ipfix.xml

<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet type="text/xsl" href="ipfix.xsl"?>
<?oxygen RNGSchema="ipfix.rng" type="xml"?>
<registry xmlns="http://www.iana.org/assignments" id="ipfix">
<title>IP Flow Information Export (IPFIX) Entities</title>
<created>2007-05-10</created>
<updated>2019-07-25</updated>

<note><xref type="rfc" data="rfc7012"/> has obsoleted <xref type="rfc" data="rfc5102"/>. However, references to <xref type="rfc" data="rfc5102"/>
remain as part of the historical record.</note>

<registry id="ipfix-information-elements">
<title>IPFIX Information Elements</title>
<registration_rule>Expert Review</registration_rule>
<expert>IE Doctors</expert>
<xref type="rfc" data="rfc7012"/>
<note>Values 0-127: NFv9-compatible</note>

<record>
<name>Reserved</name>
<elementId>0</elementId>
<description/>
<references>
<paragraph>
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision/>
<date>2013-02-18</date>
</record>

<record>
<name>octetDeltaCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>1</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The number of octets since the previous report (if any)
in incoming packets for this Flow at the Observation Point.
The number of octets includes IP header(s) and IP payload.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>packetDeltaCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>2</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The number of incoming packets since the previous report
(if any) for this Flow at the Observation Point.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>deltaFlowCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>3</elementId>
<status>current</status>
<description>
<paragraph>
The conservative count of Original Flows contributing
to this Aggregated Flow; may be distributed via any of the methods
expressed by the valueDistributionMethod Information Element.
</paragraph>
</description>
<units>flows</units>
<xref type="rfc" data="rfc7015"/>
<revision>1</revision>
<date>2013-06-25</date>
</record>

<record>
<name>protocolIdentifier</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>4</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The value of the protocol number in the IP packet header.
The protocol number identifies the IP packet payload type.
Protocol numbers are defined in the IANA Protocol Numbers
registry.
</paragraph>
<paragraph>
In Internet Protocol version 4 (IPv4), this is carried in the
Protocol field.  In Internet Protocol version 6 (IPv6), this
is carried in the Next Header field in the last extension
header of the packet.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the specification of the IPv4
protocol field.
See <xref type="rfc" data="rfc8200"/> for the specification of the
IPv6 protocol field.
See the list of protocol numbers assigned by IANA at <xref type="registry" data="protocol-numbers"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipClassOfService</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>5</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
For IPv4 packets, this is the value of the TOS field in
the IPv4 packet header.  For IPv6 packets, this is the
value of the Traffic Class field in the IPv6 packet header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc1812"/> (Section 5.3.2) and <xref type="rfc" data="rfc791"/> for the definition of the IPv4 TOS field.
See <xref type="rfc" data="rfc8200"/> for the definition of the IPv6
Traffic Class field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpControlBits</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>6</elementId>
<status>current</status>
<description>
<paragraph>
TCP control bits observed for the packets of this Flow.
This information is encoded as a bit field; for each TCP control
bit, there is a bit in this set.  The bit is set to 1 if any
observed packet of this Flow has the corresponding TCP control bit
set to 1.  The bit is cleared to 0 otherwise.
</paragraph>
<paragraph>
The values of each bit are shown below, per the definition of the
bits in the TCP header <xref type="rfc" data="rfc793"/><xref type="rfc" data="rfc3168"/>:
</paragraph>
<artwork>
 MSb                                                         LSb
  0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
|               |           | N | C | E | U | A | P | R | S | F |
|     Zero      |   Future  | S | W | C | R | C | S | S | Y | I |
| (Data Offset) |    Use    |   | R | E | G | K | H | T | N | N |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

bit    flag
value  name  description
------+-----+-------------------------------------
0x8000       Zero (see tcpHeaderLength)
0x4000       Zero (see tcpHeaderLength)
0x2000       Zero (see tcpHeaderLength)
0x1000       Zero (see tcpHeaderLength)
0x0800       Future Use
0x0400       Future Use
0x0200       Future Use
0x0100   NS  ECN Nonce Sum
0x0080  CWR  Congestion Window Reduced
0x0040  ECE  ECN Echo
0x0020  URG  Urgent Pointer field significant
0x0010  ACK  Acknowledgment field significant
0x0008  PSH  Push Function
0x0004  RST  Reset the connection
0x0002  SYN  Synchronize sequence numbers
0x0001  FIN  No more data from sender
</artwork>
<paragraph>
As the most significant 4 bits of octets 12 and 13 (counting from
zero) of the TCP header <xref type="rfc" data="rfc793"/> are used to encode the TCP data
offset (header length), the corresponding bits in this Information
Element MUST be exported as zero and MUST be ignored by the
collector.  Use the tcpHeaderLength Information Element to encode
this value.
</paragraph>
<paragraph>
Each of the 3 bits (0x800, 0x400, and 0x200), which are reserved
for future use in <xref type="rfc" data="rfc793"/>, SHOULD be exported as observed in the
TCP headers of the packets of this Flow.
</paragraph>
<paragraph>
If exported as a single octet with reduced-size encoding, this
Information Element covers the low-order octet of this field (i.e,
bits 0x80 to 0x01), omitting the ECN Nonce Sum and the three
Future Use bits.  A collector receiving this Information Element
with reduced-size encoding must not assume anything about the
content of these four bits.
</paragraph>
<paragraph>
Exporting Processes exporting this Information Element on behalf
of a Metering Process that is not capable of observing any of the
ECN Nonce Sum or Future Use bits SHOULD use reduced-size encoding,
and only export the least significant 8 bits of this Information
Element.
</paragraph>
<paragraph>
Note that previous revisions of this Information Element's
definition specified that the CWR and ECE bits must be exported as
zero, even if observed.  Collectors should therefore not assume
that a value of zero for these bits in this Information Element
indicates the bits were never set in the observed traffic,
especially if these bits are zero in every Flow Record sent by a
given exporter.
</paragraph>
</description>
<references>
<paragraph>
<xref type="rfc" data="rfc793"/><xref type="rfc" data="rfc3168"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7125"/>
<revision>1</revision>
<date>2014-01-03</date>
</record>

<record>
<name>sourceTransportPort</name>
<dataType>unsigned16</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>7</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The source port identifier in the transport header.
For the transport protocols UDP, TCP, and SCTP, this is the
source port number given in the respective header.  This
field MAY also be used for future transport protocols that
have 16-bit source port identifiers.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc768"/> for the definition of the UDP
source port field.
See <xref type="rfc" data="rfc793"/> for the definition of the TCP
source port field.
See <xref type="rfc" data="rfc4960"/> for the definition of SCTP.
</paragraph>
<paragraph>
Additional information on defined UDP and TCP port numbers can be
found at <xref type="registry" data="service-names-port-numbers"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>sourceIPv4Address</name>
<dataType>ipv4Address</dataType>
<group>ipHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>8</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The IPv4 source address in the IP packet header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the definition of the IPv4
source address field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>sourceIPv4PrefixLength</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<elementId>9</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
The number of contiguous bits that are relevant in the
sourceIPv4Prefix Information Element.
</paragraph>
</description>
<units>bits</units>
<range>0-32</range>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ingressInterface</name>
<dataType>unsigned32</dataType>
<group>scope</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>10</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The index of the IP interface where packets of this Flow
are being received.  The value matches the value of managed
object 'ifIndex' as defined in <xref type="rfc" data="rfc2863"/>.
Note that ifIndex values are not assigned statically to an
interface and that the interfaces may be renumbered every
time the device's management system is re-initialized, as
specified in <xref type="rfc" data="rfc2863"/>.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc2863"/> for the definition of the
ifIndex object.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>destinationTransportPort</name>
<dataType>unsigned16</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>11</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The destination port identifier in the transport header.
For the transport protocols UDP, TCP, and SCTP, this is the
destination port number given in the respective header.
This field MAY also be used for future transport protocols
that have 16-bit destination port identifiers.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc768"/> for the definition of the UDP
destination port field.
See <xref type="rfc" data="rfc793"/> for the definition of the TCP
destination port field.
See <xref type="rfc" data="rfc4960"/> for the definition of SCTP.
</paragraph>
<paragraph>
Additional information on defined UDP and TCP port numbers can be
found at <xref type="registry" data="service-names-port-numbers"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>destinationIPv4Address</name>
<dataType>ipv4Address</dataType>
<group>ipHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>12</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The IPv4 destination address in the IP packet header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the definition of the IPv4
destination address field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>destinationIPv4PrefixLength</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<elementId>13</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
The number of contiguous bits that are relevant in the
destinationIPv4Prefix Information Element.
</paragraph>
</description>
<units>bits</units>
<range>0-32</range>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>egressInterface</name>
<dataType>unsigned32</dataType>
<group>scope</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>14</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The index of the IP interface where packets of
this Flow are being sent.  The value matches the value of
managed object 'ifIndex' as defined in <xref type="rfc" data="rfc2863"/>.
Note that ifIndex values are not assigned statically to an
interface and that the interfaces may be renumbered every
time the device's management system is re-initialized, as
specified in <xref type="rfc" data="rfc2863"/>.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc2863"/> for the definition of the
ifIndex object.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipNextHopIPv4Address</name>
<dataType>ipv4Address</dataType>
<group>derived</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>15</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The IPv4 address of the next IPv4 hop.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>bgpSourceAsNumber</name>
<dataType>unsigned32</dataType>
<group>derived</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>16</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The autonomous system (AS) number of the source IP address.
If AS path information for this Flow is only available as
an unordered AS set (and not as an ordered AS sequence),
then the value of this Information Element is 0.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc4271"/> for a description of BGP-4, and
see <xref type="rfc" data="rfc1930"/> for the definition of the AS
number.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>bgpDestinationAsNumber</name>
<dataType>unsigned32</dataType>
<group>derived</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>17</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The autonomous system (AS) number of the destination IP
address.  If AS path information for this Flow is only
available as an unordered AS set (and not as an ordered AS
sequence), then the value of this Information Element is 0.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc4271"/> for a description of BGP-4, and
see <xref type="rfc" data="rfc1930"/> for the definition of the AS
number.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>bgpNextHopIPv4Address</name>
<dataType>ipv4Address</dataType>
<group>derived</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>18</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The IPv4 address of the next (adjacent) BGP hop.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc4271"/> for a description of BGP-4.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>postMCastPacketDeltaCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>19</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The number of outgoing multicast packets since the
previous report (if any) sent for packets of this Flow
by a multicast daemon within the Observation Domain.
This property cannot necessarily be observed at the
Observation Point, but may be retrieved by other means.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postMCastOctetDeltaCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>20</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The number of octets since the previous report (if any)
in outgoing multicast packets sent for packets of this
Flow by a multicast daemon within the Observation Domain.
This property cannot necessarily be observed at the
Observation Point, but may be retrieved by other means.
The number of octets includes IP header(s) and IP payload.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowEndSysUpTime</name>
<dataType>unsigned32</dataType>
<group>timestamp</group>
<elementId>21</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The relative timestamp of the last packet of this Flow. It indicates the
number of milliseconds since the last (re-)initialization of the IPFIX
Device (sysUpTime). sysUpTime can be calculated from
systemInitTimeMilliseconds.
</paragraph>
</description>
<units>milliseconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-01-11</date>
</record>

<record>
<name>flowStartSysUpTime</name>
<dataType>unsigned32</dataType>
<group>timestamp</group>
<elementId>22</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The relative timestamp of the first packet of this Flow. It indicates
the number of milliseconds since the last (re-)initialization of the
IPFIX Device (sysUpTime). sysUpTime can be calculated from
systemInitTimeMilliseconds.
</paragraph>
</description>
<units>milliseconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-01-11</date>
</record>

<record>
<name>postOctetDeltaCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>23</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical
to the definition of Information Element
'octetDeltaCount', except that it reports a
potentially modified value caused by a middlebox
function after the packet passed the Observation Point.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postPacketDeltaCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>24</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical
to the definition of Information Element
'packetDeltaCount', except that it reports a
potentially modified value caused by a middlebox
function after the packet passed the Observation Point.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>minimumIpTotalLength</name>
<dataType>unsigned64</dataType>
<group>minMax</group>
<elementId>25</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
Length of the smallest packet observed for this Flow.
The packet length includes the IP header(s) length and
the IP payload length.
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the specification of the IPv4
total length.
See <xref type="rfc" data="rfc8200"/> for the specification of the
IPv6 payload length.
See <xref type="rfc" data="rfc2675"/> for the specification of the
IPv6 jumbo payload length.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>maximumIpTotalLength</name>
<dataType>unsigned64</dataType>
<group>minMax</group>
<elementId>26</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
Length of the largest packet observed for this Flow.
The packet length includes the IP header(s) length and
the IP payload length.
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the specification of the IPv4
total length.
See <xref type="rfc" data="rfc8200"/> for the specification of the
IPv6 payload length.
See <xref type="rfc" data="rfc2675"/> for the specification of the
IPv6 jumbo payload length.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>sourceIPv6Address</name>
<dataType>ipv6Address</dataType>
<group>ipHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>27</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The IPv6 source address in the IP packet header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc8200"/> for the definition of the Source
Address field in the IPv6 header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>destinationIPv6Address</name>
<dataType>ipv6Address</dataType>
<group>ipHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>28</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The IPv6 destination address in the IP packet header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc8200"/> for the definition of the
Destination Address field in the IPv6 header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>sourceIPv6PrefixLength</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<elementId>29</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
The number of contiguous bits that are relevant in the
sourceIPv6Prefix Information Element.
</paragraph>
</description>
<units>bits</units>
<range>0-128</range>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>destinationIPv6PrefixLength</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<elementId>30</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
The number of contiguous bits that are relevant in the
destinationIPv6Prefix Information Element.
</paragraph>
</description>
<units>bits</units>
<range>0-128</range>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowLabelIPv6</name>
<dataType>unsigned32</dataType>
<group>ipHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>31</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The value of the IPv6 Flow Label field in the IP packet header.
</paragraph>
</description>
<range>0-0xFFFFF</range>
<references>
<paragraph>
See <xref type="rfc" data="rfc8200"/> for the definition of the
Flow Label field in the IPv6 packet header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record>
<name>icmpTypeCodeIPv4</name>
<dataType>unsigned16</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>32</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
Type and Code of the IPv4 ICMP message.  The combination of
both values is reported as (ICMP type * 256) + ICMP code.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc792"/> for the definition of the IPv4
ICMP type and code fields.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>igmpType</name>
<dataType>unsigned8</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>33</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The type field of the IGMP message.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3376"/> for the definition of the IGMP
type field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>samplingInterval</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>34</elementId>
<status>deprecated</status>
<description>
<paragraph>
Deprecated in favor of 305 samplingPacketInterval.  When using
sampled NetFlow, the rate at which packets are sampled -- e.g., a
value of 100 indicates that one of every 100 packets is sampled.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>samplingAlgorithm</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>35</elementId>
<status>deprecated</status>
<description>
<paragraph>
Deprecated in favor of 304 selectorAlgorithm.  The type of
algorithm used for sampled NetFlow:
</paragraph>
<artwork>

1 - Deterministic Sampling,
2 - Random Sampling.

</artwork>
<paragraph>
The values are not compatible with the selectorAlgorithm IE, where
"Deterministic" has been replaced by "Systematic count-based" (1)
or "Systematic time-based" (2), and "Random" is (3).  Conversion
is required; see <xref type="registry" data="psamp-parameters">Packet Sampling (PSAMP) Parameters.</xref>
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>flowActiveTimeout</name>
<dataType>unsigned16</dataType>
<group>misc</group>
<elementId>36</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The number of seconds after which an active Flow is timed out
anyway, even if there is still a continuous flow of packets.
</paragraph>
</description>
<units>seconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowIdleTimeout</name>
<dataType>unsigned16</dataType>
<group>misc</group>
<elementId>37</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
A Flow is considered to be timed out if no packets belonging
to the Flow have been observed for the number of seconds
specified by this field.
</paragraph>
</description>
<units>seconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>engineType</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>38</elementId>
<status>deprecated</status>
<description>
<paragraph>
Type of flow switching engine in a router/switch:
</paragraph>
<artwork>
RP = 0,
VIP/Line card = 1,
PFC/DFC = 2.
</artwork>
<paragraph>
Reserved for internal use on the Collector.
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>engineId</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>39</elementId>
<status>deprecated</status>
<description>
<paragraph>
Versatile Interface Processor (VIP) or line card slot number of the flow switching engine in a
router/switch.  Reserved for internal use on the Collector.
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>exportedOctetTotalCount</name>
<dataType>unsigned64</dataType>
<group>processCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>40</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of octets that the Exporting Process
has sent since the Exporting Process (re-)initialization
to a particular Collecting Process.
The value of this Information Element is calculated by
summing up the IPFIX Message Header length values of all
IPFIX Messages that were successfully sent to the Collecting
Process.  The reported number excludes octets in the IPFIX
Message that carries the counter value.
If this Information Element is sent to a particular
Collecting Process, then by default it specifies the number
of octets sent to this Collecting Process.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>exportedMessageTotalCount</name>
<dataType>unsigned64</dataType>
<group>processCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>41</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of IPFIX Messages that the Exporting Process
has sent since the Exporting Process (re-)initialization to
a particular Collecting Process.
The reported number excludes the IPFIX Message that carries
the counter value.
If this Information Element is sent to a particular
Collecting Process, then by default it specifies the number
of IPFIX Messages sent to this Collecting Process.
</paragraph>
</description>
<units>messages</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>exportedFlowRecordTotalCount</name>
<dataType>unsigned64</dataType>
<group>processCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>42</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of Flow Records that the Exporting
Process has sent as Data Records since the Exporting
Process (re-)initialization to a particular Collecting
Process.  The reported number excludes Flow Records in
the IPFIX Message that carries the counter value.
If this Information Element is sent to a particular
Collecting Process, then by default it specifies the number
of Flow Records sent to this process.
</paragraph>
</description>
<units>flows</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipv4RouterSc</name>
<dataType>ipv4Address</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>43</elementId>
<status>deprecated</status>
<description>
<paragraph>
This is a platform-specific field for the Catalyst 5000/Catalyst 6000
family.  It is used to store the address of a router that is being
shortcut when performing MultiLayer Switching.
</paragraph>
</description>
<references>
<paragraph>
<xref type="uri" data="http://www.cisco.com/en/US/products/hw/switches/ps700/products_configuration_example09186a00800ab513.shtml">CCO-MLS</xref> describes MultiLayer Switching.
</paragraph>
</references>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>sourceIPv4Prefix</name>
<dataType>ipv4Address</dataType>
<group>ipHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>44</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
IPv4 source address prefix.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>destinationIPv4Prefix</name>
<dataType>ipv4Address</dataType>
<group>ipHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>45</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph> IPv4 destination address prefix. </paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>mplsTopLabelType</name>
<dataType>unsigned8</dataType>
<group>derived</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>46</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
This field identifies the control protocol that allocated the
top-of-stack label.  Values for this field are listed in the 
MPLS label type registry. See 
<xref type="uri" data="http://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-mpls-label-type"/>
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3031"/> for the MPLS label structure.
See <xref type="rfc" data="rfc4364"/> for the association of MPLS
labels with Virtual Private Networks (VPNs).
See <xref type="rfc" data="rfc4271"/> for BGP and BGP routing.
See <xref type="rfc" data="rfc5036"/> for Label Distribution Protocol
(LDP).
See the list of MPLS label types assigned by IANA at <xref type="registry" data="mpls-label-values"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>mplsTopLabelIPv4Address</name>
<dataType>ipv4Address</dataType>
<group>derived</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>47</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The IPv4 address of the system that the MPLS top label will
cause this Flow to be forwarded to.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3031"/> for the association between MPLS
labels and IP addresses.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>samplerId</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>48</elementId>
<status>deprecated</status>
<description>
<paragraph>
Deprecated in favor of 302 selectorId.  The unique identifier
associated with samplerName.
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>samplerMode</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>49</elementId>
<status>deprecated</status>
<description>
<paragraph>
Deprecated in favor of 304 selectorAlgorithm.  The values are not
compatible: selectorAlgorithm=3 is random sampling.  The type of
algorithm used for sampling data: 1 - Deterministic, 2 - Random
Sampling.  Use with samplerRandomInterval.
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>samplerRandomInterval</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>50</elementId>
<status>deprecated</status>
<description>
<paragraph>
Deprecated in favor of 305 samplingPacketInterval.  Packet
interval at which to sample -- in case of random sampling.  Used in
connection with the samplerMode 0x02 (random sampling) value.
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>classId</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>51</elementId>
<status>deprecated</status>
<description>
<paragraph>
Deprecated in favor of 302 selectorId.  Characterizes the traffic
class, i.e., QoS treatment.
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>minimumTTL</name>
<dataType>unsigned8</dataType>
<group>minMax</group>
<elementId>52</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
Minimum TTL value observed for any packet in this Flow.
</paragraph>
</description>
<units>hops</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the definition of the IPv4
Time to Live field.
See <xref type="rfc" data="rfc8200"/> for the definition of the IPv6
Hop Limit field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>maximumTTL</name>
<dataType>unsigned8</dataType>
<group>minMax</group>
<elementId>53</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
Maximum TTL value observed for any packet in this Flow.
</paragraph>
</description>
<units>hops</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the definition of the IPv4
Time to Live field.
See <xref type="rfc" data="rfc8200"/> for the definition of the IPv6
Hop Limit field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>fragmentIdentification</name>
<dataType>unsigned32</dataType>
<group>ipHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>54</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The value of the Identification field
in the IPv4 packet header or in the IPv6 Fragment header,
respectively.  The value is 0 for IPv6 if there is
no fragment header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the definition of the IPv4
Identification field.
See <xref type="rfc" data="rfc8200"/> for the definition of the
Identification field in the IPv6 Fragment header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postIpClassOfService</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>55</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical
to the definition of Information Element
'ipClassOfService', except that it reports a
potentially modified value caused by a middlebox
function after the packet passed the Observation Point.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the definition of the IPv4
TOS field.
See <xref type="rfc" data="rfc8200"/> for the definition of the IPv6
Traffic Class field.
See <xref type="rfc" data="rfc3234"/> for the definition of
middleboxes.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>sourceMacAddress</name>
<dataType>macAddress</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>56</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The IEEE 802 source MAC address field.
</paragraph>
</description>
<references>
<paragraph>See IEEE.802-3.2002.</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>postDestinationMacAddress</name>
<dataType>macAddress</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>57</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical
to the definition of Information Element
'destinationMacAddress', except that it reports a
potentially modified value caused by a middlebox
function after the packet passed the Observation Point.
</paragraph>
</description>
<references>
<paragraph>See IEEE.802-3.2002.</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>vlanId</name>
<dataType>unsigned16</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>58</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
Virtual LAN identifier associated with ingress interface. For dot1q vlans, see 243
dot1qVlanId.
</paragraph>
</description>
<references>
<paragraph>See IEEE.802-1Q.2003.</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postVlanId</name>
<dataType>unsigned16</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>59</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
Virtual LAN identifier associated with egress interface. For postdot1q vlans, see 254, postDot1qVlanId.
</paragraph>
</description>
<references>
<paragraph>See IEEE.802-1Q.2003.</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipVersion</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>60</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The IP version field in the IP packet header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the definition of the version
field in the IPv4 packet header.
See <xref type="rfc" data="rfc8200"/> for the definition of the
version field in the IPv6 packet header.
Additional information on defined version numbers can be found at
<xref type="registry" data="version-numbers"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowDirection</name>
<dataType>unsigned8</dataType>
<group>misc</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>61</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The direction of the Flow observed at the Observation
Point.  There are only two values defined.
</paragraph>
<artwork>
0x00: ingress flow
0x01: egress flow
</artwork>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipNextHopIPv6Address</name>
<dataType>ipv6Address</dataType>
<group>derived</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>62</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The IPv6 address of the next IPv6 hop.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>bgpNextHopIPv6Address</name>
<dataType>ipv6Address</dataType>
<group>derived</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>63</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The IPv6 address of the next (adjacent) BGP hop.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc4271"/> for a description of BGP-4.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>ipv6ExtensionHeaders</name>
<dataType>unsigned32</dataType>
<group>minMax</group>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>64</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
IPv6 extension headers observed in packets of this Flow.
The information is encoded in a set of bit fields.  For
each IPv6 option header, there is a bit in this set.
The bit is set to 1 if any observed packet of this Flow
contains the corresponding IPv6 extension header.
Otherwise, if no observed packet of this Flow contained
the respective IPv6 extension header, the value of the
corresponding bit is 0.
</paragraph>
<artwork>
        0     1     2     3     4     5     6     7
    +-----+-----+-----+-----+-----+-----+-----+-----+
    | DST | HOP | Res | UNK |FRA0 | RH  |FRA1 | Res |  ...
    +-----+-----+-----+-----+-----+-----+-----+-----+

        8     9    10    11    12    13    14    15
    +-----+-----+-----+-----+-----+-----+-----+-----+
... |           Reserved    | MOB | ESP | AH  | PAY | ...
    +-----+-----+-----+-----+-----+-----+-----+-----+

       16    17    18    19    20    21    22    23
    +-----+-----+-----+-----+-----+-----+-----+-----+
... |                  Reserved                     | ...
    +-----+-----+-----+-----+-----+-----+-----+-----+

       24    25    26    27    28    29    30    31
    +-----+-----+-----+-----+-----+-----+-----+-----+
... |                  Reserved                     |
    +-----+-----+-----+-----+-----+-----+-----+-----+

Bit    IPv6 Option   Description

0, DST      60       Destination option header
1, HOP       0       Hop-by-hop option header
2, Res               Reserved
3, UNK               Unknown Layer 4 header
                     (compressed, encrypted, not supported)
4, FRA0     44       Fragment header - first fragment
5, RH       43       Routing header
6, FRA1     44       Fragmentation header - not first fragment
7, Res               Reserved
8 to 11              Reserved
12, MOB     135      IPv6 mobility [RFC3775]
13, ESP      50      Encrypted security payload
14, AH       51      Authentication Header
15, PAY     108      Payload compression header
16 to 31             Reserved
</artwork>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc8200"/> for the general definition of
IPv6 extension headers and for the specification of the hop-by-hop
options header, the routing header, the fragment header, and the
destination options header.
See <xref type="rfc" data="rfc4302"/> for the specification of the
authentication header.
See <xref type="rfc" data="rfc4303"/> for the specification of the
encapsulating security payload.

