Network Working Group B. Trammell
Internet-Draft ETH Zurich
Intended status: Informational S. Niccolini
Expires: October 13, 2011 NEC
B. Claise
Cisco Systems Inc.
H. Kaplan
Acme Packet
April 11, 2011
SIP Message Information Export using IPFIX
draft-trammell-ipfix-sip-msg-00
Abstract
This draft defines a set of Information Elements and example
Templates for IP Flow Information Export (IPFIX) based on the SIP
Common Log Format data model, to allow IPFIX export of application-
layer information about SIP messages.
Status of this Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on October 13, 2011.
Copyright Notice
Copyright (c) 2011 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
Trammell, et al. Expires October 13, 2011 [Page 1]
Internet-Draft SIP Messages in IPFIX April 2011
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Base Information Elements for SIP Message Information
Export . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.1. sipObservationType . . . . . . . . . . . . . . . . . . . . 4
2.2. sipMethod . . . . . . . . . . . . . . . . . . . . . . . . 4
2.3. sipSequenceNumber . . . . . . . . . . . . . . . . . . . . 4
2.4. sipRequestURI . . . . . . . . . . . . . . . . . . . . . . 4
2.5. sipFromURI . . . . . . . . . . . . . . . . . . . . . . . . 5
2.6. sipFromTag . . . . . . . . . . . . . . . . . . . . . . . . 5
2.7. sipToURI . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.8. sipToTag . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.9. sipCallId . . . . . . . . . . . . . . . . . . . . . . . . 5
2.10. sipResponseStatus . . . . . . . . . . . . . . . . . . . . 5
2.11. sipServerTransaction . . . . . . . . . . . . . . . . . . . 5
2.12. sipClientTransaction . . . . . . . . . . . . . . . . . . . 6
2.13. sipMethod subregistry . . . . . . . . . . . . . . . . . . 6
3. Recommended Templates for SIP Message Information Export . . . 6
4. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
4.1. Base Template Export . . . . . . . . . . . . . . . . . . . 8
4.2. UAC registration . . . . . . . . . . . . . . . . . . . . . 9
4.3. Direct Call . . . . . . . . . . . . . . . . . . . . . . . 11
4.4. Single Downstream Branch Call . . . . . . . . . . . . . . 12
4.5. Forked Call . . . . . . . . . . . . . . . . . . . . . . . 14
5. Security Considerations . . . . . . . . . . . . . . . . . . . 18
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 18
7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 18
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 18
8.1. Normative References . . . . . . . . . . . . . . . . . . . 18
8.2. Informative References . . . . . . . . . . . . . . . . . . 19
Appendix A. Definition of SIP Message Information Elements in
IANA XML Registry format . . . . . . . . . . . . . . 20
Appendix B. Definition of sipMethod registry in IANA XML
Registry format . . . . . . . . . . . . . . . . . . . 23
Appendix C. Example messages in base64 . . . . . . . . . . . . . 26
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 28
Trammell, et al. Expires October 13, 2011 [Page 2]
Internet-Draft SIP Messages in IPFIX April 2011
1. Introduction
IPFIX [RFC5101] provides a standardized means of exporting flow
information from IPFIX exporters to IPFIX collectors. This allows
collectors to analyze flows from one or more sources for numerous
uses, such as traffic patterns/trends, anomalies, failures, attacks,
and much more. IPFIX supports exporting data in near real-time, in a
secure manner, over multiple transports; as well as in local storage
with a defined file format. The core IPFIX information model is
maintained by IANA as a registry of Information Elements at
http://www.iana.org/assignments/ipfix/. In addition to these, which
cover many network measurement and management applications,
enterprise-specific Information Elements may be defined, scoped to an
SMI private enterprise number, for vendor-proprietary Information
Elements.
Session Initiation Protocol (SIP), defined by [RFC3261] and its
extensions, is used by many devices to perform a rendezvous service,
initiate and manage real-time communication sessions, install and
monitor state information, and more. In many deployments, SIP
messages cross multiple systems managed by the same administrative
entity, and thus providing a means of exporting and collecting SIP
message information from such systems using a standard protocol is
highly desirable.
