Extended TCP Options and IPv6 Extension Headers IPFIX Information Elements

1.1. Issues with ipv6ExtensionHeaders Information Element

The specification of the ipv6ExtensionHeaders IPFIX IE (64) does not:¶

• Cover the full extension headers' range defined in the IPv6 specification (Section 4 of [RFC8200]).¶

• Specify the procedure to follow when all bits are exhausted.¶

• Specify a means to export the order and the number of occurrences of a given extension header.¶

• Specify how to automatically update the IANA IPFIX registry ([IANA-IPFIX]) when a new value is assigned in the IPv6 Extension Header Types registry [IANA-EH]. Only a frozen set of extension headers can be exported using the ipv6ExtensionHeaders IE. For example, the ipv6ExtensionHeaders IE can't report some IPv6 EHs, specifically EHs for Host Identity Protocol (139), Shim6 Protocol (140) or extension headers for experimentation and testing.¶

• Specify whether the exported values match the full enclosed values or only up to a limit imposed by hardware or software (e.g., Section 1.1 of [RFC8883]). Note that some implementations may not be able to export all observed extension headers in a Flow because of a hardware or software limit (see, e.g., [I-D.ietf-6man-eh-limits]). The specification of the ipv6ExtensionHeaders IE does not discuss whether it covers all enclosed extension headers or only up to a limit.¶

• Specify how to report the length of IPv6 extension headers.¶

• Optimize the encoding.¶

• Explain the reasoning for reporting values which do not correspond to extension headers (e.g., "Unknown Layer 4 header" or "Payload compression header").¶

• Specify how to report extension header chains or aggregate extension headers length.¶

Section 3 addresses these issues.¶

This specification deprecates the ipv6ExtensionHeaders IPFIX IE in favor of the new IEs defined in this document.¶

1.2. Issues with tcpOptions Information Element

The specification of the tcpOptions IPFIX IE (209) does not:¶

• Describe how some observed TCP options in a Flow can be exported using IPFIX. Only TCP options having a Kind <= 63 can be exported in a tcpOptions IE.¶

• Allow reporting the observed Experiment Identifiers (ExIDs) that are carried in shared Experimental TCP options (Kind=253 or 254) [RFC6994].¶

• Optimize the encoding.¶

Section 4 addresses these issues.¶

This specification deprecates the tcpOptions IE in favor of the new IEs defined in this document.¶

3.1. ipv6ExtensionHeaderType Information Element

Name:

ipv6ExtensionHeaderType¶

ElementID:

TBD1¶

Description:

Type of an IPv6 extension header observed in at least one packet of this Flow.¶

Abstract Data Type:

unsigned8¶

Data Type Semantics:

identifier¶

Additional Information:

See the IPv6 Extension Header Types registry at [IANA-EH].¶

See Section 4 of [RFC8200] for the general definition of IPv6 extension headers.¶

Reference:

This-Document¶

3.2. ipv6ExtensionHeaderCount Information Element

Name:

ipv6ExtensionHeaderCount¶

ElementID:

TBD2¶

Description:

The number of consecutive occurrences of the same extension header type in a Flow.¶

This IE is reported, e.g., in the ipv6ExtensionHeaderTypeCountList IE.¶

The type of the extension header is provided in the ipv6ExtensionHeaderType IE.¶

Abstract Data Type:

unsigned8¶

Data Type Semantics:

totalCounter¶

Additional Information:

See the IPv6 Extension Header Types registry at [IANA-EH].¶

See Section 4 of [RFC8200] for the general definition of IPv6 extension headers.¶

Reference:

This-Document¶

3.3. ipv6ExtensionHeadersFull Information Element

Name:

ipv6ExtensionHeadersFull¶

ElementID:

TBD3¶

Description:

IPv6 extension headers observed in packets of this Flow. The information is encoded in a set of bit fields. For each IPv6 extension header, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv6 extension header. Otherwise, if no observed packet of this Flow contains the respective IPv6 extension header, the value of the corresponding bit is 0.¶