The diagram provided in <xref type="rfc" data="rfc5102"/> is incorrect.  
The diagram in this registry is taken from Errata 1738. See <xref type="rfc-errata" data="1738"/>       
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>Assigned for NetFlow v9 compatibility</name>
<elementId>65-69</elementId>
<references>
<paragraph>
<xref type="rfc" data="rfc3954"/>
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>mplsTopLabelStackSection</name>
<dataType>octetArray</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>70</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The Label, Exp, and S fields from the top MPLS label
stack entry, i.e., from the last label that was pushed.
</paragraph>
<paragraph>
The size of this Information Element is 3 octets.
</paragraph>
<artwork>
 0                   1                   2
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                Label                  | Exp |S|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Label:  Label Value, 20 bits
Exp:    Experimental Use, 3 bits
S:      Bottom of Stack, 1 bit
</artwork>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>mplsLabelStackSection2</name>
<dataType>octetArray</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>71</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The Label, Exp, and S fields from the label stack entry that
was pushed immediately before the label stack entry that would
be reported by mplsTopLabelStackSection.  See the definition of
mplsTopLabelStackSection for further details.
</paragraph>
<paragraph>
The size of this Information Element is 3 octets.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>mplsLabelStackSection3</name>
<dataType>octetArray</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>72</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The Label, Exp, and S fields from the label stack entry that
was pushed immediately before the label stack entry that would
be reported by mplsLabelStackSection2.  See the definition of
mplsTopLabelStackSection for further details.
</paragraph>
<paragraph>
The size of this Information Element is 3 octets.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>mplsLabelStackSection4</name>
<dataType>octetArray</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>73</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The Label, Exp, and S fields from the label stack entry that
was pushed immediately before the label stack entry that would
be reported by mplsLabelStackSection3.  See the definition of
mplsTopLabelStackSection for further details.
</paragraph>
<paragraph>
The size of this Information Element is 3 octets.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>mplsLabelStackSection5</name>
<dataType>octetArray</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>74</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The Label, Exp, and S fields from the label stack entry that
was pushed immediately before the label stack entry that would
be reported by mplsLabelStackSection4.  See the definition of
mplsTopLabelStackSection for further details.
</paragraph>
<paragraph>
The size of this Information Element is 3 octets.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>mplsLabelStackSection6</name>
<dataType>octetArray</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>75</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The Label, Exp, and S fields from the label stack entry that
was pushed immediately before the label stack entry that would
be reported by mplsLabelStackSection5.  See the definition of
mplsTopLabelStackSection for further details.
</paragraph>
<paragraph>
The size of this Information Element is 3 octets.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>mplsLabelStackSection7</name>
<dataType>octetArray</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>76</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The Label, Exp, and S fields from the label stack entry that
was pushed immediately before the label stack entry that would
be reported by mplsLabelStackSection6.  See the definition of
mplsTopLabelStackSection for further details.
</paragraph>
<paragraph>
The size of this Information Element is 3 octets.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>mplsLabelStackSection8</name>
<dataType>octetArray</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>77</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The Label, Exp, and S fields from the label stack entry that
was pushed immediately before the label stack entry that would
be reported by mplsLabelStackSection7.  See the definition of
mplsTopLabelStackSection for further details.
</paragraph>
<paragraph>
The size of this Information Element is 3 octets.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>mplsLabelStackSection9</name>
<dataType>octetArray</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>78</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The Label, Exp, and S fields from the label stack entry that
was pushed immediately before the label stack entry that would
be reported by mplsLabelStackSection8.  See the definition of
mplsTopLabelStackSection for further details.
</paragraph>
<paragraph>
The size of this Information Element is 3 octets.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>mplsLabelStackSection10</name>
<dataType>octetArray</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>79</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The Label, Exp, and S fields from the label stack entry that
was pushed immediately before the label stack entry that would
be reported by mplsLabelStackSection9.  See the definition of
mplsTopLabelStackSection for further details.
</paragraph>
<paragraph>
The size of this Information Element is 3 octets.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>destinationMacAddress</name>
<dataType>macAddress</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>80</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The IEEE 802 destination MAC address field.
</paragraph>
</description>
<references>
<paragraph>
See IEEE.802-3.2002.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>postSourceMacAddress</name>
<dataType>macAddress</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>81</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical
to the definition of Information Element
'sourceMacAddress', except that it reports a
potentially modified value caused by a middlebox
function after the packet passed the Observation Point.
</paragraph>
</description>
<references>
<paragraph>
See IEEE.802-3.2002.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>interfaceName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>82</elementId>
<status>current</status>
<description>
<paragraph>
A short name uniquely describing an interface, eg "Eth1/0".
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc2863"/> for the definition of the ifName object.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record> 

<record>
<name>interfaceDescription</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>83</elementId>
<status>current</status>
<description>
<paragraph>
The description of an interface, eg "FastEthernet 1/0" or "ISP 
connection".
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc2863"/> for the definition of the ifDescr object.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>samplerName</name>
<dataType>string</dataType>
<elementId>84</elementId>
<status>deprecated</status>
<description>
<paragraph>
Deprecated in favor of 335 selectorName.  Name of the flow 
sampler.
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>octetTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>85</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The total number of octets in incoming packets
for this Flow at the Observation Point since the Metering
Process (re-)initialization for this Observation Point.  The
number of octets includes IP header(s) and IP payload.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>packetTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>86</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The total number of incoming packets for this Flow
at the Observation Point since the Metering Process
(re-)initialization for this Observation Point.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flagsAndSamplerId</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>87</elementId>
<status>deprecated</status>
<description>
<paragraph>
Flow flags and the value of the sampler ID (samplerId) combined in
one bitmapped field.  Reserved for internal use on the Collector.
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>fragmentOffset</name>
<dataType>unsigned16</dataType>
<group>ipHeader</group>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>88</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The value of the IP fragment offset field in the
IPv4 packet header or the IPv6 Fragment header,
respectively.  The value is 0 for IPv6 if there is
no fragment header.
</paragraph>
</description>
<range>0-0x1FFF</range>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the specification of the
fragment offset in the IPv4 header.
See <xref type="rfc" data="rfc8200"/> for the specification of the
fragment offset in the IPv6 Fragment header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record>
<name>forwardingStatus</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>89</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element describes the forwarding status of the
flow and any attached reasons.
</paragraph>
<paragraph>
The layout of the encoding is as follows:
</paragraph>
<artwork>
MSB  -  0   1   2   3   4   5   6   7  -  LSB
      +---+---+---+---+---+---+---+---+
      | Status|  Reason code or flags |
      +---+---+---+---+---+---+---+---+
</artwork>
<paragraph>
See the Forwarding Status sub-registries at <xref type="uri" data="http://www.iana.org/assignments/ipfix/ipfix.xhtml#forwarding-status"/>.
</paragraph>
<artwork>
Examples:

value : 0x40 = 64
binary: 01000000
decode: 01        -&gt; Forward
          000000  -&gt; No further information

value : 0x89 = 137
binary: 10001001
decode: 10        -&gt; Drop
          001001  -&gt; Bad TTL

</artwork>
</description>
<references>
<paragraph>
See "NetFlow Version 9 Flow-Record Format" <xref type="uri" data="http://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html">CCO-NF9FMT</xref>. 
</paragraph>
</references>
<xref type="rfc" data="rfc7270"/>
  <xref type="rfc-errata" data="5262"/>
<revision>2</revision>
<date>2018-02-21</date>
</record>

<record>
<name>mplsVpnRouteDistinguisher</name>
<dataType>octetArray</dataType>
<group>derived</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>90</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The value of the VPN route distinguisher of a corresponding
entry in a VPN routing and forwarding table.  Route
distinguisher ensures that the same address can be used in
several different MPLS VPNs and that it is possible for BGP to
carry several completely different routes to that address, one
for each VPN.  According to <xref type="rfc" data="rfc4364"/>, the size of
mplsVpnRouteDistinguisher is 8 octets.  However, in <xref type="rfc" data="rfc4382"/> an
octet string with flexible length was chosen for representing a
VPN route distinguisher by object MplsL3VpnRouteDistinguisher.
This choice was made in order to be open to future changes of
the size.  This idea was adopted when choosing octetArray as
abstract data type for this Information Element.  The maximum
length of this Information Element is 256 octets.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc4364"/> for the specification of the
route distinguisher.  See <xref type="rfc" data="rfc4382"/> for the
specification of the MPLS/BGP Layer 3 Virtual Private Network (VPN)
Management Information Base.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>mplsTopLabelPrefixLength</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>91</elementId>
<status>current</status>
<description>
<paragraph>
The prefix length of the subnet of the mplsTopLabelIPv4Address that
the MPLS top label will cause the Flow to be forwarded to.
</paragraph>
</description>
<units>bits</units>
<range>0-32</range>
<references>
<paragraph>
See <xref type="rfc" data="rfc3031"/> for the association between 
MPLS labels and prefix lengths.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-08-13</date>
</record> 

<record>
<name>srcTrafficIndex</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>92</elementId>
<status>current</status>
<description>
<paragraph>
BGP Policy Accounting Source Traffic Index.
</paragraph>
</description>
<references>
<paragraph>
BGP policy accounting as described in <xref type="uri" data="http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094e88.shtml">CCO-BGPPOL</xref>.
</paragraph>
</references>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>dstTrafficIndex</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>93</elementId>
<status>current</status>
<description>
<paragraph>
BGP Policy Accounting Destination Traffic Index.
</paragraph>
</description>
<references>
<paragraph>
BGP policy accounting as described in <xref type="uri" data="http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094e88.shtml">CCO-BGPPOL</xref>.
</paragraph>
</references>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>applicationDescription</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>94</elementId>
<status>current</status>
<description>
<paragraph>
Specifies the description of an application.
</paragraph>
</description>
<references>
<paragraph>
</paragraph>
</references>
<xref type="rfc" data="rfc6759"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>applicationId</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>95</elementId>
<status>current</status>
<description>
<paragraph>
Specifies an Application ID per <xref type="rfc" data="rfc6759"/>.
</paragraph>
</description>
<references>
<paragraph>
See section 4 of <xref type="rfc" data="rfc6759"/> for the applicationId Information Element Specification.
</paragraph>
</references>
<xref type="rfc" data="rfc6759"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>applicationName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>96</elementId>
<status>current</status>
<description>
<paragraph>
Specifies the name of an application.
</paragraph>
</description>
<references>
<paragraph>
</paragraph>
</references>
<xref type="rfc" data="rfc6759"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>Assigned for NetFlow v9 compatibility</name>
<elementId>97</elementId>
<references>
<paragraph>
<xref type="rfc" data="rfc3954"/>
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postIpDiffServCodePoint</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>98</elementId>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical to the 
definition of Information Element 'ipDiffServCodePoint', except 
that it reports a potentially modified value caused by a 
middlebox function after the packet passed the Observation 
Point.
</paragraph>
</description>
<range>0-63</range>
<references>
<paragraph>
See <xref type="rfc" data="rfc3260"/> for the definition of the Differentiated 
Services Field.  See section 5.3.2 of <xref type="rfc" data="rfc1812"/> and 
<xref type="rfc" data="rfc791"/> for the definition of the IPv4 TOS field.  See 
<xref type="rfc" data="rfc8200"/> for the definition of the IPv6 Traffic Class 
field.  See the IPFIX Information Model <xref type="rfc" data="rfc5102"/> for the 
'ipDiffServCodePoint' specification.  
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>multicastReplicationFactor</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>99</elementId>
<status>current</status>
<description>
<paragraph>
The amount of multicast replication that's applied to a traffic 
stream.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc1112"/> for the specification of reserved IPv4 
multicast addresses.  See <xref type="rfc" data="rfc4291"/> for the 
specification of reserved IPv6 multicast addresses. 
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>className</name>
<dataType>string</dataType>
<elementId>100</elementId>
<status>deprecated</status>
<description>
<paragraph>
Deprecated in favor of 335 selectorName.  Traffic Class Name,
associated with the classId Information Element.
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>classificationEngineId</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>101</elementId>
<status>current</status>
<description>
<paragraph>
A unique identifier for the engine that determined the
Selector ID. Thus, the Classification Engine ID defines
the context for the Selector ID. The Classification
Engine can be considered a specific registry for
application assignments.
</paragraph>
<paragraph>
Values for this field are listed in the Classification
Engine IDs registry. See 
<xref type="uri" data="http://www.iana.org/assignments/ipfix/ipfix.xhtml#classification-engine-ids"/>
</paragraph>
</description>
<xref type="rfc" data="rfc6759"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>layer2packetSectionOffset</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>102</elementId>
<status>deprecated</status>
<description>
<paragraph>
Deprecated in favor of 409 sectionOffset.  Layer 2 packet
section offset.  Potentially a generic packet section offset.
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>layer2packetSectionSize</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>103</elementId>
<status>deprecated</status>
<description>
<paragraph>
Deprecated in favor of 312 dataLinkFrameSize.  Layer 2 packet
section size.  Potentially a generic packet section size.
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>layer2packetSectionData</name>
<dataType>octetArray</dataType>
<elementId>104</elementId>
<status>deprecated</status>
<description>
<paragraph>
Deprecated in favor of 315 dataLinkFrameSection.  Layer 2 packet
section data.
</paragraph>
</description>
<xref type="rfc" data="rfc7270"/>
<revision>0</revision>
<date>2014-04-04</date>
</record>

<record>
<name>Assigned for NetFlow v9 compatibility</name>
<elementId>105-127</elementId>
<references>
<paragraph>
<xref type="rfc" data="rfc3954"/>
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>bgpNextAdjacentAsNumber</name>
<dataType>unsigned32</dataType>
<group>derived</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>128</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The autonomous system (AS) number of the first AS in the AS
path to the destination IP address.  The path is deduced
by looking up the destination IP address of the Flow in the
BGP routing information base.  If AS path information for
this Flow is only available as an unordered AS set (and not
as an ordered AS sequence), then the value of this Information
Element is 0.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc4271"/> for a description of BGP-4, and
see <xref type="rfc" data="rfc1930"/> for the definition of the AS
number.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>bgpPrevAdjacentAsNumber</name>
<dataType>unsigned32</dataType>
<group>derived</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>129</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The autonomous system (AS) number of the last AS in the AS
path from the source IP address.  The path is deduced
by looking up the source IP address of the Flow in the BGP
routing information base.  If AS path information for this
Flow is only available as an unordered AS set (and not as
an ordered AS sequence), then the value of this Information
Element is 0.  In case of BGP asymmetry, the
bgpPrevAdjacentAsNumber might not be able to report the correct
value.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc4271"/> for a description of BGP-4, and
see <xref type="rfc" data="rfc1930"/> for the definition of the AS
number.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>exporterIPv4Address</name>
<dataType>ipv4Address</dataType>
<group>config</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>130</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The IPv4 address used by the Exporting Process.  This is used
by the Collector to identify the Exporter in cases where the
identity of the Exporter may have been obscured by the use of
a proxy.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>exporterIPv6Address</name>
<dataType>ipv6Address</dataType>
<group>config</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>131</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The IPv6 address used by the Exporting Process.  This is used
by the Collector to identify the Exporter in cases where the
identity of the Exporter may have been obscured by the use of
a proxy.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>droppedOctetDeltaCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>132</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The number of octets since the previous report (if any)
in packets of this Flow dropped by packet treatment.
The number of octets includes IP header(s) and IP payload.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>droppedPacketDeltaCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>133</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The number of packets since the previous report (if any)
of this Flow dropped by packet treatment.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>droppedOctetTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>134</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of octets in packets of this Flow dropped
by packet treatment since the Metering Process
(re-)initialization for this Observation Point.
The number of octets includes IP header(s) and IP payload.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>droppedPacketTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>135</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The number of packets of this Flow dropped by packet
treatment since the Metering Process
(re-)initialization for this Observation Point.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowEndReason</name>
<dataType>unsigned8</dataType>
<group>misc</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>136</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The reason for Flow termination.  The range of values includes
the following:
</paragraph>
<artwork>
0x01: idle timeout
      The Flow was terminated because it was considered to be
      idle.
      
0x02: active timeout
      The Flow was terminated for reporting purposes while it was
      still active, for example, after the maximum lifetime of
      unreported Flows was reached.

0x03: end of Flow detected
      The Flow was terminated because the Metering Process
      detected signals indicating the end of the Flow,
      for example, the TCP FIN flag.

0x04: forced end
      The Flow was terminated because of some external event,
      for example, a shutdown of the Metering Process initiated
      by a network management application.

0x05: lack of resources
      The Flow was terminated because of lack of resources
      available to the Metering Process and/or the Exporting
      Process.
</artwork>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>commonPropertiesId</name>
<dataType>unsigned64</dataType>
<group>scope</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>137</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
An identifier of a set of common properties that is
unique per Observation Domain and Transport Session.
Typically, this Information Element is used to link to
information reported in separate Data Records.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>observationPointId</name>
<dataType>unsigned64</dataType>
<group>scope</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>138</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
An identifier of an Observation Point that is unique per
Observation Domain.  It is RECOMMENDED that this identifier is
also unique per IPFIX Device.  Typically, this Information
Element is used for limiting the scope of other Information
Elements.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/><xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2013-04-11</date>
</record>

<record>
<name>icmpTypeCodeIPv6</name>
<dataType>unsigned16</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>139</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
Type and Code of the IPv6 ICMP message.  The combination of
both values is reported as (ICMP type * 256) + ICMP code.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc4443"/> for the definition of the IPv6
ICMP type and code fields.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>mplsTopLabelIPv6Address</name>
<dataType>ipv6Address</dataType>
<group>derived</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>140</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The IPv6 address of the system that the MPLS top label will
cause this Flow to be forwarded to.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3031"/> for the association between MPLS
labels and IP addresses.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>lineCardId</name>
<dataType>unsigned32</dataType>
<group>scope</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>141</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
An identifier of a line card that is unique per IPFIX
Device hosting an Observation Point.  Typically, this
Information Element is used for limiting the scope
of other Information Elements.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>portId</name>
<dataType>unsigned32</dataType>
<group>scope</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>142</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
An identifier of a line port that is unique per IPFIX
Device hosting an Observation Point.  Typically, this
Information Element is used for limiting the scope
of other Information Elements.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>meteringProcessId</name>
<dataType>unsigned32</dataType>
<group>scope</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>143</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
An identifier of a Metering Process that is unique per
IPFIX Device.  Typically, this Information Element is used
for limiting the scope of other Information Elements.
Note that process identifiers are typically assigned
dynamically.
The Metering Process may be re-started with a different ID.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>exportingProcessId</name>
<dataType>unsigned32</dataType>
<group>scope</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>144</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
An identifier of an Exporting Process that is unique per
IPFIX Device.  Typically, this Information Element is used
for limiting the scope of other Information Elements.
Note that process identifiers are typically assigned
dynamically.  The Exporting Process may be re-started
with a different ID.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>templateId</name>
<dataType>unsigned16</dataType>
<group>scope</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>145</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
An identifier of a Template that is locally unique within a
combination of a Transport session and an Observation Domain.
</paragraph>
<paragraph>
Template IDs 0-255 are reserved for Template Sets, Options
Template Sets, and other reserved Sets yet to be created.
Template IDs of Data Sets are numbered from 256 to 65535.
</paragraph>
<paragraph>
Typically, this Information Element is used for limiting
the scope of other Information Elements.
Note that after a re-start of the Exporting Process Template
identifiers may be re-assigned.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>wlanChannelId</name>
<dataType>unsigned8</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>146</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The identifier of the 802.11 (Wi-Fi) channel used.
</paragraph>
</description>
<references>
<paragraph>
See IEEE.802-11.1999.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>wlanSSID</name>
<dataType>string</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>147</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The Service Set IDentifier (SSID) identifying an 802.11
(Wi-Fi) network used.  According to IEEE.802-11.1999, the
SSID is encoded into a string of up to 32 characters.
</paragraph>
</description>
<references>
<paragraph>
See IEEE.802-11.1999.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowId</name>
<dataType>unsigned64</dataType>
<group>scope</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>148</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
An identifier of a Flow that is unique within an Observation
Domain.  This Information Element can be used to distinguish
between different Flows if Flow Keys such as IP addresses and
port numbers are not reported or are reported in separate
records.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>observationDomainId</name>
<dataType>unsigned32</dataType>
<group>scope</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>149</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
An identifier of an Observation Domain that is locally
unique to an Exporting Process.  The Exporting Process uses
the Observation Domain ID to uniquely identify to the
Collecting Process the Observation Domain where Flows
were metered.  It is RECOMMENDED that this identifier is
also unique per IPFIX Device.
</paragraph>
<paragraph>
A value of 0 indicates that no specific Observation Domain
is identified by this Information Element.
</paragraph>
<paragraph>
Typically, this Information Element is used for limiting
the scope of other Information Elements.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowStartSeconds</name>
<dataType>dateTimeSeconds</dataType>
<group>timestamp</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>150</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The absolute timestamp of the first packet of this Flow.
</paragraph>
</description>
<units>seconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowEndSeconds</name>
<dataType>dateTimeSeconds</dataType>
<group>timestamp</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>151</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The absolute timestamp of the last packet of this Flow.
</paragraph>
</description>
<units>seconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowStartMilliseconds</name>
<dataType>dateTimeMilliseconds</dataType>
<group>timestamp</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>152</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The absolute timestamp of the first packet of this Flow.
</paragraph>
</description>
<units>milliseconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowEndMilliseconds</name>
<dataType>dateTimeMilliseconds</dataType>
<group>timestamp</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>153</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The absolute timestamp of the last packet of this Flow.
</paragraph>
</description>
<units>milliseconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowStartMicroseconds</name>
<dataType>dateTimeMicroseconds</dataType>
<group>timestamp</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>154</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The absolute timestamp of the first packet of this Flow.
</paragraph>
</description>
<units>microseconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowEndMicroseconds</name>
<dataType>dateTimeMicroseconds</dataType>
<group>timestamp</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>155</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The absolute timestamp of the last packet of this Flow.
</paragraph>
</description>
<units>microseconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowStartNanoseconds</name>
<dataType>dateTimeNanoseconds</dataType>
<group>timestamp</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>156</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The absolute timestamp of the first packet of this Flow.
</paragraph>
</description>
<units>nanoseconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowEndNanoseconds</name>
<dataType>dateTimeNanoseconds</dataType>
<group>timestamp</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>157</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The absolute timestamp of the last packet of this Flow.
</paragraph>
</description>
<units>nanoseconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowStartDeltaMicroseconds</name>
<dataType>unsigned32</dataType>
<group>timestamp</group>
<elementId>158</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
This is a relative timestamp only valid within the scope
of a single IPFIX Message.  It contains the negative time
offset of the first observed packet of this Flow relative
to the export time specified in the IPFIX Message Header.
</paragraph>
</description>
<units>microseconds</units>
<references>
<paragraph>
See the <xref type="rfc" data="rfc7011">IPFIX protocol
specification</xref> for the definition of the IPFIX Message Header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowEndDeltaMicroseconds</name>
<dataType>unsigned32</dataType>
<group>timestamp</group>
<elementId>159</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
This is a relative timestamp only valid within the scope
of a single IPFIX Message.  It contains the negative time
offset of the last observed packet of this Flow relative
to the export time specified in the IPFIX Message Header.
</paragraph>
</description>
<units>microseconds</units>
<references>
<paragraph>
See the <xref type="rfc" data="rfc7011">IPFIX protocol
specification</xref> for the definition of the IPFIX Message Header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>systemInitTimeMilliseconds</name>
<dataType>dateTimeMilliseconds</dataType>
<group>timestamp</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>160</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The absolute timestamp of the last (re-)initialization of the
IPFIX Device.
</paragraph>
</description>
<units>milliseconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowDurationMilliseconds</name>
<dataType>unsigned32</dataType>
<group>misc</group>
<elementId>161</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The difference in time between the first observed packet
of this Flow and the last observed packet of this Flow.
</paragraph>
</description>
<units>milliseconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowDurationMicroseconds</name>
<dataType>unsigned32</dataType>
<group>misc</group>
<elementId>162</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The difference in time between the first observed packet
of this Flow and the last observed packet of this Flow.
</paragraph>
</description>
<units>microseconds</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>observedFlowTotalCount</name>
<dataType>unsigned64</dataType>
<group>processCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>163</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of Flows observed in the Observation Domain
since the Metering Process (re-)initialization for this
Observation Point.
</paragraph>
</description>
<units>flows</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ignoredPacketTotalCount</name>
<dataType>unsigned64</dataType>
<group>processCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>164</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of observed IP packets that the
Metering Process did not process since the
(re-)initialization of the Metering Process.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ignoredOctetTotalCount</name>
<dataType>unsigned64</dataType>
<group>processCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>165</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of octets in observed IP packets
(including the IP header) that the Metering Process
did not process since the (re-)initialization of the
Metering Process.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>notSentFlowTotalCount</name>
<dataType>unsigned64</dataType>
<group>processCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>166</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of Flow Records that were generated by the
Metering Process and dropped by the Metering Process or
by the Exporting Process instead of being sent to the
Collecting Process. There are several potential reasons for
this including resource shortage and special Flow export
policies.
</paragraph>
</description>
<units>flows</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>notSentPacketTotalCount</name>
<dataType>unsigned64</dataType>
<group>processCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>167</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of packets in Flow Records that were
generated by the Metering Process and dropped
by the Metering Process or by the Exporting Process
instead of being sent to the Collecting Process.
There are several potential reasons for this including
resource shortage and special Flow export policies.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>notSentOctetTotalCount</name>
<dataType>unsigned64</dataType>
<group>processCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>168</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of octets in packets in Flow Records
that were generated by the Metering Process and
dropped by the Metering Process or by the Exporting
Process instead of being sent to the Collecting Process.
There are several potential reasons for this including
resource shortage and special Flow export policies.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>destinationIPv6Prefix</name>
<dataType>ipv6Address</dataType>
<group>ipHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>169</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph> IPv6 destination address prefix. </paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>sourceIPv6Prefix</name>
<dataType>ipv6Address</dataType>
<group>ipHeader</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>170</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
IPv6 source address prefix.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postOctetTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>171</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical
to the definition of Information Element
'octetTotalCount', except that it reports a
potentially modified value caused by a middlebox
function after the packet passed the Observation Point.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postPacketTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>172</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical
to the definition of Information Element
'packetTotalCount', except that it reports a
potentially modified value caused by a middlebox
function after the packet passed the Observation Point.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>flowKeyIndicator</name>
<dataType>unsigned64</dataType>
<group>config</group>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>173</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
This set of bit fields is used for marking the Information
Elements of a Data Record that serve as Flow Key.  Each bit
represents an Information Element in the Data Record, with 
the n-th least significant bit representing the n-th Information 
Element.
A bit set to value 1 indicates that the corresponding
Information Element is a Flow Key of the reported Flow.
A bit set to value 0 indicates that this is not the case.
</paragraph>
<paragraph>
If the Data Record contains more than 64 Information Elements,
the corresponding Template SHOULD be designed such that all
Flow Keys are among the first 64 Information Elements, because
the flowKeyIndicator only contains 64 bits.  If the Data Record
contains less than 64 Information Elements, then the bits in
the flowKeyIndicator for which no corresponding Information
Element exists MUST have the value 0.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc-errata" data="4984"/>
<revision>1</revision>
<date>2017-08-01</date>
</record>

<record>
<name>postMCastPacketTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>174</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of outgoing multicast packets sent for
packets of this Flow by a multicast daemon within the
Observation Domain since the Metering Process
(re-)initialization.  This property cannot necessarily
be observed at the Observation Point, but may be retrieved
by other means.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postMCastOctetTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>175</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of octets in outgoing multicast packets
sent for packets of this Flow by a multicast daemon in the
Observation Domain since the Metering Process
(re-)initialization.  This property cannot necessarily be
observed at the Observation Point, but may be retrieved by
other means.
The number of octets includes IP header(s) and IP payload.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>icmpTypeIPv4</name>
<dataType>unsigned8</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>176</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
Type of the IPv4 ICMP message.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc792"/> for the definition of the IPv4
ICMP type field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>icmpCodeIPv4</name>
<dataType>unsigned8</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>177</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
Code of the IPv4 ICMP message.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc792"/> for the definition of the IPv4
ICMP code field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>icmpTypeIPv6</name>
<dataType>unsigned8</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>178</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
Type of the IPv6 ICMP message.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc4443"/> for the definition of the IPv6
ICMP type field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>icmpCodeIPv6</name>
<dataType>unsigned8</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>179</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
Code of the IPv6 ICMP message.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc4443"/> for the definition of the IPv6
ICMP code field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>udpSourcePort</name>
<dataType>unsigned16</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>180</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The source port identifier in the UDP header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc768"/> for the definition of the UDP
source port field.
Additional information on defined UDP port numbers can be found at
<xref type="registry" data="service-names-port-numbers"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>udpDestinationPort</name>
<dataType>unsigned16</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>181</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The destination port identifier in the UDP header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc768"/> for the definition of the UDP
destination port field.
Additional information on defined UDP port numbers can be found at
<xref type="registry" data="service-names-port-numbers"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpSourcePort</name>
<dataType>unsigned16</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>182</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The source port identifier in the TCP header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP
source port field.
Additional information on defined TCP port numbers can be found at
<xref type="registry" data="service-names-port-numbers"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpDestinationPort</name>
<dataType>unsigned16</dataType>
<group>transportHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>183</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The destination port identifier in the TCP header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP
destination port field.
Additional information on defined TCP port numbers can be found at
<xref type="registry" data="service-names-port-numbers"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpSequenceNumber</name>
<dataType>unsigned32</dataType>
<group>transportHeader</group>
<elementId>184</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The sequence number in the TCP header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP
sequence number.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpAcknowledgementNumber</name>
<dataType>unsigned32</dataType>
<group>transportHeader</group>
<elementId>185</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The acknowledgement number in the TCP header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP
acknowledgement number.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpWindowSize</name>
<dataType>unsigned16</dataType>
<group>transportHeader</group>
<elementId>186</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The window field in the TCP header.
If the TCP window scale is supported,
then TCP window scale must be known
to fully interpret the value of this information.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP
window field.
See <xref type="rfc" data="rfc1323"/> for the definition of the TCP
window scale.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpUrgentPointer</name>
<dataType>unsigned16</dataType>
<group>transportHeader</group>
<elementId>187</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The urgent pointer in the TCP header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP
urgent pointer.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpHeaderLength</name>
<dataType>unsigned8</dataType>
<group>transportHeader</group>
<elementId>188</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The length of the TCP header.  Note that the value of this
Information Element is different from the value of the Data
Offset field in the TCP header.  The Data Offset field
indicates the length of the TCP header in units of 4 octets.
This Information Elements specifies the length of the TCP
header in units of octets.
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP
header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipHeaderLength</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<elementId>189</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The length of the IP header.  For IPv6, the value of this
Information Element is 40.
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the definition of the IPv4
header.
See <xref type="rfc" data="rfc8200"/> for the definition of the IPv6
header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>totalLengthIPv4</name>
<dataType>unsigned16</dataType>
<group>ipHeader</group>
<elementId>190</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The total length of the IPv4 packet.
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the specification of the IPv4
total length.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>payloadLengthIPv6</name>
<dataType>unsigned16</dataType>
<group>ipHeader</group>
<elementId>191</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
This Information Element reports the value of the Payload
Length field in the IPv6 header.  Note that IPv6 extension
headers belong to the payload.  Also note that in case of a
jumbo payload option the value of the Payload Length field in
the IPv6 header is zero and so will be the value reported
by this Information Element.
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc8200"/> for the specification of the IPv6
payload length.
See <xref type="rfc" data="rfc2675"/> for the specification of the IPv6
jumbo payload option.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipTTL</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<elementId>192</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
For IPv4, the value of the Information Element matches
the value of the Time to Live (TTL) field in the IPv4 packet
header.  For IPv6, the value of the Information Element
matches the value of the Hop Limit field in the IPv6
packet header.
</paragraph>
</description>
<units>hops</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the definition of the IPv4
Time to Live field.
See <xref type="rfc" data="rfc2675"/> for the definition of the IPv6
Hop Limit field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>nextHeaderIPv6</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<elementId>193</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The value of the Next Header field of the IPv6 header.
The value identifies the type of the following IPv6
extension header or of the following IP payload.
Valid values are defined in the IANA
Protocol Numbers registry.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc8200"/> for the definition of the IPv6
Next Header field.
See the list of protocol numbers assigned by IANA at <xref type="registry" data="protocol-numbers"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>mplsPayloadLength</name>
<dataType>unsigned32</dataType>
<group>subIpHeader</group>
<elementId>194</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The size of the MPLS packet without the label stack.
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc3031"/> for the specification of MPLS
packets.
See <xref type="rfc" data="rfc3032"/> for the specification of the
MPLS label stack.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipDiffServCodePoint</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>195</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The value of a Differentiated Services Code Point (DSCP)
encoded in the Differentiated Services field.  The
Differentiated Services field spans the most significant
6 bits of the IPv4 TOS field or the IPv6 Traffic Class
field, respectively.
</paragraph>
<paragraph>
This Information Element encodes only the 6 bits of the
Differentiated Services field.  Therefore, its value may
range from 0 to 63.
</paragraph>
</description>
<range>0-63</range>
<references>
<paragraph>
See <xref type="rfc" data="rfc3260"/> for the definition of the
Differentiated Services field.
See <xref type="rfc" data="rfc1812"/> (Section 5.3.2) and <xref type="rfc" data="rfc791"/> for the definition of the IPv4 TOS field.
See <xref type="rfc" data="rfc8200"/> for the definition of the IPv6
Traffic Class field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipPrecedence</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>196</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The value of the IP Precedence.  The IP Precedence value
is encoded in the first 3 bits of the IPv4 TOS field
or the IPv6 Traffic Class field, respectively.
</paragraph>
<paragraph>
This Information Element encodes only these 3 bits.
Therefore, its value may range from 0 to 7.
</paragraph>
</description>
<range>0-7</range>
<references>
<paragraph>
See <xref type="rfc" data="rfc1812"/> (Section 5.3.3) and <xref type="rfc" data="rfc791"/> for the definition of the IP Precedence.
See <xref type="rfc" data="rfc1812"/> (Section 5.3.2) and <xref type="rfc" data="rfc791"/> for the definition of the IPv4 TOS field.
See <xref type="rfc" data="rfc8200"/> for the definition of the IPv6
Traffic Class field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>fragmentFlags</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>197</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
Fragmentation properties indicated by flags in the IPv4
packet header or the IPv6 Fragment header, respectively.
</paragraph>
<artwork>

Bit 0:    (RS) Reserved.
          The value of this bit MUST be 0 until specified
          otherwise.