This document defines a set of IPFIX Information Elements to enable
SIP devices, such as user agents and proxies, to export SIP message
information to IPFIX collectors using the IPFIX protocol. The
purpose of doing so is to enable collectors to analyze the SIP
"traffic", for similar purposes as those for any other IPFIX flows.
Defining IANA-registered (i.e., well-known) IPFIX IE fields enables
IPFIX records of SIP message information to be generated and consumed
by different vendors. Within the context of this document's IPFIX IE
fields, a single SIP message is a complete IPFIX Flow as defined in
[RFC5101]
The SIPCLF Working Group has defined a data model
[I-D.ietf-sipclf-problem-statement] for logging information about SIP
messages to ASCII-based SIPCLF files. While useful for on-box
storage and analysis with ASCII-based tools, SIPCLF does not provide
a means of exporting such information, nor is that its goal. This
document borrows the data model from SIPCLF and represents these in
IPFIX Information Elements. It additionally provides examples for
IPFIX representation of the example SIP Messages provided in the
SIPCLF problem statement.
Trammell, et al. Expires October 13, 2011 [Page 3]
Internet-Draft SIP Messages in IPFIX April 2011
2. Base Information Elements for SIP Message Information Export
The following Information Elements represent SIP-specific mandatory
fields defined in [I-D.ietf-sipclf-problem-statement], many
themselves taken from [RFC3261]. Together with Information Elements
already available in the IPFIX IANA Information Elements registry,
these can be used to export information about SIP Messages.
2.1. sipObservationType
Description: Denotes whether the entry was corresponds to a SIP
message received, sent, or merely seen by a passive observer, as
follows:
0: unknown: The Metering Process does not specify the observation
type.
1: receiver: The Metering Process is, or is co-located with, the
receiver of the SIP message.
2: sender: The Metering Process is, or is co-located with, the
sender of the SIP message.
3: passive: The Metering Process passively observed the SIP
message.
Data Type: unsigned8
Data Type Semantics: identifier
ElementId: 419
2.2. sipMethod
Description: The SIP method from the CSeq header, encoded as per
the IPFIX sipMethod subregistry.
Data Type: unsigned8
Data Type Semantics: identifier
ElementId: 402
2.3. sipSequenceNumber
Description: The sequence number from the CSeq header.
Data Type: unsigned32
Data Type Semantics: identifier
ElementId: 409
2.4. sipRequestURI
Description: The SIP Request URI, including any parameters, as a
UTF-8 string, escaped according to SIP rules as received by the
metering process.
Trammell, et al. Expires October 13, 2011 [Page 4]
Internet-Draft SIP Messages in IPFIX April 2011
Data Type: string
ElementId: 403
2.5. sipFromURI
Description: The URI from the SIP From: header
Data Type: string
ElementId: 404
2.6. sipFromTag
Description: The Tag parameter value from the SIP From: header
Data Type: string
ElementId: 405
2.7. sipToURI
Description: The URI from the SIP To: header
Data Type: string
ElementId: 406
2.8. sipToTag
Description: The Tag parameter value from the SIP To: header
Data Type: string
ElementId: 407
2.9. sipCallId
Description: The value of the SIP Call-ID: header
Data Type: string
ElementId: 408
2.10. sipResponseStatus
Description: The SIP Response code. The presence of this
Information Element in a SIP Message record marks it as describing
a SIP response; if absent, the record describes a SIP request.
Data Type: unsigned16
Data Type Semantics: identifier
ElementId: 412
2.11. sipServerTransaction
Trammell, et al. Expires October 13, 2011 [Page 5]
Internet-Draft SIP Messages in IPFIX April 2011
Description: The transaction identifier associated with the server
transaction.
Data Type: string
Data Type Semantics: identifier
ElementId: 413
2.12. sipClientTransaction
Description: The transaction identifier associated with the client
transaction.
