IPFIX (NetFlow version 10)

IPFIX protocol enhancements and export behavior

Describes the IPFIX (NetFlow version 10) protocol, its enhancements, export format, and sampling behavior for network traffic analysis.

IPFIX (Internet Protocol Flow Information Export), standardized by the Internet Engineering Task Force (IETF), is an export protocol for transmitting NetFlow packets. Building upon NetFlow version 9, IPFIX introduces efficient flow data formatting through templates, ensuring scalability and adaptability to diverse network environments. IPFIX uses UDP as the transport protocol to transfer NetFlow information from exporters to collectors. With native support for IPv6 flow records, optional data fields, and the ability to send data to multiple collectors, IPFIX enables comprehensive traffic analysis, monitoring, and enhanced visibility into network behavior.

The Internet Engineering Task Force (IETF) has standardized Internet Protocol Flow Information Export (IPFIX) as an export protocol for sending IP flow information. Routers support the IPFIX 315 format for exporting flow information. The IPFIX 315 format enables the transmission of 'n' octets of frame information starting from the Ethernet header up to the transport header of the traffic flow over the network. IPFIX 315 supports the sending of variable-sized packet records with variable payload information, such as IPv4, IPv6, MPLS, and nested packets like OuterIP-GRE-InnerIP. The process involves sampling and exporting the traffic flow information. Along with the Ethernet frame information, the IPFIX 315 format exports the information of the incoming and outgoing interfaces of the sampled packet.

The information of the packets flowing through a device is used for a variety of purposes, including network monitoring, capacity planning, and traffic management.

When exporting packets, a special cache-type called Immediate Aging is used. Immediate Aging ensures that the flows are exported as soon as they are added to the cache.

To sample the traffic flow information, configure a sampler-map that specifies the rate at which packets (one out of every 'n' packets) are sampled. Not all packets flowing through a device are exported; only the packets selected based on the sampling rate are exported.

• The size of the exported packet is determined by the sampled packet size from the outermost Layer 2 header.

• If the sampled packet size is less than 160 bytes, the actual packet size is exported.

• If the sampled packet size is 160 bytes or more, the exported packet size is capped at 160 bytes.

• The exported packet includes data up to the Layer 4 header if present; however, if the Layer 4 header is not found within the first 160 bytes, the export size is limited to 160 bytes.

• The location of the Layer 4 header is not used to reduce the exported packet size below the 160-byte cap.

This figure shows exported packet information for IPFIX 315 Export Packet Format.

Lists the feature history for IPFIX flow record enhancements for L2 and L3 traffic.