Extended TCP Options and IPv6 Extension Headers IPFIX Information Elements

1.1. Issues with ipv6ExtensionHeaders Information Element

The specification of ipv6ExtensionHeaders IPFIX IE does not:¶

• Cover the full extension headers range (Section 4 of [RFC8200]).¶

• Specify the procedure to follow when all bits are exhausted.¶

• Specify a means to export the order and the number of occurences of a given extension header.¶

• Specify how to automatically update the IANA IPFIX registry ([IANA-IPFIX]) when a new value is assigned in [IANA-EH].¶

• Specify whether the exported values match the full enclosed values or only up to a limit imposed by hardware or software (e.g., Section 1.1 of [RFC8883]).¶

• Specify how to report the length of IPv6 extension headers.¶

Section 3 addresses these issues.¶

1.2. Issues with tcpOptions Information Element

The specification of tcpOptions IPFIX IE does not:¶

• Describe how any observed TCP option in a Flow can be exported using IPFIX. Only TCP options having a kind =< 63 can be exported in a tcpOptions IPFIX IE.¶

• Support means to report the observed Experimental Identifiers (ExIDs) that are carried in shared TCP options (kind=253 or 254) [RFC6994].¶

Section 4 addresses these issues.¶

3.1. ipv6ExtensionHeadersFull Information Element

Name:

ipv6ExtensionHeadersFull¶

ElementID:

TBD1¶

Description:

IPv6 extension headers observed in packets of this Flow. The information is encoded in a set of bit fields. For each IPv6 extension header, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv6 extension header. Otherwise, if no observed packet of this Flow contained the respective IPv6 extension header, the value of the corresponding bit is 0.¶

The IPv6 extension header associated with each bit is provided in [NEW_IPFIX_IPv6EH_SUBREGISTRY]. Bit 0 corresponds to the least-significant bit in the ipv6ExtensionHeadersFull IE while bit 254 corresponds to the most-significant bit of the IE. In doing so, few octets will be needed to encode common IPv6 extension headers when observed in a Flow.¶

The "No Next Header" (59) value is used if there is no upper-layer header in an IPv6 packet. Even if the value is not considered as an extension header as such, the corresponding bit is set in the ipv6ExtensionHeadersFull IE whenever that value is encountered in the Flow.¶

Several extension header chains may be observed in a Flow. These extension headers may be aggregated in one single ipv6ExtensionHeadersFull Information Element or be exported in separate ipv6ExtensionHeadersFull IEs, one for each extension header chain.¶

This Information Element SHOULD NOT be exported if ipv6ExtensionHeaderCount Information Element is also present.¶

The value should be encoded in fewer octets as per the guidelines in Section 6.2 of [RFC7011].¶

Abstract Data Type:

unsigned¶

Data Type Semantics:

flags¶

Additional Information:

See [IANA-EH] for assigned extension header types.¶

See Section 4 of [RFC8200] for the general definition of IPv6 extension headers.¶

Reference:

This-Document¶

• Note to the RFC Editor: Please replace [NEW_IPFIX_IPv6EH_SUBREGISTRY] with the link to the "ipv6ExtensionHeaders Bits" registry created by [I-D.ietf-opsawg-ipfix-fixes].¶

3.2. ipv6ExtensionHeaderCount Information Element

Name:

ipv6ExtensionHeaderCount¶

ElementID:

TBD2¶

Description:

As per Section 4.1 of [RFC8200], IPv6 nodes must accept and attempt to process extension headers in occurring any number of times in the same packet. This Information Element echoes the order of extension headers and number of consecutive occurrences of the same extension header type in a Flow.¶

If several extension header chains are observed in a Flow, each header chain MUST be exported in a separate ipv6ExtensionHeaderCount IE.¶

The same extension header type may appear several times in an ipv6ExtensionHeaderCount Information Element. For example, if an IPv6 packet of a Flow includes a Hop-by-Hop Options header, a Destination Options header, a Fragment header, and Destination Options header, the ipv6ExtensionHeaderCount Information Element will report two counts of the Destination Options header: the occurrences that are observed before the Fragment header and the occurrences right after the Fragment header.¶

IPFIX reduced-size encoding as per Section 6.2 of [RFC7011] is used as required.¶

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 ...
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |  EH Type#1    |   Count       |...|  EH Type#n      |   Count       |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Abstract Data Type:

unsigned64¶

Data Type Semantics:

identifier¶

Additional Information:

See the assigned IPv6 extension header types in [IANA-EH].¶

See [RFC8200] for the general definition of IPv6 extension headers.¶

Reference:

This-Document¶

3.3. ipv6ExtensionHeadersLimit Information Element

Name:

ipv6ExtensionHeadersLimit¶

ElementID:

TBD3¶

Description:

When set to "true", this Information Element indicates that the exported extension headers information (e.g., ipv6ExtensionHeaderFull or ipv6ExtensionHeaderCount) does not match the full enclosed extension headers, but only up to a limit that is typically set by hardware or software.¶

When set to "false", this Information Element indicates that the exported extension header information matches the full enclosed extension headers.¶

When this Information Element is absent, this is equivalent to returning an ipv6ExtensionHeadersLimit Information Element with a value set to "false".¶

Abstract Data Type:

boolean¶

Data Type Semantics:

default¶

Additional Information:

See Section 4 of [RFC8200] for the general definition of IPv6 extension headers.¶

See [RFC8883] for an example of IPv6 packets processing due to limits on extension headers.¶

Reference:

This-Document¶

3.4. ipv6ExtensionHeadersChainLength Information Element

Name:

ipv6ExtensionHeadersChainLength¶

ElementID:

TBD4¶

Description:

In theory, there are no limits on the number of IPv6 extension headers that may be present in a packet other than the path MTU. However, it was regularly reported that IPv6 packets with extension headers are often dropped in the Internet.¶

As discussed in Section 1.2 of [RFC8883], some hardware devices implement a parsing buffer of a fixed size to process packets, including all the headers. When the aggregate length of headers of an IPv6 packet exceeds that size, the packet will be discarded or deferred to a slow path.¶

The ipv6ExtensionHeadersChainLength IE is used to report, in octets, the length of an extension header chain observed in a Flow. The length is the sum of the length of all extension headers of the chain. Exporting such information may help identifying root causes of performance degradation, including packet drops.¶

Abstract Data Type:

unsigned¶

Data Type Semantics:

identifier¶

Units:

octets¶

Additional Information:

See Section 4 of [RFC8200] for the general definition of IPv6 extension headers.¶

See [RFC9098] for an overview of operational implications of IPv6 packets with extension headerss.¶

Reference:

This-Document¶

3.5. Operational Considerations

If an implementation determines that it includes an extension header that it does no support, then the exact observed code of that extension header will be echoed in the ipv6ExtensionHeaderCount IE (Section 3.2). How an implementation disambiguates between unknown upper-layer protocols vs. extension headers is not IPFIX-specific. Readers may refer, for example, to Section 2.2 of [RFC8883] for a behavior of an intermediate nodes that encounters an unknown Next Header type. It is out of the scope of this document to discuss those considerations.¶

The ipv6ExtensionHeadersLimit IE (Section 3.3) may or may not be present when the ipv6ExtensionHeadersChainLength IE (Section 3.4) is also present as these IEs are targeting distinct properties of extension headers handling.¶

4.1. tcpOptionsFull Information Element

This section specifies a new Information Element to cover the full TCP options range.¶

Name:

tcpOptionsFull¶

ElementID:

TBD5¶

Description:

TCP options in packets of this Flow. The information is encoded in a set of bit fields. For each TCP option, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding TCP option. Otherwise, if no observed packet of this Flow contained the respective TCP option, the value of the corresponding bit is 0.¶

Options are mapped to bits according to their option numbers. Option number X is mapped to bit position "254 - X". This approach allows an observer to export any observed TCP option even if it does support that option and without requiring updating a mapping table.¶

The value should be encoded in fewer octets as per the guidelines in Section 6.2 of [RFC7011].¶

Abstract Data Type:

unsigned¶

Data Type Semantics:

flags¶

Additional Information:

See the assigned TCP option kinds at [IANA-TCP].¶

See [RFC9293] for the general definition of TCP options.¶

Reference:

This-Document¶

5.1. IPv6 Extension Headers

This section provides few examples to illustrate the use of some IEs defined in the document.¶

Figure 1 provides an example of reported values in an ipv6ExtensionHeadersFull Information Element for an IPv6 Flow in which only the IPv6 Destination Options header is observed. One octet is sufficient to report these observed options. Concretely, the ipv6ExtensionHeadersFull IE will be set to 1.¶

MSB                                                    LSB
                     1                20     …  25
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 … 6 7 8 9 0 1 2 … 9 0 1 2 3 4
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+…+-+-+-+-+-+-+-+…+-+-+-+-+-+-+
|0|0|0|0|0|0|0|0|0|0|0|0|0|0| |0|0|0|0|0|0|0| |0|0|0|0|0|1|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+…+-+-+-+-+-+-+-+…+-+-+-+-+-+-+

Figure 2 provides another example of reported values in an ipv6ExtensionHeadersFull Information Element for an IPv6 Flow in which the IPv6 Hop-by-Hop Options, Routing, and Destination Options headers are observed. One octet is sufficient to report these observed options. Concretely, the ipv6ExtensionHeadersFull IE will be set to 19.¶

MSB                                                    LSB
                     1                20     …  25
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 … 6 7 8 9 0 1 2 … 9 0 1 2 3 4
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+…+-+-+-+-+-+-+-+…+-+-+-+-+-+-+
|0|0|0|0|0|0|0|0|0|0|0|0|0|0| |0|0|0|0|0|0|0| |0|1|0|0|1|1|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+…+-+-+-+-+-+-+-+…+-+-+-+-+-+-+

5.2. TCP Options

Given TCP kind allocation practices and the option mapping defined in Section 4.1, fewer octers are likely to be used for Flows with common TCP options.¶

Figure 3 shows an example of reported values in a tcpOptionsFull IE for a TCP Flow in which End of Option List, Maximum Segment Size, and Window Scale options are observed. One octet is sufficient to report these observed options. Concretely, the tcpOptionsFull IE will be set to 15.¶

MSB                                                       LSB
                     1                   2     …  25
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 … 9 0 1 2 3 4
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+…+-+-+-+-+-+-+
|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| |0|0|1|1|0|1|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+…+-+-+-+-+-+-+