Data Type: string
Data Type Semantics: identifier
ElementId: 414
2.13. sipMethod subregistry
[EDITOR'S NOTE: frontmatter]
+----------+------------+-----------+
| Number | Method | Reference |
+----------+------------+-----------+
| 0 | Unknown | |
| 1 | ACK | [RFC3261] |
| 2 | BYE | [RFC3261] |
| 3 | CANCEL | [RFC3261] |
| 4 | INFO | [RFC2976] |
| 5 | INVITE | [RFC3261] |
| 6 | MESSAGE | [RFC3428] |
| 7 | NOTIFY | [RFC3265] |
| 8 | OPTIONS | [RFC3261] |
| 9 | PRACK | [RFC3262] |
| 10 | PUBLISH | [RFC3903] |
| 11 | REFER | [RFC3515] |
| 12 | REGISTER | [RFC3261] |
| 13 | SUBSCRIBE | [RFC3265] |
| 14 | UPDATE | [RFC3311] |
| 15-65535 | Unassigned | |
+----------+------------+-----------+
3. Recommended Templates for SIP Message Information Export
The SIPCLF data model represents SIP requests and SIP responses with
separate records. The following Templates are defined as recommended
base Templates for records describing requests and responses.
Optional Information Elements MAY be added to them, and the IPv4
addresses within these Templates MUST be replaced with IPv6 addresses
for logging IPv6 transport of SIP messages. A sipServerTransaction
Trammell, et al. Expires October 13, 2011 [Page 6]
Internet-Draft SIP Messages in IPFIX April 2011
Information Element SHOULD be added for all messages logged by a User
Agent Server, and a sipClientTransaction Information Element SHOULD
be added for all messages logged by a User Agent Client. These
templates follow the recommended fields for request and response
logging in [I-D.ietf-sipclf-problem-statement], and are defined using
the representation in section 9 of [I-D.trammell-ipfix-ie-doctors].
observationTimeMilliseconds(323)[8]
sipSequenceNumber(35566/409)[4]
sourceIPv4Address(8)[4]
destinationIPv4Address(12)[4]
sourceTransportPort(7)[2]
destinationTransportPort(11)[2]
protocolIdentifier(4)[1]
sipMethod(35566/402)[1]
sipObservationType(35566/419)[1]
sipRequestURI(35566/403)[v]
sipToURI(35566/406)[v]
sipToTag(35566/407)[v]
sipFromURI(35566/404)[v]
sipFromTag(35566/405)[v]
sipCallId(35566/408)[v]
Figure 1: Base Request Template (IPv4)
observationTimeMilliseconds(323)[8]
sipSequenceNumber(35566/409)[4]
sourceIPv4Address(8)[4]
destinationIPv4Address(12)[4]
sourceTransportPort(7)[2]
destinationTransportPort(11)[2]
protocolIdentifier(4)[1]
sipMethod(35566/402)[1]
sipObservationType(35566/419)[1]
sipResponseStatus(35566/412)[2]
sipToURI(35566/406)[v]
sipToTag(35566/407)[v]
sipFromURI(35566/404)[v]
sipFromTag(35566/405)[v]
sipCallId(35566/408)[v]
Figure 2: Base Response Template (IPv4)
Note that the Information Elements in these templates are ordered to
place the fixed-length elements before the variable-length ones,
which speeds random access to fixed-length elements. However, since
element order within a record is unimportant in IPFIX, any ordering
Trammell, et al. Expires October 13, 2011 [Page 7]
Internet-Draft SIP Messages in IPFIX April 2011
of the mandatory Information Elements within a record MUST be
accepted by a Collecting Process as a valid SIP request or response
record for that record type.
The record type is determined by the presence of the
sipResponseStatus field. If present in the Template, the Template
describes a response record. If absent, it describes a request
record.
4. Examples
[EDITOR'S NOTE: use rfdump more]
This section presents several views of an example SIP messages
exported using the IPFIX templates described in this document. We
present both binary and textual forms. The tools to generate this
section are based upon the open-source ripfix [ripfix] implementation
of IPFIX, maintained by one of the authors of this draft.
Here we show the IPFIX Messages generated by the situations in
sections 9.1 through 9.4 of [I-D.ietf-sipclf-problem-statement].
4.1. Base Template Export
Before exporting any Request or Response records, the Templates
describing them must be exported. In this example, the templates
These Templates are derived from the base Templates as shown in
Figure 1 and Figure 2, with the sipClientTransaction and
sipServerTransaction Information Elements appended. We use two
templates here, one each for request and response for IPv4.