Bit 1:    (DF) 0 = May Fragment,  1 = Don't Fragment.
          Corresponds to the value of the DF flag in the
          IPv4 header.  Will always be 0 for IPv6 unless
          a "don't fragment" feature is introduced to IPv6.

Bit 2:    (MF) 0 = Last Fragment, 1 = More Fragments.
          Corresponds to the MF flag in the IPv4 header
          or to the M flag in the IPv6 Fragment header,
          respectively.  The value is 0 for IPv6 if there
          is no fragment header.

Bits 3-7: (DC) Don't Care.
          The values of these bits are irrelevant.

     0   1   2   3   4   5   6   7
   +---+---+---+---+---+---+---+---+
   | R | D | M | D | D | D | D | D |
   | S | F | F | C | C | C | C | C |
   +---+---+---+---+---+---+---+---+
</artwork>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the specification of the IPv4
fragment flags.
See <xref type="rfc" data="rfc8200"/> for the specification of the
IPv6 Fragment header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>octetDeltaSumOfSquares</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<elementId>198</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The sum of the squared numbers of octets per incoming
packet since the previous report (if any) for this
Flow at the Observation Point.
The number of octets includes IP header(s) and IP payload.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>octetTotalSumOfSquares</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<elementId>199</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The total sum of the squared numbers of octets in incoming
packets for this Flow at the Observation Point since the
Metering Process (re-)initialization for this Observation
Point.  The number of octets includes IP header(s) and IP
payload.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>mplsTopLabelTTL</name>
<dataType>unsigned8</dataType>
<group>subIpHeader</group>
<elementId>200</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The TTL field from the top MPLS label stack entry,
i.e., the last label that was pushed.
</paragraph>
</description>
<units>hops</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/> for the specification of the TTL
field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>mplsLabelStackLength</name>
<dataType>unsigned32</dataType>
<group>subIpHeader</group>
<elementId>201</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The length of the MPLS label stack in units of octets.
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/> for the specification of the
MPLS label stack.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>mplsLabelStackDepth</name>
<dataType>unsigned32</dataType>
<group>subIpHeader</group>
<elementId>202</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The number of labels in the MPLS label stack.
</paragraph>
</description>
<units>entries</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/> for the specification of the
MPLS label stack.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>mplsTopLabelExp</name>
<dataType>unsigned8</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>203</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The Exp field from the top MPLS label stack entry,
i.e., the last label that was pushed.
</paragraph>
<artwork>
Bits 0-4:  Don't Care, value is irrelevant.
Bits 5-7:  MPLS Exp field.

     0   1   2   3   4   5   6   7
   +---+---+---+---+---+---+---+---+
   |     don't care    |    Exp    |
   +---+---+---+---+---+---+---+---+
</artwork>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/> for the specification of the
Exp field.
See <xref type="rfc" data="rfc3270"/> for usage of the Exp field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipPayloadLength</name>
<dataType>unsigned32</dataType>
<group>derived</group>
<elementId>204</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The effective length of the IP payload.
</paragraph>
<paragraph>
For IPv4 packets, the value of this Information Element is
the difference between the total length of the IPv4 packet
(as reported by Information Element totalLengthIPv4) and the
length of the IPv4 header (as reported by Information Element
headerLengthIPv4).
</paragraph>
<paragraph>
For IPv6, the value of the Payload Length field
in the IPv6 header is reported except in the case that
the value of this field is zero and that there is a valid
jumbo payload option.  In this case, the value of the
Jumbo Payload Length field in the jumbo payload option
is reported.
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the specification of IPv4
packets.
See <xref type="rfc" data="rfc8200"/> for the specification of the
IPv6 payload length.
See <xref type="rfc" data="rfc2675"/> for the specification of the
IPv6 jumbo payload length.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>udpMessageLength</name>
<dataType>unsigned16</dataType>
<group>transportHeader</group>
<elementId>205</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The value of the Length field in the UDP header.
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc768"/> for the specification of the UDP
header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>isMulticast</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>206</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
If the IP destination address is not a reserved multicast
address, then the value of all bits of the octet (including
the reserved ones) is zero.
</paragraph>
<paragraph>
The first bit of this octet is set to 1 if the Version
field of the IP header has the value 4 and if the
Destination Address field contains a reserved multicast
address in the range from 224.0.0.0 to 239.255.255.255.
Otherwise, this bit is set to 0.
</paragraph>
<paragraph>
The second and third bits of this octet are reserved for
future use.
</paragraph>
<paragraph>
The remaining bits of the octet are only set to values
other than zero if the IP Destination Address is a
reserved IPv6 multicast address.  Then the fourth bit
of the octet is set to the value of the T flag in the
IPv6 multicast address and the remaining four bits are
set to the value of the scope field in the IPv6
multicast address.
</paragraph>
<artwork>
      0      1      2      3      4      5      6      7
   +------+------+------+------+------+------+------+------+
   |   IPv6 multicast scope    |  T   | RES. | RES. | MCv4 |
   +------+------+------+------+------+------+------+------+

   Bits 0-3:  set to value of multicast scope if IPv6 multicast
   Bit  4:    set to value of T flag, if IPv6 multicast
   Bits 5-6:  reserved for future use
   Bit  7:    set to 1 if IPv4 multicast
</artwork>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc1112"/> for the specification of
reserved IPv4 multicast addresses.
See <xref type="rfc" data="rfc4291"/> for the specification of
reserved IPv6 multicast addresses and the definition of the T flag and
the IPv6 multicast scope.
The diagram provided in <xref type="rfc" data="rfc5102"/> is incorrect.  
The diagram in this registry is taken from Errata 1736. See <xref type="rfc-errata" data="1736"/>
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipv4IHL</name>
<dataType>unsigned8</dataType>
<group>ipHeader</group>
<elementId>207</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The value of the Internet Header Length (IHL) field in
the IPv4 header.  It specifies the length of the header
in units of 4 octets.  Please note that its unit is
different from most of the other Information Elements
reporting length values.
</paragraph>
</description>
<units>4-octet words</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the specification of the IPv4
header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipv4Options</name>
<dataType>unsigned32</dataType>
<group>minMax</group>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>208</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
IPv4 options in packets of this Flow.
The information is encoded in a set of bit fields.  For
each valid IPv4 option type, there is a bit in this set.
The bit is set to 1 if any observed packet of this Flow
contains the corresponding IPv4 option type.  Otherwise,
if no observed packet of this Flow contained the
respective IPv4 option type, the value of the
corresponding bit is 0.
</paragraph>
<paragraph>
The list of valid IPv4 options is maintained by IANA.
Note that for identifying an option not just the 5-bit
Option Number, but all 8 bits of the Option Type need to
match one of the IPv4 options specified at
http://www.iana.org/assignments/ip-parameters.
</paragraph>
<paragraph>
Options are mapped to bits according to their option numbers.
Option number X is mapped to bit X.
The mapping is illustrated by the figure below.
</paragraph>
<artwork>
        0      1      2      3      4      5      6      7
    +------+------+------+------+------+------+------+------+
... |  RR  |CIPSO |E-SEC |  TS  | LSR  |  SEC | NOP  | EOOL |
    +------+------+------+------+------+------+------+------+

        8      9     10     11     12     13     14     15
    +------+------+------+------+------+------+------+------+
... |ENCODE| VISA | FINN | MTUR | MTUP | ZSU  | SSR  | SID  | ...
    +------+------+------+------+------+------+------+------+

       16     17     18     19     20     21     22     23
    +------+------+------+------+------+------+------+------+
... | DPS  |NSAPA | SDB  |RTRALT|ADDEXT|  TR  | EIP  |IMITD | ...
    +------+------+------+------+------+------+------+------+

       24     25     26     27     28     29     30     31
    +------+------+------+------+------+------+------+------+
... |      | EXP  |   to be assigned by IANA  |  QS  | UMP  |
    +------+------+------+------+------+------+------+------+

       Type   Option
   Bit Value  Name    Reference
   ---+-----+-------+------------------------------------
   0      7   RR      Record Route, RFC 791
   1    134   CIPSO   Commercial Security
   2    133   E-SEC   Extended Security, RFC 1108
   3     68   TS      Time Stamp, RFC 791
   4    131   LSR     Loose Source Route, RFC791
   5    130   SEC     Security, RFC 1108
   6      1   NOP     No Operation, RFC 791
   7      0   EOOL    End of Options List, RFC 791
   8     15   ENCODE
   9    142   VISA    Experimental Access Control
   10   205   FINN    Experimental Flow Control
   11    12   MTUR    (obsoleted) MTU Reply, RFC 1191
   12    11   MTUP    (obsoleted) MTU Probe, RFC 1191
   13    10   ZSU     Experimental Measurement
   14   137   SSR     Strict Source Route, RFC 791
   15   136   SID     Stream ID, RFC 791
   16   151   DPS     Dynamic Packet State
   17   150   NSAPA   NSAP Address
   18   149   SDB     Selective Directed Broadcast
   19   147   ADDEXT  Address Extension
   20   148   RTRALT  Router Alert, RFC 2113
   21    82   TR      Traceroute, RFC 3193
   22   145   EIP     Extended Internet Protocol, RFC 1385
   23   144   IMITD   IMI Traffic Descriptor
   25    30   EXP     RFC3692-style Experiment
   25    94   EXP     RFC3692-style Experiment
   25   158   EXP     RFC3692-style Experiment
   25   222   EXP     RFC3692-style Experiment
   30    25   QS      Quick-Start
   31   152   UMP     Upstream Multicast Pkt.
   ...  ...   ...     Further options numbers
                      may be assigned by IANA
</artwork>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the definition of IPv4
options.
See the list of IPv4 option numbers assigned by IANA at <xref type="registry" data="ip-parameters"/>.
The diagram provided in <xref type="rfc" data="rfc5102"/> is incorrect.  
The diagram in this registry is taken from Errata 1737. See <xref type="rfc-errata" data="1737"/>   
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpOptions</name>
<dataType>unsigned64</dataType>
<group>minMax</group>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>209</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
TCP options in packets of this Flow.
The information is encoded in a set of bit fields.  For
each TCP option, there is a bit in this set.
The bit is set to 1 if any observed packet of this Flow
contains the corresponding TCP option.
Otherwise, if no observed packet of this Flow contained
the respective TCP option, the value of the
corresponding bit is 0.
</paragraph>
<paragraph>
Options are mapped to bits according to their option
numbers.  Option number X is mapped to bit X.
TCP option numbers are maintained by IANA.
</paragraph>
<artwork>
        0     1     2     3     4     5     6     7
    +-----+-----+-----+-----+-----+-----+-----+-----+
    |   7 |   6 |   5 |   4 |   3 |   2 |   1 |   0 |  ...
    +-----+-----+-----+-----+-----+-----+-----+-----+

        8     9    10    11    12    13    14    15
    +-----+-----+-----+-----+-----+-----+-----+-----+
... |  15 |  14 |  13 |  12 |  11 |  10 |   9 |   8 |...
    +-----+-----+-----+-----+-----+-----+-----+-----+

       16    17    18    19    20    21    22    23
    +-----+-----+-----+-----+-----+-----+-----+-----+
... |  23 |  22 |  21 |  20 |  19 |  18 |  17 |  16 |...
    +-----+-----+-----+-----+-----+-----+-----+-----+

                          . . .

       56    57    58    59    60    61    62    63
    +-----+-----+-----+-----+-----+-----+-----+-----+
... |  63 |  62 |  61 |  60 |  59 |  58 |  57 |  56 |
    +-----+-----+-----+-----+-----+-----+-----+-----+
</artwork>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of TCP
options.
See the list of TCP option numbers assigned by IANA at <xref type="registry" data="tcp-parameters"/>.
The diagram provided in <xref type="rfc" data="rfc5102"/> is incorrect.  
The diagram in this registry is taken from Errata 1739. See <xref type="rfc-errata" data="1739"/>
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>paddingOctets</name>
<dataType>octetArray</dataType>
<group>padding</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>210</elementId>
<applicability>option</applicability>
<status>current</status>
<description>
<paragraph>
The value of this Information Element is always a sequence of
0x00 values.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>collectorIPv4Address</name>
<dataType>ipv4Address</dataType>
<group>config</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>211</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
An IPv4 address to which the Exporting Process sends Flow
information.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>collectorIPv6Address</name>
<dataType>ipv6Address</dataType>
<group>config</group>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>212</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
An IPv6 address to which the Exporting Process sends Flow
information.
</paragraph>
</description>
<xref type="rfc" data="rfc5102"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>exportInterface</name>
<dataType>unsigned32</dataType>
<group>config</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>213</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The index of the interface from which IPFIX Messages sent
by the Exporting Process to a Collector leave the IPFIX
Device.  The value matches the value of
managed object 'ifIndex' as defined in <xref type="rfc" data="rfc2863"/>.
Note that ifIndex values are not assigned statically to an
interface and that the interfaces may be renumbered every
time the device's management system is re-initialized, as
specified in <xref type="rfc" data="rfc2863"/>.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc2863"/> for the definition of the
ifIndex object.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>exportProtocolVersion</name>
<dataType>unsigned8</dataType>
<group>config</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>214</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The protocol version used by the Exporting Process for
sending Flow information.  The protocol version is given
by the value of the Version Number field in the Message
Header.
</paragraph>
<paragraph>
The protocol version is 10 for IPFIX and 9 for NetFlow
version 9.
A value of 0 indicates that no export protocol is in use.
</paragraph>
</description>
<references>
<paragraph>
See the <xref type="rfc" data="rfc7011">IPFIX protocol
specification</xref> for the definition of the IPFIX Message Header.
See <xref type="rfc" data="rfc3954"/> for the definition of the
NetFlow version 9 message header.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>exportTransportProtocol</name>
<dataType>unsigned8</dataType>
<group>config</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>215</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The value of the protocol number used by the Exporting Process
for sending Flow information.
The protocol number identifies the IP packet payload type.
Protocol numbers are defined in the IANA Protocol Numbers
registry.
</paragraph>
<paragraph>
In Internet Protocol version 4 (IPv4), this is carried in the
Protocol field.  In Internet Protocol version 6 (IPv6), this
is carried in the Next Header field in the last extension
header of the packet.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the specification of the IPv4
protocol field.
See <xref type="rfc" data="rfc8200"/> for the specification of the
IPv6 protocol field.
See the list of protocol numbers assigned by IANA at <xref type="registry" data="protocol-numbers"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>collectorTransportPort</name>
<dataType>unsigned16</dataType>
<group>config</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>216</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The destination port identifier to which the Exporting
Process sends Flow information.  For the transport protocols
UDP, TCP, and SCTP, this is the destination port number.
This field MAY also be used for future transport protocols
that have 16-bit source port identifiers.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc768"/> for the definition of the UDP
destination port field.
See <xref type="rfc" data="rfc793"/> for the definition of the TCP
destination port field.
See <xref type="rfc" data="rfc4960"/> for the definition of SCTP.
</paragraph>
<paragraph>
Additional information on defined UDP and TCP port numbers can be
found at <xref type="registry" data="service-names-port-numbers"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>exporterTransportPort</name>
<dataType>unsigned16</dataType>
<group>config</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>217</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The source port identifier from which the Exporting
Process sends Flow information.  For the transport protocols
UDP, TCP, and SCTP, this is the source port number.
This field MAY also be used for future transport protocols
that have 16-bit source port identifiers.  This field may
be useful for distinguishing multiple Exporting Processes
that use the same IP address.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc768"/> for the definition of the UDP
source port field.
See <xref type="rfc" data="rfc793"/> for the definition of the TCP
source port field.
See <xref type="rfc" data="rfc4960"/> for the definition of SCTP.
</paragraph>
<paragraph>
Additional information on defined UDP and TCP port numbers can be
found at <xref type="registry" data="service-names-port-numbers"/>.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpSynTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>218</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of packets of this Flow with
TCP "Synchronize sequence numbers" (SYN) flag set.
</paragraph>
</description>
<units>packets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP SYN
flag.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpFinTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>219</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of packets of this Flow with
TCP "No more data from sender" (FIN) flag set.
</paragraph>
</description>
<units>packets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP FIN
flag.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpRstTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>220</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of packets of this Flow with
TCP "Reset the connection" (RST) flag set.
</paragraph>
</description>
<units>packets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP RST
flag.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpPshTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>221</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of packets of this Flow with
TCP "Push Function" (PSH) flag set.
</paragraph>
</description>
<units>packets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP PSH
flag.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpAckTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>222</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of packets of this Flow with
TCP "Acknowledgment field significant" (ACK) flag set.
</paragraph>
</description>
<units>packets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP ACK
flag.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpUrgTotalCount</name>
<dataType>unsigned64</dataType>
<group>flowCounter</group>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>223</elementId>
<applicability>data</applicability>
<status>current</status>
<description>
<paragraph>
The total number of packets of this Flow with
TCP "Urgent Pointer field significant" (URG) flag set.
</paragraph>
</description>
<units>packets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc793"/> for the definition of the TCP URG
flag.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ipTotalLength</name>
<dataType>unsigned64</dataType>
<group>ipHeader</group>
<elementId>224</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The total length of the IP packet.
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the specification of the IPv4
total length.
See <xref type="rfc" data="rfc8200"/> for the specification of the
IPv6 payload length.
See <xref type="rfc" data="rfc2675"/> for the specification of the
IPv6 jumbo payload length.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postNATSourceIPv4Address</name>
<dataType>ipv4Address</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>225</elementId>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical to the 
definition of Information Element 'sourceIPv4Address', except 
that it reports a modified value caused by a NAT middlebox 
function after the packet passed the Observation Point.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the definition of the IPv4 source 
address field.  See <xref type="rfc" data="rfc3022"/> for the definition of 
NAT.  See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes. 
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>postNATDestinationIPv4Address</name>
<dataType>ipv4Address</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>226</elementId>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical to the 
definition of Information Element 'destinationIPv4Address', 
except that it reports a modified value caused by a NAT 
middlebox function after the packet passed the Observation 
Point.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc791"/> for the definition of the IPv4 destination 
address field.  See <xref type="rfc" data="rfc3022"/> for the definition of 
NAT.  See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes. 
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>postNAPTSourceTransportPort</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>227</elementId>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical to the 
definition of Information Element 'sourceTransportPort', except 
that it reports a modified value caused by a Network Address 
Port Translation (NAPT) middlebox function after the packet 
passed the Observation Point.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc768"/> for the definition of the UDP source port 
field.  See <xref type="rfc" data="rfc793"/> for the definition of the TCP 
source port field.  See <xref type="rfc" data="rfc4960"/> for the definition of 
SCTP.     
See <xref type="rfc" data="rfc3022"/> for the definition of NAPT.  See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes. 
Additional information on defined UDP and TCP port numbers can 
be found at http://www.iana.org/assignments/port-numbers.   
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postNAPTDestinationTransportPort</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>228</elementId>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical to the 
definition of Information Element 'destinationTransportPort', 
except that it reports a modified value caused by a Network 
Address Port Translation (NAPT) middlebox function after the 
packet passed the Observation Point. 
</paragraph>
</description>
<references>
<paragraph>         
See <xref type="rfc" data="rfc768"/> for the definition of the UDP source port 
field.  See <xref type="rfc" data="rfc793"/> for the definition of the TCP 
source port field.  See <xref type="rfc" data="rfc4960"/> for the definition of 
SCTP.     
See <xref type="rfc" data="rfc3022"/> for the definition of NAPT.  See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes. 
Additional information on defined UDP and TCP port numbers can 
be found at <xref type="registry" data="service-names-port-numbers"/>.   
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>natOriginatingAddressRealm</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>229</elementId>
<status>current</status>
<description>
<paragraph>
Indicates whether the session was created because traffic 
originated in the private or public address realm. 
postNATSourceIPv4Address, postNATDestinationIPv4Address, 
postNAPTSourceTransportPort, and 
postNAPTDestinationTransportPort are qualified with the address 
realm in perspective. 
</paragraph>
<paragraph>
The allowed values are: 
</paragraph>
<paragraph>
Private: 1 
</paragraph>
<paragraph>
Public:  2
</paragraph>
</description>
<range>1-2</range>
<references>
<paragraph>         
See <xref type="rfc" data="rfc3022"/> for the definition of NAT.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record updated="2017-03-15">
<name>natEvent</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>230</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element identifies a NAT event. This IE identifies 
the type of a NAT event. Examples of NAT events include, but are not 
limited to, NAT translation create, NAT translation delete, Threshold 
Reached, or Threshold Exceeded, etc. Values for this Information 
Element are listed in the "NAT Event Type" registry, see 
<xref type="uri" data="http://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-event-type"/>. 
New assignments of values will be administered by IANA and are 
subject to Expert Review <xref type="rfc" data="rfc8126"/>. Experts 
need to check definitions of new values for completeness, accuracy, 
and redundancy.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3022"/> for the definition of NAT.  See 
<xref type="rfc" data="rfc3234"/> for the definition of middleboxes.  
See <xref type="rfc" data="rfc8158"/> 
for the definitions of values 4-16.
</paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>2</revision>
<date>2017-03-15</date>
</record>

<record>
<name>initiatorOctets</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>231</elementId>
<status>current</status>
<description>
<paragraph>
The total number of layer 4 payload bytes in a flow from the 
initiator since the previous report. The initiator is the device 
which triggered the session creation, and remains the same for 
the life of the session. 
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>         
See #298, initiatorPackets.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-08-13</date>
</record> 

<record>
<name>responderOctets</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>232</elementId>
<status>current</status>
<description>
<paragraph>
The total number of layer 4 payload bytes in a flow from the 
responder since the previous report. The responder is the device 
which replies to the initiator, and remains the same for the life 
of the session.
</paragraph>
</description>
<units>octets</units>
<references>      
<paragraph>         
See #299, responderPackets.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record>
<name>firewallEvent</name>
<dataType>unsigned8</dataType>
<elementId>233</elementId>
<status>current</status>
<description>
<paragraph>
Indicates a firewall event.  The allowed values are: 
</paragraph>
<paragraph>
0 - Ignore (invalid) 
</paragraph>
<paragraph>
1 - Flow Created 
</paragraph>
<paragraph>
2 - Flow Deleted 
</paragraph>
<paragraph>
3 - Flow Denied
</paragraph>
<paragraph>
4 - Flow Alert 
</paragraph>
<paragraph>
5 - Flow Update 
</paragraph>
</description>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ingressVRFID</name>
<dataType>unsigned32</dataType>
<elementId>234</elementId>
<status>current</status>
<description>
<paragraph>
An unique identifier of the VRFname where the packets of this 
flow are being received.  This identifier is unique per Metering 
Process 
</paragraph>
</description>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>egressVRFID</name>
<dataType>unsigned32</dataType>
<elementId>235</elementId>
<status>current</status>
<description>
<paragraph>
An unique identifier of the VRFname where the packets of this 
flow are being sent.  This identifier is unique per Metering 
Process 
</paragraph>
</description>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>VRFname</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>236</elementId>
<status>current</status>
<description>
<paragraph>
The name of a VPN Routing and Forwarding table (VRF). 
</paragraph>
</description>
<references>
<paragraph>         
See <xref type="rfc" data="rfc4364"/> for the definition of VRF.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postMplsTopLabelExp</name>
<dataType>unsigned8</dataType>
<group>subIpHeader</group>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>237</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical to the
definition of Information Element 'mplsTopLabelExp', except
that it reports a potentially modified value caused by a
middlebox function after the packet passed the Observation
Point.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc3032"/> for the specification of the Exp
field.
See <xref type="rfc" data="rfc3270"/> for usage of the Exp field.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tcpWindowScale</name>
<dataType>unsigned16</dataType>
<group>transportHeader</group>
<elementId>238</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>
The scale of the window field in the TCP header.
</paragraph>
</description>
<references>
<paragraph>
See <xref type="rfc" data="rfc1323"/> for the definition of the TCP
window scale.
</paragraph>
</references>
<xref type="rfc" data="rfc5102"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>biflowDirection</name>
<dataType>unsigned8</dataType>
<group>misc</group>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>239</elementId>
<applicability>all</applicability>
<status>current</status>
<description>
<paragraph>A description of the direction assignment method used to
assign the Biflow Source and Destination.  This Information Element
MAY be present in a Flow Data Record, or applied to all flows exported
from an Exporting Process or Observation Domain using IPFIX Options.
If this Information Element is not present in a Flow Record or
associated with a Biflow via scope, it is assumed that the
configuration of the direction assignment method is done out-of-band.
Note that when using IPFIX Options to apply this Information Element
to all flows within an Observation Domain or from an Exporting
Process, the Option SHOULD be sent reliably.  If reliable transport is
not available (i.e., when using UDP), this Information Element SHOULD
appear in each Flow Record.  This field may take the following
values:</paragraph>
<artwork>
+-------+------------------+----------------------------------------+
| Value | Name             | Description                            |
+-------+------------------+----------------------------------------+
| 0x00  | arbitrary        | Direction was assigned arbitrarily.    |
| 0x01  | initiator        | The Biflow Source is the flow          |
|       |                  | initiator, as determined by the        |
|       |                  | Metering Process' best effort to       |
|       |                  | detect the initiator.                  |
| 0x02  | reverseInitiator | The Biflow Destination is the flow     |
|       |                  | initiator, as determined by the        |
|       |                  | Metering Process' best effort to       |
|       |                  | detect the initiator.  This value is   |
|       |                  | provided for the convenience of        |
|       |                  | Exporting Processes to revise an       |
|       |                  | initiator estimate without re-encoding |
|       |                  | the Biflow Record.                     |
| 0x03  | perimeter        | The Biflow Source is the endpoint      |
|       |                  | outside of a defined perimeter.  The   |
|       |                  | perimeter's definition is implicit in  |
|       |                  | the set of Biflow Source and Biflow    |
|       |                  | Destination addresses exported in the  |
|       |                  | Biflow Records.                        |
+-------+------------------+----------------------------------------+
</artwork>
</description>
<xref type="rfc" data="rfc5103"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ethernetHeaderLength</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>240</elementId>
<status>current</status>
<description>
<paragraph>
The difference between the length of an Ethernet frame (minus the 
FCS) and the length of its MAC Client Data section (including any 
padding) as defined in section 3.1 of [IEEE.802-3.2005].  It does 
not include the Preamble, SFD and Extension field lengths.  
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>         
[IEEE.802-3.2005] 
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record>
<name>ethernetPayloadLength</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>241</elementId>
<status>current</status>
<description>
<paragraph>
The length of the MAC Client Data section (including any padding) 
of a frame as defined in section 3.1 of [IEEE.802-3.2005].  
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>         
[IEEE.802-3.2005] 
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record>
<name>ethernetTotalLength</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>242</elementId>
<status>current</status>
<description>
<paragraph>
The total length of the Ethernet frame (excluding the Preamble, 
SFD, Extension and FCS fields) as described in section 3.1 of 
[IEEE.802-3.2005]. 
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>         
[IEEE.802-3.2005] 
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record>
<name>dot1qVlanId</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>243</elementId>
<status>current</status>
<description>
<paragraph>
The value of the 12-bit VLAN Identifier portion of the Tag Control
Information field of an Ethernet frame.  The structure and
semantics within the Tag Control Information field are defined in
[IEEE802.1Q].  In Provider Bridged Networks, it represents the
Service VLAN identifier in the Service VLAN Tag (S-TAG) Tag
Control Information (TCI) field or the Customer VLAN identifier in
the Customer VLAN Tag (C-TAG) Tag Control Information (TCI) field
as described in [IEEE802.1Q].  In Provider Backbone Bridged
Networks, it represents the Backbone VLAN identifier in the 
Backbone VLAN Tag (B-TAG) Tag Control Information (TCI) field as
described in [IEEE802.1Q].  In a virtual link between a host
system and EVB bridge, it represents the Service VLAN identifier
indicating S-channel as described in [IEEE802.1Qbg].
</paragraph>
<paragraph>
In the case of a multi-tagged frame, it represents the outer tag's
VLAN identifier, except for I-TAG.
</paragraph>
</description>
<references>
<paragraph>         
[IEEE802.1Q][IEEE802.1Qbg]
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<xref type="rfc" data="rfc7133"/>
<revision>2</revision>
<date>2014-01-11</date>
</record> 

<record>
<name>dot1qPriority</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>244</elementId>
<status>current</status>
<description>
<paragraph>
The value of the 3-bit User Priority portion of the Tag Control
Information field of an Ethernet frame.  The structure and
semantics within the Tag Control Information field are defined in
[IEEE802.1Q].  In the case of multi-tagged frame, it represents
the 3-bit Priority Code Point (PCP) portion of the outer tag's Tag
Control Information (TCI) field as described in [IEEE802.1Q],
except for I-TAG.
</paragraph>
</description>
<references>
<paragraph>         
[IEEE802.1Q]
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-01-11</date>
</record> 

<record>
<name>dot1qCustomerVlanId</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>245</elementId>
<status>current</status>
<description>
<paragraph>
The value represents the Customer VLAN identifier in the Customer
VLAN Tag (C-TAG) Tag Control Information (TCI) field as described
in [IEEE802.1Q].
</paragraph>
</description>
<references>
<paragraph>         
[IEEE802.1Q]
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-01-11</date>
</record> 

<record>
<name>dot1qCustomerPriority</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>246</elementId>
<status>current</status>
<description>
<paragraph>
The value represents the 3-bit Priority Code Point (PCP) portion
of the Customer VLAN Tag (C-TAG) Tag Control Information (TCI)
field as described in [IEEE802.1Q].
</paragraph>
</description>
<references>
<paragraph>         
[IEEE802.1Q]
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-01-11</date>
</record>