The IPv6 extension header associated with each bit is provided in [NEW_IPFIX_IPv6EH_SUBREGISTRY]. Bit 0 corresponds to the least-significant bit in the ipv6ExtensionHeadersFull IE while bit 255 corresponds to the most-significant bit of the IE. In doing so, few octets will be needed to encode common IPv6 extension headers when observed in a Flow.¶

The "No Next Header" (bit 2) value (Section 4.7 of [RFC8200]) is used if there is no upper-layer header in an IPv6 packet. Even if the value is not considered as an extension header as such, the corresponding bit is set in the ipv6ExtensionHeadersFull IE whenever that value is encountered in the Flow.¶

Extension headers observed in a Flow with varying extension header chain MUST NOT be grouped in the ipv6ExtensionHeadersFull IE if the ipv6ExtensionHeaderChainLengthList IE is also present.¶

If the ipv6ExtensionHeaderChainLengthList IE is not present, then extension headers observed in a Flow with varying extension header chain MAY be grouped in one single ipv6ExtensionHeadersFull IE or be exported in separate ipv6ExtensionHeadersFull IEs, one for each extension header chain.¶

The ipv6ExtensionHeadersFull IE MUST NOT be exported if ipv6ExtensionHeaderTypeCountList IE is also present because of the overlapping scopes between these two IEs.¶

The value of ipv6ExtensionHeadersFull IE may be encoded in fewer octets per the guidelines in Section 6.2 of [RFC7011].¶

Abstract Data Type:

unsigned256¶

Data Type Semantics:

flags¶

Additional Information:

See the ipv6ExtensionHeaders Bits registry at [NEW_IPFIX_IPv6EH_SUBREGISTRY].¶

See the IPv6 Extension Header Types registry at [IANA-EH].¶

See Section 4 of [RFC8200] for the general definition of IPv6 extension headers.¶

Reference:

This-Document¶

• Note to the RFC Editor: Please replace [NEW_IPFIX_IPv6EH_SUBREGISTRY] with the link to the "ipv6ExtensionHeaders Bits" registry (Section 8.4).¶

3.4. ipv6ExtensionHeaderTypeCountList Information Element

Name:

ipv6ExtensionHeaderTypeCountList¶

ElementID:

TBD4¶

Description:

As per Section 4.1 of [RFC8200], IPv6 nodes must accept and attempt to process extension headers occurring any number of times in the same packet. This IE echoes the order of extension headers and number of consecutive occurrences of the same extension header type in a Flow.¶

This IE is a subTemplateList of ipv6ExtensionHeaderType and ipv6ExtensionHeaderCount IEs.¶

Each header chain in Flow with varying extension header chain MUST be exported in a separate IE.¶

The same extension header type may appear several times in an ipv6ExtensionHeaderTypeCountList IE. For example, if an IPv6 packet of a Flow includes a Hop-by-Hop Options header, a Destination Options header, a Fragment header, and Destination Options header, the ipv6ExtensionHeaderTypeCountList IE will report:¶

• the count of Hop-by-Hop Options headers,¶

• the occurrences of the Destination Options headers that are observed before a Fragment header,¶

• the occurrences of the Fragment headers, and¶

• the occurrences of the Destination Options headers that are observed right after a Fragment header.¶

If an implementation determines that an observed packet of a Flow includes an extension header (including an extension header that it does not support), then the exact observed code of that extension header MUST be echoed in the ipv6ExtensionHeaderTypeCountList IE. How an implementation disambiguates between unknown upper-layer protocols vs. extension headers is not IPFIX-specific. Refer, for example, to Section 2.2 of [RFC8883] for a behavior of an intermediate node that encounters an unknown Next Header type.¶

Abstract Data Type:

subTemplateList¶

Data Type Semantics:

list¶

Additional Information:

See the IPv6 Extension Header Types registry at [IANA-EH].¶

See [RFC8200] for the general definition of IPv6 extension headers.¶

Reference:

This-Document¶

3.5. ipv6ExtensionHeadersLimit Information Element

Name:

ipv6ExtensionHeadersLimit¶

ElementID:

TBD5¶

Description:

When set to "false", this IE indicates that the exported extension headers information (e.g., ipv6ExtensionHeadersFull or ipv6ExtensionHeaderTypeCountList) does not match the full enclosed extension headers, but only up to a limit that is typically set by hardware or software.¶