Exporting these Templates results in the following IPFIX message,
illustrated as an annotated hexdump in Figure 3.
Trammell, et al. Expires October 13, 2011 [Page 8]
Internet-Draft SIP Messages in IPFIX April 2011
0000: 00 0a 00 fc 4c c0 2a a2 00 00 00 00 00 00 30 39 ....L.*.......09
[ IPFIX message header, length 252 ]
0010: 00 02 00 ec ....
[ Template set (ID 2) header, length 236 ]
0014: 01 01 00 11 01 43 00 08 81 99 00 04 .....C......
0020: 00 00 8a ee 00 08 00 04 00 0c 00 04 00 07 00 02 ................
0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee ................
0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee ................
0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee ................
0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee ................
0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee ................
0080: 81 9d ff ff 00 00 8a ee ........
[ Template 257, 17 elements (v4 request) ]
0088: 01 02 00 11 01 43 00 08 .....C..
0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 0c 00 04 ................
00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01 ................
00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02 ................
00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff ................
00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff ................
00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff ................
00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee ............
[ Template 258, 17 elements (v4 response) ]
Figure 3: Base template message export
4.2. UAC registration
Having exported templates, now we create a simple IPFIX Message
representing a UAC registration as seen from the UAC, corresponding
to example 9.1 in [I-D.ietf-sipclf-problem-statement]. This message
contains two records, including the UAS registration request, and the
response received. This is shown in the annotated hexdump in
Figure 4.
Trammell, et al. Expires October 13, 2011 [Page 9]
Internet-Draft SIP Messages in IPFIX April 2011
0000: 00 0a 00 d8 4c 90 7f c1 00 00 00 00 00 00 30 39 ....L.........09
[ IPFIX message header, length 218 ]
0010: 01 01 00 6b ...k
[ Data set (ID 257) header, length 107 ]
0014: 00 00 01 29 13 66 13 93 00 00 00 01 ...).f......
0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 0c 02 0f .3d..3d.........
0030: 73 69 70 3a 65 78 61 6d 70 6c 65 2e 63 6f 6d 00 sip:example.com.
0040: 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d ..sip:alice@exam
0050: 70 6c 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 ple.com.76yhh.f8
0060: 31 2d 64 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 1-d4-f6@example.
0070: 63 6f 6d 06 63 2d 74 72 2d 31 00 com.c-tr-1.
[ Request record content ]
007b: 01 02 00 5d ...]
[ Data set (ID 258) header, length 93 ]
007f: 00 .
0080: 00 01 29 13 66 15 24 00 00 00 01 c6 33 64 0a c6 ..).f.$.....3d..
0090: 33 64 01 13 c4 13 c4 11 0c 01 00 c8 00 00 15 73 3d.............s
00a0: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 ip:alice@example
00b0: 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 31 2d 64 .com.76yhh.f81-d
00c0: 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 4-f6@example.com
00d0: 06 63 2d 74 72 2d 31 00 .c-tr-1.
[ Response record content ]
Figure 4: Message containing two log entries for UAC registration
While this demonstrates the binary nature of the SIPCLF-IPFIX format,
and shows the content framing for this message, it is not readable
for illustration purposes. In Figure 5, we run the message through
the rfdump tool provided with ripfix to provide a more human-readable
view. Note that the sipMethod and sipObservationType are encoded
according to the registries in Section 2.