<record>
<name>metroEvcId</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>247</elementId>
<status>current</status>
<description>
<paragraph>
The EVC Service Attribute which uniquely identifies the Ethernet 
Virtual Connection (EVC) within a Metro Ethernet Network, as 
defined in section 6.2 of MEF 10.1.  The MetroEVCID is encoded in 
a string of up to 100 characters.  
</paragraph>
</description>
<references>
<paragraph>         
MEF 10.1 (Ethernet Services Attributes Phase 2) 
MEF16 (Ethernet Local Management Interface) 
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>metroEvcType</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>248</elementId>
<status>current</status>
<description>
<paragraph>
The 3-bit EVC Service Attribute which identifies the type of 
service provided by an EVC. 
</paragraph>
</description>
<references>
<paragraph>         
MEF 10.1 (Ethernet Services Attributes Phase 2)  
MEF16 (Ethernet Local Management Interface) 
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>pseudoWireId</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>249</elementId>
<status>current</status>
<description>
<paragraph>
A 32-bit non-zero connection identifier, which together with the 
pseudoWireType, identifies the Pseudo Wire (PW) as defined in <xref type="rfc" data="rfc8077"/>. 
</paragraph>
</description>
<references>
<paragraph>         
See <xref type="rfc" data="rfc8077"/> for pseudowire definitions.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>pseudoWireType</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>250</elementId>
<status>current</status>
<description>
<paragraph>
The value of this information element identifies the type of MPLS 
Pseudo Wire (PW) as defined in <xref type="rfc" data="rfc4446"/>.
</paragraph>
</description>
<references>
<paragraph>         
See <xref type="rfc" data="rfc4446"/> for the pseudowire type definition, and 
http://www.iana.org/assignments/pwe3-parameters for the IANA 
Pseudowire Types Registry.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>pseudoWireControlWord</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>251</elementId>
<status>current</status>
<description>
<paragraph>
The 32-bit Preferred Pseudo Wire (PW) MPLS Control Word as 
defined in Section 3 of <xref type="rfc" data="rfc4385"/>. 
</paragraph>
</description>
<references>
<paragraph>         
See <xref type="rfc" data="rfc4385"/> for the Pseudo Wire Control Word 
definition.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ingressPhysicalInterface</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>252</elementId>
<status>current</status>
<description>
<paragraph>
The index of a networking device's physical interface (example, a 
switch port) where packets of this flow are being received. 
</paragraph>
</description>
<references>
<paragraph>         
See <xref type="rfc" data="rfc2863"/> for the definition of the ifIndex object.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>egressPhysicalInterface</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>253</elementId>
<status>current</status>
<description>
<paragraph>
The index of a networking device's physical interface (example, a 
switch port) where packets of this flow are being sent. 
</paragraph>
</description>
<references>
<paragraph>         
See <xref type="rfc" data="rfc2863"/> for the definition of the ifIndex object.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postDot1qVlanId</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>254</elementId>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical to the 
definition of Information Element 'dot1qVlanId', except that it 
reports a potentially modified value caused by a middlebox 
function after the packet passed the Observation Point.  
</paragraph>
</description>
<references>
<paragraph>         
[IEEE.802-3.2005] 
[IEEE.802-1ad.2005] 
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postDot1qCustomerVlanId</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>255</elementId>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical to the 
definition of Information Element 'dot1qCustomerVlanId', except 
that it reports a potentially modified value caused by a 
middlebox function after the packet passed the Observation Point. 
</paragraph>
</description>
<references>
<paragraph>         
[IEEE.802-1ad.2005] 
[IEEE.802-1Q.2003]
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record> 

<record>
<name>ethernetType</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>256</elementId>
<status>current</status>
<description>
<paragraph>
The Ethernet type field of an Ethernet frame that identifies the 
MAC client protocol carried in the payload as defined in 
paragraph 1.4.349 of [IEEE.802-3.2005]. 
</paragraph>
</description>
<references>
<paragraph>         
[IEEE.802-3.2005] 
Ethertype registry available at
<xref type="uri" data="http://standards.ieee.org/regauth/ethertype/eth.txt"/>
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>postIpPrecedence</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>257</elementId>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical to the         
definition of Information Element 'ipPrecedence', except that 
it reports a potentially modified value caused by a middlebox
function after the packet passed the Observation Point.
</paragraph>
</description>
<range>0-7</range>
<references>
<paragraph>         
See <xref type="rfc" data="rfc1812"/> (Section 5.3.3) and 
<xref type="rfc" data="rfc791"/> for the definition of the
IP Precedence. See <xref type="rfc" data="rfc1812"/> 
(Section 5.3.2) and <xref type="rfc" data="rfc791"/> for the
definition of the IPv4 TOS field. See 
<xref type="rfc" data="rfc8200"/> for the definition of the 
IPv6 Traffic Class field. 
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>collectionTimeMilliseconds</name>
<dataType>dateTimeMilliseconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>258</elementId>
<status>current</status>
<description>
<paragraph>
The absolute timestamp at which the data within the
scope containing this Information Element was received by a
Collecting Process.  This Information Element SHOULD be bound to
its containing IPFIX Message via IPFIX Options and the
messageScope Information Element, as defined below.
</paragraph>
</description>
<units>milliseconds</units>
<xref type="rfc" data="rfc5655"/><xref type="rfc-errata" data="3559"/>
<revision>1</revision>
<date>2013-03-26</date>
</record>

<record>
<name>exportSctpStreamId</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>259</elementId>
<status>current</status>
<description>
<paragraph>
The value of the SCTP Stream Identifier used by the
Exporting Process for exporting IPFIX Message data.  This is
carried in the Stream Identifier field of the header of the SCTP
DATA chunk containing the IPFIX Message(s).
</paragraph>
</description>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>maxExportSeconds</name>
<dataType>dateTimeSeconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>260</elementId>
<status>current</status>
<description>
<paragraph>
The absolute Export Time of the latest IPFIX Message
within the scope containing this Information Element. This
Information Element SHOULD be bound to its containing IPFIX
Transport Session via IPFIX Options and the sessionScope
Information Element.
</paragraph>
</description>
<units>seconds</units>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>maxFlowEndSeconds</name>
<dataType>dateTimeSeconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>261</elementId>
<status>current</status>
<description>
<paragraph>
The latest absolute timestamp of the last packet
within any Flow within the scope containing this Information
Element, rounded up to the second if necessary.  This Information
Element SHOULD be bound to its containing IPFIX Transport Session
via IPFIX Options and the sessionScope Information Element.
</paragraph>
</description>
<units>seconds</units>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>messageMD5Checksum</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>262</elementId>
<status>current</status>
<description>
<paragraph>
The MD5 checksum of the IPFIX Message containing this
record.  This Information Element SHOULD be bound to its
containing IPFIX Message via an options record and the
messageScope Information Element, as defined below, and SHOULD
appear only once in a given IPFIX Message.  To calculate the value
of this Information Element, first buffer the containing IPFIX
Message, setting the value of this Information Element to all
zeroes.  Then calculate the MD5 checksum of the resulting buffer
as defined in <xref type="rfc" data="rfc1321"/>, place the resulting value in this
Information Element, and export the buffered message.  This
Information Element is intended as a simple checksum only;
therefore collision resistance and algorithm agility are not
required, and MD5 is an appropriate message digest.

This Information Element has a fixed length of 16 octets.
</paragraph>
</description>
<xref type="rfc" data="rfc5655"/>
<xref type="rfc" data="rfc1321"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>messageScope</name>
<dataType>unsigned8</dataType>
<elementId>263</elementId>
<status>current</status>
<description>
<paragraph>
The presence of this Information Element as scope in
an Options Template signifies that the options described by the
Template apply to the IPFIX Message that contains them. It is
defined for general purpose message scoping of options, and
proposed specifically to allow the attachment a checksum to a
message via IPFIX Options. The value of this Information Element
MUST be written as 0 by the File Writer or Exporting Process. The
value of this Information Element MUST be ignored by the File
Reader or the Collecting Process.
</paragraph>
</description>
<range>0-0</range>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>minExportSeconds</name>
<dataType>dateTimeSeconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>264</elementId>
<status>current</status>
<description>
<paragraph>
The absolute Export Time of the earliest IPFIX Message
within the scope containing this Information Element.  This
Information Element SHOULD be bound to its containing IPFIX
Transport Session via an options record and the sessionScope
Information Element.
</paragraph>
</description>
<units>seconds</units>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>minFlowStartSeconds</name>
<dataType>dateTimeSeconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>265</elementId>
<status>current</status>
<description>
<paragraph>
The earliest absolute timestamp of the first packet
within any Flow within the scope containing this Information
Element, rounded down to the second if necessary.  This
Information Element SHOULD be bound to its containing IPFIX
Transport Session via an options record and the sessionScope
Information Element.
</paragraph>
</description>
<units>seconds</units>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>opaqueOctets</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>266</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element is used to encapsulate non-
IPFIX data into an IPFIX Message stream, for the purpose of
allowing a non-IPFIX data processor to store a data stream inline
within an IPFIX File.  A Collecting Process or File Writer MUST
NOT try to interpret this binary data.  This Information Element
differs from paddingOctets as its contents are meaningful in some
non-IPFIX context, while the contents of paddingOctets MUST be
0x00 and are intended only for Information Element alignment.
</paragraph>
</description>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>sessionScope</name>
<dataType>unsigned8</dataType>
<elementId>267</elementId>
<status>current</status>
<description>
<paragraph>
The presence of this Information Element as scope in
an Options Template signifies that the options described by the
Template apply to the IPFIX Transport Session that contains them.
Note that as all options are implicitly scoped to Transport
Session and Observation Domain, this Information Element is
equivalent to a "null" scope.  It is defined for general purpose
session scoping of options, and proposed specifically to allow the
attachment of time window to an IPFIX File via IPFIX Options.  The
value of this Information Element MUST be written as 0 by the File
Writer or Exporting Process.  The value of this Information
Element MUST be ignored by the File Reader or the Collecting
Process.
</paragraph>
</description>
<range>0-0</range>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>maxFlowEndMicroseconds</name>
<dataType>dateTimeMicroseconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>268</elementId>
<status>current</status>
<description>
<paragraph>
The latest absolute timestamp of the last packet
within any Flow within the scope containing this Information
Element, rounded up to the microsecond if necessary.  This
Information Element SHOULD be bound to its containing IPFIX
Transport Session via IPFIX Options and the sessionScope
Information Element.  This Information Element SHOULD be used only
in Transport Sessions containing Flow Records with microsecond-
precision (or better) timestamp Information Elements.
</paragraph>
</description>
<units>microseconds</units>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>maxFlowEndMilliseconds</name>
<dataType>dateTimeMilliseconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>269</elementId>
<status>current</status>
<description>
<paragraph>
The latest absolute timestamp of the last packet
within any Flow within the scope containing this Information
Element, rounded up to the millisecond if necessary.  This
Information Element SHOULD be bound to its containing IPFIX
Transport Session via IPFIX Options and the sessionScope
Information Element.  This Information Element SHOULD be used only
in Transport Sessions containing Flow Records with millisecond-
precision (or better) timestamp Information Elements.
</paragraph>
</description>
<units>milliseconds</units>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>maxFlowEndNanoseconds</name>
<dataType>dateTimeNanoseconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>270</elementId>
<status>current</status>
<description>
<paragraph>
The latest absolute timestamp of the last packet
within any Flow within the scope containing this Information
Element.  This Information Element SHOULD be bound to its
containing IPFIX Transport Session via IPFIX Options and the
sessionScope Information Element.  This Information Element SHOULD
be used only in Transport Sessions containing Flow Records with
nanosecond-precision timestamp Information Elements.
</paragraph>
</description>
<units>nanoseconds</units>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>minFlowStartMicroseconds</name>
<dataType>dateTimeMicroseconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>271</elementId>
<status>current</status>
<description>
<paragraph>
The earliest absolute timestamp of the first packet
within any Flow within the scope containing this Information
Element, rounded down to the microsecond if necessary.  This
Information Element SHOULD be bound to its containing IPFIX
Transport Session via an options record and the sessionScope
Information Element.  This Information Element SHOULD be used only
in Transport Sessions containing Flow Records with microsecond-
precision (or better) timestamp Information Elements.
</paragraph>
</description>
<units>microseconds</units>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>minFlowStartMilliseconds</name>
<dataType>dateTimeMilliseconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>272</elementId>
<status>current</status>
<description>
<paragraph>
The earliest absolute timestamp of the first packet
within any Flow within the scope containing this Information
Element, rounded down to the millisecond if necessary.  This
Information Element SHOULD be bound to its containing IPFIX
Transport Session via an options record and the sessionScope
Information Element.  This Information Element SHOULD be used only
in Transport Sessions containing Flow Records with millisecond-
precision (or better) timestamp Information Elements.
</paragraph>
</description>
<units>milliseconds</units>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>minFlowStartNanoseconds</name>
<dataType>dateTimeNanoseconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>273</elementId>
<status>current</status>
<description>
<paragraph>
The earliest absolute timestamp of the first packet
within any Flow within the scope containing this Information
Element.  This Information Element SHOULD be bound to its
containing IPFIX Transport Session via an options record and the
sessionScope Information Element.  This Information Element SHOULD
be used only in Transport Sessions containing Flow Records with
nanosecond-precision timestamp Information Elements.
</paragraph>
</description>
<units>nanoseconds</units>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>collectorCertificate</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>274</elementId>
<status>current</status>
<description>
<paragraph>
The full X.509 certificate, encoded in ASN.1 DER
format, used by the Collector when IPFIX Messages were transmitted
using TLS or DTLS.  This Information Element SHOULD be bound to
its containing IPFIX Transport Session via an options record and
the sessionScope Information Element, or to its containing IPFIX
Message via an options record and the messageScope Information
Element.
</paragraph>
</description>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>exporterCertificate</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>275</elementId>
<status>current</status>
<description>
<paragraph>
The full X.509 certificate, encoded in ASN.1 DER
format, used by the Collector when IPFIX Messages were transmitted
using TLS or DTLS.  This Information Element SHOULD be bound to
its containing IPFIX Transport Session via an options record and
the sessionScope Information Element, or to its containing IPFIX
Message via an options record and the messageScope Information
Element.
</paragraph>
</description>
<xref type="rfc" data="rfc5655"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>dataRecordsReliability</name>
<dataType>boolean</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>276</elementId>
<status>current</status>
<description>
<paragraph>
The export reliability of Data Records, within this SCTP 
stream, for the element(s) in the Options Template 
scope.  A typical example of an element for which the 
export reliability will be reported is the templateID, 
as specified in the Data Records Reliability Options 
Template.  A value of 'True' means that the Exporting 
Process MUST send any Data Records associated with the 
element(s) reliably within this SCTP stream.  A value of 
'False' means that the Exporting Process MAY send any 
Data Records associated with the element(s) unreliably 
within this SCTP stream.     
</paragraph>
</description>
<xref type="rfc" data="rfc6526"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record date="2010-09-16">
<name>observationPointType</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>277</elementId>
<status>current</status>
<description>
<paragraph>
Type of observation point. Values assigned to date are:
</paragraph>
<paragraph>
1. Physical port
</paragraph>
<paragraph>
2. Port channel
</paragraph>
<paragraph>
3. Vlan.
</paragraph>
</description>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record date="2010-10-19">
<name>newConnectionDeltaCount</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>278</elementId>
<status>current</status>
<description>
<paragraph>This information element counts the number of TCP or UDP
connections which were opened during the observation period. The
observation period may be specified by the flow start and end timestamps.
</paragraph>
</description>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record date="2010-10-19">
<name>connectionSumDurationSeconds</name>
<dataType>unsigned64</dataType>
<elementId>279</elementId>
<status>current</status>
<description>
<paragraph>This information element aggregates the total time in
seconds for all of the TCP or UDP connections which were in use during
the observation period. For example if there are 5 concurrent
connections each for 10 seconds, the value would be 50 s.
</paragraph>
</description>
<units>seconds</units>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2013-06-25</date>
</record>

<record date="2010-10-19">
<name>connectionTransactionId</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>280</elementId>
<status>current</status>
<description>
<paragraph>This information element identifies a transaction within a
connection. A transaction is a meaningful exchange of application data
between two network devices or a client and server. A transactionId is
assigned the first time a flow is reported, so that later reports for
the same flow will have the same transactionId. A different
transactionId is used for each transaction within a TCP or UDP
connection. The identifiers need not be sequential.
</paragraph>
</description>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record date="2010-10-19">
<name>postNATSourceIPv6Address</name>
<dataType>ipv6Address</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>281</elementId>
<status>current</status>
<description>
<paragraph>The definition of this Information Element is identical to
the definition of Information Element 'sourceIPv6Address', except that
it reports a modified value caused by a NAT64 middlebox function after
the packet passed the Observation Point.

See <xref type="rfc" data="rfc8200"/> for the definition of the Source Address field in the IPv6
header. See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes. See
<xref type="rfc" data="rfc6146"/> for nat64 specification.
</paragraph>
</description>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record date="2010-10-19">
<name>postNATDestinationIPv6Address</name>
<dataType>ipv6Address</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>282</elementId>
<status>current</status>
<description>
<paragraph>The definition of this Information Element is identical to
the definition of Information Element 'destinationIPv6Address', except
that it reports a modified value caused by a NAT64 middlebox function
after the packet passed the Observation Point.

See <xref type="rfc" data="rfc8200"/> for the definition of the Destination Address field in the
IPv6 header. See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes. See
<xref type="rfc" data="rfc6146"/> for nat64 specification.
</paragraph>
</description>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record date="2011-02-10">
<name>natPoolId</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>283</elementId>
<status>current</status>
<description>
<paragraph>Locally unique identifier of a NAT pool.
</paragraph>
</description>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record date="2011-02-10">
<name>natPoolName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>284</elementId>
<status>current</status>
<description>
<paragraph>The name of a NAT pool identified by a natPoolID.
</paragraph>
</description>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>anonymizationFlags</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>285</elementId>
<status>current</status>
<description>
<paragraph>A flag word describing specialized modifications to
the anonymization policy in effect for the anonymization technique
applied to a referenced Information Element within a referenced
Template.  When flags are clear (0), the normal policy (as
described by anonymizationTechnique) applies without modification.
</paragraph>
<artwork>
MSB   14  13  12  11  10   9   8   7   6   5   4   3   2   1  LSB
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
|                Reserved                       |LOR|PmA|   SC  |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

anonymizationFlags IE

+--------+----------+-----------------------------------------------+
| bit(s) | name     | description                                   |
| (LSB = |          |                                               |
| 0)     |          |                                               |
+--------+----------+-----------------------------------------------+
| 0-1    | SC       | Stability Class: see the Stability Class      |
|        |          | table below, and section Section 5.1.         | 
| 2      | PmA      | Perimeter Anonymization: when set (1),        |
|        |          | source- Information Elements as described in  |
|        |          | [RFC5103] are interpreted as external         |
|        |          | addresses, and destination- Information       |
|        |          | Elements as described in [RFC5103] are        |
|        |          | interpreted as internal addresses, for the    |
|        |          | purposes of associating                       |
|        |          | anonymizationTechnique to Information         |
|        |          | Elements only; see Section 7.2.2 for details. |
|        |          | This bit MUST NOT be set when associated with |
|        |          | a non-endpoint (i.e., source- or              |
|        |          | destination-) Information Element.  SHOULD be |
|        |          | consistent within a record (i.e., if a        |
|        |          | source- Information Element has this flag     |
|        |          | set, the corresponding destination- element   |
|        |          | SHOULD have this flag set, and vice-versa.)   |
| 3      | LOR      | Low-Order Unchanged: when set (1), the        |
|        |          | low-order bits of the anonymized Information  |
|        |          | Element contain real data.  This modification |
|        |          | is intended for the anonymization of          |
|        |          | network-level addresses while leaving         |
|        |          | host-level addresses intact in order to       |
|        |          | preserve host level-structure, which could    |
|        |          | otherwise be used to reverse anonymization.   |
|        |          | MUST NOT be set when associated with a        |
|        |          | truncation-based anonymizationTechnique.      |
| 4-15   | Reserved | Reserved for future use: SHOULD be cleared    |
|        |          | (0) by the Exporting Process and MUST be      |
|        |          | ignored by the Collecting Process.            |
+--------+----------+-----------------------------------------------+
</artwork>
<paragraph>
The Stability Class portion of this flags word describes the
stability class of the anonymization technique applied to a
referenced Information Element within a referenced Template.
Stability classes refer to the stability of the parameters of the
anonymization technique, and therefore the comparability of the
mapping between the real and anonymized values over time.  This
determines which anonymized datasets may be compared with each
other.  Values are as follows:
</paragraph>
<artwork>
+-----+-----+-------------------------------------------------------+
| Bit | Bit | Description                                           |
| 1   | 0   |                                                       |
+-----+-----+-------------------------------------------------------+
| 0   | 0   | Undefined: the Exporting Process makes no             |
|     |     | representation as to how stable the mapping is, or    |
|     |     | over what time period values of this field will       |
|     |     | remain comparable; while the Collecting Process MAY   |
|     |     | assume Session level stability, Session level         |
|     |     | stability is not guaranteed.  Processes SHOULD assume |
|     |     | this is the case in the absence of stability class    |
|     |     | information; this is the default stability class.     |
| 0   | 1   | Session: the Exporting Process will ensure that the   |
|     |     | parameters of the anonymization technique are stable  |
|     |     | during the Transport Session.  All the values of the  |
|     |     | described Information Element for each Record         |
|     |     | described by the referenced Template within the       |
|     |     | Transport Session are comparable.  The Exporting      |
|     |     | Process SHOULD endeavour to ensure at least this      |
|     |     | stability class.                                      |
| 1   | 0   | Exporter-Collector Pair: the Exporting Process will   |
|     |     | ensure that the parameters of the anonymization       |
|     |     | technique are stable across Transport Sessions over   |
|     |     | time with the given Collecting Process, but may use   |
|     |     | different parameters for different Collecting         |
|     |     | Processes.  Data exported to different Collecting     |
|     |     | Processes are not comparable.                         |
| 1   | 1   | Stable: the Exporting Process will ensure that the    |
|     |     | parameters of the anonymization technique are stable  |
|     |     | across Transport Sessions over time, regardless of    |
|     |     | the Collecting Process to which it is sent.           |
+-----+-----+-------------------------------------------------------+
</artwork>
</description>
<xref type="rfc" data="rfc6235"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>anonymizationTechnique</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>286</elementId>
<status>current</status>
<description>
<paragraph>
A description of the anonymization technique applied
to a referenced Information Element within a referenced Template.
Each technique may be applicable only to certain Information
Elements and recommended only for certain Infomation Elements;
these restrictions are noted in the table below.
</paragraph>
<artwork>
+-------+---------------------------+-----------------+-------------+
| Value | Description               | Applicable to   | Recommended |
|       |                           |                 | for         |
+-------+---------------------------+-----------------+-------------+
| 0     | Undefined: the Exporting  | all             | all         |
|       | Process makes no          |                 |             |
|       | representation as to      |                 |             |
|       | whether the defined field |                 |             |
|       | is anonymized or not.     |                 |             |
|       | While the Collecting      |                 |             |
|       | Process MAY assume that   |                 |             |
|       | the field is not          |                 |             |
|       | anonymized, it is not     |                 |             |
|       | guaranteed not to be.     |                 |             |
|       | This is the default       |                 |             |
|       | anonymization technique.  |                 |             |
| 1     | None: the values exported | all             | all         |
|       | are real.                 |                 |             |
| 2     | Precision                 | all             | all         |
|       | Degradation/Truncation:   |                 |             |
|       | the values exported are   |                 |             |
|       | anonymized using simple   |                 |             |
|       | precision degradation or  |                 |             |
|       | truncation.  The new      |                 |             |
|       | precision or number of    |                 |             |
|       | truncated bits is         |                 |             |
|       | implicit in the exported  |                 |             |
|       | data, and can be deduced  |                 |             |
|       | by the Collecting         |                 |             |
|       | Process.                  |                 |             |
| 3     | Binning: the values       | all             | all         |
|       | exported are anonymized   |                 |             |
|       | into bins.                |                 |             |
| 4     | Enumeration: the values   | all             | timestamps  |
|       | exported are anonymized   |                 |             |
|       | by enumeration.           |                 |             |
| 5     | Permutation: the values   | all             | identifiers |
|       | exported are anonymized   |                 |             |
|       | by permutation.           |                 |             |
| 6     | Structured Permutation:   | addresses       |             |
|       | the values exported are   |                 |             |
|       | anonymized by             |                 |             |
|       | permutation, preserving   |                 |             |
|       | bit-level structure as    |                 |             |
|       | appropriate; this         |                 |             |
|       | represents                |                 |             |
|       | prefix-preserving IP      |                 |             |
|       | address anonymization or  |                 |             |
|       | structured MAC address    |                 |             |
|       | anonymization.            |                 |             |
| 7     | Reverse Truncation: the   | addresses       |             |
|       | values exported are       |                 |             |
|       | anonymized using reverse  |                 |             |
|       | truncation.  The number   |                 |             |
|       | of truncated bits is      |                 |             |
|       | implicit in the exported  |                 |             |
|       | data, and can be deduced  |                 |             |
|       | by the Collecting         |                 |             |
|       | Process.                  |                 |             |
| 8     | Noise: the values         | non-identifiers | counters    |
|       | exported are anonymized   |                 |             |
|       | by adding random noise to |                 |             |
|       | each value.               |                 |             |
| 9     | Offset: the values        | all             | timestamps  |
|       | exported are anonymized   |                 |             |
|       | by adding a single offset |                 |             |
|       | to all values.            |                 |             |
+-------+---------------------------+-----------------+-------------+ 
</artwork>
</description>
<xref type="rfc" data="rfc6235"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>informationElementIndex</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>287</elementId>
<status>current</status>
<description>
<paragraph>A zero-based index of an Information Element
referenced by informationElementId within a Template referenced by
templateId; used to disambiguate scope for templates containing
multiple identical Information Elements.</paragraph>
</description>
<xref type="rfc" data="rfc6235"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>p2pTechnology
</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>288</elementId>
<status>current</status>
<description>
<paragraph>Specifies if the Application ID is based on peer-to-peer
technology. 
</paragraph>
<paragraph>
Possible values are: { "yes", "y", 1 }, 
{ "no", "n", 2 } and { "unassigned", "u", 0 }.
</paragraph>
</description>
<xref type="rfc" data="rfc6759"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>tunnelTechnology
</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>289</elementId>
<status>current</status>
<description>
<paragraph>Specifies if the Application ID is used as a tunnel technology.
</paragraph>
<paragraph>
Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and 
{ "unassigned", "u", 0 }.
</paragraph>
</description>
<xref type="rfc" data="rfc6759"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>encryptedTechnology
</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>290</elementId>
<status>current</status>
<description>
<paragraph>Specifies if the Application ID is an encrypted networking
protocol. 
</paragraph>
<paragraph>Possible values are: { "yes", "y", 1 }, 
{ "no", "n", 2 } and { "unassigned", "u", 0 }.
</paragraph>
</description>
<xref type="rfc" data="rfc6759"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>basicList</name>
<dataType>basicList</dataType>
<dataTypeSemantics>list</dataTypeSemantics>
<elementId>291</elementId>
<status>current</status>
<description>
<paragraph>
Specifies a generic Information Element with a basicList abstract
data type.  For example, a list of port numbers, a list of
interface indexes, etc.
</paragraph>
</description>
<xref type="rfc" data="rfc6313"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>subTemplateList</name>
<dataType>subTemplateList</dataType>
<dataTypeSemantics>list</dataTypeSemantics>
<elementId>292</elementId>
<status>current</status>
<description>
<paragraph>
Specifies a generic Information Element with a subTemplateList
abstract data type.
</paragraph>
</description>
<xref type="rfc" data="rfc6313"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>subTemplateMultiList</name>
<dataType>subTemplateMultiList</dataType>
<dataTypeSemantics>list</dataTypeSemantics>
<elementId>293</elementId>
<status>current</status>
<description>
<paragraph>
Specifies a generic Information Element with a
subTemplateMultiList abstract data type.
</paragraph>
</description>
<xref type="rfc" data="rfc6313"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>bgpValidityState</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>294</elementId>
<status>current</status>
<description>
<paragraph>
This element describes the "validity state" of the BGP route correspondent source or destination IP address. If the "validity state" for this Flow is only available, then the value of this Information Element is 255.
</paragraph>
</description>
<references>
<paragraph>         
See <xref type="rfc" data="rfc4271"/> for a description of BGP-4, 
<xref type="rfc" data="rfc6811"/> for the
definition of "validity states" and 
<xref type="draft" data="draft-ietf-sidr-origin-validation-signaling"/> 
for the encoding of those "validity states". 
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>IPSecSPI</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>295</elementId>
<status>current</status>
<description>
<paragraph>
IPSec Security Parameters Index (SPI).
</paragraph>
</description>
<references>
<paragraph>         
See <xref type="rfc" data="rfc2401"/> for the definition of SPI.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>greKey</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>296</elementId>
<status>current</status>
<description>
<paragraph>
GRE key, which is used for identifying an individual traffic flow within a tunnel.
</paragraph>
</description>
<references>
<paragraph>         
See <xref type="rfc" data="rfc1701"/> for the definition of GRE and the GRE Key.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>natType</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>297</elementId>
<status>current</status>
<description>
<paragraph>
The type of NAT treatment:
</paragraph>
<paragraph>
0 unknown
</paragraph>
<paragraph>
1 NAT44 translated
</paragraph>
<paragraph>
2 NAT64 translated
</paragraph>
<paragraph>
3 NAT46 translated
</paragraph>
<paragraph>
4 IPv4--&gt;IPv4 (no NAT)
</paragraph>
<paragraph>
5 NAT66 translated
</paragraph>
<paragraph>
6 IPv6--&gt;IPv6 (no NAT)
</paragraph>
</description>
<range/>
<references>
<paragraph>         
See <xref type="rfc" data="rfc3022"/> for the definition of NAT.
See <xref type="rfc" data="rfc1631"/> for the definition of NAT44.
See <xref type="rfc" data="rfc6144"/> for the definition of NAT64.
See <xref type="rfc" data="rfc6146"/> for the definition of NAT46.
See <xref type="rfc" data="rfc6296"/> for the definition of NAT66.
See <xref type="rfc" data="rfc791"/> for the definition of IPv4.
See <xref type="rfc" data="rfc8200"/> for the definition of IPv6.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>initiatorPackets</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>298</elementId>
<status>current</status>
<description>
<paragraph>
The total number of layer 4 packets in a flow from the initiator 
since the previous report. The initiator is the device which 
triggered the session creation, and remains the same for the life 
of the session.
</paragraph>
</description>
<units>packets</units>
<references>
<paragraph>         
See #231, initiatorOctets.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record>
<name>responderPackets</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>299</elementId>
<status>current</status>
<description>
<paragraph>
The total number of layer 4 packets in a flow from the responder 
since the previous report. The responder is the device which 
replies to the initiator, and remains the same for the life of the 
session.
</paragraph>
</description>
<units>packets</units>
<references>
<paragraph>         
See #232, responderOctets.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record>
<name>observationDomainName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>300</elementId>
<status>current</status>
<description>
<paragraph>
The name of an observation domain identified by an
observationDomainId.
</paragraph>
</description>
<references>
<paragraph>         
See #149, observationDomainId.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>selectionSequenceId</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>301</elementId>
<status>current</status>
<description>
<paragraph>
From all the packets observed at an Observation Point, a subset of
the packets is selected by a sequence of one or more Selectors.
The selectionSequenceId is a unique value per Observation Domain,
specifying the Observation Point and the sequence of Selectors
through which the packets are selected.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>selectorId</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>302</elementId>
<status>current</status>
<description>
<paragraph>
The Selector ID is the unique ID identifying a Primitive Selector.
Each Primitive Selector must have a unique ID in the Observation
Domain.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<xref type="rfc-errata" data="2052"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>informationElementId</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>303</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element contains the ID of another Information
Element.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>selectorAlgorithm</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>304</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element identifies the packet selection methods
(e.g., Filtering, Sampling) that are applied by the Selection
Process.
</paragraph>
<paragraph>
Most of these methods have parameters.  Further Information
Elements are needed to fully specify packet selection with these
methods and all their parameters.
</paragraph>
<paragraph>
The methods listed below are defined in <xref type="rfc" data="rfc5475"/>.  For their parameters, Information Elements are defined in
the information model document.  The names of these Information
Elements are listed for each method identifier.
</paragraph>
<paragraph>
Further method identifiers may be added to the list below.  It
might be necessary to define new Information Elements to specify
their parameters.
</paragraph>
<paragraph>
The selectorAlgorithm registry is maintained by IANA.  New
assignments for the registry will be administered by IANA, and
are subject to Expert Review <xref type="rfc" data="rfc8126"/>.
</paragraph>
<paragraph>
The registry can be updated when specifications of the new
method(s) and any new Information Elements are provided.
</paragraph>
<paragraph>
The group of experts must double check the selectorAlgorithm
definitions and Information Elements with already defined
selectorAlgorithms and Information Elements for completeness,
accuracy, and redundancy.  Those experts will initially be drawn
from the Working Group Chairs and document editors of the IPFIX
and PSAMP Working Groups.
</paragraph>
<paragraph>
The following packet selection methods identifiers are defined
here:
</paragraph>
<paragraph>
<xref type="registry" data="psamp-parameters"/>
</paragraph>
<paragraph>
There is a broad variety of possible parameters that could be used
for Property match Filtering (5) but currently there are no agreed
parameters specified.        
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>samplingPacketInterval</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>305</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the number of packets that are
consecutively sampled.  A value of 100 means that 100
consecutive packets are sampled.
</paragraph>
<paragraph>
For example, this Information Element may be used to describe the
configuration of a systematic count-based Sampling Selector.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>samplingPacketSpace</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>306</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the number of packets between
two "samplingPacketInterval"s.  A value of 100 means that the next
interval starts 100 packets (which are not sampled) after the
current "samplingPacketInterval" is over.
</paragraph>
<paragraph>
For example, this Information Element may be used to describe the
configuration of a systematic count-based Sampling Selector.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>samplingTimeInterval</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>307</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the time interval in
microseconds during which all arriving packets are sampled.
</paragraph>
<paragraph>
For example, this Information Element may be used to describe the
configuration of a systematic time-based Sampling Selector.
</paragraph>
</description>
<units>microseconds</units>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>samplingTimeSpace</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>308</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the time interval in
microseconds between two "samplingTimeInterval"s.  A value of 100
means that the next interval starts 100 microseconds (during which
no packets are sampled) after the current "samplingTimeInterval"
is over.
</paragraph>
<paragraph>
For example, this Information Element may used to describe the
configuration of a systematic time-based Sampling Selector.
</paragraph>
</description>
<units>microseconds</units>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>samplingSize</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>309</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the number of elements taken
from the parent Population for random Sampling methods.
</paragraph>
<paragraph>
For example, this Information Element may be used to describe the
configuration of a random n-out-of-N Sampling Selector.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>samplingPopulation</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>310</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the number of elements in the
parent Population for random Sampling methods.
</paragraph>
<paragraph>
For example, this Information Element may be used to describe the
configuration of a random n-out-of-N Sampling Selector.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>samplingProbability</name>
<dataType>float64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>311</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the probability that a packet
is sampled, expressed as a value between 0 and 1.  The probability
is equal for every packet.  A value of 0 means no packet was
sampled since the probability is 0.
</paragraph>
<paragraph>
For example, this Information Element may be used to describe the
configuration of a uniform probabilistic Sampling Selector.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>dataLinkFrameSize</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>312</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the length of the selected data
link frame.
</paragraph>
<paragraph>
The data link layer is defined in [ISO/IEC.7498-1:1994].
</paragraph>
</description>
<references>
<paragraph>
[ISO/IEC.7498-1:1994]
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-01-11</date>
</record>

