting(1)
       |  +- ipfixTransportSessionTemplateRefreshTimeout (11) = 0
       |  +- ipfixTransportSessionOptionTemplateRefreshTimeout (12) = 0
       |  +- ipfixTransportSessionTemplateRefreshPacket (13) = 0
       |  +- ipfixTransportSessionOptionTemplateRefreshPacket (14) = 0
       |  +- ipfixTransportSessionIpfixVersion (15) = 10
       |  +- ipfixTransportSessionStatus (16) = 2 (active)
       .
       .
       .
       +- index (11) (ipfixTransportSessionIndex)
          +- ipfixTransportSessionIndex (1) = 11
          +- ipfixTransportSessionProtocol (2) = 17 (UDP)
          +- ipfixTransportSessionSourceAddressType (3) = 1 (ipv4)
          +- ipfixTransportSessionSourceAddress (4) = 192.0.2.22
          +- ipfixTransportSessionDestinationAddressType (5) = 1 (ipv4)
          +- ipfixTransportSessionDestinationAddress (6) = 192.0.2.44
          +- ipfixTransportSessionSourcePort (7) = 14287
          +- ipfixTransportSessionDestinationPort (8) = 4739
          +- ipfixTransportSessionSctpAssocId (9) = 0
          +- ipfixTransportSessionDeviceMode (10) = exporting(1)
          +- ipfixTransportSessionTemplateRefreshTimeout (11) = 100
          +- ipfixTransportSessionOptionTemplateRefreshTimeout (12)
          |                                                     = 100
          +- ipfixTransportSessionTemplateRefreshPacket (13) = 10
          +- ipfixTransportSessionOptionTemplateRefreshPacket (14) = 10
          +- ipfixTransportSessionIpfixVersion (15) = 10
          +- ipfixTransportSessionStatus (16) = 2 (active)

   The values in brackets are the OID numbers.  The Collectors would
   then have the same entry except that the index would most likely
   differ and the ipfixTransportSessionDeviceMode would be
   collecting(2).




<span class="grey">Dietz, et al.                Standards Track                    [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


<span class="h3"><a class="selflink" id="section-5.2" href="#section-5.2">5.2</a>.  The Template Table</span>

   The Template table lists all Templates (including Options Templates)
   that are sent (by an Exporter) or received (by a Collector).  The
   (Options) Templates are unique per Transport Session, which also
   gives the device mode (Exporter or Collector) and Observation Domain;
   thus, the table is indexed by:

   o  the Transport Session Index (ipfixTransportSessionIndex)

   o  and the Observation Domain Id (ipfixTemplateObservationDomainId).

   It contains the Set Id and an access time denoting the time when the
   (Options) Template was last sent or received.

   To resume the above example, the Exporter may want to export a
   Template and an Options Template for each Transport Session defined
   above.  This leads to the following Template table defining Template
   and Options Template:
































<span class="grey">Dietz, et al.                Standards Track                    [Page 7]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-8" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


    ipfixTemplateTable (3)
    |
    +- ipfixTemplateEntry (1)
       |
       +- index (5) (ipfixTransportSessionIndex)
       |  +- index (3) (ipfixTemplateObservationDomainId)
       |     + index (257) (ipfixTemplateId)
       |     | +- ipfixTemplateObservationDomainId (1) = 3
       |     | +- ipfixTemplateId (2) = 257
       |     | +- ipfixTemplateSetId (3) = 2
       |     | +- ipfixTemplateAccessTime (4)
       |     |                             = 2008-7-1,12:49:11.2,+2:0
       |     |
       |     + index (264) (ipfixTemplateId)
       |       +- ipfixTemplateObservationDomainId (1) = 3
       |       +- ipfixTemplateId (2) = 264
       |       +- ipfixTemplateSetId (3) = 3
       |       +- ipfixTemplateAccessTime (4)
       .                                   = 2008-7-1,12:47:04.8,+2:0
       .
       .
       .
       +- index (11) (ipfixTransportSessionIndex)
          +- index (3) (ipfixTemplateObservationDomainId)
             + index (273) (ipfixTemplateId)
             | +- ipfixTemplateObservationDomainId (1) = 3
             | +- ipfixTemplateId (2) = 273
             | +- ipfixTemplateSetId (3) = 2
             | +- ipfixTemplateAccessTime (4)
             |                             = 2008-7-1,12:49:11.2,+2:0
             |
             + index (289) (ipfixTemplateId)
               +- ipfixTemplateObservationDomainId (1) = 3
               +- ipfixTemplateId (2) = 289
               +- ipfixTemplateSetId (3) = 3
               +- ipfixTemplateAccessTime (4)
                                           = 2008-7-1,12:47:04.8,+2:0

   We assume that the Transport Session that is stored with index 5 in
   the Transport Session table of the Exporter is stored with index 17
   in the Transport Session table of the (corresponding) Collector.
   Then, the Template table would look as follows:









<span class="grey">Dietz, et al.                Standards Track                    [Page 8]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-9" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


    ipfixTemplateTable (3)
    |
    +- ipfixTemplateEntry (1)
       |
       +- index (17) (ipfixTransportSessionIndex)
          +- index (3) (ipfixTemplateObservationDomainId)
             + index (257) (ipfixTemplateId)
             | +- ipfixTemplateObservationDomainId (1) = 3
             | +- ipfixTemplateId (2) = 257
             | +- ipfixTemplateSetId (3) = 2
             | +- ipfixTemplateAccessTime (4)
             |                             = 2008-7-1,12:49:11.8,+2:0
             |
             + index (264) (ipfixTemplateId)
               +- ipfixTemplateObservationDomainId (1) = 3
               +- ipfixTemplateId (2) = 264
               +- ipfixTemplateSetId (3) = 3
               +- ipfixTemplateAccessTime (4)
                                           = 2008-7-1,12:47:05.3,+2:0

   The table on the second Collector would be analogous to the one shown
   above.

<span class="h3"><a class="selflink" id="section-5.3" href="#section-5.3">5.3</a>.  The Template Definition Table</span>

   The Template Definition table lists all the Information Elements
   contained in a Template or Options Template.  Therefore, it has the
   same indexes as the corresponding Template table plus the Template
   Id.  Its own index denotes the order of the Information Element
   inside the Template.  Besides the Information Element Id and the
   length of the encoded value, the table contains the enterprise number
   for enterprise-specific Information Elements and flags for each
   Information Element.  The flags indicate if the Information Element
   is used for scoping or as a Flow Key.

   To resume the above example again, the Exporter is configured to
   export the octets received and dropped at the Observation Point since
   the last export of these values.  In addition, it exports the start
   and end time of the Flow relative to the timestamp contained in the
   IPFIX header.  This leads to the following Template Definition table
   on the Exporter:










<span class="grey">Dietz, et al.                Standards Track                    [Page 9]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-10" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


    ipfixTemplateDefinitionTable (4)
    |
    +- ipfixTemplateDefinitionEntry (1)
       |
       +- index (5) (ipfixTransportSessionIndex)
          +- index (3) (ipfixTemplateObservationDomainId)
             + index (257) (ipfixTemplateId)
               +- index (1) (ipfixTemplateDefinitionIndex)
               |  +- ipfixTemplateDefinitionIndex (1) = 1
               |  +- ipfixTemplateDefinitionIeId (2) = 158
               |  |                      (flowStartDeltaMicroseconds)
               |  +- ipfixTemplateDefinitionIeLength (3) = 4
               |  +- ipfixTemplateDefinitionEnterprise (4) = 0
               |  +- ipfixTemplateDefinitionFlags (5) = 0
               |
               +- index (2) (ipfixTemplateDefinitionIndex)
               |  +- ipfixTemplateDefinitionIndex (1) = 2
               |  +- ipfixTemplateDefinitionIeId (2) = 159
               |  |                      (flowEndDeltaMicroseconds)
               |  +- ipfixTemplateDefinitionIeLength (3) = 4
               |  +- ipfixTemplateDefinitionEnterprise (4) = 0
               |  +- ipfixTemplateDefinitionFlags (5) = 0
               |
               +- index (3) (ipfixTemplateDefinitionIndex)
               |  +- ipfixTemplateDefinitionIndex (1) = 3
               |  +- ipfixTemplateDefinitionIeId (2) = 1
               |  |                                 (octetDeltaCount)
               |  +- ipfixTemplateDefinitionIeLength (3) = 8
               |  +- ipfixTemplateDefinitionEnterprise (4) = 0
               |  +- ipfixTemplateDefinitionFlags (5) = 0
               |
               +- index (4) (ipfixTemplateDefinitionIndex)
                  +- ipfixTemplateDefinitionIndex (1) = 4
                  +- ipfixTemplateDefinitionIeId (2) = 132
                  |                          (droppedOctetDeltaCount)
                  +- ipfixTemplateDefinitionIeLength (3) = 8
                  +- ipfixTemplateDefinitionEnterprise (4) = 0
                  +- ipfixTemplateDefinitionFlags (5) = 0

   The corresponding table entry on the Collector is the same except
   that it would have another ipfixTransportSessionIndex, e.g., 17 as in
   the previous example.









<span class="grey">Dietz, et al.                Standards Track                   [Page 10]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-11" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


<span class="h3"><a class="selflink" id="section-5.4" href="#section-5.4">5.4</a>.  The Export Table</span>

   On Exporters, the Export table (ipfixExportTable) can be used to
   support features like failover, load-balancing, duplicate export to
   several Collectors, etc.  The table has three indexes that link an
   entry with:

   o  the Metering Process table (ipfixMeteringProcessCacheId, see
      below)

   o  and the Transport Session table (ipfixTransportSessionIndex).

   Those entries with the same ipfixExportIndex and the same
   ipfixMeteringProcessCacheId define a Transport Session group.  The
   member type for each group member describes its functionality.  All
   Transport Sessions referenced in this table MUST have the
   ipfixTransportSessionDeviceMode exporting(1).

   If the Exporter does not use Transport Session grouping, then each
   ipfixExportIndex contains a single ipfixMeteringProcessCacheId, and
   thus a singe Transport Session (ipfixTransportSessionIndex) and this
   session MUST have the member type primary(1).

   For failover, a Transport Session group can contain one Transport
   Session with member type "primary" and several Transport Sessions
   with type secondary(2).  Entries with other member types are not
   allowed for that type of group.  For load-balancing or parallel
   export, all Transport Sessions in the group MUST have the same member
   type, either loadBalancing(4) or parallel(3).

   The algorithms used for failover or load-balancing are out of the
   scope of this document.

   To continue the example, we assume that the Exporter uses the two
   connections shown in the examples above as one primary Transport
   Session protected by a secondary Transport Session.  The Exporter
   then has the following entries in the ipfixExportTable:














<span class="grey">Dietz, et al.                Standards Track                   [Page 11]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-12" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


    ipfixExportTable (5)
    |
    +- ipfixExportEntry (1)
       |
       +- index (7) (ipfixExportIndex)
       |  +- index (9) (ipfixMeteringProcessCacheId)
       |     |  +- index (5) (ipfixTransportSessionIndex)
       |        |  +- ipfixExportIndex (1) = 7
       |        |  +- ipfixExportMemberType (2) = 1 (primary)
       |        |
       |        +- index (11) (ipfixTransportSessionIndex)
       |           +- ipfixExportIndex (1) = 7
       |           +- ipfixExportMemberType (2) = 2 (secondary)
       |
       +- index (8) (ipfixExportIndex)
          +- index (9) (ipfixMeteringProcessCacheId)
             +- index (5) (ipfixTransportSessionIndex)
             |  +- ipfixExportIndex (1) = 8
             |  +- ipfixExportMemberType (2) = 2 (secondary)
             +- index (11) (ipfixTransportSessionIndex)
                +- ipfixExportIndex (1) = 8
                +- ipfixExportMemberType (2) = 1 (primary)

   The example shows that the Exporter uses the Metering Process Cache
   9, explained below, to export IPFIX Data Records for the Transport
   Sessions 5 and 11.  The Templates 257 and 264 defined above are
   exported within Transport Session 5, and the Templates 273 and 289
   are exported within Transport Session 11.  If we assume that
   Templates 257 and 264 are identical, then the Collector that receives
   Transport Session 11 is a backup for the Collector of Transport
   Session 5.