Trammell, et al. Expires October 13, 2011 [Page 10]
Internet-Draft SIP Messages in IPFIX April 2011
==== message sequence 0 in domain 12345 at 2010-08-11 11:53:27 UTC ====
---- record 12345/257 ----
observationTimeMilliseconds => 2010-06-07 17:12:23 UTC
sipSequenceNumber => 1
sourceIPv4Address => 198.51.100.1
destinationIPv4Address => 198.51.100.10
sourceTransportPort => 5060
destinationTransportPort => 5060
protocolIdentifier => 17
sipMethod => 12
sipObservationType => 2
sipRequestURI => sip:example.com
sipToURI =>
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => 76yhh
sipCallId => f81-d4-f6@example.com
sipClientTransaction => c-tr-1
sipServerTransaction =>
---- record 12345/258 ----
observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
sipSequenceNumber => 1
sourceIPv4Address => 198.51.100.10
destinationIPv4Address => 198.51.100.1
sourceTransportPort => 5060
destinationTransportPort => 5060
sipResponseStatus => 200
protocolIdentifier => 17
sipMethod => 12
sipObservationType => 1
sipToURI =>
sipToTag =>
sipFromURI => sip:alice@example.com
sipFromTag => 76yhh
sipCallId => f81-d4-f6@example.com
sipClientTransaction => c-tr-1
sipServerTransaction =>
Figure 5: Message containing two log entries for UAC registration
4.3. Direct Call
This example demonstrates the export of a direct call from Alice to
Bob, as seen by Bob's agent, corresponding to example 9.2 in
[I-D.ietf-sipclf-problem-statement]. Here we have four records: an
INVITE received from Alice, a 180 Ringing sent back followed by a 200
OK, and an ACK received from Alice. This is shown in the hexdump in
Figure 6; message headers, set headers, and data records are
Trammell, et al. Expires October 13, 2011 [Page 11]
Internet-Draft SIP Messages in IPFIX April 2011
separated by '|' characters here for compactness. Note here that
each record has its own data set to support high-speed seeking to a
specific record, even when two messages using the same are adjacent
in the message.
0000: 00 0a 02 1a 4c c0 2c b3 00 00 00 00 00 00 30 39 ....L.,.......09
0010: 01 01 00 88 00 00 01 29 13 66 13 93 00 00 00 20 .......).f.....
0020: c6 33 64 01 cb 00 71 01 13 c4 13 c4 11 05 02 18 .3d...q.........
0030: 73 69 70 3a 62 6f 62 40 62 6f 62 31 2e 65 78 61 sip:bob@bob1.exa
0040: 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 mple.net.sip:bob
0050: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 @example.net..si
0060: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example.
0070: 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d 64 34 com.76yhh.f82-d4
0080: 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 07 -f7@example.com.
0090: 63 2d 31 2d 78 74 36 00 01 02 00 79 00 00 01 29 c-1-xt6....y...)
00a0: 13 66 18 aa 00 00 00 20 cb 00 71 01 c6 33 64 01 .f..... ..q..3d.
00b0: 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 6f ..........sip:bo
00c0: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 08 62 2d b@example.net.b-
00d0: 69 6e 36 2d 69 75 15 73 69 70 3a 61 6c 69 63 65 in6-iu.sip:alice
00e0: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 05 37 36 79 @example.com.76y
00f0: 68 68 15 66 38 32 2d 64 34 2d 66 37 40 65 78 61 hh.f82-d4-f7@exa
0100: 6d 70 6c 65 2e 63 6f 6d 07 63 2d 31 2d 78 74 36 mple.com.c-1-xt6
0110: 00 01 02 00 79 00 00 01 29 13 66 1c f4 00 00 00 ....y...).f.....
0120: 20 cb 00 71 01 c6 33 64 01 13 c4 13 c4 11 05 01 ..q..3d........
0130: 00 c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 ...sip:bob@examp
0140: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15 le.net.b-in6-iu.
0150: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl
0160: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d e.com.76yhh.f82-
0170: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f d4-f7@example.co
0180: 6d 07 63 2d 31 2d 78 74 36 00 01 01 00 90 00 00 m.c-1-xt6.......
0190: 01 29 13 66 1d 08 00 00 00 20 c6 33 64 01 cb 00 .).f..... .3d...
01a0: 71 01 13 c4 13 c4 11 01 02 18 73 69 70 3a 62 6f q.........sip:bo
01b0: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n
01c0: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp
01d0: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15 le.net.b-in6-iu.
01e0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl
01f0: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d e.com.76yhh.f82-
0200: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f d4-f7@example.co
0210: 6d 07 63 2d 31 2d 78 74 36 00 m.c-1-xt6.
Figure 6: Message containing four log entries for a simple call
4.4. Single Downstream Branch Call
The example in Figure 7 demonstrates the export of a call with a
downstream branch to Bob, as seen by the proxy which the call
traverses, corresponding to example 9.3 in
[I-D.ietf-sipclf-problem-statement]. See this example in the problem
Trammell, et al. Expires October 13, 2011 [Page 12]
Internet-Draft SIP Messages in IPFIX April 2011
statement for more details.