<record>
<name>ipHeaderPacketSection</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>313</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element carries a series of n octets from the IP
header of a sampled packet, starting sectionOffset octets into the
IP header.
</paragraph>
<paragraph>
However, if no sectionOffset field corresponding to this
Information Element is present, then a sectionOffset of zero
applies, and the octets MUST be from the start of the IP header.
</paragraph>
<paragraph>
With sufficient length, this element also reports octets from the
IP payload.  However, full packet capture of arbitrary packet
streams is explicitly out of scope per the Security Considerations
sections of <xref type="rfc" data="rfc5477"/> and <xref type="rfc" data="rfc2804"/>.
</paragraph>
<paragraph>
The sectionExportedOctets expresses how much data was exported,
while the remainder is padding.
</paragraph>
<paragraph>
When the sectionExportedOctets field corresponding to this
Information Element exists, this Information Element MAY have a
fixed length and MAY be padded, or it MAY have a variable length.
</paragraph>
<paragraph>
When the sectionExportedOctets field corresponding to this
Information Element does not exist, this Information Element
SHOULD have a variable length and MUST NOT be padded.  In this
case, the size of the exported section may be constrained due to
limitations in the IPFIX protocol.
</paragraph>
</description>
<references>
<paragraph>
<xref type="rfc" data="rfc2804"/>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc5477"/>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-01-11</date>
</record>

<record>
<name>ipPayloadPacketSection</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>314</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element carries a series of n octets from the IP
payload of a sampled packet, starting sectionOffset octets into
the IP payload.
</paragraph>
<paragraph>
However, if no sectionOffset field corresponding to this
Information Element is present, then a sectionOffset of zero
applies, and the octets MUST be from the start of the IP payload.
</paragraph>
<paragraph>
The IPv4 payload is that part of the packet that follows the IPv4
header and any options, which <xref type="rfc" data="rfc791"/> refers to as "data" or
"data octets".  For example, see the examples in <xref type="rfc" data="rfc791"/>,
Appendix A.
</paragraph>
<paragraph>
The IPv6 payload is the rest of the packet following the 40-octet
IPv6 header.  Note that any extension headers present are
considered part of the payload.  See <xref type="rfc" data="rfc8200"/> for the IPv6
specification.
</paragraph>
<paragraph>
The sectionExportedOctets expresses how much data was observed,
while the remainder is padding.
</paragraph>
<paragraph>
When the sectionExportedOctets field corresponding to this
Information Element exists, this Information Element MAY have a
fixed length and MAY be padded, or MAY have a variable length.
</paragraph>
<paragraph>
When the sectionExportedOctets field corresponding to this
Information Element does not exist, this Information Element
SHOULD have a variable length and MUST NOT be padded.  In this
case, the size of the exported section may be constrained due to
limitations in the IPFIX protocol.
</paragraph>
</description>
<references>
<paragraph>
<xref type="rfc" data="rfc791"/>
<xref type="rfc" data="rfc8200"/>
</paragraph>
</references>
<xref type="rfc" data="rfc5477"/>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-01-11</date>
</record>

<record>
<name>dataLinkFrameSection</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>315</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element carries n octets from the data link frame
of a selected frame, starting sectionOffset octets into the frame.
</paragraph>
<paragraph>
However, if no sectionOffset field corresponding to this
Information Element is present, then a sectionOffset of zero
applies, and the octets MUST be from the start of the data link
frame.
</paragraph>
<paragraph>
The sectionExportedOctets expresses how much data was observed,
while the remainder is padding.
</paragraph>
<paragraph>
When the sectionExportedOctets field corresponding to this
Information Element exists, this Information Element MAY have a
fixed length and MAY be padded, or MAY have a variable length.
</paragraph>
<paragraph>
When the sectionExportedOctets field corresponding to this
Information Element does not exist, this Information Element
SHOULD have a variable length and MUST NOT be padded.  In this
case, the size of the exported section may be constrained due to
limitations in the IPFIX protocol.
</paragraph>
<paragraph>
Further Information Elements, i.e., dataLinkFrameType and
dataLinkFrameSize, are needed to specify the data link type and the
size of the data link frame of this Information Element.  A set of
these Information Elements MAY be contained in a structured data
type, as expressed in <xref type="rfc" data="rfc6313"/>.  Or a set of these Information
Elements MAY be contained in one Flow Record as shown in Appendix
B of <xref type="rfc" data="rfc7133"/>.
</paragraph>
<paragraph>
The data link layer is defined in [ISO/IEC.7498-1:1994].
</paragraph>
</description>
<references>
<paragraph>
<xref type="rfc" data="rfc6313"/>
<xref type="rfc" data="rfc7133"/>
[ISO/IEC.7498-1:1994]
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-01-11</date>
</record>

<record>
<name>mplsLabelStackSection</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>316</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element carries a series of n octets from the
MPLS label stack of a sampled packet, starting sectionOffset
octets into the MPLS label stack.
</paragraph>
<paragraph>
However, if no sectionOffset field corresponding to this
Information Element is present, then a sectionOffset of zero
applies, and the octets MUST be from the head of the MPLS label
stack.
</paragraph>
<paragraph>
With sufficient length, this element also reports octets from the
MPLS payload.  However, full packet capture of arbitrary packet
streams is explicitly out of scope per the Security Considerations
sections of <xref type="rfc" data="rfc5477"/> and <xref type="rfc" data="rfc2804"/>.
</paragraph>
<paragraph>
See <xref type="rfc" data="rfc3031"/> for the specification of MPLS packets.
</paragraph>
<paragraph>
See <xref type="rfc" data="rfc3032"/> for the specification of the MPLS label stack.
</paragraph>
<paragraph>
The sectionExportedOctets expresses how much data was observed,
while the remainder is padding.
</paragraph>
<paragraph>
When the sectionExportedOctets field corresponding to this
Information Element exists, this Information Element MAY have a
fixed length and MAY be padded, or MAY have a variable length.
</paragraph>
<paragraph>
When the sectionExportedOctets field corresponding to this
Information Element does not exist, this Information Element
SHOULD have a variable length and MUST NOT be padded.  In this
case, the size of the exported section may be constrained due to
limitations in the IPFIX protocol.
</paragraph>
</description>
<references>
<paragraph>
<xref type="rfc" data="rfc2804"/>
<xref type="rfc" data="rfc3031"/>
<xref type="rfc" data="rfc3032"/>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc5477"/>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-01-11</date>
</record>

<record>
<name>mplsPayloadPacketSection</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>317</elementId>
<status>current</status>
<description>
<paragraph>
The mplsPayloadPacketSection carries a series of n octets from the
MPLS payload of a sampled packet, starting sectionOffset octets
into the MPLS payload, as it is data that follows immediately after
the MPLS label stack.
</paragraph>
<paragraph>
However, if no sectionOffset field corresponding to this
Information Element is present, then a sectionOffset of zero
applies, and the octets MUST be from the start of the MPLS
payload.
</paragraph>
<paragraph>
See <xref type="rfc" data="rfc3031"/> for the specification of MPLS packets.
</paragraph>
<paragraph>
See <xref type="rfc" data="rfc3032"/> for the specification of the MPLS label stack.
</paragraph>
<paragraph>
The sectionExportedOctets expresses how much data was observed,
while the remainder is padding.
</paragraph>
<paragraph>
When the sectionExportedOctets field corresponding to this
Information Element exists, this Information Element MAY have a
fixed length and MAY be padded, or it MAY have a variable length.
</paragraph>
<paragraph>
When the sectionExportedOctets field corresponding to this
Information Element does not exist, this Information Element
SHOULD have a variable length and MUST NOT be padded.  In this
case, the size of the exported section may be constrained due to
limitations in the IPFIX protocol.          
</paragraph>
</description>
<references>
<paragraph>
<xref type="rfc" data="rfc3031"/>
<xref type="rfc" data="rfc3032"/>
</paragraph>
</references>
<xref type="rfc" data="rfc5477"/>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-01-11</date>
</record>

<record>
<name>selectorIdTotalPktsObserved</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>318</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the total number of packets
observed by a Selector, for a specific value of SelectorId.
</paragraph>
<paragraph>
This Information Element should be used in an Options Template
scoped to the observation to which it refers.  See Section 3.4.2.1
of the IPFIX protocol document <xref type="rfc" data="rfc7011"/>.      
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>selectorIdTotalPktsSelected</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>319</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the total number of packets
selected by a Selector, for a specific value of SelectorId.
</paragraph>
<paragraph>
This Information Element should be used in an Options Template
scoped to the observation to which it refers.  See Section 3.4.2.1
of the IPFIX protocol document <xref type="rfc" data="rfc7011"/>.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>absoluteError</name>
<dataType>float64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>320</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the maximum possible
measurement error of the reported value for a given Information
Element.  The absoluteError has the same unit as the Information
Element with which it is associated.  The real value of the metric can
differ by absoluteError (positive or negative) from the measured
value.
</paragraph>
<paragraph>
This Information Element provides only the error for measured
values.  If an Information Element contains an estimated value
(from Sampling), the confidence boundaries and confidence level
have to be provided instead, using the upperCILimit, lowerCILimit, 
and confidenceLevel Information Elements.
</paragraph>
<paragraph>
This Information Element should be used in an Options Template
scoped to the observation to which it refers.  See Section 3.4.2.1
of the IPFIX protocol document <xref type="rfc" data="rfc7011"/>.   
</paragraph>
</description>
<units>inferred</units>
<xref type="rfc" data="rfc5477"/>
<revision>1</revision>
<date>2018-06-13</date>
</record>

<record>
<name>relativeError</name>
<dataType>float64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>321</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the maximum possible positive
or negative error ratio for the reported value for a given
Information Element as percentage of the measured value.  The real
value of the metric can differ by relativeError percent (positive
or negative) from the measured value.
</paragraph>
<paragraph>
This Information Element provides only the error for measured
values.  If an Information Element contains an estimated value
(from Sampling), the confidence boundaries and confidence level
have to be provided instead, using the upperCILimit, lowerCILimit, 
and confidenceLevel Information Elements.
</paragraph>
<paragraph>
This Information Element should be used in an Options Template
scoped to the observation to which it refers.  See Section 3.4.2.1
of the IPFIX protocol document <xref type="rfc" data="rfc7011"/>. 
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>observationTimeSeconds</name>
<dataType>dateTimeSeconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>322</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the absolute time in seconds of
an observation.
</paragraph>
</description>
<units>seconds</units>
<xref type="rfc" data="rfc5477"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>observationTimeMilliseconds</name>
<dataType>dateTimeMilliseconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>323</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the absolute time in
milliseconds of an observation.
</paragraph>
</description>
<units>milliseconds</units>
<xref type="rfc" data="rfc5477"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>observationTimeMicroseconds</name>
<dataType>dateTimeMicroseconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>324</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the absolute time in
microseconds of an observation.
</paragraph>
</description>
<units>microseconds</units>
<xref type="rfc" data="rfc5477"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>observationTimeNanoseconds</name>
<dataType>dateTimeNanoseconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>325</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the absolute time in
nanoseconds of an observation.
</paragraph>
</description>
<units>nanoseconds</units>
<xref type="rfc" data="rfc5477"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>digestHashValue</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>326</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the value from the digest hash
function.

See also Sections 6.2, 3.8 and 7.1 of <xref type="rfc" data="rfc5475"/>.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>hashIPPayloadOffset</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>327</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the IP payload offset used by a
Hash-based Selection Selector.

See also Sections 6.2, 3.8 and 7.1 of <xref type="rfc" data="rfc5475"/>.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>hashIPPayloadSize</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>328</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the IP payload size used by a
Hash-based Selection Selector.  See also Sections 6.2, 3.8 and 7.1 of
<xref type="rfc" data="rfc5475"/>.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>hashOutputRangeMin</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>329</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the value for the beginning of
a hash function's potential output range.
</paragraph>
<paragraph>
See also Sections 6.2, 3.8 and 7.1 of <xref type="rfc" data="rfc5475"/>.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>hashOutputRangeMax</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>330</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the value for the end of a hash
function's potential output range.
</paragraph>
<paragraph>
See also Sections 6.2, 3.8 and 7.1 of <xref type="rfc" data="rfc5475"/>.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>hashSelectedRangeMin</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>331</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the value for the beginning of
a hash function's selected range.
</paragraph>
<paragraph>
See also Sections 6.2, 3.8 and 7.1 of <xref type="rfc" data="rfc5475"/>.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>hashSelectedRangeMax</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>332</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the value for the end of a hash
function's selected range.
</paragraph>
<paragraph>
See also Sections 6.2, 3.8 and 7.1 of <xref type="rfc" data="rfc5475"/>.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>hashDigestOutput</name>
<dataType>boolean</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>333</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element contains a boolean value that is TRUE if
the output from this hash Selector has been configured to be
included in the packet report as a packet digest, else FALSE.
</paragraph>
<paragraph>
See also Sections 6.2, 3.8 and 7.1 of <xref type="rfc" data="rfc5475"/>.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>hashInitialiserValue</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>334</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the initialiser value to the
hash function.
</paragraph>
<paragraph>
See also Sections 6.2, 3.8 and 7.1 of <xref type="rfc" data="rfc5475"/>.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>selectorName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>335</elementId>
<status>current</status>
<description>
<paragraph>
The name of a selector identified by a selectorID.  Globally 
unique per Metering Process. 
</paragraph>
</description>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>upperCILimit</name>
<dataType>float64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>336</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the upper limit of a confidence
interval.  It is used to provide an accuracy statement for an
estimated value.  The confidence limits define the range in which
the real value is assumed to be with a certain probability p.
Confidence limits always need to be associated with a confidence
level that defines this probability p.  Please note that a
confidence interval only provides a probability that the real
value lies within the limits.  That means the real value can lie
outside the confidence limits.
</paragraph>
<paragraph>
The upperCILimit, lowerCILimit, and confidenceLevel Information
Elements should all be used in an Options Template scoped to the
observation to which they refer.  See Section 3.4.2.1 of the IPFIX
protocol document <xref type="rfc" data="rfc7011"/>.
</paragraph>
<paragraph>
Note that the upperCILimit, lowerCILimit, and confidenceLevel are
all required to specify confidence, and should be disregarded
unless all three are specified together.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>lowerCILimit</name>
<dataType>float64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>337</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the lower limit of a confidence
interval.  For further information, see the description of
upperCILimit.
</paragraph>
<paragraph>
The upperCILimit, lowerCILimit, and confidenceLevel Information
Elements should all be used in an Options Template scoped to the
observation to which they refer.  See Section 3.4.2.1 of the IPFIX
protocol document <xref type="rfc" data="rfc7011"/>.
</paragraph>
<paragraph>
Note that the upperCILimit, lowerCILimit, and confidenceLevel are
all required to specify confidence, and should be disregarded
unless all three are specified together.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>confidenceLevel</name>
<dataType>float64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>338</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the confidence level.  It is
used to provide an accuracy statement for estimated values.  The
confidence level provides the probability p with which the real
value lies within a given range.  A confidence level always needs
to be associated with confidence limits that define the range in
which the real value is assumed to be.
</paragraph>
<paragraph>
The upperCILimit, lowerCILimit, and confidenceLevel Information
Elements should all be used in an Options Template scoped to the
observation to which they refer.  See Section 3.4.2.1 of the IPFIX
protocol document <xref type="rfc" data="rfc7011"/>.
</paragraph>
<paragraph>
Note that the upperCILimit, lowerCILimit, and confidenceLevel are
all required to specify confidence, and should be disregarded
unless all three are specified together.
</paragraph>
</description>
<xref type="rfc" data="rfc5477"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>informationElementDataType</name>
<dataType>unsigned8</dataType>
<elementId>339</elementId>
<status>current</status>
<description>
<paragraph>
A description of the abstract data type of an IPFIX
information element.These are taken from the abstract data types
defined in section 3.1 of the IPFIX Information Model <xref type="rfc" data="rfc5102"/>;
see that section for more information on the types described
in the informationElementDataType sub-registry.
</paragraph>
<paragraph>
These types are registered in the IANA IPFIX Information Element
Data Type subregistry.  This subregistry is intended to assign
numbers for type names, not to provide a mechanism for adding data
types to the IPFIX Protocol, and as such requires a Standards
Action <xref type="rfc" data="rfc8126"/> to modify.
</paragraph>
</description>
<xref type="rfc" data="rfc5610"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>informationElementDescription</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>340</elementId>
<status>current</status>
<description>
<paragraph>
A UTF-8 <xref type="rfc" data="rfc3629"/> encoded Unicode string containing a
human-readable description of an Information Element.  The content
of the informationElementDescription MAY be annotated with one or
more language tags <xref type="rfc" data="rfc4646"/>, encoded in-line <xref type="rfc" data="rfc2482"/> within the
UTF-8 string, in order to specify the language in which the
description is written.  Description text in multiple languages
MAY tag each section with its own language tag; in this case, the
description information in each language SHOULD have equivalent
meaning.  In the absence of any language tag, the "i-default"
<xref type="rfc" data="rfc2277"/> language SHOULD be assumed.  See the Security
Considerations section for notes on string handling for
Information Element type records.
</paragraph>
</description>
<xref type="rfc" data="rfc5610"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>informationElementName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>341</elementId>
<status>current</status>
<description>
<paragraph>
A UTF-8 <xref type="rfc" data="rfc3629"/> encoded Unicode string containing
the name of an Information Element, intended as a simple
identifier.  See the Security Considerations section for notes on
string handling for Information Element type records
</paragraph>
</description>
<xref type="rfc" data="rfc5610"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>informationElementRangeBegin</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>342</elementId>
<status>current</status>
<description>
<paragraph>
Contains the inclusive low end of the range of
acceptable values for an Information Element.
</paragraph>
</description>
<xref type="rfc" data="rfc5610"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>informationElementRangeEnd</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>343</elementId>
<status>current</status>
<description>
<paragraph>
Contains the inclusive high end of the range of
acceptable values for an Information Element.
</paragraph>
</description>
<xref type="rfc" data="rfc5610"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>informationElementSemantics</name>
<dataType>unsigned8</dataType>
<elementId>344</elementId>
<status>current</status>
<description>
<paragraph>
A description of the semantics of an IPFIX Information
Element.  These are taken from the data type semantics defined in
section 3.2 of the IPFIX Information Model <xref type="rfc" data="rfc5102"/>; see that
section for more information on the types defined in the informationElementSemantics sub-registry.  This
field may take the values in Table ; the special value 0x00
(default) is used to note that no semantics apply to the field; it
cannot be manipulated by a Collecting Process or File Reader that
does not understand it a priori.
</paragraph>
<paragraph>
These semantics are registered in the IANA IPFIX Information
Element Semantics subregistry.  This subregistry is intended to
assign numbers for semantics names, not to provide a mechanism for
adding semantics to the IPFIX Protocol, and as such requires a
Standards Action <xref type="rfc" data="rfc8126"/> to modify.
</paragraph>
</description>
<xref type="rfc" data="rfc5610"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>informationElementUnits</name>
<dataType>unsigned16</dataType>
<elementId>345</elementId>
<status>current</status>
<description>
<paragraph>
A description of the units of an IPFIX Information
Element.  These correspond to the units implicitly defined in the
Information Element definitions in section 5 of the IPFIX
Information Model <xref type="rfc" data="rfc5102"/>; see that section for more information
on the types described in the informationElementsUnits sub-registry.  This field may take the values in
Table 3 below; the special value 0x00 (none) is used to note that
the field is unitless.
</paragraph>
<paragraph>
These types are registered in the IANA IPFIX Information Element
Units subregistry; new types may be added on a First Come First
Served <xref type="rfc" data="rfc8126"/> basis.
</paragraph>
</description>
<xref type="rfc" data="rfc5610"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>privateEnterpriseNumber</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>346</elementId>
<status>current</status>
<description>
<paragraph>
A private enterprise number, as assigned by IANA.
Within the context of an Information Element Type record, this
element can be used along with the informationElementId element to
scope properties to a specific Information Element.  To export
type information about an IANA-assigned Information Element, set
the privateEnterpriseNumber to 0, or do not export the
privateEnterpriseNumber in the type record.  To export type
information about an enterprise-specific Information Element,
export the enterprise number in privateEnterpriseNumber, and
export the Information Element number with the Enterprise bit
cleared in informationElementId.  The Enterprise bit in the
associated informationElementId Information Element MUST be
ignored by the Collecting Process.
</paragraph>
</description>
<xref type="rfc" data="rfc5610"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>virtualStationInterfaceId</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>347</elementId>
<status>current</status>
<description>
<paragraph>
Instance Identifier of the interface to a Virtual Station. A Virtual 
Station is an end station instance: it can be a virtual machine or a 
physical host.
</paragraph>
</description>
<references>
<paragraph>
See IEEE 802.1Qbg for the definition of Virtual Station Interface ID.         
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>virtualStationInterfaceName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>348</elementId>
<status>current</status>
<description>
<paragraph>
Name of the interface to a Virtual Station. A Virtual Station is an end station 
instance: it can be a virtual machine or a physical host.
</paragraph>
</description>
<references>
<paragraph>
See IEEE 802.1Qbg for the definition of Virtual Station Interface.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>virtualStationUUID</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>349</elementId>
<status>current</status>
<description>
<paragraph>
Unique Identifier of a Virtual Station. A Virtual Station is an end station 
instance: it can be a virtual machine or a physical host.
</paragraph>
</description>
<references>
<paragraph>
See IEEE 802.1Qbg for the definition of Virtual Station.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>virtualStationName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>350</elementId>
<status>current</status>
<description>
<paragraph>
Name of a Virtual Station. A Virtual Station is an end station 
instance: it can be a virtual machine or a physical host.
</paragraph>
</description>
<references>
<paragraph>
See IEEE 802.1Qbg for the definition of Virtual Station.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>layer2SegmentId</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>351</elementId>
<status>current</status>
<description>
<paragraph>
Identifier of a layer 2 network segment in an overlay network. 
The most significant byte identifies the layer 2 network 
overlay network encapsulation type:
</paragraph>
<paragraph>
0x00 reserved
</paragraph>
<paragraph>
0x01 VxLAN
</paragraph>
<paragraph>
0x02 NVGRE
</paragraph>
<paragraph>
The three lowest significant bytes
hold the value of the layer 2
overlay network segment identifier.
</paragraph>
<paragraph>
For example:
</paragraph>
<paragraph>
- a 24 bit segment ID VXLAN Network
Identifier (VNI)
</paragraph>
<paragraph>
- a 24 bit Tenant Network Identifier
(TNI) for NVGRE
</paragraph>
</description>
<references>
<paragraph>
See VxLAN RFC at <xref type="rfc" data="rfc7348"/>
</paragraph>
<paragraph>
See NVGRE RFC at <xref type="rfc" data="rfc7637"/>
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record> 