When set to "true", this IE indicates that the exported extension header information matches the full enclosed extension headers.¶

Abstract Data Type:

boolean¶

Data Type Semantics:

default¶

Additional Information:

See Section 4 of [RFC8200] for the general definition of IPv6 extension headers.¶

See [RFC8883] for an example of IPv6 packet processing due to limits on extension headers.¶

Reference:

This-Document¶

3.6. ipv6ExtensionHeadersChainLength Information Element

Name:

ipv6ExtensionHeadersChainLength¶

ElementID:

TBD6¶

Description:

In theory, there are no limits on the number of IPv6 extension headers that may be present in a packet other than the path MTU. However, it was regularly reported that IPv6 packets with extension headers are often dropped in the Internet.¶

As discussed in Section 1.2 of [RFC8883], some hardware devices implement a parsing buffer of a fixed size to process packets, including all the headers. When the aggregate length of headers of an IPv6 packet exceeds that size, the packet will be discarded or deferred to a slow path.¶

The ipv6ExtensionHeadersChainLength IE is used to report, in octets, the length of an extension header chain observed in a Flow. The length is the sum of the length of all extension headers of the chain. Exporting such information might help identifying root causes of performance degradation, including packet drops.¶

Each header chain length of a Flow with varying extension header chain MUST be exported in a separate ipv6ExtensionHeadersChainLength IE.¶

Abstract Data Type:

unsigned32¶

Data Type Semantics:

identifier¶

Units:

octets¶

Additional Information:

See Section 4 of [RFC8200] for the general definition of IPv6 extension headers.¶

See [RFC9098] for an overview of operational implications of IPv6 packets with extension headers.¶

Reference:

This-Document¶

3.7. ipv6ExtensionHeaderChainLengthList Information Element

Name:

ipv6ExtensionHeaderChainLengthList¶

ElementID:

TBD7¶

Description:

This IE is used to report the chains and their length as observed in a Flow with varying extension header chain.¶

This IE is a subTemplateList of ipv6ExtensionHeadersFull and ipv6ExtensionHeadersChainLength IEs.¶

If several extension header chains are observed in a Flow, each header chain MUST be exported in a separate ipv6ExtensionHeaderChainLengthList IE.¶

Abstract Data Type:

subTemplateList¶

Data Type Semantics:

list¶

Additional Information:

See the IPv6 Extension Header Types registry at [IANA-EH].¶

See [RFC8200] for the general definition of IPv6 extension headers.¶

Reference:

This-Document¶

4.1. tcpOptionsFull Information Element

This section specifies a new IE to cover the full TCP options range.¶

Name:

tcpOptionsFull¶

ElementID:

TBD8¶

Description:

TCP options in packets of this Flow. The information is encoded in a set of bit fields. For each TCP option, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding TCP option. Otherwise, if no observed packet of this Flow contains the respective TCP option, the value of the corresponding bit is 0.¶

Options are mapped to bits according to their option numbers. TCP option Kind 0 corresponds to the least-significant bit in the tcpOptionsFull IE while Kind 255 corresponds to the most-significant bit of the IE. This approach allows an observer to export any observed TCP option even if it does support that option and without requiring updating a mapping table.¶

The value of tcpOptionsFull IE may be encoded in fewer octets per the guidelines in Section 6.2 of [RFC7011].¶

The presence of tcpSharedOptionExID16List or tcpSharedOptionExID32List IEs is an indication that a shared TCP option (Kind=253 or 254) is observed in a Flow. The presence of tcpSharedOptionExID16List or tcpSharedOptionExID32List IEs takes precedence over setting the corresponding bits in the tcpOptionsFull IE for the same Flow. In order to optimize the use of the reduced-size encoding in the presence of tcpSharedOptionExID16List or tcpSharedOptionExID32List IEs, the Exporter MUST NOT set to 1 the shared TCP options (Kind=253 or 254) flags of the tcpOptionsFull IE that is reported for the same Flow.¶

Abstract Data Type:

unsigned256¶

Data Type Semantics:

flags¶

Additional Information:

See the TCP Option Kind Numbers registry at [IANA-TCP].¶

See [RFC9293] for the general definition of TCP options.¶

Reference:

This-Document¶

4.2. tcpSharedOptionExID16 Information Element

Name:

tcpSharedOptionExID16¶

ElementID:

TBD9¶

Description:

Reports an observed 2-byte ExID in a shared TCP option (Kind=253 or 254) in a Flow.¶

A basicList of tcpSharedOptionExID16 is used to report tcpSharedOptionExID16List values.¶

Abstract Data Type:

unsigned16¶

Data Type Semantics:

identifier¶

Additional Information:

See the TCP Experimental Option Experiment Identifiers (TCP ExIDs) registry at [IANA-TCP-EXIDs].¶

See [RFC9293] for the general definition of TCP options.¶

See [RFC6994] for the shared use of experimental TCP Options.¶

Reference:

This-Document¶

4.3. tcpSharedOptionExID32 Information Element

Name:

tcpSharedOptionExID32¶

ElementID:

TBD10¶

Description:

Reports an observed 4-byte ExID in a shared TCP option (Kind=253 or 254) in a Flow.¶

A basicList of tcpSharedOptionExID32 is used to report tcpSharedOptionExID32List values.¶

Abstract Data Type:

unsigned32¶

Data Type Semantics:

identifier¶

Additional Information:

See the TCP Experimental Option Experiment Identifiers (TCP ExIDs) registry at [IANA-TCP-EXIDs].¶

See [RFC9293] for the general definition of TCP options.¶

See [RFC6994] for the shared use of experimental TCP Options.¶

Reference:

This-Document¶

4.4. tcpSharedOptionExID16List Information Element

Name:

tcpSharedOptionExID16List¶

ElementID:

TBD11¶

Description:

Reports observed 2-byte ExIDs in shared TCP options (Kind=253 or 254) in a Flow.¶

A basicList of tcpSharedOptionExID16 IEs in which each tcpSharedOptionExID16 IE carries an observed 2-byte ExID in a shared option.¶

Abstract Data Type:

basicList¶

Data Type Semantics:

list¶

Additional Information:

See the TCP Experimental Option Experiment Identifiers (TCP ExIDs) registry at [IANA-TCP-EXIDs].¶

See [RFC9293] for the general definition of TCP options.¶

See [RFC6994] for the shared use of experimental TCP Options.¶

Reference:

This-Document¶

4.5. tcpSharedOptionExID32List Information Element

Name:

tcpSharedOptionExID32List¶

ElementID:

TBD12¶

Description:

Reports observed 4-byte ExIDs in shared TCP options (Kind=253 or 254) in a Flow.¶

A basicList of tcpSharedOptionExID32 IEs in which each tcpSharedOptionExID32 IE carries an observed 4-byte ExID in a shared option.¶

Abstract Data Type:

basicList¶

Data Type Semantics:

list¶

Additional Information:

See the TCP Experimental Option Experiment Identifiers (TCP ExIDs) registry at [IANA-TCP-EXIDs].¶

See [RFC9293] for the general definition of TCP options.¶

See [RFC6994] for the shared use of experimental TCP Options.¶

Reference:

This-Document¶

6.1. IPv6 Extension Headers

Figure 1 provides an example of EH/bit mappings in an ipv6ExtensionHeadersFull IE for an IPv6 Flow in which only the IPv6 Destination Options (0) header is observed. The bits are set following the table provided in Section 8.4.1.¶

MSB                                                      LSB
                     1                          25
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 ... 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+...+-+-+-+-+-+-+-+-+
|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|   |0|0|0|0|0|0|0|1|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+...+-+-+-+-+-+-+-+-+

The leading zeros are dropped per the reduced-size encoding guidance. One octet is thus sufficient to send these observed options on the wire. Concretely, the ipv6ExtensionHeadersFull IE will be set to 0x01 (Figure 2).¶

MSB           LSB
 0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|0|0|0|0|0|0|0|1|
+-+-+-+-+-+-+-+-+