<span class="h3"><a class="selflink" id="section-5.5" href="#section-5.5">5.5</a>.  The Metering Process Table</span>

   The Metering Process, as defined in [<a href="./rfc5101" title="&quot;Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information&quot;">RFC5101</a>], consists of a set of
   functions.  Maintaining the Flow Records is one of them.  This
   function is responsible for passing the Flow Records to the Exporting
   Process and also for detecting Flow expiration.  The Flow Records
   that are maintained by the Metering Process can be grouped by the
   Observation Points at which they are observed.  The instance that
   maintains such a group of Flow Records is a kind of cache.  For this
   reason, the Metering Process table (ipfixMeteringProcessTable) is
   indexed by cache Ids (ipfixMeteringProcessCacheId).  Each cache can
   be maintained by a separate instance of the Metering Process.  To
   specify the Observation Point(s) where the Flow Records are gathered,
   the ipfixMeteringProcessObservationPointGroupRef may contain an
   ipfixObservationPointGroupId from the Observation Point table
   (ipfixObservationPointTable) described in the next section.  If an



<span class="grey">Dietz, et al.                Standards Track                   [Page 12]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-13" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   Observation Point is not specified for the Flow Records, the
   ipfixMeteringProcessObservationPointGroupRef MUST be zero(0).  The
   timeouts (ipfixMeteringProcessCacheActiveTimeout and
   ipfixMeteringProcessCacheInactiveTimeout) specify when Flows are
   expired.

    ipfixMeteringProcessTable (6)
    |
    +- ipfixMeteringProcessEntry (1)
       |
       +- index (9) (ipfixMeteringProcessCacheId)
          +- ipfixMeteringProcessCacheId (1) = 9
          +- ipfixMeteringProcessObservationPointGroupRef (2) = 17
          +- ipfixMeteringProcessCacheActiveTimeout (3) = 100
          +- ipfixMeteringProcessCacheInactiveTimeout (4) = 100

<span class="h3"><a class="selflink" id="section-5.6" href="#section-5.6">5.6</a>.  The Observation Point Table</span>

   The Observation Point table (ipfixObservationPointTable) groups
   Observation Points with the ipfixObservationPointGroupId.  Each entry
   contains the Observation Domain Id in which the Observation Point is
   located and a reference to the ENTITY MIB module [<a href="./rfc4133" title="&quot;Entity MIB (Version 3)&quot;">RFC4133</a>] or the IF
   MIB module [<a href="./rfc2863" title="&quot;The Interfaces Group MIB&quot;">RFC2863</a>].  The objects in the ENTITY MIB module
   referenced by ipfixObservationPointPhysicalEntity or IF MIB module
   referenced by ipfixObservationPointPhysicalInterface denote the
   Observation Point.  If no such index can be given in those modules,
   the references MUST be 0.  If a reference is given in both object
   ipfixObservationPointPhysicalEntity and
   ipfixObservationPointPhysicalInterface, then both MUST point to the
   same physical interface.  In addition, a direction can be given to
   render more specifically which Flow to monitor.




















<span class="grey">Dietz, et al.                Standards Track                   [Page 13]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-14" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


    ipfixObservationPointTable (7)
    |
    +- ipfixObservationPointEntry (1)
       |
       +- index (17) (ipfixObservationPointGroupId)
          +- index (1) (ipfixObservationPointIndex)
          |  +- ipfixObservationPointGroupId (1) = 17
          |  +- ipfixObservationPointIndex (2) = 1
          |  +- ipfixObservationPointObservationDomainId (3) = 3
          |  +- ipfixObservationPointPhysicalEntity (4) = 6
          |  +- ipfixObservationPointPhysicalInterface(5) = 0
          |  +- ipfixObservationPointPhysicalEntityDirection (6)
                                                             = 3 (both)
          |
          +- index (2) (ipfixObservationPointIndex)
             +- ipfixObservationPointGroupId (1) = 17
             +- ipfixObservationPointIndex (2) = 2
             +- ipfixObservationPointObservationDomainId (3) = 3
             +- ipfixObservationPointPhysicalEntity (4) = 0
             +- ipfixObservationPointPhysicalInterface (5) = 0
             +- ipfixObservationPointPhysicalEntityDirection (6)
                                                           = 1 (ingress)

<span class="h3"><a class="selflink" id="section-5.7" href="#section-5.7">5.7</a>.  The Selection Process Table</span>

   This table supports the usage of Filtering and Sampling functions, as
   described in [<a href="./rfc5470" title="&quot;Architecture for IP Flow Information Export&quot;">RFC5470</a>].  It contains lists of functions per Metering
   Process cache (ipfixMeteringProcessCacheId).  The selection process
   index ipfixSelectionProcessIndex forms groups of selection methods
   that are applied to an observed packet stream.  The selection process
   selector index (ipfixSelectionProcessSelectorIndex) indicates the
   order in which the functions are applied to the packets observed at
   the Observation Points associated with the Metering Process cache.
   The selection methods are applied in increasing order, i.e.,
   selection methods with a lower ipfixSelectionProcessSelectorIndex are
   applied first.  The functions are referred by object identifiers
   pointing to the function with its parameters.  If the selection
   method does not use parameters, then it MUST point to the root of the
   function subtree (see also <a href="#section-6">Section 6</a>).  If the function uses
   parameters, then it MUST point to an entry in the parameter table of
   the selection method.  If no Filtering or Sampling function is used
   for a Metering Process, then an entry for the Metering Process SHOULD
   be created pointing to the Select All function (ipfixFuncSelectAll).








<span class="grey">Dietz, et al.                Standards Track                   [Page 14]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-15" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


<span class="h3"><a class="selflink" id="section-5.8" href="#section-5.8">5.8</a>.  The Statistical Tables</span>

   For the ipfixTransportSessionTable, the ipfixTemplateTable, the
   ipfixMeteringProcessTable, and the ipfixSelectionProcessTable
   statistical tables are defined that augment those tables.  All the
   statistical tables contain a discontinuity object that holds a
   timestamp that denotes the time when a discontinuity event occurred
   to notify the management system that the counters contained in those
   tables might not be continuous anymore.

<span class="h4"><a class="selflink" id="section-5.8.1" href="#section-5.8.1">5.8.1</a>.  The Transport Session Statistical Table</span>

   The Transport Session Statistical table
   (ipfixTransportSessionStatsTable) augments the
   ipfixTransportSessionTable with statistical values.  It contains the
   rate (in bytes per second) with which it receives or sends out IPFIX
   Messages, the number of bytes, packets, messages, Records, Templates
   and Options Templates received or sent and the number of messages
   that were discarded.

<span class="h4"><a class="selflink" id="section-5.8.2" href="#section-5.8.2">5.8.2</a>.  The Template Statistical Table</span>

   This table contains a statistical value for each Template.  It
   augments the Template table (ipfixTemplateTable) and specifies the
   number of Data Records exported or collected for the Template.

<span class="h4"><a class="selflink" id="section-5.8.3" href="#section-5.8.3">5.8.3</a>.  The Metering Process Statistical Table</span>

   This table augments the Metering Process table
   (ipfixMeteringProcessTable).  It contains the statistical values for
   the exported Data Records and the number of unused cache entries.

<span class="h4"><a class="selflink" id="section-5.8.4" href="#section-5.8.4">5.8.4</a>.  The Selection Process Statistical Table</span>

   This table augments the Selection Process table
   (ipfixSelectionProcessTable) and introduces two generic statistical
   values, the number of packets observed and the number of packets
   dropped by the selection method.

<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>.  Structure of the IPFIX SELECTOR MIB</span>

   The IPFIX SELECTOR MIB module defined in this section provides the
   standard Filtering and Sampling functions that can be referenced in
   the ipfixSelectionProcessTable.  The subtree ipfixSelectorFunctions
   is a placeholder where all standard Filtering and Sampling functions
   should be located.  It currently contains the Select All function
   (ipfixFuncSelectAll).  The IPFIX SELECTOR MIB module is maintained by
   IANA and can be extended through Expert Review [<a href="./rfc5226" title="">RFC5226</a>], i.e.,



<span class="grey">Dietz, et al.                Standards Track                   [Page 15]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-16" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   review by one of a group of experts designated by an IETF Area
   Director.  The group of experts MUST check the requested MIB objects
   for completeness and accuracy of the description.  Requests for MIB
   objects that duplicate the functionality of existing objects SHOULD
   be declined.  The smallest available OID SHOULD be assigned to a new
   MIB objects.  The specification of new MIB objects SHOULD follow the
   structure specified in the next Section and MUST be published using a
   well-established and persistent publication medium.  The experts will
   initially be drawn from the Working Group Chairs and document editors
   of the IPFIX and PSAMP Working Groups.

<span class="h3"><a class="selflink" id="section-6.1" href="#section-6.1">6.1</a>.  The Selector Functions</span>

   The following figure shows what the MIB tree usually should look
   like.  It already contains the ipfixFuncSelectAll.  The subtree in
   ipfixFuncF2 gives the basic structure that all selection methods
   SHOULD follow.

    ipfixSelectorFunctions
    |
    +- ipfixFuncSelectAll
    |  |
    |  +- ipfixFuncSelectAllAvail (is the function available?)
    |
    +- ipfixFuncF2
    |  |
    |  +- ipfixFuncF2Avail (is the function F2 available?)
    |  |
    |  +- ipfixFuncF2Parameters (a table with parameters)
    ...
    |
    +- ipfixFunFn...

   The selection method SHOULD be designed as a MIB subtree introduced
   by an object with the name ipfixFunc appended by a function name.
   The objects in this subtree SHOULD be prefixed by this name.  If the
   function is named Fx, then we would start a subtree with an OID named
   ipfixFuncFx.  This subtree should contain an object ipfixFuncFxAvail
   that has the type TruthValue.  If a selection method takes
   parameters, the MIB should contain a table named
   ipfixFuncFxParameters, which should contain all the parameters that
   the selection method specifies.  An entry in this table will be
   referenced by the IPFIX MIB module if the selection method with the
   parameters is used.







<span class="grey">Dietz, et al.                Standards Track                   [Page 16]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-17" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   To illustrate the structure defined above, the following contains an
   example of a function MyFunc that holds three integer parameters
   Param1, Param2, and Param3.  In the example, there are currently two
   instances of the parameters set defined with indexes 1 and 4.

    ipfixSelectorFunctions (1)
    |
    +- ipfixFuncMyFunc (?)
       |
       +- ipfixFuncMyFuncAvail (1) = true
       +- ipfixFuncMyFuncParameters (2)
          |
          +- ipfixFuncMyFuncParametersEntry (1)
             |
             +- index (1) (ipfixFuncMyFuncParametersIndex)
             |  +- ipfixFuncMyFuncParam1 (1) = 47
             |  +- ipfixFuncMyFuncParam2 (2) = -128
             |  +- ipficFuncMyFuncParam3 (3) = 19
             |
             +- index(4) (ipfixFuncMyFuncParametersIndex)
                +- ipfixFuncMyFuncParam1 (1) = 19
                +- ipfixFuncMyFuncParam2 (2) = -1
                +- ipficFuncMyFuncParam3 (3) = 728

   If the function defined above is referenced in the IPFIX MIB module,
   the ipfixSelectionProcessTable would look as follows:

    ipfixSelectionProcessTable (8)
    |
    +- ipfixSelectionProcessEntry (1)
       |
       +- index (9) (ipfixMeteringProcessCacheId)
          +- index (1) (ipfixSelectionProcessIndex)
             +- index (1) (ipfixSelectionProcessSelectorIndex)
             |  +- ipfixSelectionProcessSelectorFunction (3)
             |                          = ipfixSelectorFunctions.?.2.1.4
             +- index (2) (ipfixSelectionProcessSelectorIndex)
                +- ipfixSelectionProcessSelectorFunction (3)
                                        = ipfixSelectorFunctions.?.2.1.1

   This means that for the ipfixMeteringProcessCacheId(9), a Selection
   Process with index 1 is created that applies two times the same
   function but with different parameter sets.  First, the function
   MyFunc is applied with the parameters of the set with index 4 and the
   with the parameters of the set with index 1.






<span class="grey">Dietz, et al.                Standards Track                   [Page 17]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-18" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>.  Relationship to Other MIB Modules</span>

   Besides the usual imports from the SNMP Standards [<a href="./rfc2578" title="&quot;Structure of Management Information Version 2 (SMIv2)&quot;">RFC2578</a>],
   [<a href="./rfc2579" title="&quot;Textual Conventions for SMIv2&quot;">RFC2579</a>], and [<a href="./rfc2580" title="&quot;Conformance Statements for SMIv2&quot;">RFC2580</a>], the IPFIX MIB module references the ENTITY
   MIB module [<a href="./rfc4133" title="&quot;Entity MIB (Version 3)&quot;">RFC4133</a>] and the IF MIB module [<a href="./rfc2863" title="&quot;The Interfaces Group MIB&quot;">RFC2863</a>].

<span class="h3"><a class="selflink" id="section-7.1" href="#section-7.1">7.1</a>.  Relationship to the ENTITY MIB and IF MIB</span>

   The Observation Point table (ipfixObservationPointTable) contains a
   reference to the ENTITY MIB module[RFC4133]
   (ipfixObservationPointPhysicalEntity) or the IF MIB module [<a href="./rfc2863" title="&quot;The Interfaces Group MIB&quot;">RFC2863</a>]
   (ipfixObservationPointPhysicalInterface).  If the implementors of the
   IPFIX MIB module want to specify the physical entity where Flows are
   observed, then they SHOULD also implement the ENTITY MIB and/or the
   IF MIB module.  The implementation of the ENTITY MIB and/or IF MIB
   module is OPTIONAL.  If one of them is not implemented, then all
   values of the respective column ipfixObservationPointPhysicalEntity
   or ipfixObservationPointPhysicalInterface in the Observation Point
   table are zero and the values of the
   ipfixObservationPointPhysicalEntityDirection columns are unknown(0),
   if none of them are defined.

<span class="h3"><a class="selflink" id="section-7.2" href="#section-7.2">7.2</a>.  MIB Modules Required for IMPORTS</span>

   The IPFIX MIB module requires the modules SNMPv2-SMI [<a href="./rfc2578" title="&quot;Structure of Management Information Version 2 (SMIv2)&quot;">RFC2578</a>],
   SNMPv2-TC [<a href="./rfc2579" title="&quot;Textual Conventions for SMIv2&quot;">RFC2579</a>], and SNMPv2-CONF [<a href="./rfc2580" title="&quot;Conformance Statements for SMIv2&quot;">RFC2580</a>].  Further on, it
   imports the textual conventions InetAddressType and InetAddress from
   the INET ADDRESS MIB module [<a href="./rfc4001" title="&quot;Textual Conventions for Internet Network Addresses&quot;">RFC4001</a>].