<record date="2013-02-18">
<name>layer2OctetDeltaCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>352</elementId>
<status>current</status>
<description>
<paragraph>
The number of layer 2 octets since the previous report (if any) in
incoming packets for this Flow at the Observation Point.  The
number of octets includes layer 2 header(s) and layer 2 payload.
# memo: layer 2 version of octetDeltaCount (field #1)
</paragraph>
</description>
<units>octets</units>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record date="2013-02-18">
<name>layer2OctetTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>353</elementId>
<status>current</status>
<description>
<paragraph>      
The total number of layer 2 octets in incoming packets for this
Flow at the Observation Point since the Metering Process
(re-)initialization for this Observation Point.  The number of
octets includes layer 2 header(s) and layer 2 payload.
# memo: layer 2 version of octetTotalCount (field #85)
</paragraph>
</description>
<units>octets</units>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>ingressUnicastPacketTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>354</elementId>
<status>current</status>
<description>
<paragraph>      
The total number of incoming unicast packets metered at the 
Observation Point since the Metering Process (re-)initialization 
for this Observation Point.
</paragraph>
</description>
<units>packets</units>
<references><paragraph/></references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ingressMulticastPacketTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>355</elementId>
<status>current</status>
<description>
<paragraph>      
The total number of incoming multicast packets metered at the 
Observation Point since the Metering Process (re-)initialization 
for this Observation Point.
</paragraph>
</description>
<units>packets</units>
<references><paragraph/></references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>ingressBroadcastPacketTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>356</elementId>
<status>current</status>
<description>
<paragraph>      
The total number of incoming broadcast packets metered at the 
Observation Point since the Metering Process (re-)initialization 
for this Observation Point.
</paragraph>
</description>
<units>packets</units>
<references><paragraph/></references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>egressUnicastPacketTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>357</elementId>
<status>current</status>
<description>
<paragraph>      
The total number of incoming unicast packets metered at the 
Observation Point since the Metering Process (re-)initialization 
for this Observation Point.
</paragraph>
</description>
<units>packets</units>
<references><paragraph/></references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>egressBroadcastPacketTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>358</elementId>
<status>current</status>
<description>
<paragraph>      
The total number of incoming broadcast packets metered at the 
Observation Point since the Metering Process (re-)initialization 
for this Observation Point.
</paragraph>
</description>
<units>packets</units>
<references><paragraph/></references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>monitoringIntervalStartMilliSeconds</name>
<dataType>dateTimeMilliseconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>359</elementId>
<status>current</status>
<description>
<paragraph>      
The absolute timestamp at which the monitoring interval
started.
A Monitoring interval is the period of time during which the Metering
Process is running.
</paragraph>
</description>
<units>milliseconds</units>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>monitoringIntervalEndMilliSeconds</name>
<dataType>dateTimeMilliseconds</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>360</elementId>
<status>current</status>
<description>
<paragraph>      
The absolute timestamp at which the monitoring interval ended.
A Monitoring interval is the period of time during which the Metering
Process is running.
</paragraph>
</description>
<units>milliseconds</units>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>portRangeStart</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>361</elementId>
<status>current</status>
<description>
<paragraph>      
The port number identifying the start of a range of ports. A value 
of zero indicates that the range start is not specified, ie the
range is defined in some other way.
</paragraph>
<paragraph>
Additional information on defined TCP port numbers can be found at 
<xref type="registry" data="service-names-port-numbers"/>.
</paragraph>
</description>
<references><paragraph/></references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>portRangeEnd</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>362</elementId>
<status>current</status>
<description>
<paragraph>      
The port number identifying the end of a range of ports. A value 
of zero indicates that the range end is not specified, ie the
range is defined in some other way.
</paragraph>
<paragraph>
Additional information on defined TCP port numbers can be found at
<xref type="registry" data="service-names-port-numbers"/>.
</paragraph>
</description>
<references><paragraph/></references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>portRangeStepSize</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>363</elementId>
<status>current</status>
<description>
<paragraph>      
The step size in a port range. The default step size is 1,
which indicates contiguous ports. A value of zero indicates 
that the step size is not specified, ie the range is defined 
in some other way.
</paragraph>
</description>
<references><paragraph/></references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>portRangeNumPorts</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>364</elementId>
<status>current</status>
<description>
<paragraph>      
The number of ports in a port range. A value of zero indicates 
that the number of ports is not specified, ie the range is defined 
in some other way.
</paragraph>
</description>
<references><paragraph/></references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>staMacAddress</name>
<dataType>macAddress</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>365</elementId>
<status>current</status>
<description>
<paragraph>      
The IEEE 802 MAC address of a wireless station (STA).
</paragraph>
</description>
<references>
<paragraph>See section 1.4 of <xref type="rfc" data="rfc5415"/> for the definition of STA.</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>staIPv4Address</name>
<dataType>ipv4Address</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>366</elementId>
<status>current</status>
<description>
<paragraph>      
The IPv4 address of a wireless station (STA).
</paragraph>
</description>
<references>
<paragraph>See section 1.4 of <xref type="rfc" data="rfc5415"/> for the definition of STA.</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>wtpMacAddress</name>
<dataType>macAddress</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>367</elementId>
<status>current</status>
<description>
<paragraph>      
The IEEE 802 MAC address of a wireless access point (WTP).
</paragraph>
</description>
<references>
<paragraph>See section 1.4 of <xref type="rfc" data="rfc5415"/> for the definition of WTP.</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>ingressInterfaceType</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>368</elementId>
<status>current</status>
<description>
<paragraph>      
The type of interface where packets of this Flow are being received.
The value matches the value of managed object 'ifType' as defined in 
<xref type="registry" data="ianaiftype-mib"/>.
</paragraph>
</description>
<references>
<paragraph><xref type="registry" data="ianaiftype-mib"/></paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>egressInterfaceType</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>369</elementId>
<status>current</status>
<description>
<paragraph>      
The type of interface where packets of this Flow are being sent.
The value matches the value of managed object 'ifType' as defined in 
<xref type="registry" data="ianaiftype-mib"/>.
</paragraph>
</description>
<references>
<paragraph><xref type="registry" data="ianaiftype-mib"/></paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>rtpSequenceNumber</name>
<dataType>unsigned16</dataType>
<elementId>370</elementId>
<status>current</status>
<description>
<paragraph>
The RTP sequence number per <xref type="rfc" data="rfc3550"/>.
</paragraph>
</description>
<references>
<paragraph>         
<xref type="rfc" data="rfc3550"/>
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>userName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>371</elementId>
<status>current</status>
<description>
<paragraph>
User name associated with the flow.
</paragraph>
</description>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>applicationCategoryName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>372</elementId>
<status>current</status>
<description>
<paragraph>
An attribute that provides a first level categorization for
each Application ID.
</paragraph>
</description>
<xref type="rfc" data="rfc6759"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>applicationSubCategoryName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>373</elementId>
<status>current</status>
<description>
<paragraph>
An attribute that provides a second level categorization
for each Application ID.
</paragraph>
</description>
<xref type="rfc" data="rfc6759"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>applicationGroupName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>374</elementId>
<status>current</status>
<description>
<paragraph>
An attribute that groups multiple Application IDs that
belong to the same networking application.
</paragraph>
</description>
<xref type="rfc" data="rfc6759"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>originalFlowsPresent</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>375</elementId>
<status>current</status>
<description>
<paragraph>
The non-conservative count of Original Flows
contributing to this Aggregated Flow.  Non-conservative counts
need not sum to the original count on re-aggregation.
</paragraph>
</description>
<units>flows</units>
<xref type="rfc" data="rfc7015"/>
<revision>1</revision>
<date>2013-06-25</date>
</record>

<record>
<name>originalFlowsInitiated</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>376</elementId>
<status>current</status>
<description>
<paragraph>
The conservative count of Original Flows whose first
packet is represented within this Aggregated Flow.  Conservative
counts must sum to the original count on re-aggregation.
</paragraph>
</description>
<units>flows</units>
<xref type="rfc" data="rfc7015"/>
<revision>1</revision>
<date>2013-06-25</date>
</record>

<record>
<name>originalFlowsCompleted</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>377</elementId>
<status>current</status>
<description>
<paragraph>
The conservative count of Original Flows whose last
packet is represented within this Aggregated Flow.  Conservative
counts must sum to the original count on re-aggregation.
</paragraph>
</description>
<units>flows</units>
<xref type="rfc" data="rfc7015"/>
<revision>1</revision>
<date>2013-06-25</date>
</record>

<record>
<name>distinctCountOfSourceIPAddress</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>378</elementId>
<status>current</status>
<description>
<paragraph>
The count of distinct source IP address values for
Original Flows contributing to this Aggregated Flow, without
regard to IP version.  This Information Element is preferred to
the IP-version-specific counters, unless it is important to
separate the counts by version.
</paragraph>
</description>
<xref type="rfc" data="rfc7015"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>distinctCountOfDestinationIPAddress</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>379</elementId>
<status>current</status>
<description>
<paragraph>
The count of distinct destination IP address values
for Original Flows contributing to this Aggregated Flow, without
regard to IP version.  This Information Element is preferred to
the version-specific counters below, unless it is important to
separate the counts by version.
</paragraph>
</description>
<xref type="rfc" data="rfc7015"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>distinctCountOfSourceIPv4Address</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>380</elementId>
<status>current</status>
<description>
<paragraph>
The count of distinct source IPv4 address values for
Original Flows contributing to this Aggregated Flow.
</paragraph>
</description>
<xref type="rfc" data="rfc7015"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>distinctCountOfDestinationIPv4Address</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>381</elementId>
<status>current</status>
<description>
<paragraph>
The count of distinct destination IPv4 address values
for Original Flows contributing to this Aggregated Flow.
</paragraph>
</description>
<xref type="rfc" data="rfc7015"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>distinctCountOfSourceIPv6Address</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>382</elementId>
<status>current</status>
<description>
<paragraph>
The count of distinct source IPv6 address values for
Original Flows contributing to this Aggregated Flow.
</paragraph>
</description>
<xref type="rfc" data="rfc7015"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>distinctCountOfDestinationIPv6Address</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>383</elementId>
<status>current</status>
<description>
<paragraph>
The count of distinct destination IPv6 address values
for Original Flows contributing to this Aggregated Flow.
</paragraph>
</description>
<xref type="rfc" data="rfc7015"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>valueDistributionMethod</name>
<dataType>unsigned8</dataType>
<elementId>384</elementId>
<status>current</status>
<description>
<paragraph>
A description of the method used to distribute the
counters from Contributing Flows into the Aggregated Flow records
described by an associated scope, generally a Template.  The
method is deemed to apply to all the non-key Information Elements
in the referenced scope for which value distribution is a valid
operation; if the originalFlowsInitiated and/or
originalFlowsCompleted Information Elements appear in the
Template, they are not subject to this distribution method, as
they each infer their own distribution method.  This is intended
to be a complete set of possible value distribution methods; it is
encoded as follows:
</paragraph>
<artwork>
+-------+-----------------------------------------------------------+
| Value | Description                                               |
+-------+-----------------------------------------------------------+
| 0     | Unspecified: The counters for an Original Flow are        |
|       | explicitly not distributed according to any other method  |
|       | defined for this Information Element; use for arbitrary   |
|       | distribution, or distribution algorithms not described by |
|       | any other codepoint.                                      |
|       | --------------------------------------------------------- |
|       |                                                           |
| 1     | Start Interval: The counters for an Original Flow are     |
|       | added to the counters of the appropriate Aggregated Flow  |
|       | containing the start time of the Original Flow.  This     |
|       | should be assumed the default if value distribution       |
|       | information is not available at a Collecting Process for  |
|       | an Aggregated Flow.                                       |
|       | --------------------------------------------------------- |
|       |                                                           |
| 2     | End Interval: The counters for an Original Flow are added |
|       | to the counters of the appropriate Aggregated Flow        |
|       | containing the end time of the Original Flow.             |
|       | --------------------------------------------------------- |
|       |                                                           |
| 3     | Mid Interval: The counters for an Original Flow are added |
|       | to the counters of a single appropriate Aggregated Flow   |
|       | containing some timestamp between start and end time of   |
|       | the Original Flow.                                        |
|       | --------------------------------------------------------- |
|       |                                                           |
| 4     | Simple Uniform Distribution: Each counter for an Original |
|       | Flow is divided by the number of time intervals the       |
|       | Original Flow covers (i.e., of appropriate Aggregated     |
|       | Flows sharing the same Flow Key), and this number is      |
|       | added to each corresponding counter in each Aggregated    |
|       | Flow.                                                     |
|       | --------------------------------------------------------- |
|       |                                                           |
| 5     | Proportional Uniform Distribution: Each counter for an    |
|       | Original Flow is divided by the number of time units the  |
|       | Original Flow covers, to derive a mean count rate.  This  |
|       | mean count rate is then multiplied by the number of time  |
|       | units in the intersection of the duration of the Original |
|       | Flow and the time interval of each Aggregated Flow.  This |
|       | is like simple uniform distribution, but accounts for the |
|       | fractional portions of a time interval covered by an      |
|       | Original Flow in the first and last time interval.        |
|       | --------------------------------------------------------- |
|       |                                                           |
| 6     | Simulated Process: Each counter of the Original Flow is   |
|       | distributed among the intervals of the Aggregated Flows   |
|       | according to some function the Intermediate Aggregation   |
|       | Process uses based upon properties of Flows presumed to   |
|       | be like the Original Flow.  This is essentially an        |
|       | assertion that the Intermediate Aggregation Process has   |
|       | no direct packet timing information but is nevertheless   |
|       | not using one of the other simpler distribution methods.  |
|       | The Intermediate Aggregation Process specifically makes   |
|       | no assertion as to the correctness of the simulation.     |
|       | --------------------------------------------------------- |
|       |                                                           |
| 7     | Direct: The Intermediate Aggregation Process has access   |
|       | to the original packet timings from the packets making up |
|       | the Original Flow, and uses these to distribute or        |
|       | recalculate the counters.                                 |
+-------+-----------------------------------------------------------+
</artwork>
</description>
<xref type="rfc" data="rfc7015"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>rfc3550JitterMilliseconds</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>385</elementId>
<status>current</status>
<description>
<paragraph>
Interarrival jitter as defined in section 6.4.1 of <xref type="rfc" data="rfc3550"/>, 
measured in milliseconds.
</paragraph>
</description>
<units>milliseconds</units>
<references><paragraph>
<xref type="rfc" data="rfc3550"/>
</paragraph></references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>rfc3550JitterMicroseconds</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>386</elementId>
<status>current</status>
<description>
<paragraph>
Interarrival jitter as defined in section 6.4.1 of <xref type="rfc" data="rfc3550"/>, 
measured in microseconds.
</paragraph>
</description>
<units>microseconds</units>
<references><paragraph>
<xref type="rfc" data="rfc3550"/>
</paragraph></references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>rfc3550JitterNanoseconds</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>387</elementId>
<status>current</status>
<description>
<paragraph>
Interarrival jitter as defined in section 6.4.1 of <xref type="rfc" data="rfc3550"/>, 
measured in nanoseconds.
</paragraph>
</description>
<units>nanoseconds</units>
<references><paragraph>
<xref type="rfc" data="rfc3550"/>
</paragraph></references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2013-02-18</date>
</record>

<record>
<name>dot1qDEI</name>
<dataType>boolean</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>388</elementId>
<status>current</status>
<description>
<paragraph>
The value of the 1-bit Drop Eligible Indicator (DEI) field of the VLAN tag as 
described in 802.1Q-2011 subclause 9.6. In case of a QinQ frame, it represents 
the outer tag's DEI field and in case of an IEEE 802.1ad frame it represents 
the DEI field of the S-TAG. Note: in earlier versions of 802.1Q the same bit 
field in the incoming packet is occupied by the Canonical Format Indicator 
(CFI) field, except for S-TAGs.
</paragraph>
</description>
<units/>
<references><paragraph>
<xref type="uri" data="http://standards.ieee.org/findstds/standard/802.1Q-2011.html">802.1Q-2011 subclause 9.6</xref>
</paragraph></references>
<xref type="person" data="Yaakov_J_Stein"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>dot1qCustomerDEI</name>
<dataType>boolean</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>389</elementId>
<status>current</status>
<description>
<paragraph>
In case of a QinQ frame, it represents the inner tag's Drop Eligible Indicator 
(DEI) field and in case of an IEEE 802.1ad frame it represents the DEI field of 
the C-TAG.
</paragraph>
</description>
<units/>
<references><paragraph>
<xref type="uri" data="http://standards.ieee.org/findstds/standard/802.1Q-2011.html">802.1Q-2011 subclause 9.6</xref>
</paragraph></references>
<xref type="person" data="Yaakov_J_Stein"/>
<revision>1</revision>
<date>2014-02-03</date>
</record>

<record>
<name>flowSelectorAlgorithm</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>390</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element identifies the Intermediate Flow
Selection Process technique (e.g., Filtering, Sampling) that is
applied by the Intermediate Flow Selection Process.  Most of these
techniques have parameters.  Its configuration parameter(s) MUST
be clearly specified.  Further Information Elements are needed to
fully specify packet selection with these methods and all their
parameters.  Further method identifiers may be added to the 
flowSelectorAlgorithm registry.  It might be necessary to define new Information Elements
to specify their parameters.  The flowSelectorAlgorithm registry
is maintained by IANA.  New assignments for the registry will be
administered by IANA, on a First Come First Served basis
<xref type="rfc" data="rfc8126"/>, subject to Expert Review <xref type="rfc" data="rfc8126"/>.  Please note that
the purpose of the flow selection techniques described in this
document is the improvement of measurement functions as defined in
the Scope (Section 1).  Before adding new flow selector algorithms
it should be checked what is their intended purpose and especially
if those contradict with policies defined in <xref type="rfc" data="rfc2804"/>.  The
designated expert(s) should consult with the community if a
request is received that runs counter to <xref type="rfc" data="rfc2804"/>.  The registry
can be updated when specifications of the new method(s) and any
new Information Elements are provided.  The group of experts must
double check the flowSelectorAlgorithm definitions and Information
Elements with already defined flowSelectorAlgorithm and
Information Elements for completeness, accuracy, and redundancy.
Those experts will initially be drawn from the Working Group
Chairs and document editors of the IPFIX and PSAMP Working Groups.
The Intermediate Flow Selection Process Techniques
identifiers are defined at <xref type="uri" data="http://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-flowselectoralgorithm"/>.
</paragraph>
</description>
<xref type="rfc" data="rfc7014"/>
<revision>0</revision>
<date>2013-06-07</date>
</record>

<record>
<name>flowSelectedOctetDeltaCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>391</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the volume in octets of all
Flows that are selected in the Intermediate Flow Selection Process
since the previous report.
</paragraph>
</description>
<units>octets</units>
<xref type="rfc" data="rfc7014"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record>
<name>flowSelectedPacketDeltaCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>392</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the volume in packets of all
Flows that were selected in the Intermediate Flow Selection
Process since the previous report.
</paragraph>
</description>
<units>packets</units>
<xref type="rfc" data="rfc7014"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record>
<name>flowSelectedFlowDeltaCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>393</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the number of Flows that were
selected in the Intermediate Flow Selection Process since the last
report.
</paragraph>
</description>
<units>flows</units>
<xref type="rfc" data="rfc7014"/>
<revision>1</revision>
<date>2014-08-13</date>
</record>

<record>
<name>selectorIDTotalFlowsObserved</name>
<dataType>unsigned64</dataType>
<elementId>394</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the total number of Flows
observed by a Selector, for a specific value of SelectorId.  This
Information Element should be used in an Options Template scoped
to the observation to which it refers.  See Section 3.4.2.1 of the
IPFIX protocol document <xref type="rfc" data="rfc7011"/>.
</paragraph>
</description>
<units>flows</units>
<xref type="rfc" data="rfc7014"/>
<revision>0</revision>
<date>2013-06-07</date>
</record>

<record>
<name>selectorIDTotalFlowsSelected</name>
<dataType>unsigned64</dataType>
<elementId>395</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the total number of Flows
selected by a Selector, for a specific value of SelectorId.  This
Information Element should be used in an Options Template scoped
to the observation to which it refers.  See Section 3.4.2.1 of the
IPFIX protocol document <xref type="rfc" data="rfc7011"/>.
</paragraph>
</description>
<units>flows</units>
<xref type="rfc" data="rfc7014"/>
<revision>0</revision>
<date>2013-06-07</date>
</record>

<record>
<name>samplingFlowInterval</name>
<dataType>unsigned64</dataType>
<elementId>396</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the number of Flows that are
consecutively sampled.  A value of 100 means that 100 consecutive
Flows are sampled.  For example, this Information Element may be
used to describe the configuration of a systematic count-based
Sampling Selector.
</paragraph>
</description>
<units>flows</units>
<xref type="rfc" data="rfc7014"/>
<revision>0</revision>
<date>2013-06-07</date>
</record>

<record>
<name>samplingFlowSpacing</name>
<dataType>unsigned64</dataType>
<elementId>397</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the number of Flows between two
"samplingFlowInterval"s.  A value of 100 means that the next
interval starts 100 Flows (which are not sampled) after the
current "samplingFlowInterval" is over.  For example, this
Information Element may be used to describe the configuration of a
systematic count-based Sampling Selector.
</paragraph>
</description>
<units>flows</units>
<xref type="rfc" data="rfc7014"/>
<revision>0</revision>
<date>2013-06-07</date>
</record>

<record>
<name>flowSamplingTimeInterval</name>
<dataType>unsigned64</dataType>
<elementId>398</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the time interval in
microseconds during which all arriving Flows are sampled.  For
example, this Information Element may be used to describe the
configuration of a systematic time-based Sampling Selector.
</paragraph>
</description>
<units>microseconds</units>
<xref type="rfc" data="rfc7014"/>
<revision>0</revision>
<date>2013-06-07</date>
</record>

<record>
<name>flowSamplingTimeSpacing</name>
<dataType>unsigned64</dataType>
<elementId>399</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the time interval in
microseconds between two "flowSamplingTimeInterval"s.  A value of
100 means that the next interval starts 100 microseconds (during
which no Flows are sampled) after the current
"flowsamplingTimeInterval" is over.  For example, this Information
Element may used to describe the configuration of a systematic
time-based Sampling Selector.
</paragraph>
</description>
<units>microseconds</units>
<xref type="rfc" data="rfc7014"/>
<revision>0</revision>
<date>2013-06-07</date>
</record>

<record>
<name>hashFlowDomain</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>400</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the Information Elements that
are used by the Hash-based Flow Selector as the Hash Domain.
</paragraph>
</description>
<xref type="rfc" data="rfc7014"/>
<revision>0</revision>
<date>2013-06-07</date>
</record>

<record>
<name>transportOctetDeltaCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>401</elementId>
<status>current</status>
<description>
<paragraph>
The number of octets, excluding IP header(s) and Layer 4 transport 
protocol header(s), observed for this Flow at the Observation Point 
since the previous report (if any).
</paragraph>
</description>
<units>octets</units>
<xref type="person" data="Brian_Trammell"/>
<revision>0</revision>
<date>2013-08-01</date>
</record>

<record>
<name>transportPacketDeltaCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>402</elementId>
<status>current</status>
<description>
<paragraph>
The number of packets containing at least one octet beyond the IP header(s) and 
Layer 4 transport protocol header(s), observed for this Flow at the Observation 
Point since the previous report (if any).
</paragraph>
</description>
<units>packets</units>
<xref type="person" data="Brian_Trammell"/>
<revision>0</revision>
<date>2013-08-01</date>
</record>

<record>
<name>originalExporterIPv4Address</name>
<dataType>ipv4Address</dataType>
<elementId>403</elementId>
<status>current</status>
<description>
<paragraph>
The IPv4 address used by the Exporting Process on an 
Original Exporter, as seen by the Collecting Process on an IPFIX 
Mediator.  Used to provide information about the Original 
Observation Points to a downstream Collector.
</paragraph>
</description>
<xref type="rfc" data="rfc7119"/>
<revision>0</revision>
<date>2013-12-24</date>
</record>

<record>
<name>originalExporterIPv6Address</name>
<dataType>ipv6Address</dataType>
<elementId>404</elementId>
<status>current</status>
<description>
<paragraph>
The IPv6 address used by the Exporting Process on an 
Original Exporter, as seen by the Collecting Process on an IPFIX 
Mediator.  Used to provide information about the Original 
Observation Points to a downstream Collector.
</paragraph>
</description>
<xref type="rfc" data="rfc7119"/>
<revision>0</revision>
<date>2013-12-24</date>
</record>

<record>
<name>originalObservationDomainId</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>405</elementId>
<status>current</status>
<description>
<paragraph>
The Observation Domain ID reported by the Exporting 
Process on an Original Exporter, as seen by the Collecting Process 
on an IPFIX Mediator.  Used to provide information about the 
Original Observation Domain to a downstream Collector.  When 
cascading through multiple Mediators, this identifies the initial 
Observation Domain in the cascade.
</paragraph>
</description>
<xref type="rfc" data="rfc7119"/>
<revision>0</revision>
<date>2013-12-24</date>
</record>

<record>
<name>intermediateProcessId</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>406</elementId>
<status>current</status>
<description>
<paragraph>
Description: An identifier of an Intermediate Process that is 
unique per IPFIX Device. Typically, this Information Element is 
used for limiting the scope of other Information Elements. Note 
that process identifiers may be assigned dynamically; that is, an 
Intermediate Process may be restarted with a different ID. 
</paragraph>
</description>
<xref type="rfc" data="rfc7119"/>
<revision>0</revision>
<date>2013-12-24</date>
</record>

<record>
<name>ignoredDataRecordTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>407</elementId>
<status>current</status>
<description>
<paragraph>
Description: The total number of received Data Records that the 
Intermediate Process did not process since the (re-)initialization 
of the Intermediate Process; includes only Data Records not 
examined or otherwise handled by the Intermediate Process due to 
resource constraints, not Data Records that were examined or 
otherwise handled by the Intermediate Process but those that 
merely do not contribute to any exported Data Record due to the 
operations performed by the Intermediate Process. 
</paragraph>
</description>
<xref type="rfc" data="rfc7119"/>
<revision>0</revision>
<date>2013-12-24</date>
</record>

<record>
<name>dataLinkFrameType</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>408</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the type of the selected data
link frame.
</paragraph>
<paragraph>
The following data link types are defined here:
</paragraph>
<paragraph>
- 0x01 IEEE802.3 ETHERNET [IEEE802.3]
</paragraph>
<paragraph>
- 0x02 IEEE802.11 MAC Frame format [IEEE802.11]
</paragraph>
<paragraph>
Further values may be assigned by IANA.  Note that the assigned
values are bits so that multiple observations can be OR'd
together.
</paragraph>
<paragraph>
The data link layer is defined in [ISO/IEC.7498-1:1994].
</paragraph>
</description>
<references>
<paragraph>
[IEEE802.3][IEEE802.11][ISO/IEC.7498-1:1994]
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>0</revision>
<date>2014-01-11</date>
</record>

<record>
<name>sectionOffset</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>409</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the offset of the packet
section (e.g., dataLinkFrameSection, ipHeaderPacketSection,
ipPayloadPacketSection, mplsLabelStackSection, and
mplsPayloadPacketSection).  If this Information Element is
omitted, it defaults to zero (i.e., no offset).
</paragraph>
<paragraph>
If multiple sectionOffset Information Elements are specified
within a single Template, then they apply to the packet section
Information Elements in order: the first sectionOffset applies to
the first packet section, the second to the second, and so on.
Note that the "closest" sectionOffset and packet section
Information Elements within a given Template are not necessarily
related.  If there are fewer sectionOffset Information Elements
than packet section Information Elements, then subsequent packet
section Information Elements have no offset, i.e., a sectionOffset
of zero applies to those packet section Information Elements.  If
there are more sectionOffset Information Elements than the number
of packet section Information Elements, then the additional
sectionOffset Information Elements are meaningless.
</paragraph>
</description>
<xref type="rfc" data="rfc7133"/>
<revision>0</revision>
<date>2014-01-11</date>
</record>

<record>
<name>sectionExportedOctets</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>410</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element specifies the observed length of the
packet section (e.g., dataLinkFrameSection, ipHeaderPacketSection,
ipPayloadPacketSection, mplsLabelStackSection, and
mplsPayloadPacketSection) when padding is used.
</paragraph>
<paragraph>
The packet section may be of a fixed size larger than the
sectionExportedOctets.  In this case, octets in the packet section
beyond the sectionExportedOctets MUST follow the <xref type="rfc" data="rfc7011"/> rules
for padding (i.e., be composed of zero (0) valued octets).
</paragraph>
</description>
<references>
<paragraph>
<xref type="rfc" data="rfc7011"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>0</revision>
<date>2014-01-11</date>
</record>

<record>
<name>dot1qServiceInstanceTag</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>411</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element, which is 16 octets long, represents the
Backbone Service Instance Tag (I-TAG) Tag Control Information
(TCI) field of an Ethernet frame as described in [IEEE802.1Q].  It
encodes the Backbone Service Instance Priority Code Point (I-PCP),
Backbone Service Instance Drop Eligible Indicator (I-DEI), Use Customer Addresses (UCAs),
Backbone Service Instance Identifier (I-SID), Encapsulated
Customer Destination Address (C-DA), Encapsulated Customer Source
Address (C-SA), and reserved fields.  The structure and semantics
within the Tag Control Information field are defined in
[IEEE802.1Q].
</paragraph>
</description>
<references>
<paragraph>
[IEEE802.1Q]
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>dot1qServiceInstanceId</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>412</elementId>
<status>current</status>
<description>
<paragraph>
The value of the 24-bit Backbone Service Instance Identifier
(I-SID) portion of the Backbone Service Instance Tag (I-TAG) Tag
Control Information (TCI) field of an Ethernet frame as described
in [IEEE802.1Q].
</paragraph>
</description>
<range>0-0xFFFFFF</range>
<references>
<paragraph>
[IEEE802.1Q]
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>dot1qServiceInstancePriority</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>413</elementId>
<status>current</status>
<description>
<paragraph>
The value of the 3-bit Backbone Service Instance Priority Code
Point (I-PCP) portion of the Backbone Service Instance Tag (I-TAG)
Tag Control Information (TCI) field of an Ethernet frame as
described in [IEEE802.1Q].
</paragraph>
</description>
<range>0-7</range>
<references>
<paragraph>
[IEEE802.1Q]
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>dot1qCustomerSourceMacAddress</name>
<dataType>macAddress</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>414</elementId>
<status>current</status>
<description>
<paragraph>
The value of the Encapsulated Customer Source Address (C-SA)
portion of the Backbone Service Instance Tag (I-TAG) Tag Control
Information (TCI) field of an Ethernet frame as described in
[IEEE802.1Q].
</paragraph>
</description>
<references>
<paragraph>
[IEEE802.1Q]
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>dot1qCustomerDestinationMacAddress</name>
<dataType>macAddress</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>415</elementId>
<status>current</status>
<description>
<paragraph>
The value of the Encapsulated Customer Destination Address (C-DA)
portion of the Backbone Service Instance Tag (I-TAG) Tag Control
Information (TCI) field of an Ethernet frame as described in
[IEEE802.1Q].
</paragraph>
</description>
<references>
<paragraph>
[IEEE802.1Q]
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name/>
<elementId>416</elementId>

<status>deprecated</status>
<description>
<paragraph>
Duplicate of Information Element ID 352, layer2OctetDeltaCount.
</paragraph>
</description>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<revision>2</revision>
<date>2014-05-13</date>
</record>

<record>
<name>postLayer2OctetDeltaCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>417</elementId>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical to the
definition of the layer2OctetDeltaCount Information Element,
except that it reports a potentially modified value caused by a
middlebox function after the packet passed the Observation Point.
</paragraph>
<paragraph>
This Information Element is the layer 2 version of
postOctetDeltaCount (ElementId #23).
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>postMCastLayer2OctetDeltaCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>418</elementId>
<status>current</status>
<description>
<paragraph>
The number of layer 2 octets since the previous report (if any) in
outgoing multicast packets sent for packets of this Flow by a
multicast daemon within the Observation Domain.  This property
cannot necessarily be observed at the Observation Point but may
be retrieved by other means.  The number of octets includes layer
2 header(s) and layer 2 payload.
</paragraph>
<paragraph>
This Information Element is the layer 2 version of
postMCastOctetDeltaCount (ElementId #20).
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name/>
<elementId>419</elementId>

<status>deprecated</status>
<description>
<paragraph>
Duplicate of Information Element ID 353, layer2OctetTotalCount.
</paragraph>
</description>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<revision>2</revision>
<date>2014-05-13</date>
</record>