Figure 3 provides another example of reported values in an ipv6ExtensionHeadersFull IE for an IPv6 Flow in which the Destination Options (0), IPv6 Hop-by-Hop Options (1), and Routing (5) headers are observed. One octet is sufficient to report these observed options. Concretely, the ipv6ExtensionHeadersFull IE will be set to 0x23.¶

MSB           LSB
 0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|0|0|1|0|0|0|1|1|
+-+-+-+-+-+-+-+-+

Let us now consider an IPv6 Flow in which the following EH chain is observed: Routing (5), Mobility (7), and Authentication (9) header. Figure 4 shows the ipv6ExtensionHeadersFull IE (0x02A0) to reprot this individual chain.¶

MSB                          LSB
                     1
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|0|0|0|0|0|1|0|1|0|1|0|0|0|0|0|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

6.2. TCP Options

MSB                                                      LSB
                     1                          25
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 ... 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+...+-+-+-+-+-+-+-+-+
|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|   |0|0|0|0|1|1|0|1|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+...+-+-+-+-+-+-+-+-+

MSB           LSB
 0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|0|0|0|0|1|1|0|1|
+-+-+-+-+-+-+-+-+

 MSB                                                          LSB
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
:                           ...                                 :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|      255      |        List Length = 9        |semantic=allof |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|tcpSharedOptionExID16 = TBD9   |         Field Length = 2      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|              0x0348           |             0x454E            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|      255      |        List Length = 9        |semantic=allof |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|tcpSharedOptionExID32 = TBD10  |         Field Length = 4      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                           0xE2D4C3D9                          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
:                           ...                                 :

8.1. Deprecate ipv6ExtensionHeaders and tcpOptions Information Elements

This document requests IANA to update the "IPFIX Information Elements" registry under the "IP Flow Information Export (IPFIX) Entities" registry group [IANA-IPFIX] as follows:¶

• Update the ipv6ExtensionHeaders IE (64) entry by marking it as deprecated in favor of the ipv6ExtensionHeadersFull IE defined in this document. This note should also be echoed in the "Additional Information" of the ipv6ExtensionHeaders IE.¶

• Update the tcpOptions IE (209) entry by marking it as deprecated in favor of the tcpOptionsFull IE defined in this document. This note should also be echoed in the "Additional Information" of the tcpOptions IE.¶

IANA is also requested to update the reference of ipv6ExtensionHeaders IE (64) and tcpOptions IE (209) to point to this document.¶

8.2. IPFIX Information Elements

This document requests IANA to add the following new IPFIX IEs to the "IPFIX Information Elements" registry under the "IP Flow Information Export (IPFIX) Entities" registry group [IANA-IPFIX]:¶

8.3. IPFIX Information Element Data Type

This document requests IANA to add the following new abstract data type to the "IPFIX Information Element Data Types" registry under the "IP Flow Information Export (IPFIX) Entities" registry group [IANA-IPFIX]:¶

8.4. IPFIX Subregistry for IPv6 Extension Headers

This document requests IANA to create a new registry entitled "ipv6ExtensionHeaders Bits" under the IANA IPFIX registry group [IANA-IPFIX].¶

When a new code is assigned to an IPv6 EH in [IANA-EH], the next available free bit is selected by IANA for this EH from "ipv6ExtensionHeaders Bits" registry and the registry is updated with the details that mirror the assigned EH. The "Label" mirrors the "keyword" of an EH as indicated in [IANA-Protocols], while the "Protocol Number" mirrors the "Protocol Number" in [IANA-EH]. IANA is requested to add the following note to [IANA-EH]:¶

• Note:

  When a new code is assigned to an IPv6 Extension Header, the next available free bit in [NEW_IPFIX_IPv6EH_SUBREGISTRY] is selected for this new Extension Header. [NEW_IPFIX_IPv6EH_SUBREGISTRY] is updated accordingly. Modifications to existing registrations must be mirrored in [NEW_IPFIX_IPv6EH_SUBREGISTRY].¶

• Note to the RFC Editor: Please replace [NEW_IPFIX_IPv6EH_SUBREGISTRY] with the link used by IANA for this new registry.¶

Otherwise, the registration policy for the registry is Expert Review (Section 4.5 of [RFC8126]). See more details in Section 8.4.2.¶