   The IPFIX SELECTOR MIB module also requires the modules SNMPv2-SMI
   [<a href="./rfc2578" title="&quot;Structure of Management Information Version 2 (SMIv2)&quot;">RFC2578</a>], SNMPv2-TC [<a href="./rfc2579" title="&quot;Textual Conventions for SMIv2&quot;">RFC2579</a>], and SNMPv2-CONF [<a href="./rfc2580" title="&quot;Conformance Statements for SMIv2&quot;">RFC2580</a>].

<span class="h2"><a class="selflink" id="section-8" href="#section-8">8</a>.  MIB Definitions</span>

   This section contains the definitions of the IPFIX-MIB module and the
   IPFIX-SELECTOR-MIB module.  There are different mandatory groups
   defined for Collector and Exporter implementations.  The statistical
   objects are made OPTIONAL.













<span class="grey">Dietz, et al.                Standards Track                   [Page 18]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-19" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


<span class="h3"><a class="selflink" id="section-8.1" href="#section-8.1">8.1</a>.  IPFIX MIB Definition</span>

   IPFIX-MIB DEFINITIONS ::= BEGIN

   IMPORTS
       MODULE-IDENTITY, OBJECT-TYPE, mib-2, Unsigned32, Counter64,
       Gauge32
           FROM SNMPv2-SMI                                -- <a href="./rfc2578">RFC2578</a>
       TimeStamp, DateAndTime
           FROM SNMPv2-TC                                 -- <a href="./rfc2579">RFC2579</a>
       MODULE-COMPLIANCE, OBJECT-GROUP
           FROM SNMPv2-CONF                               -- <a href="./rfc2580">RFC2580</a>
       InterfaceIndexOrZero
           FROM IF-MIB                                    -- <a href="./rfc2863">RFC2863</a>
       InetAddressType, InetAddress, InetPortNumber
           FROM INET-ADDRESS-MIB                          -- <a href="./rfc4001">RFC4001</a>
       PhysicalIndexOrZero
           FROM ENTITY-MIB;                               -- <a href="./rfc4133">RFC4133</a>

   ipfixMIB MODULE-IDENTITY
       LAST-UPDATED "201004190000Z"         -- 19 April 2010
       ORGANIZATION "IETF IPFIX Working Group"
       CONTACT-INFO
           "WG charter:
             <a href="http://www.ietf.org/html.charters/ipfix-charter.html">http://www.ietf.org/html.charters/ipfix-charter.html</a>

           Mailing Lists:
             General Discussion: ipfix@ietf.org
             To Subscribe: <a href="http://www1.ietf.org/mailman/listinfo/ipfix">http://www1.ietf.org/mailman/listinfo/ipfix</a>
             Archive:
         <a href="http://www1.ietf.org/mail-archive/web/ipfix/current/index.html">http://www1.ietf.org/mail-archive/web/ipfix/current/index.html</a>

           Editor:
             Thomas Dietz
             NEC Europe Ltd.
             NEC Laboratories Europe
             Network Research Division
             Kurfuersten-Anlage 36
             69115 Heidelberg
             Germany
             Phone: +49 6221 4342-128
             Email: Thomas.Dietz@nw.neclab.eu









<span class="grey">Dietz, et al.                Standards Track                   [Page 19]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-20" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


             Atsushi Kobayashi
             NTT Information Sharing Platform Laboratories
             3-9-11 Midori-cho
             Musashino-shi
             180-8585
             Japan
             Phone: +81-422-59-3978
             Email: akoba@nttv6.net

             Benoit Claise
             Cisco Systems, Inc.
             De Kleetlaan 6a b1
             Degem 1831
             Belgium
             Phone:  +32 2 704 5622
             Email: bclaise@cisco.com

             Gerhard Muenz
             Technische Universitaet Muenchen
             Department of Informatics
             Chair for Network Architectures and Services (I8)
             Boltzmannstr. 3
             85748 Garching
             Germany
             Phone: +49 89 289-18008
             Email: muenz@net.in.tum.de
             URI:   <a href="http://www.net.in.tum.de/~muenz">http://www.net.in.tum.de/~muenz</a>"
       DESCRIPTION
           "The IPFIX MIB defines managed objects for IP Flow
           Information eXport.  These objects provide information about
           managed nodes supporting the IPFIX protocol,
           for Exporters as well as for Collectors.

           Copyright (c) 2010 IETF Trust and the persons identified as
           authors of the code.  All rights reserved.

           Redistribution and use in source and binary forms, with or
           without modification, is permitted pursuant to, and subject
           to the license terms contained in, the Simplified BSD
           License set forth in <a href="#section-4">Section 4</a>.c of the IETF Trust's
           Legal Provisions Relating to IETF Documents
           (<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>)."









<span class="grey">Dietz, et al.                Standards Track                   [Page 20]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-21" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   --  Revision history

        REVISION     "201004190000Z"         -- 19 April 2010
        DESCRIPTION
           "Initial version, published as <a href="./rfc5815">RFC 5815</a>."

       ::= { mib-2 193 }


   --******************************************************************
   -- Top Level Structure of the MIB
   --******************************************************************

   ipfixObjects     OBJECT IDENTIFIER ::= { ipfixMIB 1 }
   ipfixConformance OBJECT IDENTIFIER ::= { ipfixMIB 2 }

   ipfixMainObjects OBJECT IDENTIFIER ::= { ipfixObjects 1 }
   ipfixStatistics  OBJECT IDENTIFIER ::= { ipfixObjects 2 }

   --==================================================================
   -- 1.1: Objects used by all IPFIX implementations
   --==================================================================
   --------------------------------------------------------------------
   -- 1.1.1: Transport Session Table
   --------------------------------------------------------------------
   ipfixTransportSessionTable  OBJECT-TYPE
       SYNTAX      SEQUENCE OF IpfixTransportSessionEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table lists the currently established Transport
           Sessions between an Exporting Process and a Collecting
           Process."
       ::= { ipfixMainObjects 1 }

   ipfixTransportSessionEntry OBJECT-TYPE
       SYNTAX      IpfixTransportSessionEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines an entry in the ipfixTransportSessionTable."
       INDEX       { ipfixTransportSessionIndex }
       ::= { ipfixTransportSessionTable 1 }








<span class="grey">Dietz, et al.                Standards Track                   [Page 21]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-22" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   IpfixTransportSessionEntry ::=
       SEQUENCE {
          ipfixTransportSessionIndex                  Unsigned32,
          ipfixTransportSessionProtocol               Unsigned32,
          ipfixTransportSessionSourceAddressType      InetAddressType,
          ipfixTransportSessionSourceAddress          InetAddress,
          ipfixTransportSessionDestinationAddressType InetAddressType,
          ipfixTransportSessionDestinationAddress     InetAddress,
          ipfixTransportSessionSourcePort             InetPortNumber,
          ipfixTransportSessionDestinationPort        InetPortNumber,
          ipfixTransportSessionSctpAssocId            Unsigned32,
          ipfixTransportSessionDeviceMode             INTEGER,
          ipfixTransportSessionTemplateRefreshTimeout Unsigned32,
          ipfixTransportSessionOptionsTemplateRefreshTimeout Unsigned32,
          ipfixTransportSessionTemplateRefreshPacket  Unsigned32,
          ipfixTransportSessionOptionsTemplateRefreshPacket Unsigned32,
          ipfixTransportSessionIpfixVersion           Unsigned32,
          ipfixTransportSessionStatus                 INTEGER
       }

   ipfixTransportSessionIndex OBJECT-TYPE
       SYNTAX      Unsigned32 (1..4294967295)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Locally arbitrary, but unique identifier of an entry in
           the ipfixTransportSessionTable.  The value is expected to
           remain constant from a re-initialization of the entity's
           network management agent to the next re-initialization."
       ::= { ipfixTransportSessionEntry 1 }

   ipfixTransportSessionProtocol OBJECT-TYPE
       SYNTAX      Unsigned32 (1..255)
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The transport protocol used for receiving or transmitting
           IPFIX Messages.  Protocol numbers are assigned by IANA.  A
           current list of all assignments is available from
           &lt;<a href="http://www.iana.org/">http://www.iana.org/</a>&gt;."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow
           Information Export (IPFIX) Protocol for the Exchange of IP
           Traffic Flow Information, <a href="#section-10">Section 10</a>."
       ::= { ipfixTransportSessionEntry 2 }






<span class="grey">Dietz, et al.                Standards Track                   [Page 22]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-23" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   ipfixTransportSessionSourceAddressType OBJECT-TYPE
       SYNTAX      InetAddressType
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The type of address used for the source address,
           as specified in <a href="./rfc4001">RFC 4001</a>.  This object is used with protocols
           (specified in ipfixTransportSessionProtocol) like TCP (6)
           and UDP (17) that have the notion of addresses.  SCTP (132)
           should use the ipfixTransportSessionSctpAssocId instead.
           If SCTP (132) or any other protocol without the notion of
           addresses is used, the object MUST be set to unknown(0)."
       ::= { ipfixTransportSessionEntry 3 }

   ipfixTransportSessionSourceAddress OBJECT-TYPE
       SYNTAX      InetAddress
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The source address of the Exporter of the IPFIX Transport
           Session.  This value is interpreted according to the value of
           ipfixTransportSessionAddressType as specified in <a href="./rfc4001">RFC 4001</a>.
           This object is used with protocols (specified in
           ipfixTransportSessionProtocol) like TCP (6) and UDP (17) that
           have the notion of addresses.  SCTP (132) should use the
           ipfixTransportSessionSctpAssocId instead.  If SCTP (132) or
           any other protocol without the notion of addresses is used,
           the object MUST be set to a zero-length string."
       ::= { ipfixTransportSessionEntry 4 }

   ipfixTransportSessionDestinationAddressType OBJECT-TYPE
       SYNTAX      InetAddressType
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The type of address used for the destination address,
           as specified in <a href="./rfc4001">RFC 4001</a>.  This object is used with protocols
           (specified in ipfixTransportSessionProtocol) like TCP (6)
           and UDP (17) that have the notion of addresses.  SCTP (132)
           should use the ipfixTransportSessionSctpAssocId instead.
           If SCTP (132) or any other protocol without the notion of
           addresses is used, the object MUST be set to unknown(0)."
       ::= { ipfixTransportSessionEntry 5 }

   ipfixTransportSessionDestinationAddress OBJECT-TYPE
       SYNTAX      InetAddress
       MAX-ACCESS  read-only
       STATUS      current



<span class="grey">Dietz, et al.                Standards Track                   [Page 23]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-24" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       DESCRIPTION
           "The destination address of the Collector of the IPFIX
           Transport Session.  This value is interpreted according to
           the value of ipfixTransportSessionAddressType, as specified
           in <a href="./rfc4001">RFC 4001</a>.  This object is used with protocols
           (specified in ipfixTransportSessionProtocol) like TCP (6)
           and UDP (17) that have the notion of addresses.  SCTP (132)
           should use the ipfixTransportSessionSctpAssocId instead.
           If SCTP (132) or any other protocol without the notion of
           addresses is used, the object MUST be set to a zero-length
           string"
       ::= { ipfixTransportSessionEntry 6 }

   ipfixTransportSessionSourcePort OBJECT-TYPE
       SYNTAX      InetPortNumber
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The transport protocol port number of the Exporter.
           This object is used with protocols (specified in
           ipfixTransportSessionProtocol) like TCP (6)
           and UDP (17) that have the notion of ports.  SCTP (132)
           should copy the value of sctpAssocLocalPort if the
           Transport Session is in collecting mode or
           sctpAssocRemPort if the Transport Session is in
           exporting mode.  The association is referenced
           by the ipfixTransportSessionSctpAssocId.
           If any other protocol without the notion of
           ports is used, the object MUST be set to zero."
       ::= { ipfixTransportSessionEntry 7 }

   ipfixTransportSessionDestinationPort OBJECT-TYPE
       SYNTAX      InetPortNumber
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The transport protocol port number of the Collector.  The
           default value is 4739 for all currently defined transport
           protocol types.  This object is used with protocols
           (specified in ipfixTransportSessionProtocol) like TCP (6)
           and UDP (17) that have the notion of ports.  SCTP (132)
           should copy the value of sctpAssocRemPort if the
           Transport Session is in collecting mode or
           sctpAssocLocalPort if the Transport Session is in
           exporting mode.  The association is referenced
           by the ipfixTransportSessionSctpAssocId.
           If any other protocol without the notion of
           ports is used, the object MUST be set to zero."