<record>
<name>postLayer2OctetTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>420</elementId>
<status>current</status>
<description>
<paragraph>
The definition of this Information Element is identical to the
definition of the layer2OctetTotalCount Information Element,
except that it reports a potentially modified value caused by a
middlebox function after the packet passed the Observation Point.
</paragraph>
<paragraph>
This Information Element is the layer 2 version of
postOctetTotalCount (ElementId #171).
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>postMCastLayer2OctetTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>421</elementId>
<status>current</status>
<description>
<paragraph>
The total number of layer 2 octets in outgoing multicast packets
sent for packets of this Flow by a multicast daemon in the
Observation Domain since the Metering Process (re-)initialization.
This property cannot necessarily be observed at the Observation
Point but may be retrieved by other means.  The number of octets
includes layer 2 header(s) and layer 2 payload.
</paragraph>
<paragraph>
This Information Element is the layer 2 version of
postMCastOctetTotalCount (ElementId #175).
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>minimumLayer2TotalLength</name>
<dataType>unsigned64</dataType>
<elementId>422</elementId>
<status>current</status>
<description>
<paragraph>
Layer 2 length of the smallest packet observed for this Flow.  The
packet length includes the length of the layer 2 header(s) and the 
length of the layer 2 payload.
</paragraph>
<paragraph>
This Information Element is the layer 2 version of
minimumIpTotalLength (ElementId #25).
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>maximumLayer2TotalLength</name>
<dataType>unsigned64</dataType>
<elementId>423</elementId>
<status>current</status>
<description>
<paragraph>
Layer 2 length of the largest packet observed for this Flow.  The
packet length includes the length of the layer 2 header(s) and the length of the layer
2 payload.
</paragraph>
<paragraph>
This Information Element is the layer 2 version of
maximumIpTotalLength (ElementId #26).
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>droppedLayer2OctetDeltaCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>424</elementId>
<status>current</status>
<description>
<paragraph>
The number of layer 2 octets since the previous report (if any) in
packets of this Flow dropped by packet treatment.  The number of
octets includes layer 2 header(s) and layer 2 payload.
</paragraph>
<paragraph>
This Information Element is the layer 2 version of
droppedOctetDeltaCount (ElementId #132).
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>droppedLayer2OctetTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>425</elementId>
<status>current</status>
<description>
<paragraph>
The total number of octets in observed layer 2 packets (including
the layer 2 header) that were dropped by packet treatment since
the (re-)initialization of the Metering Process.
</paragraph>
<paragraph>
This Information Element is the layer 2 version of
droppedOctetTotalCount (ElementId #134).
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>ignoredLayer2OctetTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>426</elementId>
<status>current</status>
<description>
<paragraph>
The total number of octets in observed layer 2 packets (including
the layer 2 header) that the Metering Process did not process
since the (re-)initialization of the Metering Process.
</paragraph>
<paragraph>
This Information Element is the layer 2 version of
ignoredOctetTotalCount (ElementId #165).
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>notSentLayer2OctetTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>427</elementId>
<status>current</status>
<description>
<paragraph>
The total number of octets in observed layer 2 packets (including
the layer 2 header) that the Metering Process did not process
since the (re-)initialization of the Metering Process.
</paragraph>
<paragraph>
This Information Element is the layer 2 version of
notSentOctetTotalCount (ElementId #168).
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>layer2OctetDeltaSumOfSquares</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>428</elementId>
<status>current</status>
<description>
<paragraph>
The sum of the squared numbers of layer 2 octets per incoming
packet since the previous report (if any) for this Flow at the
Observation Point.  The number of octets includes layer 2
header(s) and layer 2 payload.
</paragraph>
<paragraph>
This Information Element is the layer 2 version of
octetDeltaSumOfSquares (ElementId #198).
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record>
<name>layer2OctetTotalSumOfSquares</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>429</elementId>
<status>current</status>
<description>
<paragraph>
The total sum of the squared numbers of layer 2 octets in incoming
packets for this Flow at the Observation Point since the Metering
Process (re-)initialization for this Observation Point.  The
number of octets includes layer 2 header(s) and layer 2 payload.
</paragraph>
<paragraph>
This Information Element is the layer 2 version of
octetTotalSumOfSquares (ElementId #199).
</paragraph>
</description>
<units>octets</units>
<references>
<paragraph>
<xref type="rfc" data="rfc5477"/>
</paragraph>
</references>
<xref type="rfc" data="rfc7133"/>
<revision>1</revision>
<date>2014-05-02</date>
</record>

<record date="2014-05-02">
<name>layer2FrameDeltaCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>deltaCounter</dataTypeSemantics>
<elementId>430</elementId>
<status>current</status>
<description>
<paragraph>
The number of incoming layer 2 frames since the
previous report (if any) for this Flow at the
Observation Point.
</paragraph>
</description>
<units>frames</units>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2014-05-02</date>
</record>

<record date="2014-05-02">
<name>layer2FrameTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>431</elementId>
<status>current</status>
<description>
<paragraph>
The total number of incoming layer 2 frames
for this Flow at the Observation Point since
the Metering Process (re-)initialization for
this Observation Point.
</paragraph>
</description>
<units>frames</units>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2014-05-02</date>
</record>

<record date="2014-05-28">
<name>pseudoWireDestinationIPv4Address</name>
<dataType>ipv4Address</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>432</elementId>
<status>current</status>
<description>
<paragraph>
The destination IPv4 address of the PSN tunnel carrying the pseudowire.
</paragraph>
</description>
<references>
<paragraph>
<xref type="rfc" data="rfc3985"/>
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2014-05-28</date>
</record>  

<record date="2014-06-27">
<name>ignoredLayer2FrameTotalCount</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>totalCounter</dataTypeSemantics>
<elementId>433</elementId>
<status>current</status>
<description>
<paragraph>
The total number of observed layer 2 frames that the Metering Process 
did not process since the (re-)initialization of the Metering Process.
This Information Element is the layer 2 version of ignoredPacketTotalCount (ElementId #164).
</paragraph>
</description>
<units>frames</units>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2014-06-27</date>
</record>

<record date="2015-12-13">
<name>mibObjectValueInteger</name>
<dataType>signed32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>434</elementId>
<status>current</status>
<description>
<paragraph>
An IPFIX Information Element that denotes that the
integer value of a MIB object will be exported.  The MIB Object
Identifier ("mibObjectIdentifier") for this field MUST be exported
in a MIB Field Option or via another means.  This Information
Element is used for MIB objects with the Base syntax of Integer32
and INTEGER with IPFIX reduced-size encoding used as required.
The value is encoded as per the standard IPFIX Abstract Data Type
of signed32.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>1</revision>
<date>2017-04-30</date>
</record>

<record date="2015-12-13">
<name>mibObjectValueOctetString</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>435</elementId>
<status>current</status>
<description>
<paragraph>
An IPFIX Information Element that denotes that an
Octet String or Opaque value of a MIB object will be exported.
The MIB Object Identifier ("mibObjectIdentifier") for this field
MUST be exported in a MIB Field Option or via another means.  This
Information Element is used for MIB objects with the Base syntax
of OCTET STRING and Opaque.  The value is encoded as per the
standard IPFIX Abstract Data Type of octetArray.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibObjectValueOID</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>436</elementId>
<status>current</status>
<description>
<paragraph>
An IPFIX Information Element that denotes that an
Object Identifier or OID value of a MIB object will be exported.
The MIB Object Identifier ("mibObjectIdentifier") for this field
MUST be exported in a MIB Field Option or via another means.  This
Information Element is used for MIB objects with the Base syntax
of OBJECT IDENTIFIER.  Note: In this case, the
"mibObjectIdentifier" defines which MIB object is being exported,
and the "mibObjectValueOID" field will contain the OID value of
that MIB object.  The mibObjectValueOID Information Element is
encoded as ASN.1/BER [X.690] in an octetArray.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibObjectValueBits</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>437</elementId>
<status>current</status>
<description>
<paragraph>
An IPFIX Information Element that denotes that a set
of Enumerated flags or bits from a MIB object will be exported.
The MIB Object Identifier ("mibObjectIdentifier") for this field
MUST be exported in a MIB Field Option or via another means.  This
Information Element is used for MIB objects with the Base syntax
of BITS.  The flags or bits are encoded as per the standard IPFIX
Abstract Data Type of octetArray, with sufficient length to
accommodate the required number of bits.  If the number of bits is
not an integer multiple of octets, then the most significant bits
at the end of the octetArray MUST be set to 0.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibObjectValueIPAddress</name>
<dataType>ipv4Address</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>438</elementId>
<status>current</status>
<description>
<paragraph>
An IPFIX Information Element that denotes that the
IPv4 address value of a MIB object will be exported.  The MIB
Object Identifier ("mibObjectIdentifier") for this field MUST be
exported in a MIB Field Option or via another means.  This
Information Element is used for MIB objects with the Base syntax
of IpAddress.  The value is encoded as per the standard IPFIX
Abstract Data Type of ipv4Address.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibObjectValueCounter</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>snmpCounter</dataTypeSemantics>
<elementId>439</elementId>
<status>current</status>
<description>
<paragraph>
An IPFIX Information Element that denotes that the
counter value of a MIB object will be exported.  The MIB Object
Identifier ("mibObjectIdentifier") for this field MUST be exported
in a MIB Field Option or via another means.  This Information
Element is used for MIB objects with the Base syntax of Counter32
or Counter64 with IPFIX reduced-size encoding used as required.
The value is encoded as per the standard IPFIX Abstract Data Type
of unsigned64.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibObjectValueGauge</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>snmpGauge</dataTypeSemantics>
<elementId>440</elementId>
<status>current</status>
<description>
<paragraph>
An IPFIX Information Element that denotes that the
Gauge value of a MIB object will be exported.  The MIB Object
Identifier ("mibObjectIdentifier") for this field MUST be exported
in a MIB Field Option or via another means.  This Information
Element is used for MIB objects with the Base syntax of Gauge32.
The value is encoded as per the standard IPFIX Abstract Data Type
of unsigned32.  This value represents a non-negative integer that
may increase or decrease but that shall never exceed a maximum
value or fall below a minimum value.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibObjectValueTimeTicks</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>441</elementId>
<status>current</status>
<description>
<paragraph>
An IPFIX Information Element that denotes that the
TimeTicks value of a MIB object will be exported.  The MIB Object
Identifier ("mibObjectIdentifier") for this field MUST be exported
in a MIB Field Option or via another means.  This Information
Element is used for MIB objects with the Base syntax of TimeTicks.
The value is encoded as per the standard IPFIX Abstract Data Type
of unsigned32.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>1</revision>
<date>2017-04-30</date>
</record>

<record date="2015-12-13">
<name>mibObjectValueUnsigned</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>442</elementId>
<status>current</status>
<description>
<paragraph>
An IPFIX Information Element that denotes that an
unsigned integer value of a MIB object will be exported.  The MIB
Object Identifier ("mibObjectIdentifier") for this field MUST be
exported in a MIB Field Option or via another means.  This
Information Element is used for MIB objects with the Base syntax
of unsigned32 with IPFIX reduced-size encoding used as required.
The value is encoded as per the standard IPFIX Abstract Data Type
of unsigned32.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>1</revision>
<date>2017-04-30</date>
</record>

<record date="2015-12-13">
<name>mibObjectValueTable</name>
<dataType>subTemplateList</dataType>
<dataTypeSemantics>list</dataTypeSemantics>
<elementId>443</elementId>
<status>current</status>
<description>
<paragraph>
An IPFIX Information Element that denotes that a
complete or partial conceptual table will be exported.  The MIB
Object Identifier ("mibObjectIdentifier") for this field MUST be
exported in a MIB Field Option or via another means.  This
Information Element is used for MIB objects with a syntax of
SEQUENCE OF.  This is encoded as a subTemplateList of mibObjectValue
Information Elements.  The Template specified in the
subTemplateList MUST be an Options Template and MUST include all
the objects listed in the INDEX clause as Scope Fields.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>1</revision>
<date>2017-04-30</date>
</record>

<record date="2015-12-13">
<name>mibObjectValueRow</name>
<dataType>subTemplateList</dataType>
<dataTypeSemantics>list</dataTypeSemantics>
<elementId>444</elementId>
<status>current</status>
<description>
<paragraph>
An IPFIX Information Element that denotes that a
single row of a conceptual table will be exported.  The MIB Object
Identifier ("mibObjectIdentifier") for this field MUST be exported
in a MIB Field Option or via another means.  This Information
Element is used for MIB objects with a syntax of SEQUENCE.  This
is encoded as a subTemplateList of mibObjectValue Information
Elements.  The subTemplateList exported MUST contain exactly one
row (i.e., one instance of the subTemplate).  The Template
specified in the subTemplateList MUST be an Options Template and
MUST include all the objects listed in the INDEX clause as Scope
Fields.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibObjectIdentifier</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>445</elementId>
<status>current</status>
<description>
<paragraph>
An IPFIX Information Element that denotes that a MIB
Object Identifier (MIB OID) is exported in the (Options)
Template Record.  The mibObjectIdentifier Information Element
contains the OID assigned to the MIB object type definition
encoded as ASN.1/BER [X.690].
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibSubIdentifier</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>446</elementId>
<status>current</status>
<description>
<paragraph>
A non-negative sub-identifier of an Object Identifier (OID).
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibIndexIndicator</name>
<dataType>unsigned64</dataType>
<dataTypeSemantics>flags</dataTypeSemantics>
<elementId>447</elementId>
<status>current</status>
<description>
<paragraph>
A set of bit fields that is used for marking the
Information Elements of a Data Record that serve as INDEX MIB
objects for an indexed columnar MIB object.  Each bit represents
an Information Element in the Data Record, with the n-th least
significant bit representing the n-th Information Element.  A bit
set to 1 indicates that the corresponding Information Element is
an index of the columnar object represented by the mibObjectValue.
A bit set to 0 indicates that this is not the case.
</paragraph>
<paragraph>
If the Data Record contains more than 64 Information Elements, the
corresponding Template SHOULD be designed such that all index
fields are among the first 64 Information Elements, because the
mibIndexIndicator only contains 64 bits.  If the Data Record
contains less than 64 Information Elements, then the extra bits in
the mibIndexIndicator for which no corresponding Information
Element exists MUST have the value 0 and must be disregarded by
the Collector.  This Information Element may be exported with
IPFIX reduced-size encoding.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibCaptureTimeSemantics</name>
<dataType>unsigned8</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>448</elementId>
<status>current</status>
<description>
<paragraph>
Indicates when in the lifetime of the Flow the MIB
value was retrieved from the MIB for a mibObjectIdentifier.  This
is used to indicate if the value exported was collected from the
MIB closer to Flow creation or Flow export time and refers to the
Timestamp fields included in the same Data Record.  This field
SHOULD be used when exporting a mibObjectValue that specifies
counters or statistics.
</paragraph>
<paragraph>
If the MIB value was sampled by SNMP prior to the IPFIX Metering
Process or Exporting Process retrieving the value (i.e., the data
is already stale) and it is important to know the exact sampling
time, then an additional observationTime* element should be paired
with the OID using IPFIX Structured Data [RFC6313].  Similarly, if
different MIB capture times apply to different mibObjectValue elements
within the Data Record, then individual mibCaptureTimeSemantics
Information Elements should be paired with each OID using IPFIX
Structured Data.
</paragraph>
<paragraph>
Values:
</paragraph>
<paragraph>
0  undefined
</paragraph>
<paragraph>
1  begin - The value for the MIB object is captured from the
MIB when the Flow is first observed
</paragraph>
<paragraph>
2  end - The value for the MIB object is captured from the MIB
when the Flow ends
</paragraph>
<paragraph>
3  export - The value for the MIB object is captured from the
MIB at export time
</paragraph>
<paragraph>
4  average - The value for the MIB object is an average of
multiple captures from the MIB over the observed life of the
Flow 
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibContextEngineID</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>449</elementId>
<status>current</status>
<description>
<paragraph>
A mibContextEngineID that specifies the SNMP engine
ID for a MIB field being exported over IPFIX.  Definition as per
<xref type="rfc" data="rfc3411"/>, Section 3.3.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibContextName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>450</elementId>
<status>current</status>
<description>
<paragraph>
An Information Element that denotes that a MIB
context name is specified for a MIB field being exported over
IPFIX.  Reference <xref type="rfc" data="rfc3411"/>, Section 3.3.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibObjectName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>451</elementId>
<status>current</status>
<description>
<paragraph>
The name (called a descriptor in <xref type="rfc" data="rfc2578"/> 
of an object type definition.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibObjectDescription</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>452</elementId>
<status>current</status>
<description>
<paragraph>
The value of the DESCRIPTION clause of a MIB object
type definition.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibObjectSyntax</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>453</elementId>
<status>current</status>
<description>
<paragraph>
The value of the SYNTAX clause of a MIB object type
definition, which may include a textual convention or sub-typing.
See <xref type="rfc" data="rfc2578"/>.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-13">
<name>mibModuleName</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>454</elementId>
<status>current</status>
<description>
<paragraph>
The textual name of the MIB module that defines a MIB
object.
</paragraph>
</description>
<units/>
<xref type="rfc" data="rfc8038"/>
<revision>0</revision>
<date>2015-12-13</date>
</record>

<record date="2015-12-15">
<name>mobileIMSI</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>455</elementId>
<status>current</status>
<description>
<paragraph>
The International Mobile Subscription Identity (IMSI). The
IMSI is a decimal digit string with up to a maximum of 15 ASCII/UTF-8
encoded digits (0x30 - 0x39).
</paragraph>
</description>
<references>
<paragraph>
<xref type="uri" data="http://www.3gpp.org/DynaReport/23003.htm">3GPP TS 23.003</xref> Section 3 and <xref type="uri" data="https://www.itu.int/rec/T-REC-E.164/en">ITU-T E.164</xref>.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2015-12-15</date>
</record>

<record date="2015-12-15">
<name>mobileMSISDN</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>456</elementId>
<status>current</status>
<description>
<paragraph>
The Mobile Station International Subscriber Directory Number
(MSISDN). The MSISDN is a decimal digit string with up to a maximum of 15
ASCII/UTF-8 encoded digits (0x30 - 0x39).
</paragraph>
</description>
<references>
<paragraph>
<xref type="uri" data="http://www.3gpp.org/DynaReport/23003.htm">3GPP TS 23.003</xref> Section 3 and <xref type="uri" data="https://www.itu.int/rec/T-REC-E.164/en">ITU-T E.164</xref>.
</paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2015-12-15</date>
</record>

<record date="2016-04-28">
<name>httpStatusCode</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>457</elementId>
<status>current</status>
<description>
<paragraph>
The HTTP Response Status Code, as defined in 
section 6 of <xref type="rfc" data="rfc7231"/>, 
associated with a flow. Implies that the flow 
record represents a flow containing an HTTP 
Response.
</paragraph>
</description>
<range>0-999</range>
<references>
<paragraph>
<xref type="rfc" data="rfc7231"/>
</paragraph>
</references>
<xref type="person" data="Andrew_Feren"/>
<revision>0</revision>
<date>2016-04-28</date>
</record>

<record date="2016-11-10">
<name>sourceTransportPortsLimit</name>
<dataType>unsigned16</dataType>
<dataTypeSemantics>quantity</dataTypeSemantics>
<elementId>458</elementId>
<status>current</status>
<description>
<paragraph>
This Information Element contains the maximum
number of IP source transport ports that can be used by an end
user when sending IP packets; each user is associated with one
or more (source) IPv4 or IPv6 addresses. This Information
Element is particularly useful in address-sharing deployments
that adhere to REQ-4 of <xref type="rfc" data="rfc6888"/>. Limiting the number of
ports assigned to each user ensures fairness among users and
mitigates the denial-of-service attack that a user could launch
against other users through the address-sharing device in order
to grab more ports.
</paragraph>
</description>
<units>ports</units>
<range>1-65535</range>
<xref type="rfc" data="rfc8045"/>
<xref type="rfc-errata" data="5009"/>
<revision>1</revision>
<date>2017-08-01</date>
</record>

<record date="2016-11-15">
<name>httpRequestMethod</name>
<dataType>string</dataType>
<elementId>459</elementId>
<status>current</status>
<description>
<paragraph>
The HTTP request method, as defined in section 4 of
<xref type="rfc" data="rfc7231"/>, associated with a 
flow. String with up to 8 UTF-8 characters.
</paragraph>
</description>
<units/>
<range/>
<xref type="person" data="Felix_Erlacher"/>
<revision>0</revision>
<date>2016-11-15</date>
</record>

<record date="2016-11-15">
<name>httpRequestHost</name>
<dataType>string</dataType>
<elementId>460</elementId>
<status>current</status>
<description>
<paragraph>
The HTTP request host, as defined in section 5.4 of
<xref type="rfc" data="rfc7230"/> or, in the case of 
HTTP/2, the content of the :authority pseudo-header 
field as defined in section 8.1.2.3 of 
<xref type="rfc" data="rfc7240"/>. Encoded in UTF-8.
</paragraph>
</description>
<units/>
<range/>
<xref type="person" data="Felix_Erlacher"/>
<revision>0</revision>
<date>2016-11-15</date>
</record>

<record date="2016-11-15">
<name>httpRequestTarget</name>
<dataType>string</dataType>
<elementId>461</elementId>
<status>current</status>
<description>
<paragraph>
The HTTP request target, as defined in section 2 of
<xref type="rfc" data="rfc7231"/> and in section 5.3 of 
<xref type="rfc" data="rfc7230"/>, associated with a flow.
Or the HTTP/2 ":path" pseudo-header field as defined in 
section 8.1.2.3 of <xref type="rfc" data="rfc7240"/>. 
Encoded in UTF-8.
</paragraph>
</description>
<units/>
<range/>
<xref type="person" data="Felix_Erlacher"/>
<revision>0</revision>
<date>2016-11-15</date>
</record>

<record date="2016-11-15">
<name>httpMessageVersion</name>
<dataType>string</dataType>
<elementId>462</elementId>
<status>current</status>
<description>
<paragraph>
The version of an HTTP/1.1 message as indicated by the
HTTP-version field, defined in section 2.6 of 
<xref type="rfc" data="rfc7230"/>, or the version
identification of an HTTP/2 frame as defined in 
<xref type="rfc" data="rfc7240"/> section 3.1. The length 
of this field is limited to 10 characters, UTF-8 encoded.
</paragraph>
</description>
<units/>
<range/>
<xref type="person" data="Felix_Erlacher"/>
<revision>0</revision>
<date>2016-11-15</date>
</record>

<record date="2017-03-15">
<name>natInstanceID</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>463</elementId>
<status>current</status>
<description>
  <paragraph>
    This Information Element uniquely identifies an Instance of the NAT 
    that runs on a NAT middlebox function after the packet passes the 
    Observation Point. natInstanceID is defined in 
    <xref type="rfc" data="rfc7659"/>.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc791"/> for the definition of the IPv4 
    source address field.  See <xref type="rfc" data="rfc3022"/> 
    for the definition of NAT.  See <xref type="rfc" data="rfc3234"/> 
    for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-03-15</date>
</record>

<record date="2017-03-15">
<name>internalAddressRealm</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>464</elementId>
<status>current</status>
<description>
  <paragraph>
    This Information Element represents the internal address realm where 
    the packet is originated from or destined to. By definition, a NAT 
    mapping can be created from two address realms, one from internal and 
    one from external. Realms are implementation dependent and can represent 
    a Virtual Routing and Forwarding (VRF) ID, a VLAN ID, or some unique 
    identifier. Realms are optional and, when left unspecified, would mean 
    that the external and internal realms are the same.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc791"/> for the definition of the IPv4 
    source address field.  See <xref type="rfc" data="rfc3022"/> 
    for the definition of NAT.  See <xref type="rfc" data="rfc3234"/> 
    for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-03-15</date>
</record>

<record date="2017-03-15">
<name>externalAddressRealm</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>465</elementId>
<status>current</status>
<description>
  <paragraph>
    This Information Element represents the external address
    realm where the packet is originated from or destined to.  The
    detailed definition is in the internal address realm as specified
    above.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc791"/> for the definition of the IPv4 
    source address field.  See <xref type="rfc" data="rfc3022"/> 
    for the definition of NAT.  See <xref type="rfc" data="rfc3234"/> 
    for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-03-15</date>
</record>

<record date="2017-03-15">
<name>natQuotaExceededEvent</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>466</elementId>
<status>current</status>
<description>
  <paragraph>
    This Information Element identifies the type of a NAT Quota Exceeded 
    event. Values for this Information Element are listed in the "NAT 
    Quota Exceeded Event Type" registry, see 
    <xref type="uri" data="http://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-quota-exceeded-event"/>. 
    New assignments of values will be administered by IANA and are subject 
    to Expert Review <xref type="rfc" data="rfc8126"/>. Experts need to 
    check definitions of new values for completeness, accuracy, and 
    redundancy.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc791"/> for the definition of the IPv4 
    source address field.  See <xref type="rfc" data="rfc3022"/> 
    for the definition of NAT.  See <xref type="rfc" data="rfc3234"/> 
    for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-03-15</date>
</record>

<record date="2017-03-15">
<name>natThresholdEvent</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>467</elementId>
<status>current</status>
<description>
  <paragraph>
    This Information Element identifies a type of a NAT Threshold event. 
    Values for this Information Element are listed in the "NAT Threshold 
    Event Type" registry, see 
    <xref type="uri" data="http://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-threshold-event"/>. 
    New assignments of values will be administered by IANA and are 
    subject to Expert Review <xref type="rfc" data="rfc8126"/>. Experts 
    need to check definitions of new values for completeness, accuracy, 
    and redundancy.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc791"/> for the definition of the IPv4 
    source address field.  See <xref type="rfc" data="rfc3022"/> 
    for the definition of NAT.  See <xref type="rfc" data="rfc3234"/> 
    for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-03-15</date>
</record>

<record date="2017-04-19">
<name>httpUserAgent</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>468</elementId>
<status>current</status>
<description>
  <paragraph>
    The HTTP User-Agent header field as defined in section 5.5.3 of  
    <xref type="rfc" data="rfc7231"/>. Encoded in UTF-8.
  </paragraph>
</description>
<units/>
<range/>
<references>
  <paragraph>
    <xref type="rfc" data="rfc7231"/>
  </paragraph>
</references>
<xref type="person" data="Andrew_Feren"/>
<revision>0</revision>
<date>2017-04-19</date>
</record>

<record date="2017-04-19">
<name>httpContentType</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>469</elementId>
<status>current</status>
<description>
  <paragraph>
    The HTTP Content-Type header field as defined in section 3.1.1.5 of 
    <xref type="rfc" data="rfc7231"/>. Encoded in UTF-8.
  </paragraph>
</description>
<units/>
<range/>
<references>
  <paragraph>
    <xref type="rfc" data="rfc7231"/>
  </paragraph>
</references>
<xref type="person" data="Andrew_Feren"/>
<revision>0</revision>
<date>2017-04-19</date>
</record>

<record date="2017-06-19">
<name>httpReasonPhrase</name>
<dataType>string</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>470</elementId>
<status>current</status>
<description>
  <paragraph>
    The HTTP reason phrase as defined in section 6.1 of of 
    <xref type="rfc" data="rfc7231"/>.
  </paragraph>
</description>
<units/>
<range/>
<references>
  <paragraph>
    <xref type="rfc" data="rfc7231"/>
  </paragraph>
</references>
<xref type="person" data="Felix_Erlacher"/>
<revision>0</revision>
<date>2017-06-19</date>
</record>

<record date="2017-12-01">
<name>maxSessionEntries</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>471</elementId>
<status>current</status>
<description>
  <paragraph>
    This element represents the maximum session entries that
    can be created by the NAT device. 
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc3022"/> for the definition of NAT.  
    See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-12-01</date>
</record>

<record date="2017-12-01">
<name>maxBIBEntries</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>472</elementId>
<status>current</status>
<description>
  <paragraph>
    This element represents the maximum BIB entries that can
    be created by the NAT device.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc3022"/> for the definition of NAT.  
    See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-12-01</date>
</record>

<record date="2017-12-01">
<name>maxEntriesPerUser</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>473</elementId>
<status>current</status>
<description>
  <paragraph>
    This element represents the maximum NAT entries that can
    be created per user by the NAT device.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc3022"/> for the definition of NAT.  
    See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-12-01</date>
</record>

<record date="2017-12-01">
<name>maxSubscribers</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>474</elementId>
<status>current</status>
<description>
  <paragraph>
    This element represents the maximum subscribers or
    maximum hosts that are allowed by the NAT device.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc3022"/> for the definition of NAT.  
    See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-12-01</date>
</record>

<record date="2017-12-01">
<name>maxFragmentsPendingReassembly</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>475</elementId>
<status>current</status>
<description>
  <paragraph>
    This element represents the maximum fragments that the
    NAT device can store for reassembling the packet.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc3022"/> for the definition of NAT.  
    See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-12-01</date>
</record>

<record date="2017-12-01">
<name>addressPoolHighThreshold</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>476</elementId>
<status>current</status>
<description>
  <paragraph>
    This element represents the high threshold value of the
    number of public IP addresses in the address pool.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc3022"/> for the definition of NAT.  
    See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-12-01</date>
</record>

<record date="2017-12-01">
<name>addressPoolLowThreshold</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>477</elementId>
<status>current</status>
<description>
  <paragraph>
    This element represents the low threshold value of the
    number of public IP addresses in the address pool.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc3022"/> for the definition of NAT.  
    See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-12-01</date>
</record>

<record date="2017-12-01">
<name>addressPortMappingHighThreshold</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>478</elementId>
<status>current</status>
<description>
  <paragraph>
    This element represents the high threshold value of the
    number of address and port mappings.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc3022"/> for the definition of NAT.  
    See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-12-01</date>
</record>

<record date="2017-12-01">
<name>addressPortMappingLowThreshold</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>479</elementId>
<status>current</status>
<description>
  <paragraph>
    This element represents the low threshold value of the
    number of address and port mappings.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc3022"/> for the definition of NAT.  
    See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-12-01</date>
</record>

<record date="2017-12-01">
<name>addressPortMappingPerUserHighThreshold</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>480</elementId>
<status>current</status>
<description>
  <paragraph>
    This element represents the high threshold value of the
    number of address and port mappings that a single user is allowed to
    create on a NAT device.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc3022"/> for the definition of NAT.  
    See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes.
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-12-01</date>
</record>

<record date="2017-12-01">
<name>globalAddressMappingHighThreshold</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>481</elementId>
<status>current</status>
<description>
  <paragraph>
    This element represents the high threshold value of the
    number of address and port mappings that a single user is allowed to
    create on a NAT device in a paired address pooling behavior.
  </paragraph>
</description>
<references>
  <paragraph>
    See <xref type="rfc" data="rfc3022"/> for the definition of NAT.  
    See <xref type="rfc" data="rfc3234"/> for the definition of middleboxes.
    See <xref type="rfc" data="rfc4787"/> for the definition of paired 
    address pooling behavior.    
  </paragraph>
</references>
<xref type="rfc" data="rfc8158"/>
<revision>0</revision>
<date>2017-12-01</date>
</record>
  
<record date="2018-07-10">
<name>vpnIdentifier</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>482</elementId>
<status>current</status>
<description>
  <paragraph>
   VPN ID in the format specified by <xref type="rfc" data="rfc2685"/>.
   The size of this Information Element is 7 octets.
  </paragraph>
</description>
<references>
  <paragraph>
  <xref type="rfc" data="rfc2685"/>   
  </paragraph>
</references>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
<revision>0</revision>
<date>2018-07-10</date>
</record>

<record date="2019-01-18">
<name>bgpCommunity</name>
<dataType>unsigned32</dataType>
<dataTypeSemantics>identifier</dataTypeSemantics>
<elementId>483</elementId>
<status>current</status>
<description>
  <paragraph>
    BGP community as defined in <xref type="rfc" data="rfc1997"/>
  </paragraph>
</description>
<references>
  <paragraph>
    <xref type="rfc" data="rfc1997"/> 
  </paragraph>
</references>
<xref type="rfc" data="rfc8549"/>
<revision>0</revision>
<date>2019-01-18</date>
</record>
  