0000: 00 0a 04 e1 4c c0 2c e5 00 00 00 00 00 00 30 39 ....L.,.......09
0010: 01 01 00 7e 00 00 01 29 13 66 13 93 00 00 00 2b ...~...).f.....+
0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 05 01 13 .3d..3d.........
0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example.
0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d net.sip:bob@exam
0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali
0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a
0070: 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 l-1.tr-87h@examp
0080: 6c 65 2e 63 6f 6d 00 06 73 2d 78 2d 74 72 01 02 le.com..s-x-tr..
0090: 00 6c 00 00 01 29 13 66 14 c1 00 00 00 2b c6 33 .l...).f.....+.3
00a0: 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13 d..3d.........d.
00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example.
00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 net..sip:alice@e
00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 xample.com.al-1.
00e0: 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 tr-87h@example.c
00f0: 6f 6d 00 06 73 2d 78 2d 74 72 01 01 00 89 00 00 om..s-x-tr......
0100: 01 29 13 66 18 a6 00 00 00 2b c6 33 64 0a cb 00 .).f.....+.3d...
0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f q.........sip:bo
0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n
0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp
0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 le.net..sip:alic
0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c e@example.com.al
0160: 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c -1.tr-87h@exampl
0170: 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 e.com.c-x-tr.s-x
0180: 2d 74 72 01 02 00 76 00 00 01 29 13 66 19 70 00 -tr...v...).f.p.
0190: 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 c4 11 ..+..q..3d......
01a0: 05 01 00 64 13 73 69 70 3a 62 6f 62 40 65 78 61 ...d.sip:bob@exa
01b0: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 mple.net.b1-1.si
01c0: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example.
01d0: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40 com.al-1.tr-87h@
01e0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d example.com.c-x-
01f0: 74 72 06 73 2d 78 2d 74 72 01 02 00 76 00 00 01 tr.s-x-tr...v...
0200: 29 13 66 1b c8 00 00 00 2b cb 00 71 01 c6 33 64 ).f.....+..q..3d
0210: 0a 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 ...........sip:b
0220: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 ob@example.net.b
0230: 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 1-1.sip:alice@ex
0240: 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 ample.com.al-1.t
0250: 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 6f r-87h@example.co
0260: 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 72 01 m.c-x-tr.s-x-tr.
0270: 02 00 76 00 00 01 29 13 66 1c 98 00 00 00 2b c6 ..v...).f.....+.
0280: 33 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 b4 3d..3d..........
0290: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 .sip:bob@example
02a0: 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 6c .net.b1-1.sip:al
02b0: 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 ice@example.com.
02c0: 61 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d al-1.tr-87h@exam
02d0: 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 ple.com.c-x-tr.s
Trammell, et al. Expires October 13, 2011 [Page 13]
Internet-Draft SIP Messages in IPFIX April 2011
02e0: 2d 78 2d 74 72 01 02 00 76 00 00 01 29 13 66 20 -x-tr...v...).f
02f0: f0 00 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 ....+..q..3d....
0300: c4 11 05 01 00 c8 13 73 69 70 3a 62 6f 62 40 65 .......sip:bob@e
0310: 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 xample.net.b1-1.
0320: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl
0330: 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 e.com.al-1.tr-87
0340: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d h@example.com.c-
0350: 78 2d 74 72 06 73 2d 78 2d 74 72 01 02 00 76 00 x-tr.s-x-tr...v.
0360: 00 01 29 13 66 21 a4 00 00 00 2b c6 33 64 0a c6 ..).f!....+.3d..
0370: 33 64 01 13 c4 13 c4 11 05 02 00 c8 13 73 69 70 3d...........sip
0380: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 :bob@example.net
0390: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 .b1-1.sip:alice@
03a0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 example.com.al-1
03b0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e .tr-87h@example.
03c0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 com.c-x-tr.s-x-t
03d0: 72 01 01 00 88 00 00 01 29 13 66 28 ac 00 00 00 r.......).f(....