<span class="grey">Dietz, et al.                Standards Track                   [Page 24]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-25" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       ::= { ipfixTransportSessionEntry 8 }

   ipfixTransportSessionSctpAssocId OBJECT-TYPE
       SYNTAX      Unsigned32
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The association id used for the SCTP session between the
           Exporter and the Collector of the IPFIX Transport Session.
           It is equal to the sctpAssocId entry in the sctpAssocTable
           defined in the SCTP MIB.  This object is only valid if
           ipfixTransportSessionProtocol has the value 132 (SCTP).  In
           all other cases, the value MUST be zero."
       REFERENCE
           "<a href="./rfc3873">RFC 3873</a>, Stream Control Transmission Protocol (SCTP)
           Management Information Base (MIB)."
       ::= { ipfixTransportSessionEntry 9 }

   ipfixTransportSessionDeviceMode OBJECT-TYPE
       SYNTAX      INTEGER {
                       exporting(1),
                       collecting(2)
                   }
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The mode of operation of the device for the given Transport
           Session.  This object can have the following values:

           exporting(1)
               This value MUST be used if the Transport Session is
               used for exporting Records to other IPFIX Devices,
               i.e., this device acts as Exporter.

           collecting(2)
               This value MUST be used if the Transport Session is
               used for collecting Records from other IPFIX Devices,
               i.e., this device acts as Collector."
       ::= { ipfixTransportSessionEntry 10 }

   ipfixTransportSessionTemplateRefreshTimeout OBJECT-TYPE
       SYNTAX      Unsigned32
       UNITS       "seconds"
       MAX-ACCESS  read-only
       STATUS      current






<span class="grey">Dietz, et al.                Standards Track                   [Page 25]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-26" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       DESCRIPTION
           "On Exporters, this object contains the time in seconds
           after which IPFIX Templates are resent by the
           Exporter.

           On Collectors, this object contains the lifetime in seconds
           after which a Template becomes invalid when it is not
           received again within this lifetime.

           This object is only valid if ipfixTransportSessionProtocol
           has the value 17 (UDP).  In all other cases, the value MUST
           be zero."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, Sections <a href="#section-10.3.6">10.3.6</a> and <a href="#section-10.3.7">10.3.7</a>."
       ::= { ipfixTransportSessionEntry 11 }

   ipfixTransportSessionOptionsTemplateRefreshTimeout OBJECT-TYPE
       SYNTAX      Unsigned32
       UNITS       "seconds"
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "On Exporters, this object contains the time in seconds
           after which IPFIX Options Templates are resent by the
           Exporter.

           On Collectors, this object contains the lifetime in seconds
           after which an Options Template becomes invalid when it is
           not received again within this lifetime.

           This object is only valid if ipfixTransportSessionProtocol
           has the value 17 (UDP).  In all other cases the value MUST
           be zero."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, Sections <a href="#section-10.3.6">10.3.6</a> and <a href="#section-10.3.7">10.3.7</a>."
       ::= { ipfixTransportSessionEntry 12 }

   ipfixTransportSessionTemplateRefreshPacket OBJECT-TYPE
       SYNTAX      Unsigned32
       UNITS       "packets"
       MAX-ACCESS  read-only
       STATUS      current





<span class="grey">Dietz, et al.                Standards Track                   [Page 26]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-27" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       DESCRIPTION
           "On Exporters, this object contains the number of exported
           IPFIX Messages after which IPFIX Templates are resent
           by the Exporter.

           On Collectors, this object contains the lifetime in number
           of exported IPFIX Messages after which a Template becomes
           invalid when it is not received again within this lifetime.

           This object is only valid if ipfixTransportSessionProtocol
           has the value 17 (UDP).  In all other cases the value MUST
           be zero."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, Sections <a href="#section-10.3.6">10.3.6</a> and <a href="#section-10.3.7">10.3.7</a>."
       ::= { ipfixTransportSessionEntry 13 }

   ipfixTransportSessionOptionsTemplateRefreshPacket OBJECT-TYPE
       SYNTAX      Unsigned32
       UNITS       "packets"
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "On Exporters, this object contains the number of exported
           IPFIX Messages after which IPFIX Options Templates are
           resent by the Exporter.

           On Collectors, this object contains the lifetime in number
           of exported IPFIX Messages after which an Options Template
           becomes invalid when it is not received again within this
           lifetime.

           This object is only valid if ipfixTransportSessionProtocol
           has the value 17 (UDP).  In all other cases the value MUST
           be zero."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, Sections <a href="#section-10.3.6">10.3.6</a> and <a href="#section-10.3.7">10.3.7</a>."
       ::= { ipfixTransportSessionEntry 14 }

   ipfixTransportSessionIpfixVersion OBJECT-TYPE
       SYNTAX      Unsigned32 (0..65535)
       MAX-ACCESS  read-only
       STATUS      current





<span class="grey">Dietz, et al.                Standards Track                   [Page 27]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-28" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       DESCRIPTION
           "On Exporters the object contains the version number of the
           IPFIX protocol that the Exporter uses to export its data in
           this Transport Session.

           On Collectors the object contains the version number of the
           IPFIX protocol it receives for this Transport Session.

           If IPFIX Messages of different IPFIX protocol versions are
           transmitted or received in this Transport Session, this
           object contains the maximum version number."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, <a href="#section-3.1">Section 3.1</a>."
       ::= { ipfixTransportSessionEntry 15 }

   ipfixTransportSessionStatus OBJECT-TYPE
       SYNTAX      INTEGER {
                       unknown(0),
                       inactive(1),
                       active(2)
                   }
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The status of a Transport Session.  This object can have the
           following values:

           unknown(0)
               This value MUST be used if the status of the
               Transport Session cannot be detected by the equipment.
               This value should be avoided as far as possible.

           inactive(1)
               This value MUST be used for Transport Sessions that
               are specified in the system but are not currently active.
               The value can be used, e.g., for Transport Sessions that
               are backup (secondary) sessions in a Transport Session
               group.

           active(2)
               This value MUST be used for Transport Sessions that are
               currently active and transmitting or receiving data."
       ::= { ipfixTransportSessionEntry 16 }






<span class="grey">Dietz, et al.                Standards Track                   [Page 28]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-29" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   --------------------------------------------------------------------
   -- 1.1.2: Template Table
   --------------------------------------------------------------------
   ipfixTemplateTable  OBJECT-TYPE
       SYNTAX      SEQUENCE OF IpfixTemplateEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table lists the Templates and Options Templates that
           are transmitted by the Exporting Process or received by the
           Collecting Process.

           The table contains the Templates and Options Templates that
           are received or used for exporting data for a given
           Transport Session group and Observation Domain.

           Withdrawn or invalidated (Options) Template MUST be removed
           from this table."
       ::= { ipfixMainObjects 2 }

   ipfixTemplateEntry OBJECT-TYPE
       SYNTAX      IpfixTemplateEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines an entry in the ipfixTemplateTable."
       INDEX       {
           ipfixTransportSessionIndex,
           ipfixTemplateObservationDomainId,
           ipfixTemplateId
       }
       ::= { ipfixTemplateTable 1 }

   IpfixTemplateEntry ::=
       SEQUENCE {
           ipfixTemplateObservationDomainId Unsigned32,
           ipfixTemplateId                  Unsigned32,
           ipfixTemplateSetId               Unsigned32,
           ipfixTemplateAccessTime          DateAndTime
       }











<span class="grey">Dietz, et al.                Standards Track                   [Page 29]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-30" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   ipfixTemplateObservationDomainId OBJECT-TYPE
       SYNTAX      Unsigned32 (0..4294967295)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The Id of the Observation Domain for which this Template
           is defined.  This value is used when sending IPFIX Messages.

           The special value of 0 indicates that the Data Records
           exported with this (Option Template) cannot be applied to a
           single Observation Domain."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, <a href="#section-3.1">Section 3.1</a>."
       ::= { ipfixTemplateEntry 1 }

   ipfixTemplateId OBJECT-TYPE
       SYNTAX      Unsigned32 (256..65535)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This number indicates the Template Id in the IPFIX
           Message.  Values from 0 to 255 are not allowed for Template
           Ids."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, <a href="#section-3.4.1">Section 3.4.1</a>."
       ::= { ipfixTemplateEntry 2 }

   ipfixTemplateSetId OBJECT-TYPE
       SYNTAX      Unsigned32 (1..65535)
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "This number indicates the Set Id of the Template.  This
           object allows to easily retrieve the Template type.

           Currently, there are two values defined.  The value 2 is
           used for Sets containing Template definitions.  The value 3
           is used for Sets containing Options Template definitions."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, <a href="#section-3.3.2">Section 3.3.2</a>."
       ::= { ipfixTemplateEntry 3 }




<span class="grey">Dietz, et al.                Standards Track                   [Page 30]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-31" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   ipfixTemplateAccessTime OBJECT-TYPE
       SYNTAX      DateAndTime
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "If the Transport Session is in exporting mode
           (ipfixTransportSessionDeviceMode) the time when this
           (Options) Template was last sent to the Collector(s).

           In the specific case of UDP as transport protocol, this
           time is used to know when a retransmission of the
           (Options) Template is needed.

           If it is in collecting mode, this object contains the
           time when this (Options) Template was last received from
           the Exporter.  In the specific case of UDP as transport
           protocol, this time is used to know when this (Options)
           Template times out and thus is no longer valid."
       ::= { ipfixTemplateEntry 4 }

   --------------------------------------------------------------------
   -- 1.1.3: Exported Template Definition Table
   --------------------------------------------------------------------
   ipfixTemplateDefinitionTable  OBJECT-TYPE
       SYNTAX      SEQUENCE OF IpfixTemplateDefinitionEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "On Exporters, this table lists the (Options) Template fields
           of which a (Options) Template is defined.  It defines the
           (Options) Template given in the ipfixTemplateId specified in
           the ipfixTemplateTable.

           On Collectors, this table lists the (Options) Template fields
           of which a (Options) Template is defined.  It defines the
           (Options) Template given in the ipfixTemplateId specified in
           the ipfixTemplateTable."
       ::= { ipfixMainObjects 3 }

   ipfixTemplateDefinitionEntry OBJECT-TYPE
       SYNTAX      IpfixTemplateDefinitionEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines an entry in the ipfixTemplateDefinitionTable."






<span class="grey">Dietz, et al.                Standards Track                   [Page 31]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-32" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       INDEX       {
           ipfixTransportSessionIndex,
           ipfixTemplateObservationDomainId,
           ipfixTemplateId,
           ipfixTemplateDefinitionIndex
       }
       ::= { ipfixTemplateDefinitionTable 1 }

   IpfixTemplateDefinitionEntry ::=
       SEQUENCE {
           ipfixTemplateDefinitionIndex            Unsigned32,
           ipfixTemplateDefinitionIeId             Unsigned32,
           ipfixTemplateDefinitionIeLength         Unsigned32,
           ipfixTemplateDefinitionEnterpriseNumber Unsigned32,
           ipfixTemplateDefinitionFlags            BITS
       }

   ipfixTemplateDefinitionIndex OBJECT-TYPE
       SYNTAX      Unsigned32 (1..65535)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The ipfixTemplateDefinitionIndex specifies the order in
           which the Information Elements are used in the (Options)
           Template Record.

           Since a Template Record can contain a maximum of 65535
           Information Elements, the index is limited to this value."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, Sections <a href="#section-3.4.1">3.4.1</a> and <a href="#section-3.4.2">3.4.2</a>."
       ::= { ipfixTemplateDefinitionEntry 1 }

   ipfixTemplateDefinitionIeId OBJECT-TYPE
       SYNTAX      Unsigned32 (1..65535)
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "This indicates the Information Element Id at position
           ipfixTemplateDefinitionIndex in the (Options) Template
           ipfixTemplateId.  This implicitly specifies the data type
           of the Information Element.  The elements are registered
           at IANA.  A current list of assignments can be found at
           &lt;<a href="http://www.iana.org/assignments/ipfix">http://www.iana.org/assignments/ipfix</a>&gt;"






<span class="grey">Dietz, et al.                Standards Track                   [Page 32]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-33" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, <a href="#section-3.2">Section 3.2</a>.

           <a href="./rfc5102">RFC 5102</a>, Information Model for IP Flow Information Export."
       ::= { ipfixTemplateDefinitionEntry 2 }

   ipfixTemplateDefinitionIeLength OBJECT-TYPE
       SYNTAX      Unsigned32 (0..65535)
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "This indicates the length of the Information Element Id at
           position ipfixTemplateDefinitionIndex in the (Options)
           Template ipfixTemplateId."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, <a href="#section-3.2">Section 3.2</a>.

           <a href="./rfc5102">RFC 5102</a>, Information Model for IP Flow Information Export."
       ::= { ipfixTemplateDefinitionEntry 3 }

   ipfixTemplateDefinitionEnterpriseNumber OBJECT-TYPE
       SYNTAX      Unsigned32
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "IANA enterprise number of the authority defining the
           Information Element identifier in this Template Record.
           Enterprise numbers are assigned by IANA.  A current list of
           all assignments is available from
           &lt;<a href="http://www.iana.org/assignments/enterprise-numbers/">http://www.iana.org/assignments/enterprise-numbers/</a>&gt;.

           This object must be zero(0) for all standard Information
           Elements registered with IANA.  A current list of these
           elements is available from
           &lt;<a href="http://www.iana.org/assignments/ipfix/ipfix.xhtml">http://www.iana.org/assignments/ipfix/ipfix.xhtml</a>&gt;."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, <a href="#section-3.2">Section 3.2</a>.