<record date="2019-01-18">
<name>bgpSourceCommunityList</name>
<dataType>basicList</dataType>
<dataTypeSemantics>list</dataTypeSemantics>
<elementId>484</elementId>
<status>current</status>
<description>
  <paragraph>
    basicList of zero or more bgpCommunity IEs, containing the BGP 
    communities corresponding with source IP address of a specific flow
  </paragraph>
</description>
<references>
  <paragraph>
    <xref type="rfc" data="rfc6313"/>
    <xref type="rfc" data="rfc1997"/> 
  </paragraph>
</references>
<xref type="rfc" data="rfc8549"/>
<revision>0</revision>
<date>2019-01-18</date>
</record>

<record date="2019-01-18">
<name>bgpDestinationCommunityList</name>
<dataType>basicList</dataType>
<dataTypeSemantics>list</dataTypeSemantics>
<elementId>485</elementId>
<status>current</status>
<description>
  <paragraph>
    basicList of zero or more bgpCommunity IEs, containing the BGP 
    communities corresponding with destination IP address of a specific flow
  </paragraph>
</description>
<references>
  <paragraph>
    <xref type="rfc" data="rfc6313"/>
    <xref type="rfc" data="rfc1997"/> 
  </paragraph>
</references>
<xref type="rfc" data="rfc8549"/>
<revision>0</revision>
<date>2019-01-18</date>
</record>

<record date="2019-01-18">
<name>bgpExtendedCommunity</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>486</elementId>
<status>current</status>
<description>
  <paragraph>
    BGP Extended Community as defined in <xref type="rfc" data="rfc4360"/>;
    the size of this IE MUST be 8 octets
  </paragraph>
</description>
<references>
  <paragraph>
    <xref type="rfc" data="rfc4360"/>
  </paragraph>
</references>
<xref type="rfc" data="rfc8549"/>
<revision>0</revision>
<date>2019-01-18</date>
</record>
  
<record date="2019-01-18">
<name>bgpSourceExtendedCommunityList</name>
<dataType>basicList</dataType>
<dataTypeSemantics>list</dataTypeSemantics>
<elementId>487</elementId>
<status>current</status>
<description>
  <paragraph>
    basicList of zero or more bgpExtendedCommunity IEs, 
    containing the BGP Extended Communities corresponding with source 
    IP address of a specific flow
  </paragraph>
</description>
<references>
  <paragraph>
    <xref type="rfc" data="rfc6313"/>
    <xref type="rfc" data="rfc4360"/> 
  </paragraph>
</references>
<xref type="rfc" data="rfc8549"/>
<revision>0</revision>
<date>2019-01-18</date>
</record>
  
<record date="2019-01-18">
<name>bgpDestinationExtendedCommunityList</name>
<dataType>basicList</dataType>
<dataTypeSemantics>list</dataTypeSemantics>
<elementId>488</elementId>
<status>current</status>
<description>
  <paragraph>
    basicList of zero or more bgpExtendedCommunity IEs, 
    containing the BGP Extended Communities corresponding 
    with destination IP address of a specific flow
  </paragraph>
</description>
<references>
  <paragraph>
    <xref type="rfc" data="rfc6313"/>
    <xref type="rfc" data="rfc4360"/> 
  </paragraph>
</references>
<xref type="rfc" data="rfc8549"/>
<revision>0</revision>
<date>2019-01-18</date>
</record>
  
<record date="2019-01-18">
<name>bgpLargeCommunity</name>
<dataType>octetArray</dataType>
<dataTypeSemantics>default</dataTypeSemantics>
<elementId>489</elementId>
<status>current</status>
<description>
  <paragraph>
    BGP Large Community as defined in <xref type="rfc" data="rfc8092"/>;
    the size of this IE MUST be 12 octets.
  </paragraph>
</description>
<references>
  <paragraph>
    <xref type="rfc" data="rfc8092"/>
   </paragraph>
</references>
<xref type="rfc" data="rfc8549"/>
<revision>0</revision>
<date>2019-01-18</date>
</record>

<record date="2019-01-18">
<name>bgpSourceLargeCommunityList</name>
<dataType>basicList</dataType>
<dataTypeSemantics>list</dataTypeSemantics>
<elementId>490</elementId>
<status>current</status>
<description>
  <paragraph>
    basicList of zero or more bgpLargeCommunity IEs, 
    containing the BGP Large Communities corresponding 
    with source IP address of a specific flow 
  </paragraph>
</description>
<references>
<paragraph>
  <xref type="rfc" data="rfc6313"/>
  <xref type="rfc" data="rfc8092"/> 
</paragraph>
</references>
<xref type="rfc" data="rfc8549"/>
<revision>0</revision>
<date>2019-01-18</date>
</record>
  
<record date="2019-01-18">
<name>bgpDestinationLargeCommunityList</name>
<dataType>basicList</dataType>
<dataTypeSemantics>list</dataTypeSemantics>
<elementId>491</elementId>
<status>current</status>
<description>
  <paragraph>
    basicList of zero or more bgpLargeCommunity IEs, 
    containing the BGP Large Communities corresponding 
    with destination IP address of a specific flow
  </paragraph>
</description>
<references>
  <paragraph>
    <xref type="rfc" data="rfc6313"/>
    <xref type="rfc" data="rfc8092"/> 
  </paragraph>
</references>
<xref type="rfc" data="rfc8549"/>
<revision>0</revision>
<date>2019-01-18</date>
</record>
  
<record>
<name>Unassigned</name>
<elementId>492-32767</elementId>
</record>




<registry id="ipfix-mpls-label-type">
<title>IPFIX MPLS label type (Value 46)</title>
<registration_rule>Expert Review</registration_rule>
<expert>IE Doctors</expert>
<xref type="rfc" data="rfc7012"/>

<record>
<value>0</value>
<description>Unknown: The MPLS label type is not known.</description>
<xref type="rfc" data="rfc3954"/>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
</record>

<record>
<value>1</value>
<description>TE-MIDPT: Any TE tunnel mid-point or tail label</description>
<xref type="rfc" data="rfc5102"/>
</record>

<record>
<value>2</value>
<description>Pseudowire: Any PWE3 or Cisco AToM based label</description>
<xref type="rfc" data="rfc5102"/>
</record>

<record>
<value>3</value>
<description>VPN: Any label associated with VPN</description>
<xref type="rfc" data="rfc5102"/>
</record>

<record>
<value>4</value>
<description>BGP: Any label associated with BGP or BGP routing</description>
<xref type="rfc" data="rfc5102"/>
</record>

<record>
<value>5</value>
<description>LDP: Any label associated with dynamically assigned labels using LDP</description>
<xref type="rfc" data="rfc5102"/>
</record>

<record>
<value>6-255</value>
<description>Unassigned</description>
<xref type="rfc" data="rfc5102"/>
</record>
</registry>



<registry id="forwarding-status">
<title>Forwarding Status (Value 89)</title>
<registration_rule>Expert Review</registration_rule>
<expert>IE Doctors</expert>
<xref type="rfc" data="rfc7270"/>

<record>
  <value>00b</value>
  <description>Unknown</description>
  <xref type="rfc" data="rfc7270"/>
</record>

<record>
  <value>01b</value>
  <description>Forwarded</description>
  <xref type="rfc" data="rfc7270"/>
</record>

<record>
  <value>10b</value>
  <description>Dropped</description>
  <xref type="rfc" data="rfc7270"/>
</record>

<record>
  <value>11b</value>
  <description>Consumed</description>
  <xref type="rfc" data="rfc7270"/>
</record>

<registry id="forwarding-status-00b">
  <title>Status 00b: Unknown</title>
  <registration_rule>Expert Review</registration_rule>
  <expert>IE Doctors</expert>
  <xref type="rfc" data="rfc7270"/>
 
  <record>
    <binary-value/>
    <value>0x00-0x3F</value>
    <description>Unassigned</description>
  </record>

</registry>

<registry id="forwarding-status-01b">
  <title>Status 01b: Forwarded</title>
  <registration_rule>Expert Review</registration_rule>
  <expert>IE Doctors</expert>
  <xref type="rfc" data="rfc7270"/>
  
  <record>
    <binary-value>01 000000b</binary-value>
    <value>0x40</value>
    <description>Unknown</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>01 000001b</binary-value>
    <value>0x41</value>
    <description>Fragmented</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>01 000010b</binary-value>
    <value>0x42</value>
    <description>Not Fragmented</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record date="2018-02-12">
    <binary-value>01 000011b</binary-value>
    <value>0x43</value>
    <description>Tunneled</description>
    <xref type="person" data="Alfred_Nothaft"/>
  </record>
  
  <record>
    <binary-value/>
    <value>0x44-0x7F</value>
    <description>Unassigned</description>
  </record>

</registry>

<registry id="forwarding-status-10b">
  <title>Status 10b: Dropped</title>
  <registration_rule>Expert Review</registration_rule>
  <expert>IE Doctors</expert>
  <xref type="rfc" data="rfc7270"/>
  
  <record>
    <binary-value>10 000000b</binary-value>
    <value>0x80</value>
    <description>Unknown</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 000001b</binary-value>
    <value>0x81</value>
    <description>ACL deny</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 000010b</binary-value>
    <value>0x82</value>
    <description>ACL drop</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 000011b</binary-value>
    <value>0x83</value>
    <description>Unroutable</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 000100b</binary-value>
    <value>0x84</value>
    <description>Adjacency</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 000101b</binary-value>
    <value>0x85</value>
    <description>Fragmentation and DF set</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 000110b</binary-value>
    <value>0x86</value>
    <description>Bad header checksum</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 000111b</binary-value>
   <value>0x87</value>
    <description>Bad total Length</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 001000b</binary-value>
    <value>0x88</value>
    <description>Bad header length</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 001001b</binary-value>
    <value>0x89</value>
    <description>bad TTL</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 001010b</binary-value>
    <value>0x8A</value>
    <description>Policer</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 001011b</binary-value>
    <value>0x8B</value>
    <description>WRED</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 001100b</binary-value>
    <value>0x8C</value>
    <description>RPF</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 001101b</binary-value>
    <value>0x8D</value>
    <description>For us</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 001110b</binary-value>
    <value>0x8E</value>
    <description>Bad output interface</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>10 001111b</binary-value>
    <value>0x8F</value>
    <description>Hardware</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value/>
    <value>0x90-0xBF</value>
    <description>Unassigned</description>
  </record>

</registry>

<registry id="forwarding-status-11b">
  <title>Status 11b: Consumed</title>
  <registration_rule>Expert Review</registration_rule>
  <expert>IE Doctors</expert>
  <xref type="rfc" data="rfc7270"/>
  
  <record>
    <binary-value>11 000000b</binary-value>
    <value>0xC0</value>
    <description>Unknown</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>11 000001b</binary-value>
    <value>0xC1</value>
    <description>Punt Adjacency</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>11 000010b</binary-value>
    <value>0xC2</value>
    <description>Incomplete Adjacency</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value>11 000011b</binary-value>
    <value>0xC3</value>
    <description>For us</description>
    <xref type="rfc" data="rfc7270"/>
  </record>
  
  <record>
    <binary-value/>
    <value>0xC4-0xFF</value>
    <description>Unassigned</description>
  </record>
</registry>

</registry>



<registry id="classification-engine-ids">
<title>Classification Engine IDs (Value 101)</title>
<registration_rule>Expert Review</registration_rule>
<expert>IE Doctors</expert>
<xref type="rfc" data="rfc6759"/>

<record>
<value>0</value>
<description>Invalid.</description>
<length/>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>1</value>
<description>IANA-L3: The Assigned Internet Protocol Number (layer 3 (L3)) is exported in the Selector ID. See <xref type="registry" data="protocol-numbers"/>.
</description>
<length>1</length>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>2</value>
<description>PANA-L3: Proprietary layer 3 definition. An enterprise can export its own layer 3 protocol numbers. The Selector ID has a global significance for all devices from the same enterprise.
</description>
<length>1</length>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>3</value>
<description>IANA-L4: The IANA layer 4 (L4) well-known port
number is exported in the Selector ID. See <xref type="registry" data="service-names-port-numbers"/>. Note: as an IPFIX flow is unidirectional,
it contains the destination port in a flow from
the client to the server.
</description>
<length>2</length>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>4</value>
<description>PANA-L4: Proprietary layer 4 definition. An
enterprise can export its own layer 4 port
numbers. The Selector ID has global significance
for devices from the same enterprise. Example:
IPFIX had the port 4739 pre-assigned in the IETF
draft for years. While waiting for the RFC and its
associated IANA registration, the Selector ID 4739
was used with this PANA-L4.
</description>
<length>2</length>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>5</value>
<description>Reserved</description>
<length/>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>6</value>
<description>USER-Defined: The Selector ID represents
applications defined by the user (using CLI, GUI,
etc.) based on the methods described in section 2.
The Selector ID has a local significance per
device.
</description>
<length>3</length>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>7</value>
<description>Reserved</description>
<length/>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>8</value>
<description>Reserved</description>
<length/>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>9</value>
<description>Reserved</description>
<length/>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>10</value>
<description>Reserved</description>
<length/>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>11</value>
<description>Reserved</description>
<length/>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>12</value>
<description>PANA-L2: Proprietary layer 2 (L2) definition.  An
enterprise can export its own layer 2 identifiers.
The Selector ID represents the enterprise's unique
global layer 2 applications. The Selector ID has a
global significance for all devices from the same
enterprise. Examples include Cisco Subnetwork
Access Protocol (SNAP).
</description>
<length>5</length>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>13</value>
<description>PANA-L7: Proprietary layer 7 definition. The
Selector ID represents the enterprise's unique
global ID for the layer 7 applications. The
Selector ID has a global significance for all
devices from the same enterprise. This
Classification Engine Id is used when the
application registry is owned by the Exporter
manufacturer (referred to as the "enterprise" in
this document).
</description>
<length>3</length>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>14</value>
<description>Reserved</description>
<length/>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>15</value>
<description>Reserved</description>
<length/>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>16</value>
<description>Reserved</description>
<length/>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>17</value>
<description>Reserved</description>
<length/>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>18</value>
<description>ETHERTYPE: The Selector ID represents the well-
known Ethertype. See <xref type="uri" data="http://standards.ieee.org/develop/regauth/ethertype/eth.txt"/>. 
Note that the Ethertype is usually expressed in 
hexadecimal. However, the corresponding decimal 
value is used in this Selector ID.
</description>
<length>2</length>
<xref type="rfc" data="rfc6759"/>
</record>

<record>
<value>19</value>
<description>LLC: The Selector ID represents the well-known
IEEE 802.2 Link Layer Control (LLC) Destination
Service Access Point (DSAP). 
See <xref type="uri" data="http://standards.ieee.org/develop/regauth/llc/public.html"/>. 
Note that LLC DSAP is usually expressed in 
hexadecimal. However, the corresponding decimal 
value is used in this Selector ID.
</description>
<length>1</length>
<xref type="rfc" data="rfc6759"/>
</record>    

<record>
<value>20</value>
<description>PANA-L7-PEN: Proprietary layer 7 definition,
including a Private Enterprise Number (PEN) 
<xref type="registry" data="enterprise-numbers"/>
to identify that the application registry being
used is not owned by the Exporter manufacturer or to identify the
original enterprise in the case of a mediator or
3rd party device. The Selector ID represents the
enterprise unique global ID for the layer 7
applications. The Selector ID has a global
significance for all devices from the same
enterprise.
</description>
<length>3</length>
<xref type="rfc" data="rfc6759"/>
</record>

<record date="2017-02-21">
<value>21</value>
<description>The Selector ID contains an application ID from the Qosmos ixEngine.</description>
<length>4</length>
<xref type="person" data="Paul_Aitken"/>
<xref type="person" data="Qosmos"/>
</record>

<record date="2019-06-18">
<value>22</value>
<description>The Selector ID contains a protocol from the ntop nDPI engine.</description>
<length>2</length>
<xref type="person" data="Paul_Aitken"/>
<xref type="uri" data="https://www.ntop.org/products/deep-packet-inspection/ndpi"/>
</record>

</registry>



<registry id="ipfix-nat-event-type">
<title>NAT Event Type (Value 230)</title>
<registration_rule>Expert Review</registration_rule>
<expert>IE Doctors</expert>
<xref type="rfc" data="rfc8158"/>

<record date="2017-03-27">
<value>0</value>
<description>Reserved</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>1</value>
<description>NAT translation create (Historic)</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>2</value>
<description>NAT translation delete (Historic)</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>3</value>
<description>NAT Addresses exhausted</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>4</value>
<description>NAT44 session create</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>5</value>
<description>NAT44 session delete</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>6</value>
<description>NAT64 session create</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>7</value>
<description>NAT64 session delete</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>8</value>
<description>NAT44 BIB create</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>9</value>
<description>NAT44 BIB delete</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>10</value>
<description>NAT64 BIB create</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>11</value>
<description>NAT64 BIB delete</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>12</value>
<description>NAT ports exhausted</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>13</value>
<description>Quota Exceeded</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>14</value>
<description>Address binding create</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>15</value>
<description>Address binding delete</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>16</value>
<description>Port block allocation</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>17</value>
<description>Port block de-allocation</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record>
<value>18</value>
<description>Threshold Reached</description>
<xref type="rfc" data="rfc8158"/>
</record>

</registry>



<registry id="ipfix-flowselectoralgorithm">
<title>flowSelectorAlgorithm (Value 390)</title>
<registration_rule>Expert Review</registration_rule>
<expert>IE Doctors</expert>
<xref type="rfc" data="rfc7014"/>

<record>
<value>0</value>
<description>Unassigned</description>
<parameters/>
</record>

<record>
<value>1</value>
<description>Systematic count-based Sampling</description>
<parameters>flowSamplingInterval, flowSamplingSpacing</parameters>
<xref type="rfc" data="rfc7014"/>
</record>

<record>
<value>2</value>
<description>Systematic time-based Sampling</description>
<parameters>flowSamplingTimeInterval, flowSamplingTimeSpacing</parameters>
<xref type="rfc" data="rfc7014"/>
</record>

<record>
<value>3</value>
<description>Random n-out-of-N Sampling</description>
<parameters>samplingSize, samplingPopulation</parameters>
<xref type="rfc" data="rfc7014"/>
</record> 

<record>
<value>4</value>
<description>Uniform probabilistic Sampling</description>
<parameters>samplingProbability</parameters>
<xref type="rfc" data="rfc7014"/>
</record>

<record>
<value>5</value>
<description>Property Match Filtering</description>
<parameters>Information Element Value Range</parameters>
<xref type="rfc" data="rfc7014"/>
</record>

<record>
<value>6</value>
<description>Hash-based Filtering using BOB</description>
<parameters>hashInitialiserValue, hashFlowDomain, hashSelectedRangeMin, 
hashSelectedRangeMax, hashOutputRangeMin, hashOutputRangeMax</parameters>
<xref type="rfc" data="rfc7014"/>
</record>

<record>
<value>7</value>
<description>Hash-based Filtering using IPSX</description>
<parameters>hashInitialiserValue, hashFlowDomain, hashSelectedRangeMin, 
hashSelectedRangeMax, hashOutputRangeMin, hashOutputRangeMax</parameters>
<xref type="rfc" data="rfc7014"/>
</record>

<record>
<value>8</value>
<description>Hash-based Filtering using CRC</description>
<parameters>hashInitialiserValue, hashFlowDomain, hashSelectedRangeMin, 
hashSelectedRangeMax, hashOutputRangeMin, hashOutputRangeMax</parameters>
<xref type="rfc" data="rfc7014"/>
</record>

<record>
<value>9</value>
<description>Flow-state Dependent Intermediate Flow Selection Process</description>
<parameters>No agreed Parameters</parameters>
<xref type="rfc" data="rfc7014"/>
</record>

</registry>



<registry id="ipfix-nat-quota-exceeded-event">
<title>NAT Quota Exceeded Event Type (Value 466)</title>
<registration_rule>Expert Review</registration_rule>
<expert>IE Doctors</expert>
<xref type="rfc" data="rfc8158"/>

<record date="2017-03-27">
<value>0</value>
<description>Reserved</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record date="2017-03-15">
<value>1</value>
<description>Maximum session entries</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record date="2017-03-15">
<value>2</value>
<description>Maximum BIB entries</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record date="2017-03-15">
<value>3</value>
<description>Maximum entries per user</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record date="2017-03-15">
<value>4</value>
<description>Maximum active hosts or subscribers</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record date="2017-03-15">
<value>5</value>
<description>Maximum fragments pending reassembly</description>
<xref type="rfc" data="rfc8158"/>
</record>

</registry>



<registry id="ipfix-nat-threshold-event">
<title>NAT Threshold Event Type (Value 467)</title>
<registration_rule>Expert Review</registration_rule>
<expert>IE Doctors</expert>
<xref type="rfc" data="rfc8158"/>

<record date="2017-03-27">
<value>0</value>
<description>Reserved</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record date="2017-03-15">
<value>1</value>
<description>Address pool high threshold event</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record date="2017-03-15">
<value>2</value>
<description>Address pool low threshold event</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record date="2017-03-15">
<value>3</value>
<description>Address and port mapping high threshold event</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record date="2017-03-15">
<value>4</value>
<description>Address and port mapping per user high threshold event</description>
<xref type="rfc" data="rfc8158"/>
</record>

<record date="2017-03-15">
<value>5</value>
<description>Global Address mapping high threshold event</description>
<xref type="rfc" data="rfc8158"/>
</record>

</registry>



</registry>



<registry id="ipfix-version-numbers">
<title>IPFIX Version Numbers</title>
<xref type="rfc" data="rfc7011"/>
<registration_rule>Standards Action</registration_rule>

<record>
<value>0</value>
<description>Reserved</description>
</record>

<record>
<value>1-8</value>
<description>Reserved (historic)</description>
</record>

<record>
<value>9</value>
<description>Cisco Systems NetFlow Version 9 (historic)</description>
<xref type="rfc" data="rfc3954"/>
</record>

<record>
<value>10</value>
<description>IPFIX</description>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>11-65535</value>
<description>Unassigned</description>
</record>

</registry>



<registry id="ipfix-set-ids">
<title>IPFIX Set IDs</title>
<xref type="rfc" data="rfc7011"/>
<registration_rule>Standards Action</registration_rule>

<record>
<value>0-1</value>
<description>Not used (historic)</description>
<xref type="rfc" data="rfc3954"/>
</record>

<record>
<value>2</value>
<description>Template Set</description>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>3</value>
<description>Options Template Set</description>
<xref type="rfc" data="rfc7011"/>
<xref type="rfc-errata" data="1818"/>
</record>

<record>
<value>4-255</value>
<description>Unassigned</description>
</record>

<record>
<value>256-65535</value>
<description>Reserved for Data Sets</description>
<xref type="rfc" data="rfc7011"/>
</record>

</registry>



<registry id="ipfix-information-element-data-types">
<title>IPFIX Information Element Data Types</title>
<xref type="rfc" data="rfc5610"/>
<registration_rule>Standards Action</registration_rule>

<record>
<value>0</value>
<description>octetArray</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>1</value>
<description>unsigned8</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>2</value>
<description>unsigned16</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>3</value>
<description>unsigned32</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>4</value>
<description>unsigned64</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>5</value>
<description>signed8</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>6</value>
<description>signed16</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>7</value>
<description>signed32</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>8</value>
<description>signed64</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>9</value>
<description>float32</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>10</value>
<description>float64</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>11</value>
<description>boolean</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>12</value>
<description>macAddress</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>13</value>
<description>string</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>14</value>
<description>dateTimeSeconds</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>15</value>
<description>dateTimeMilliseconds</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>16</value>
<description>dateTimeMicroseconds</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>17</value>
<description>dateTimeNanoseconds</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>18</value>
<description>ipv4Address</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>19</value>
<description>ipv6Address</description>
<xref type="rfc" data="rfc5102"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>20</value>
<description>basicList</description>
<xref type="rfc" data="rfc6313"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>21</value>
<description>subTemplateList</description>
<xref type="rfc" data="rfc6313"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>22</value>
<description>subTemplateMultiList</description>
<xref type="rfc" data="rfc6313"/>
<xref type="rfc" data="rfc7011"/>
</record>

<record>
<value>23-255</value>
<description>Unassigned</description>
</record>



</registry>



<registry id="ipfix-information-element-semantics">
<title>IPFIX Information Element Semantics</title>
<xref type="rfc" data="rfc5610"/>
<registration_rule>Standards Action</registration_rule>

<record>
<value>0</value>
<description>default</description>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>1</value>
<description>quantity</description>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>2</value>
<description>totalCounter</description>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>3</value>
<description>deltaCounter</description>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>4</value>
<description>identifier</description>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>5</value>
<description>flags</description>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>6</value>
<description>list</description>
<xref type="rfc" data="rfc6313"/>
</record>

<record date="2015-12-13">
<value>7</value>
<description>snmpCounter</description>
<xref type="rfc" data="rfc8038"/>
</record>

<record date="2015-12-13">
<value>8</value>
<description>snmpGauge</description>
<xref type="rfc" data="rfc8038"/>
</record>

<record>
<value>9-255</value>
<description>Unassigned</description>
<xref type="rfc" data="rfc5610"/>
</record>



</registry>



<registry id="ipfix-information-element-units">
<title>IPFIX Information Element Units</title>
<xref type="rfc" data="rfc5610"/>
<registration_rule>Expert Review</registration_rule>
<expert>IE Doctors</expert>

<record>
<value>0</value>
<description>none</description>
<comments/>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>1</value>
<description>bits</description>
<comments/>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>2</value>
<description>octets</description>
<comments/>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>3</value>
<description>packets</description>
<comments/>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>4</value>
<description>flows</description>
<comments/>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>5</value>
<description>seconds</description>
<comments/>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>6</value>
<description>milliseconds</description>
<comments/>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>7</value>
<description>microseconds</description>
<comments/>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>8</value>
<description>nanoseconds</description>
<comments/>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>9</value>
<description>4-octet words</description>
<comments>For example, for IPv4 header length</comments>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>10</value>
<description>messages</description>
<comments>For example, for reliability reporting</comments>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>11</value>
<description>hops</description>
<comments>For example, for TTL</comments>
<xref type="rfc" data="rfc5610"/>
</record>

<record>
<value>12</value>
<description>entries</description>
<comments>For example, for MPLS label stack</comments>
<xref type="rfc" data="rfc5610"/>
</record>

<record date="2014-05-02">
<value>13</value>
<description>frames</description>
<comments>For example, Layer 2 frames</comments>
<xref type="person" data="ipfix-iana_at_cisco.com"/>
</record>
  
<record date="2018-06-13">
<value>14</value> 
<description>ports</description>
<comments/>
<xref type="rfc" data="rfc8045"/> 
</record>

<record date="2018-06-13">
<value>15</value> 
<description>inferred</description>
<comments>The units of the inferred Information Element</comments>
<xref type="rfc" data="rfc5477"/> 
</record>

<record>
<value>16-65535</value>
<description>Unassigned</description>
<comments/>
<xref type="rfc" data="rfc5610"/>
</record>

</registry>



<registry id="ipfix-structured-data-types-semantics">
<title>IPFIX Structured Data Types Semantics</title>
<xref type="rfc" data="rfc6313"/>
<registration_rule>Standards Action</registration_rule>

<record>
<value>0x00</value>
<name>noneOf</name>
<description>The "noneOf" structured data type semantic specifies
that none of the elements are actual properties of the Data
Record.
</description>
<xref type="rfc" data="rfc6313"/>
</record>

<record>
<value>0x01</value>
<name>exactlyOneOf</name>
<description>The "exactlyOneOf" structured data type semantic
specifies that only a single element from the structured data is
an actual property of the Data Record.  This is equivalent to a
logical XOR operation.
</description>
<xref type="rfc" data="rfc6313"/>
</record>

<record>
<value>0x02</value>
<name>oneOrMoreOf</name>
<description>The "oneOrMoreOf" structured data type semantic
specifies that one or more elements from the list in the
structured data are actual properties of the Data Record. This is
equivalent to a logical OR operation.
</description>
<xref type="rfc" data="rfc6313"/>
</record>

<record>
<value>0x03</value>
<name>allOf</name>
<description>The "allOf" structured data type semantic specifies
that all of the list elements from the structured data are actual
properties of the Data Record.
</description>
<xref type="rfc" data="rfc6313"/>
</record>

<record>
<value>0x04</value>
<name>ordered</name>
<description>The "ordered" structured data type semantic specifies
that elements from the list in the structured data are ordered.
</description>
<xref type="rfc" data="rfc6313"/>
</record>

<record>
<value>0x05-0xFE</value>
<name/>
<description>unassigned
</description>
</record>

<record>
<value>0xFF</value>
<name>undefined</name>
<description>The "undefined" structured data type semantic
specifies that the semantic of the list elements is not specified 
and that, if a semantic exists, then it is up to the Collecting
Process to draw its own conclusions.  The "undefined" structured
data type semantic is the default structured data type semantic.
</description>
<xref type="rfc" data="rfc6313"/>
</record>

</registry>



<people>

<person id="Alfred_Nothaft">
<name>Alfred Nothaft</name>
<uri>mailto:alfred.nothaft&amp;nokia.com</uri>
<updated>2018-02-12</updated>
</person>  

<person id="Andrew_Feren">
<name>Andrew Feren</name>
<uri>mailto:andrew.feren&amp;plixer.com</uri>
<updated>2017-04-19</updated>
</person>  

<person id="Brian_Trammell">
<name>Brian Trammell</name>
<uri>mailto:brian&amp;trammell.ch</uri>
<updated>2013-08-01</updated>
</person>

<person id="Felix_Erlacher">
<name>Felix Erlacher</name>
<uri>mailto:felix.erlacher&amp;ccs-labs.org</uri>
<updated>2017-06-19</updated>
</person>  

<person id="ipfix-iana_at_cisco.com">
<name>ipfix-iana at cisco.com</name>
<uri>mailto:ipfix-iana&amp;cisco.com</uri>
<updated>2013-04-11</updated>
</person>

<person id="Paul_Aitken">
<name>Paul Aitken</name>
<uri>mailto:paul.aitken&amp;att.com</uri>
<updated>2018-02-12</updated>
</person>

<person id="Qosmos">
<name>Qosmos</name>
<uri>http://www.qosmos.com</uri>
<updated>2017-02-21</updated>
</person> 

<person id="Yaakov_J_Stein">
<name>Yaakov (J) Stein</name>
<uri>mailto:yaakov_s&amp;rad.com</uri>
<updated>2013-04-11</updated>
</person>
</people>

</registry>