           <a href="./rfc5102">RFC 5102</a>, Information Model for IP Flow Information Export."
       ::= { ipfixTemplateDefinitionEntry 4 }





<span class="grey">Dietz, et al.                Standards Track                   [Page 33]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-34" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   ipfixTemplateDefinitionFlags OBJECT-TYPE
       SYNTAX      BITS {
                       scope(0),
                       flowKey(1)
                   }
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "This bitmask indicates special attributes for the
           Information Element:

           scope(0)
               This Information Element is used for scope.

           flowKey(1)
               This Information Element is a Flow Key.

           Thus, we get the following values for an Information Element:

           If neither bit scope(0) nor bit flowKey(1) are set
               The Information Element is neither used for scoping nor
               as Flow Key.
           If only bit scope(0) is set
               The Information Element is used for scoping.
           If only bit flowKey(1) is set
               The Information Element is used as Flow Key.

           Both bit scope(0) and flowKey(1) MUST NOT be set at the same
           time.  This combination is not allowed."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information
           Export (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information, Sections <a href="#section-2">2</a> and <a href="#section-3.4.2.1">3.4.2.1</a>.

           <a href="./rfc5102">RFC 5102</a>, Information Model for IP Flow Information Export."
       ::= { ipfixTemplateDefinitionEntry 5 }

   --------------------------------------------------------------------
   -- 1.1.4: Export Table
   --------------------------------------------------------------------
   ipfixExportTable  OBJECT-TYPE
       SYNTAX      SEQUENCE OF IpfixExportEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table lists all exports of an IPFIX device.





<span class="grey">Dietz, et al.                Standards Track                   [Page 34]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-35" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


           On Exporters, this table contains all exports grouped by
           Transport Session, Observation Domain Id, Template Id, and
           Metering Process represented by the
           ipfixMeteringProcessCacheId.  Thanks to the ipfixExportIndex,
           the exports can group one or more Transport Sessions to
           achieve a special functionality like failover management,
           load-balancing, etc.  The entries with the same
           ipfixExportIndex, ipfixObservationDomainId,
           and ipfixMeteringProcessCacheId define a Transport
           Session group.  If the Exporter does not use Transport
           Session grouping, then each ipfixExportIndex contains a
           single ipfixMeteringProcessCacheId and thus a singe
           Transport Session, and this session MUST have the member
           type primary(1).  Transport Sessions referenced in this
           table MUST have the ipfixTransportSessionDeviceMode
           exporting(1).

           On Collectors, this table is not needed."
       ::= { ipfixMainObjects 4 }

   ipfixExportEntry OBJECT-TYPE
       SYNTAX      IpfixExportEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines an entry in the ipfixExportTable."
       INDEX       {
           ipfixExportIndex,
           ipfixMeteringProcessCacheId,
           ipfixTransportSessionIndex
       }
       ::= { ipfixExportTable 1 }

   IpfixExportEntry ::=
       SEQUENCE {
          ipfixExportIndex      Unsigned32,
          ipfixExportMemberType INTEGER
       }

   ipfixExportIndex OBJECT-TYPE
       SYNTAX      Unsigned32 (1..4294967295)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Locally arbitrary, but unique identifier of an entry in
           the ipfixExportTable.  The value is expected
           to remain constant from a re-initialization of the entity's
           network management agent to the next re-initialization.



<span class="grey">Dietz, et al.                Standards Track                   [Page 35]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-36" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


           A common ipfixExportIndex between two entries from this
           table expresses that there is a relationship between the
           Transport Sessions in ipfixTransportSessionIndex.  The type
           of relationship is expressed by the value of
           ipfixExportMemberType."
       ::= { ipfixExportEntry 1 }

   ipfixExportMemberType OBJECT-TYPE
       SYNTAX      INTEGER {
                       unknown(0),
                       primary(1),
                       secondary(2),
                       parallel(3),
                       loadBalancing(4)
                   }
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The type of a member Transport Session in a Transport
           Session group (identified by the value of ipfixExportIndex,
           ipfixObservationDomainId, and ipfixMeteringProcessCacheId).
           The following values are valid:

           unknown(0)
               This value MUST be used if the status of the group
               membership cannot be detected by the equipment.  This
               value should be avoided as far as possible.

           primary(1)
               This value is used for a group member that is used as
               the primary target of an Exporter.  Other group members
               (with the same ipfixExportIndex and
               ipfixMeteringProcessCacheId) MUST NOT have the value
               primary(1) but MUST have the value secondary(2).
               This value MUST also be specified if the Exporter does
               not support Transport Session grouping.  In this case,
               the group contains only one Transport Session.

           secondary(2)
               This value is used for a group member that is used as a
               secondary target of an Exporter.  The Exporter will use
               one of the targets specified as secondary(2) within the
               same Transport Session group when the primary target is
               not reachable.







<span class="grey">Dietz, et al.                Standards Track                   [Page 36]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-37" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


           parallel(3)
               This value is used for a group member that is used for
               duplicate exporting, i.e., all group members identified
               by the ipfixExportIndex are exporting the same Records
               in parallel.  This implies that all group members MUST
               have the same membertype parallel(3).

           loadBalancing(4)
               This value is used for a group member that is used
               as one target for load-balancing.  This means that a
               Record is sent to one of the group members in this
               group identified by ipfixExportIndex.
               This implies that all group members MUST have the same
               membertype loadBalancing(4)."
       ::= { ipfixExportEntry 2 }

   --------------------------------------------------------------------
   -- 1.1.5: Metering Process Table
   --------------------------------------------------------------------
   ipfixMeteringProcessTable  OBJECT-TYPE
       SYNTAX      SEQUENCE OF IpfixMeteringProcessEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table lists so-called caches used at the Metering
           Process to store the metering data of Flows observed at
           the Observation Points given in the
           ipfixObservationPointGroupReference.  The table lists the
           timeouts that specify when the cached metering data is
           expired.

           On Collectors, the table is not needed."
       ::= { ipfixMainObjects 5 }

   ipfixMeteringProcessEntry OBJECT-TYPE
       SYNTAX      IpfixMeteringProcessEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines an entry in the ipfixMeteringProcessTable."
       INDEX       { ipfixMeteringProcessCacheId }
       ::= { ipfixMeteringProcessTable 1 }









<span class="grey">Dietz, et al.                Standards Track                   [Page 37]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-38" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   IpfixMeteringProcessEntry ::=
       SEQUENCE {
           ipfixMeteringProcessCacheId              Unsigned32,
           ipfixMeteringProcessObservationPointGroupRef Unsigned32,
           ipfixMeteringProcessCacheActiveTimeout   Unsigned32,
           ipfixMeteringProcessCacheInactiveTimeout Unsigned32
       }

   ipfixMeteringProcessCacheId OBJECT-TYPE
       SYNTAX      Unsigned32 (1..4294967295)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Locally arbitrary, but unique identifier of an entry in the
           ipfixMeterinProcessTable.  The value is expected to remain
           constant from a re-initialization of the entity's network
           management agent to the next re-initialization."
       ::= { ipfixMeteringProcessEntry 1 }

   ipfixMeteringProcessObservationPointGroupRef OBJECT-TYPE
       SYNTAX      Unsigned32
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The Observation Point Group Id that links this table entry
           to the ipfixObservationPointTable.  The matching
           ipfixObservationPointGroupId in that table gives the
           Observation Points used in that cache.  If the Observation
           Points are unknown, the
           ipfixMeteringProcessObservationPointGroupRef MUST be zero."
       ::= { ipfixMeteringProcessEntry 2 }

   ipfixMeteringProcessCacheActiveTimeout OBJECT-TYPE
       SYNTAX      Unsigned32
       UNITS       "seconds"
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "On the Exporter, this object contains the time after which a
           Flow is expired (and a Data Record for the template is sent)
           even though packets matching this Flow are still received by
           the Metering Process.  If this value is 0, the Flow is not
           prematurely expired."
       REFERENCE
           "<a href="./rfc5470">RFC 5470</a>, Architecture for IP Flow Information Export,
           <a href="#section-5.1.1">Section 5.1.1</a>, item 3."
       ::= { ipfixMeteringProcessEntry 3 }




<span class="grey">Dietz, et al.                Standards Track                   [Page 38]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-39" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   ipfixMeteringProcessCacheInactiveTimeout OBJECT-TYPE
       SYNTAX      Unsigned32
       UNITS       "seconds"
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "On the Exporter. this object contains the time after which a
           Flow is expired (and a Data Record for the template is sent)
           when no packets matching this Flow are received by the
           Metering Process for the given number of seconds.  If this
           value is zero, the Flow is expired immediately, i.e., a Data
           Record is sent for every packet received by the Metering
           Process."
       REFERENCE
           "<a href="./rfc5470">RFC 5470</a>, Architecture for IP Flow Information Export,
           <a href="#section-5.1.1">Section 5.1.1</a>, item 1"
       ::= { ipfixMeteringProcessEntry 4 }

   --------------------------------------------------------------------
   -- 1.1.6: Observation Point Table
   --------------------------------------------------------------------
   ipfixObservationPointTable  OBJECT-TYPE
       SYNTAX      SEQUENCE OF IpfixObservationPointEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table lists the Observation Points used within an
           Exporter by the Metering Process. The index
           ipfixObservationPointGroupId groups Observation Points
           and is referenced in the Metering Process table.

           On Collectors this table is not needed."
       ::= { ipfixMainObjects 6 }

   ipfixObservationPointEntry OBJECT-TYPE
       SYNTAX      IpfixObservationPointEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines an entry in the ipfixObservationPointTable."
       INDEX       {
           ipfixObservationPointGroupId,
           ipfixObservationPointIndex
       }
       ::= { ipfixObservationPointTable 1 }






<span class="grey">Dietz, et al.                Standards Track                   [Page 39]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-40" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   IpfixObservationPointEntry ::=
       SEQUENCE {
           ipfixObservationPointGroupId           Unsigned32,
           ipfixObservationPointIndex             Unsigned32,
           ipfixObservationPointObservationDomainId Unsigned32,
           ipfixObservationPointPhysicalEntity    PhysicalIndexOrZero,
           ipfixObservationPointPhysicalInterface InterfaceIndexOrZero,
           ipfixObservationPointPhysicalEntityDirection INTEGER
       }

   ipfixObservationPointGroupId OBJECT-TYPE
       SYNTAX      Unsigned32 (1..4294967295)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Locally arbitrary, but unique identifier of an entry in the
           ipfixObservationPointTable.  The value is expected to remain
           constant from a re-initialization of the entity's network
           management agent to the next re-initialization.

           This index represents a group of Observation Points.

           The special value of 0 MUST NOT be used within this table
           but is reserved for the usage in the
           ipfixMeteringProcessTable.  An index of 0 for the
           ipfixObservationPointGroupReference index in that table
           indicates that an Observation Point is unknown or
           unspecified for a Metering Process cache."
       ::= { ipfixObservationPointEntry 1 }

   ipfixObservationPointIndex OBJECT-TYPE
       SYNTAX      Unsigned32 (1..4294967295)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Locally arbitrary, but unique identifier of an entry in the
           ipfixObservationPointTable.  The value is expected to remain
           constant from a re-initialization of the entity's network
           management agent to the next re-initialization.

           This index represents a single Observation Point in an
           Observation Point group."
       ::= { ipfixObservationPointEntry 2 }

   ipfixObservationPointObservationDomainId OBJECT-TYPE
       SYNTAX      Unsigned32
       MAX-ACCESS  read-only
       STATUS      current



<span class="grey">Dietz, et al.                Standards Track                   [Page 40]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-41" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       DESCRIPTION
           "The Id of the Observation Domain in which this
           Observation Point is included.

           The special value of 0 indicates that the Observation
           Points within this group cannot be applied to a single
           Observation Domain."
       REFERENCE
           "<a href="./rfc5101">RFC 5101</a>, Specification of the IP Flow Information Export
           (IPFIX) Protocol for the Exchange of IP
           Traffic Flow Information, <a href="#section-3.1">Section 3.1</a>."
       ::= { ipfixObservationPointEntry 3 }

   ipfixObservationPointPhysicalEntity OBJECT-TYPE
       SYNTAX      PhysicalIndexOrZero
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "This object contains the index of a physical entity in
           the ENTITY MIB.  This physical entity is the given
           Observation Point.  If such a physical entity cannot be
           specified or is not known, then the object is zero."
       ::= { ipfixObservationPointEntry 4 }

   ipfixObservationPointPhysicalInterface OBJECT-TYPE
       SYNTAX      InterfaceIndexOrZero
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "This object contains the index of a physical interface in
           the IF MIB.  This physical interface is the given
           Observation Point.  If such a physical interface cannot be
           specified or is not known, then the object is zero.

           This object MAY be used stand alone or in addition to
           ipfixObservationPointPhysicalEntity.  If
           ipfixObservationPointPhysicalEntity is not zero, this object
           MUST point to the same physical interface that is
           referenced in ipfixObservationPointPhysicalEntity.
           Otherwise, it may reference any interface in the IF MIB."
       ::= { ipfixObservationPointEntry 5 }










<span class="grey">Dietz, et al.                Standards Track                   [Page 41]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-42" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   ipfixObservationPointPhysicalEntityDirection OBJECT-TYPE
       SYNTAX      INTEGER {
                       unknown(0),
                       ingress(1),
                       egress(2),
                       both(3)
                   }
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The direction of the Flow that is monitored on the given
           physical entity.  The following values are valid:

           unknown(0)
               This value MUST be used if a direction is not
               known for the given physical entity.

           ingress(1)
               This value is used for monitoring incoming Flows on the
               given physical entity.

           egress(2)
               This value is used for monitoring outgoing Flows on the
               given physical entity.

           both(3)
               This value is used for monitoring incoming and outgoing
               Flows on the given physical entity."
       ::= { ipfixObservationPointEntry 6 }

   --------------------------------------------------------------------
   -- 1.1.7: Selection Process Table
   --------------------------------------------------------------------
   ipfixSelectionProcessTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF IpfixSelectionProcessEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table contains Selector Functions connected to a
           Metering Process by the index ipfixMeteringProcessCacheId.
           The Selector Functions are grouped into Selection Processes
           by the ipfixSelectionProcessIndex.  The Selector Functions
           are applied within the Selection Process to the packets
           observed for the given Metering Process cache in increasing
           order implied by the ipfixSelectionProcessSelectorIndex.
           This means Selector Functions with lower
           ipfixSelectionProcessSelectorIndex are applied first.  The
           remaining packets are accounted for in Flow Records.



<span class="grey">Dietz, et al.                Standards Track                   [Page 42]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-43" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


           Since IPFIX does not define any Selector Function (except
           selecting every packet), this is a placeholder for future
           use and a guideline for implementing enterprise-specific
           Selector Function objects.

           The following object tree should visualize how the
           Selector Function objects should be implemented:

           ipfixSelectorFunctions
           |
           +- ipfixFuncSelectAll
           |  |
           |  +- ipfixFuncSelectAllAvail (is the function available?)
           |
           +- ipfixFuncF2
           |  |
           |  +- ipfixFuncF2Avail (is the function F2 available?)
           |  |
           |  +- ipfixFuncF2Parameters (a table with parameters)
           ...
           |
           +- ipfixFunFn...

           If a Selector Function takes parameters, the MIB should
           contain a table with an entry for each set of parameters
           used at the Exporter."
       ::= { ipfixMainObjects 7 }

   ipfixSelectionProcessEntry OBJECT-TYPE
       SYNTAX      IpfixSelectionProcessEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines an entry in the ipfixSelectionProcessTable."
       INDEX       {
           ipfixMeteringProcessCacheId,
           ipfixSelectionProcessIndex,
           ipfixSelectionProcessSelectorIndex
       }
       ::= { ipfixSelectionProcessTable 1 }

   IpfixSelectionProcessEntry ::= SEQUENCE {
           ipfixSelectionProcessIndex            Unsigned32,
           ipfixSelectionProcessSelectorIndex    Unsigned32,
           ipfixSelectionProcessSelectorFunction OBJECT IDENTIFIER
       }





<span class="grey">Dietz, et al.                Standards Track                   [Page 43]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-44" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   ipfixSelectionProcessIndex OBJECT-TYPE
       SYNTAX      Unsigned32 (1..4294967295)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Locally arbitrary, but unique identifier of an entry in the
           ipfixSelectionProcessTable.  The value is expected to remain
           constant from a re-initialization of the entity's network
           management agent to the next re-initialization."
       ::= { ipfixSelectionProcessEntry 1 }

   ipfixSelectionProcessSelectorIndex OBJECT-TYPE
       SYNTAX      Unsigned32 (1..4294967295)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Index specifying the order in which the referenced
           ipfixSelctionProcessSelectorFunctions are applied to the
           observed packet stream within the given Selection Process
           (identified by the ipfixSelectionProcessIndex).  The
           Selector Functions are applied in increasing order, i.e.,
           Selector Functions with lower index are applied first."
       ::= { ipfixSelectionProcessEntry 2 }

   ipfixSelectionProcessSelectorFunction OBJECT-TYPE
       SYNTAX      OBJECT IDENTIFIER
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The pointer to the Selector Function used at position
           ipfixSelectionProcessSelectorIndex in the list of Selector
           Functions for the Metering Process cache specified by the
           index ipfixMeteringProcessCacheId and for the given
           Selection Process (identified by the
           ipfixSelectionProcessIndex).

           This usually points to an object in the IPFIX SELECTOR MIB.
           If the Selector Function does not take parameters, then it
           MUST point to the root of the function subtree.  If the
           function takes parameters, then it MUST point to an entry
           in the parameter table of the Selector Function."
       ::= { ipfixSelectionProcessEntry 3 }









<span class="grey">Dietz, et al.                Standards Track                   [Page 44]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-45" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   --------------------------------------------------------------------
   -- 1.2.1: Transport Session Statistics Table
   --------------------------------------------------------------------
   ipfixTransportSessionStatsTable  OBJECT-TYPE
       SYNTAX      SEQUENCE OF IpfixTransportSessionStatsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table lists Transport Sessions statistics between
           Exporting Processes and Collecting Processes."
       ::= { ipfixStatistics 1 }

   ipfixTransportSessionStatsEntry OBJECT-TYPE
       SYNTAX      IpfixTransportSessionStatsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines an entry in the ipfixTransportSessionStatsTable."
       AUGMENTS    { ipfixTransportSessionEntry }
       ::= { ipfixTransportSessionStatsTable 1 }

   IpfixTransportSessionStatsEntry ::=
       SEQUENCE {
           ipfixTransportSessionRate              Gauge32,
           ipfixTransportSessionPackets           Counter64,
           ipfixTransportSessionBytes             Counter64,
           ipfixTransportSessionMessages          Counter64,
           ipfixTransportSessionDiscardedMessages Counter64,
           ipfixTransportSessionRecords           Counter64,
           ipfixTransportSessionTemplates         Counter64,
           ipfixTransportSessionOptionsTemplates  Counter64,
           ipfixTransportSessionDiscontinuityTime TimeStamp
       }

   ipfixTransportSessionRate OBJECT-TYPE
       SYNTAX      Gauge32
       UNITS       "bytes/second"
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The number of bytes per second received by the
           Collector or transmitted by the Exporter.  A
           value of zero (0) means that no packets were sent or
           received, yet.  This object is updated every second."
       ::= { ipfixTransportSessionStatsEntry 1 }






<span class="grey">Dietz, et al.                Standards Track                   [Page 45]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-46" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   ipfixTransportSessionPackets OBJECT-TYPE
       SYNTAX      Counter64
       UNITS       "packets"
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The number of packets received by the Collector
           or transmitted by the Exporter.
           Discontinuities in the value of this counter can occur at
           re-initialization of the management system and at other
           times as indicated by the value of
           ipfixTransportSessionDiscontinuityTime."
       ::= { ipfixTransportSessionStatsEntry 2 }

   ipfixTransportSessionBytes OBJECT-TYPE
       SYNTAX      Counter64
       UNITS       "bytes"
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The number of bytes received by the Collector
           or transmitted by the Exporter.
           Discontinuities in the value of this counter can occur at
           re-initialization of the management system and at other
           times as indicated by the value of
           ipfixTransportSessionDiscontinuityTime."
       ::= { ipfixTransportSessionStatsEntry 3 }

   ipfixTransportSessionMessages OBJECT-TYPE
       SYNTAX      Counter64
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The number of IPFIX Messages received by the
           Collector or transmitted by the Exporter.
           Discontinuities in the value of this counter can occur at
           re-initialization of the management system and at other
           times as indicated by the value of
           ipfixTransportSessionDiscontinuityTime."
       ::= { ipfixTransportSessionStatsEntry 4 }

   ipfixTransportSessionDiscardedMessages OBJECT-TYPE
       SYNTAX      Counter64
       MAX-ACCESS  read-only
       STATUS      current






<span class="grey">Dietz, et al.                Standards Track                   [Page 46]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-47" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       DESCRIPTION
           "The number of received IPFIX Message that are malformed,
           cannot be decoded, are received in the wrong order, or are
           missing according to the sequence number.

           If used at the Exporter, the number of messages that could
           not be sent due to, e.g., internal buffer overflows, network
           congestion, or routing issues.
           Discontinuities in the value of this counter can occur at
           re-initialization of the management system and at other
           times as indicated by the value of
           ipfixTransportSessionDiscontinuityTime."
       ::= { ipfixTransportSessionStatsEntry 5 }

   ipfixTransportSessionRecords OBJECT-TYPE
       SYNTAX      Counter64
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The number of Data Records received by the Collector or
           transmitted by the Exporter.
           Discontinuities in the value of this counter can occur at
           re-initialization of the management system and at other
           times as indicated by the value of
           ipfixTransportSessionDiscontinuityTime."
       ::= { ipfixTransportSessionStatsEntry 6 }

   ipfixTransportSessionTemplates OBJECT-TYPE
       SYNTAX      Counter64
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The number of Templates received or transmitted.
           Discontinuities in the value of this counter can occur at
           re-initialization of the management system and at other
           times as indicated by the value of
           ipfixTransportSessionDiscontinuityTime."
       ::= { ipfixTransportSessionStatsEntry 7 }

   ipfixTransportSessionOptionsTemplates OBJECT-TYPE
       SYNTAX      Counter64
       MAX-ACCESS  read-only
       STATUS      current








<span class="grey">Dietz, et al.                Standards Track                   [Page 47]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-48" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       DESCRIPTION
           "The number of Options Templates received or transmitted.
           Discontinuities in the value of this counter can occur at
           re-initialization of the management system and at other
           times as indicated by the value of
           ipfixTransportSessionDiscontinuityTime."
       ::= { ipfixTransportSessionStatsEntry 8 }

   ipfixTransportSessionDiscontinuityTime OBJECT-TYPE
       SYNTAX       TimeStamp
       MAX-ACCESS   read-only
       STATUS       current
       DESCRIPTION
           "The value of sysUpTime at the most recent occasion at which
           one or more of the Transport Session counters suffered a
           discontinuity.
           A value of zero indicates no such discontinuity has
           occurred since the last re-initialization of the local
           management subsystem."
       ::= { ipfixTransportSessionStatsEntry 9 }

   --------------------------------------------------------------------
   -- 1.2.2: Template Statistics Table
   --------------------------------------------------------------------
   ipfixTemplateStatsTable  OBJECT-TYPE
       SYNTAX      SEQUENCE OF IpfixTemplateStatsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table lists statistics objects per Template."
       ::= { ipfixStatistics 2 }

   ipfixTemplateStatsEntry OBJECT-TYPE
       SYNTAX      IpfixTemplateStatsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines an entry in the ipfixTemplateStatsTable."
       AUGMENTS    { ipfixTemplateEntry }
       ::= { ipfixTemplateStatsTable 1 }

   IpfixTemplateStatsEntry ::=
       SEQUENCE {
           ipfixTemplateDataRecords       Counter64,
           ipfixTemplateDiscontinuityTime TimeStamp
       }





<span class="grey">Dietz, et al.                Standards Track                   [Page 48]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-49" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   ipfixTemplateDataRecords OBJECT-TYPE
       SYNTAX      Counter64
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The number of Data Records that are transmitted or received
           per Template.
           Discontinuities in the value of this counter can occur at
           re-initialization of the management system, and at other
           times as indicated by the value of
           ipfixTemplateDiscontinuityTime."
       ::= { ipfixTemplateStatsEntry 1 }

   ipfixTemplateDiscontinuityTime OBJECT-TYPE
       SYNTAX       TimeStamp
       MAX-ACCESS   read-only
       STATUS       current
       DESCRIPTION
           "The value of sysUpTime at the most recent occasion at which
           the Template counter suffered a discontinuity.
           A value of zero indicates no such discontinuity has
           occurred since the last re-initialization of the local
           management subsystem."
       ::= { ipfixTemplateStatsEntry 2 }

   --------------------------------------------------------------------
   -- 1.2.3: Metering Process Statistics Table
   --------------------------------------------------------------------
   ipfixMeteringProcessStatsTable  OBJECT-TYPE
       SYNTAX      SEQUENCE OF IpfixMeteringProcessStatsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table lists statistic objects that have data per
           Metering Process cache.

           On Collectors, this table is not needed."
       ::= { ipfixStatistics 3 }













<span class="grey">Dietz, et al.                Standards Track                   [Page 49]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-50" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   ipfixMeteringProcessStatsEntry OBJECT-TYPE
       SYNTAX      IpfixMeteringProcessStatsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines an entry in the ipfixMeteringProcessStatsTable."
       AUGMENTS    { ipfixMeteringProcessEntry }
       ::= { ipfixMeteringProcessStatsTable 1 }

   IpfixMeteringProcessStatsEntry ::=
       SEQUENCE {
           ipfixMeteringProcessCacheActiveFlows          Gauge32,
           ipfixMeteringProcessCacheUnusedCacheEntries   Gauge32,
           ipfixMeteringProcessCacheDataRecords          Counter64,
           ipfixMeteringProcessCacheDiscontinuityTime    TimeStamp
       }

   ipfixMeteringProcessCacheActiveFlows OBJECT-TYPE
       SYNTAX      Gauge32
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The number of Flows currently active at this cache."
       ::= { ipfixMeteringProcessStatsEntry 1 }

   ipfixMeteringProcessCacheUnusedCacheEntries   OBJECT-TYPE
       SYNTAX      Gauge32
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The number of unused cache entries."
       ::= { ipfixMeteringProcessStatsEntry 2 }

   ipfixMeteringProcessCacheDataRecords OBJECT-TYPE
       SYNTAX      Counter64
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The number of Data Records generated.
           Discontinuities in the value of this counter can occur at
           re-initialization of the management system and at other
           times as indicated by the value of
           ipfixTemplateDiscontinuityTime."
       ::= { ipfixMeteringProcessStatsEntry 3 }







<span class="grey">Dietz, et al.                Standards Track                   [Page 50]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-51" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   ipfixMeteringProcessCacheDiscontinuityTime OBJECT-TYPE
       SYNTAX       TimeStamp
       MAX-ACCESS   read-only
       STATUS       current
       DESCRIPTION
           "The value of sysUpTime at the most recent occasion at which
           the Metering Process counter suffered a discontinuity.
           A value of zero indicates no such discontinuity has
           occurred since the last re-initialization of the local
           management subsystem."
       ::= { ipfixMeteringProcessStatsEntry 4 }

   --------------------------------------------------------------------
   -- 1.2.4: Selection Process Statistics Table
   --------------------------------------------------------------------
   ipfixSelectionProcessStatsTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF IpfixSelectionProcessStatsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table contains statistics for the Selector Functions
           connected to Metering Process by the index
           ipfixMeteringProcessCacheId.

           The indexes MUST match an entry in the
           ipfixSelectionProcessTable."
       ::= { ipfixStatistics 4 }

   ipfixSelectionProcessStatsEntry OBJECT-TYPE
       SYNTAX      IpfixSelectionProcessStatsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines an entry in the ipfixSelectionProcessStatsTable."
       AUGMENTS    { ipfixSelectionProcessEntry }
       ::= { ipfixSelectionProcessStatsTable 1 }

   IpfixSelectionProcessStatsEntry ::= SEQUENCE {
           ipfixSelectionProcessStatsPacketsObserved   Counter64,
           ipfixSelectionProcessStatsPacketsDropped    Counter64,
           ipfixSelectionProcessStatsDiscontinuityTime TimeStamp
       }

   ipfixSelectionProcessStatsPacketsObserved OBJECT-TYPE
       SYNTAX      Counter64
       MAX-ACCESS  read-only
       STATUS      current




<span class="grey">Dietz, et al.                Standards Track                   [Page 51]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-52" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       DESCRIPTION
           "The number of packets observed at the entry point of the
           function.  The entry point may be the Observation Point or
           the exit point of another Selector Function.
           Discontinuities in the value of this counter can occur at
           re-initialization of the management system and at other
           times as indicated by the value of
           ipfixSelectionProcessStatsDiscontinuityTime."
       ::= { ipfixSelectionProcessStatsEntry 1 }

   ipfixSelectionProcessStatsPacketsDropped OBJECT-TYPE
       SYNTAX      Counter64
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The number of packets dropped while selecting packets.
           Discontinuities in the value of this counter can occur at
           re-initialization of the management system and at other
           times as indicated by the value of
           ipfixSelectionProcessStatsDiscontinuityTime."
       ::= { ipfixSelectionProcessStatsEntry 2 }

   ipfixSelectionProcessStatsDiscontinuityTime OBJECT-TYPE
       SYNTAX       TimeStamp
       MAX-ACCESS   read-only
       STATUS       current
       DESCRIPTION
           "The value of sysUpTime at the most recent occasion at which
           one or more of the Selector counters suffered a
           discontinuity.
           A value of zero indicates no such discontinuity has
           occurred since the last re-initialization of the local
           management subsystem."
       ::= { ipfixSelectionProcessStatsEntry 3 }

















<span class="grey">Dietz, et al.                Standards Track                   [Page 52]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-53" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   --==================================================================
   -- 2: Conformance Information
   --==================================================================
   ipfixCompliances OBJECT IDENTIFIER ::= { ipfixConformance 1 }
   ipfixGroups      OBJECT IDENTIFIER ::= { ipfixConformance 2 }

   --------------------------------------------------------------------
   -- 2.1: Compliance Statements
   --------------------------------------------------------------------
   ipfixCollectorCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "An implementation that builds an IPFIX Collector
           that complies to this module MUST implement the objects
           defined in the mandatory group ipfixCommonGroup.

           The implementation of all objects in the other groups is
           optional and depends on the corresponding functionality
           implemented in the equipment.

           An implementation that is compliant to this MIB module
           is limited to use only the values TCP (6), UDP (17), and
           SCTP (132) in the ipfixTransportSessionProtocol object
           because these are the only protocol currently specified
           for usage within IPFIX (see <a href="./rfc5101">RFC 5101</a>)."
       MODULE  -- this module
       MANDATORY-GROUPS {
           ipfixCommonGroup
       }

       GROUP ipfixCommonStatsGroup
       DESCRIPTION
           "These objects should be implemented if the statistics
           function is implemented in the equipment."
       ::= { ipfixCompliances 1 }

   ipfixExporterCompliance MODULE-COMPLIANCE
       STATUS  current
       DESCRIPTION
           "An implementation that builds an IPFIX Exporter that
           complies to this module MUST implement the objects defined
           in the mandatory group ipfixCommonGroup.  The implementation
           of all other objects depends on the implementation of the
           corresponding functionality in the equipment."
       MODULE  -- this module






<span class="grey">Dietz, et al.                Standards Track                   [Page 53]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-54" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       MANDATORY-GROUPS {
               ipfixCommonGroup,
               ipfixExporterGroup
       }

       GROUP ipfixCommonStatsGroup
       DESCRIPTION
           "These objects should be implemented if the statistics
           function is implemented in the equipment."

       GROUP ipfixExporterStatsGroup
       DESCRIPTION
           "These objects MUST be implemented if statistical functions
           are implemented on the equipment."
       ::= { ipfixCompliances 2 }

   --------------------------------------------------------------------
   -- 2.2: MIB Grouping
   --------------------------------------------------------------------
   ipfixCommonGroup OBJECT-GROUP
       OBJECTS {
           ipfixTransportSessionProtocol,
           ipfixTransportSessionSourceAddressType,
           ipfixTransportSessionSourceAddress,
           ipfixTransportSessionDestinationAddressType,
           ipfixTransportSessionDestinationAddress,
           ipfixTransportSessionSourcePort,
           ipfixTransportSessionDestinationPort,
           ipfixTransportSessionSctpAssocId,
           ipfixTransportSessionDeviceMode,
           ipfixTransportSessionTemplateRefreshTimeout,
           ipfixTransportSessionOptionsTemplateRefreshTimeout,
           ipfixTransportSessionTemplateRefreshPacket,
           ipfixTransportSessionOptionsTemplateRefreshPacket,
           ipfixTransportSessionIpfixVersion,
           ipfixTransportSessionStatus,

           ipfixTemplateSetId,
           ipfixTemplateAccessTime,

           ipfixTemplateDefinitionIeId,
           ipfixTemplateDefinitionIeLength,
           ipfixTemplateDefinitionEnterpriseNumber,
           ipfixTemplateDefinitionFlags
       }
       STATUS      current





<span class="grey">Dietz, et al.                Standards Track                   [Page 54]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-55" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       DESCRIPTION
           "The main IPFIX objects."
       ::= { ipfixGroups 1 }

   ipfixCommonStatsGroup OBJECT-GROUP
       OBJECTS {
           ipfixTransportSessionRate,
           ipfixTransportSessionPackets,
           ipfixTransportSessionBytes,
           ipfixTransportSessionMessages,
           ipfixTransportSessionDiscardedMessages,
           ipfixTransportSessionRecords,
           ipfixTransportSessionTemplates,
           ipfixTransportSessionOptionsTemplates,
           ipfixTransportSessionDiscontinuityTime,

           ipfixTemplateDataRecords,
           ipfixTemplateDiscontinuityTime
       }
       STATUS      current
       DESCRIPTION
           "Common statistical objects."
       ::= { ipfixGroups 2 }

   ipfixExporterGroup OBJECT-GROUP
       OBJECTS {
           ipfixExportMemberType,

           ipfixMeteringProcessObservationPointGroupRef,
           ipfixMeteringProcessCacheActiveTimeout,
           ipfixMeteringProcessCacheInactiveTimeout,

           ipfixObservationPointObservationDomainId,
           ipfixObservationPointPhysicalEntity,
           ipfixObservationPointPhysicalInterface,
           ipfixObservationPointPhysicalEntityDirection,

           ipfixSelectionProcessSelectorFunction
       }
       STATUS      current
       DESCRIPTION
           "The main objects for Exporters."
       ::= { ipfixGroups 3 }








<span class="grey">Dietz, et al.                Standards Track                   [Page 55]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-56" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   ipfixExporterStatsGroup OBJECT-GROUP
       OBJECTS {
           ipfixMeteringProcessCacheActiveFlows,
           ipfixMeteringProcessCacheUnusedCacheEntries,
           ipfixMeteringProcessCacheDataRecords,
           ipfixMeteringProcessCacheDiscontinuityTime,

           ipfixSelectionProcessStatsPacketsObserved,
           ipfixSelectionProcessStatsPacketsDropped,
           ipfixSelectionProcessStatsDiscontinuityTime
       }
       STATUS      current
       DESCRIPTION
           "The statistical objects for Exporters."
       ::= { ipfixGroups 4 }

   END

<span class="h3"><a class="selflink" id="section-8.2" href="#section-8.2">8.2</a>.  IPFIX SELECTOR MIB Definition</span>


   IPFIX-SELECTOR-MIB DEFINITIONS ::= BEGIN

   IMPORTS
       MODULE-IDENTITY, OBJECT-TYPE, mib-2
           FROM SNMPv2-SMI                                -- <a href="./rfc2578">RFC2578</a>
       TruthValue
           FROM SNMPv2-TC                                 -- <a href="./rfc2579">RFC2579</a>
       MODULE-COMPLIANCE, OBJECT-GROUP
           FROM SNMPv2-CONF;                              -- <a href="./rfc2580">RFC2580</a>

   ipfixSelectorMIB MODULE-IDENTITY
       LAST-UPDATED "201003150000Z"         -- 15 March 2010
       ORGANIZATION "IETF IPFIX Working Group"
       CONTACT-INFO
           "WG charter:
             <a href="http://www.ietf.org/html.charters/ipfix-charter.html">http://www.ietf.org/html.charters/ipfix-charter.html</a>

           Mailing Lists:
             General Discussion: ipfix@ietf.org
             To Subscribe: <a href="http://www1.ietf.org/mailman/listinfo/ipfix">http://www1.ietf.org/mailman/listinfo/ipfix</a>
             Archive:
         <a href="http://www1.ietf.org/mail-archive/web/ipfix/current/index.html">http://www1.ietf.org/mail-archive/web/ipfix/current/index.html</a>








<span class="grey">Dietz, et al.                Standards Track                   [Page 56]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-57" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


           Editor:
             Thomas Dietz
             NEC Europe Ltd.
             NEC Laboratories Europe
             Network Research Division
             Kurfuersten-Anlage 36
             69115 Heidelberg
             Germany
             Phone: +49 6221 4342-128
             Email: Thomas.Dietz@nw.neclab.eu

             Atsushi Kobayashi
             NTT Information Sharing Platform Laboratories
             3-9-11 Midori-cho
             Musashino-shi
             180-8585
             Japan
             Phone: +81-422-59-3978
             Email: akoba@nttv6.net

             Benoit Claise
             Cisco Systems, Inc.
             De Kleetlaan 6a b1
             Degem 1831
             Belgium
             Phone:  +32 2 704 5622
             Email: bclaise@cisco.com

             Gerhard Muenz
             Technische Universitaet Muenchen
             Department of Informatics
             Chair for Network Architectures and Services (I8)
             Boltzmannstr. 3
             85748 Garching
             Germany
             Phone: +49 89 289-18008
             Email: muenz@net.in.tum.de
             URI:   <a href="http://www.net.in.tum.de/~muenz">http://www.net.in.tum.de/~muenz</a>"
       DESCRIPTION
           "The IPFIX SELECTOR MIB module defines the standard
           filtering and sampling functions that can be referenced in
           the ipfixSelectorTable of the IPFIX MIB.  The subtree
           ipfixSelectorFunctions is a placeholder where all standard
           filtering and sampling functions should be located.

           The IPFIX SELECTOR MIB module is maintained by IANA and can
           be extended through Expert Review [<a href="./rfc5226" title="">RFC5226</a>], i.e., review by
           one of a group of experts designated by an IETF Area



<span class="grey">Dietz, et al.                Standards Track                   [Page 57]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-58" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


           Director.  The group of experts MUST check the requested MIB
           objects for completeness and accuracy of the description.
           Requests for MIB objects that duplicate the functionality of
           existing objects SHOULD be declined.  The smallest available
           OID SHOULD be assigned to a new MIB objects.  The
           specification of new MIB objects SHOULD follow the structure
           specified in <a href="./rfc5815">RFC 5815</a> and MUST be published using a
           well-established and persistent publication medium.  The
           experts will initially be drawn from the Working Group
           Chairs and document editors of the IPFIX and PSAMP Working
           Groups.

           Copyright (c) 2010 IETF Trust and the persons identified as
           authors of the code. All rights reserved.

           Redistribution and use in source and binary forms, with or
           without modification, is permitted pursuant to, and subject
           to the license terms contained in, the Simplified BSD
           License set forth in <a href="#section-4">Section 4</a>.c of the IETF Trust's
           Legal Provisions Relating to IETF Documents
           (<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>)."

   --  Revision history

       REVISION     "201003150000Z"         -- 15 March 2010
       DESCRIPTION
           "Initial version, published as <a href="./rfc5815">RFC 5815</a>."

       ::= { mib-2 194 }

   --******************************************************************
   -- Top Level Structure of the MIB
   --******************************************************************

   ipfixSelectorObjects     OBJECT IDENTIFIER
       ::= { ipfixSelectorMIB 1 }
   ipfixSelectorConformance OBJECT IDENTIFIER
       ::= { ipfixSelectorMIB 2 }

   --==================================================================
   -- 1: Objects used by all IPFIX implementations
   --==================================================================
   --------------------------------------------------------------------
   -- 1.1: Packet Selector Functions for IPFIX
   --------------------------------------------------------------------
   ipfixSelectorFunctions OBJECT IDENTIFIER
       ::= { ipfixSelectorObjects 1 }




<span class="grey">Dietz, et al.                Standards Track                   [Page 58]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-59" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   --------------------------------------------------------------------
   -- 1.1.1: Function 1: Selecting All Packets
   --------------------------------------------------------------------
   ipfixFuncSelectAll OBJECT IDENTIFIER
       ::= { ipfixSelectorFunctions 1 }

   ipfixFuncSelectAllAvail OBJECT-TYPE
       SYNTAX      TruthValue
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "This object indicates the availability of the trivial
           function of selecting all packets.  This function is always
           available."
       ::= { ipfixFuncSelectAll 1 }

   --==================================================================
   -- 2: Conformance Information
   --==================================================================
   ipfixSelectorCompliances OBJECT IDENTIFIER
       ::= { ipfixSelectorConformance 1 }
   ipfixSelectorGroups      OBJECT IDENTIFIER
       ::= { ipfixSelectorConformance 2 }

   --------------------------------------------------------------------
   -- 2.1: Compliance Statements
   --------------------------------------------------------------------
   ipfixSelectorBasicCompliance MODULE-COMPLIANCE
       STATUS  current
       DESCRIPTION
           "An implementation that builds an IPFIX Exporter that
           complies to this module MUST implement the objects defined
           in the mandatory group ipfixBasicGroup.  The implementation
           of all other objects depends on the implementation of the
           corresponding functionality in the equipment."
       MODULE  -- this module
       MANDATORY-GROUPS {
               ipfixSelectorBasicGroup
       }
       ::= { ipfixSelectorCompliances 1 }

   --------------------------------------------------------------------
   -- 2.2: MIB Grouping
   --------------------------------------------------------------------
   ipfixSelectorBasicGroup OBJECT-GROUP
       OBJECTS {
           ipfixFuncSelectAllAvail
       }



<span class="grey">Dietz, et al.                Standards Track                   [Page 59]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-60" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


       STATUS      current
       DESCRIPTION
           "The main IPFIX objects."
       ::= { ipfixSelectorGroups 1 }

   END

<span class="h2"><a class="selflink" id="section-9" href="#section-9">9</a>.  Security Considerations</span>

   There are no management objects defined in this MIB module that have
   a MAX-ACCESS clause of read-write and/or read-create.  So, if these
   MIB modules are implemented correctly, then there is no risk that an
   intruder can alter or create any management objects of these MIB
   modules via direct SNMP SET operations.

   Some of the readable objects in these MIB modules (i.e., objects with
   a MAX-ACCESS other than not-accessible) may be considered sensitive
   or vulnerable in some network environments.  It is thus important to
   control even GET and/or NOTIFY access to these objects and possibly
   to even encrypt the values of these objects when sending them over
   the network via SNMP.  These are the tables and objects and their
   sensitivity/vulnerability:

   o  ipfixTransportSessionTable - contains configuration data that
      might be sensitive because objects in this table may reveal
      information about the network infrastructure

   o  ipfixExportTable - contains configuration data that might be
      sensitive because object in this table may reveal information
      about the network infrastructure as well

   o  ipfixMeteringProcessTable - contains configuration data that might
      be sensitive because objects in this table may reveal information
      about the IPFIX Device itself

   o  ipfixObservationPointTable - contains configuration data that
      might be sensitive because objects in this table may reveal
      information about the IPFIX Device itself and the network
      infrastructure

   o  ipfixSelectorFunctions - currently contains no sensitive data but
      might want to be secured anyway since it may contain sensitive
      data in a future version

   All other objects and tables contain no data that is considered
   sensitive.





<span class="grey">Dietz, et al.                Standards Track                   [Page 60]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-61" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


   SNMP versions prior to SNMPv3 did not include adequate security.
   Even if the network itself is secure (for example by using IPsec),
   even then, there is no control as to who on the secure network is
   allowed to access and GET/SET (read/change/create/delete) the objects
   in these MIB modules.

   It is RECOMMENDED that implementers consider the security features as
   provided by the SNMPv3 framework (see <a href="./rfc3410#section-8">[RFC3410] Section&nbsp;8</a>), including
   full support for the SNMPv3 cryptographic mechanisms (for
   authentication and privacy).

   Further, deployment of SNMP versions prior to SNMPv3 is NOT
   RECOMMENDED.  Instead, it is RECOMMENDED to deploy SNMPv3 and to
   enable cryptographic security.  It is then a customer/operator
   responsibility to ensure that the SNMP entity giving access to an
   instance of these MIB modules is properly configured to give access
   to the objects only to those principals (users) that have legitimate
   rights to indeed GET or SET (change/create/delete) them.

<span class="h2"><a class="selflink" id="section-10" href="#section-10">10</a>.  IANA Considerations</span>

   The MIB module in this document uses the following IANA-assigned
   OBJECT IDENTIFIER values recorded in the SMI Numbers registry:

           Descriptor        OBJECT IDENTIFIER value
           ----------        -----------------------
           ipfixMIB          { mib-2 193 }
           ipfixSelectorMIB  { mib-2 194 }

   Further on, the whole IPFIX SELECTOR MIB module is maintained by
   IANA.  Additions to this MIB module are subject to Expert Review
   [<a href="./rfc5226" title="">RFC5226</a>], i.e., review by one of a group of experts designated by an
   IETF Area Director.  The group of experts MUST check the requested
   MIB objects for completeness and accuracy of the description.
   Requests for MIB objects that duplicate the functionality of existing
   objects SHOULD be declined.  The smallest available OID SHOULD be
   assigned to new MIB objects.  The specification of new MIB objects
   SHOULD follow the structure specified in <a href="#section-6">Section 6</a> and MUST be
   published using a well-established and persistent publication medium.
   The experts will initially be drawn from the Working Group Chairs and
   document editors of the IPFIX and PSAMP Working Groups.

<span class="h2"><a class="selflink" id="section-11" href="#section-11">11</a>.  Acknowledgments</span>

   This document is a product of the IPFIX Working Group.  The authors
   would like to thank the following persons: Paul Aitken for his
   detailed review, Dan Romascanu and the MIB doctors, and many more,
   for the technical reviews and feedback.



<span class="grey">Dietz, et al.                Standards Track                   [Page 61]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-62" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


<span class="h2"><a class="selflink" id="section-12" href="#section-12">12</a>.  References</span>

<span class="h3"><a class="selflink" id="section-12.1" href="#section-12.1">12.1</a>.  Normative References</span>

   [<a id="ref-RFC2119">RFC2119</a>]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>, March 1997.

   [<a id="ref-RFC2578">RFC2578</a>]  McCloghrie, K., Ed., Perkins, D., Ed., and J.
              Schoenwaelder, Ed., "Structure of Management Information
              Version 2 (SMIv2)", STD 58, <a href="./rfc2578">RFC 2578</a>, April 1999.

   [<a id="ref-RFC2579">RFC2579</a>]  McCloghrie, K., Ed., Perkins, D., Ed., and J.
              Schoenwaelder, Ed., "Textual Conventions for SMIv2",
              STD 58, <a href="./rfc2579">RFC 2579</a>, April 1999.

   [<a id="ref-RFC2580">RFC2580</a>]  McCloghrie, K., Perkins, D., and J. Schoenwaelder,
              "Conformance Statements for SMIv2", STD 58, <a href="./rfc2580">RFC 2580</a>,
              April 1999.

   [<a id="ref-RFC4001">RFC4001</a>]  Daniele, M., Haberman, B., Routhier, S., and J.
              Schoenwaelder, "Textual Conventions for Internet Network
              Addresses", <a href="./rfc4001">RFC 4001</a>, February 2005.

   [<a id="ref-RFC2863">RFC2863</a>]  McCloghrie, K. and F. Kastenholz, "The Interfaces Group
              MIB", <a href="./rfc2863">RFC 2863</a>, June 2000.

   [<a id="ref-RFC3873">RFC3873</a>]  Pastor, J. and M. Belinchon, "Stream Control Transmission
              Protocol (SCTP) Management Information Base (MIB)",
              <a href="./rfc3873">RFC 3873</a>, September 2004.

   [<a id="ref-RFC4133">RFC4133</a>]  Bierman, A. and K. McCloghrie, "Entity MIB (Version 3)",
              <a href="./rfc4133">RFC 4133</a>, August 2005.

   [<a id="ref-RFC5101">RFC5101</a>]  Claise, B., "Specification of the IP Flow Information
              Export (IPFIX) Protocol for the Exchange of IP Traffic
              Flow Information", <a href="./rfc5101">RFC 5101</a>, January 2008.

   [<a id="ref-RFC5102">RFC5102</a>]  Quittek, J., Bryant, S., Claise, B., Aitken, P., and J.
              Meyer, "Information Model for IP Flow Information Export",
              <a href="./rfc5102">RFC 5102</a>, January 2008.

   [<a id="ref-RFC5226">RFC5226</a>]  Narten, T. and H. Alvestrand, "Guidelines for Writing an
              IANA Considerations Section in RFCs", <a href="https://www.rfc-editor.org/bcp/bcp26">BCP 26</a>, <a href="./rfc5226">RFC 5226</a>,
              May 2008.







<span class="grey">Dietz, et al.                Standards Track                   [Page 62]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-63" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


<span class="h3"><a class="selflink" id="section-12.2" href="#section-12.2">12.2</a>.  Informative References</span>

   [<a id="ref-RFC3410">RFC3410</a>]  Case, J., Mundy, R., Partain, D., and B. Stewart,
              "Introduction and Applicability Statements for Internet-
              Standard Management Framework", <a href="./rfc3410">RFC 3410</a>, December 2002.

   [<a id="ref-RFC3917">RFC3917</a>]  Quittek, J., Zseby, T., Claise, B., and S. Zander,
              "Requirements for IP Flow Information Export (IPFIX)",
              <a href="./rfc3917">RFC 3917</a>, October 2004.

   [<a id="ref-RFC5470">RFC5470</a>]  Sadasivan, G., Brownlee, N., Claise, B., and J. Quittek,
              "Architecture for IP Flow Information Export", <a href="./rfc5470">RFC 5470</a>,
              March 2009.

   [<a id="ref-RFC5472">RFC5472</a>]  Zseby, T., Boschi, E., Brownlee, N., and B. Claise, "IP
              Flow Information Export (IPFIX) Applicability", <a href="./rfc5472">RFC 5472</a>,
              March 2009.

   [<a id="ref-RFC5474">RFC5474</a>]  Duffield, N., Chiou, D., Claise, B., Greenberg, A.,
              Grossglauser, M., and J. Rexford, "A Framework for Packet
              Selection and Reporting", <a href="./rfc5474">RFC 5474</a>, March 2009.

   [<a id="ref-RFC5475">RFC5475</a>]  Zseby, T., Molina, M., Duffield, N., Niccolini, S., and F.
              Raspall, "Sampling and Filtering Techniques for IP Packet
              Selection", <a href="./rfc5475">RFC 5475</a>, March 2009.

   [<a id="ref-RFC5476">RFC5476</a>]  Claise, B., Johnson, A., and J. Quittek, "Packet Sampling
              (PSAMP) Protocol Specifications", <a href="./rfc5476">RFC 5476</a>, March 2009.























<span class="grey">Dietz, et al.                Standards Track                   [Page 63]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-64" ></span>
<span class="grey"><a href="./rfc5815">RFC 5815</a>                        IPFIX MIB                     April 2010</span>


Authors' Addresses

   Thomas Dietz (editor)
   NEC Europe, Ltd.
   NEC Laboratories Europe
   Network Research Division
   Kurfuersten-Anlage 36
   Heidelberg  69115
   DE

   Phone: +49 6221 4342-128
   EMail: Thomas.Dietz@nw.neclab.eu


   Atsushi Kobayashi
   NTT Information Sharing Platform Laboratories
   3-9-11 Midori-cho
   Musashino-shi, Tokyo  180-8585
   JA

   Phone: +81-422-59-3978
   EMail: akoba@nttv6.net


   Benoit Claise
   Cisco Systems, Inc.
   De Kleetlaan 6a b1
   Degem  1831
   BE

   Phone: +32 2 704 5622
   EMail: bclaise@cisco.com


   Gerhard Muenz
   Technische Universitaet Muenchen
   Department of Informatics
   Chair for Network Architectures and Services (I8)
   Boltzmannstr. 3
   Garching  85748
   DE

   Phone: +49 89 289-18008
   EMail: muenz@net.in.tum.de
   URI:   <a href="http://www.net.in.tum.de/~muenz">http://www.net.in.tum.de/~muenz</a>






Dietz, et al.                Standards Track                   [Page 64]
</pre>