03e0: 2b c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 01 01 +.3d..3d........
03f0: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 .sip:bob@example
0400: 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 .net.sip:bob@exa
0410: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 mple.net.b1-1.si
0420: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example.
0430: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40 com.al-1.tr-87h@
0440: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d example.com.c-x-
0450: 74 72 06 73 2d 78 2d 74 72 01 01 00 88 00 00 01 tr.s-x-tr.......
0460: 29 13 66 28 ac 00 00 00 2b c6 33 64 0a cb 00 71 ).f(....+.3d...q
0470: 01 13 c4 13 c4 11 01 02 13 73 69 70 3a 62 6f 62 .........sip:bob
0480: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 @example.net.sip
0490: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 :bob@example.net
04a0: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 .b1-1.sip:alice@
04b0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 example.com.al-1
04c0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e .tr-87h@example.
04d0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 com.c-x-tr.s-x-t
04e0: 72
Figure 7: Message containing ten log entries for a downstream branch
call
4.5. Forked Call
The example in Figure 9 demonstrates the export of forked call to
Bob, as seen by one of Bob's instances which forks the call
traverses, corresponding to example 9.4 in
[I-D.ietf-sipclf-problem-statement]. See this example for more
details. Note that, since Bob's first instance is multihomed IPv4-
IPv6, this example requires additional templates: request and
response templates for IPv4 to IPv6 and back, these are shown in
Figure 8.
Trammell, et al. Expires October 13, 2011 [Page 14]
Internet-Draft SIP Messages in IPFIX April 2011
0000: 00 0a 01 e4 4c c0 2d 9b 00 00 00 00 00 00 30 39 ....L.-.......09
0010: 00 02 01 d4 01 05 00 11 01 43 00 08 81 99 00 04 .........C......
0020: 00 00 8a ee 00 08 00 04 00 1c 00 10 00 07 00 02 ................
0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee ................
0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee ................
0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee ................
0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee ................
0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee ................
0080: 81 9d ff ff 00 00 8a ee 01 06 00 11 01 43 00 08 .............C..
0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 1c 00 10 ................
00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01 ................
00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02 ................
00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff ................
00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff ................
00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff ................
00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee 01 07 00 11 ................
0100: 01 43 00 08 81 99 00 04 00 00 8a ee 00 1b 00 10 .C..............
0110: 00 0c 00 04 00 07 00 02 00 0b 00 02 00 04 00 01 ................
0120: 81 92 00 01 00 00 8a ee 81 a3 00 01 00 00 8a ee ................
0130: 81 93 ff ff 00 00 8a ee 81 96 ff ff 00 00 8a ee ................
0140: 81 97 ff ff 00 00 8a ee 81 94 ff ff 00 00 8a ee ................
0150: 81 95 ff ff 00 00 8a ee 81 98 ff ff 00 00 8a ee ................
0160: 81 9e ff ff 00 00 8a ee 81 9d ff ff 00 00 8a ee ................
0170: 01 08 00 11 01 43 00 08 81 99 00 04 00 00 8a ee .....C..........
0180: 00 1b 00 10 00 0c 00 04 00 07 00 02 00 0b 00 02 ................
0190: 00 04 00 01 81 92 00 01 00 00 8a ee 81 a3 00 01 ................
01a0: 00 00 8a ee 81 9c 00 02 00 00 8a ee 81 96 ff ff ................
01b0: 00 00 8a ee 81 97 ff ff 00 00 8a ee 81 94 ff ff ................
01c0: 00 00 8a ee 81 95 ff ff 00 00 8a ee 81 98 ff ff ................
01d0: 00 00 8a ee 81 9e ff ff 00 00 8a ee 81 9d ff ff ................
01e0: 00 00 8a ee ....
Figure 8: Message containing templates for IPv4 to IPv6 requests and
responses, and vice versa
0000: 00 0a 07 8c 4c c0 2d 9b 00 00 00 00 00 00 30 39 ....L.-.......09
0010: 01 01 00 7e 00 00 01 29 13 66 13 93 00 00 00 2b ...~...).f.....+
0020: c6 33 64 01 cb 00 71 c8 13 c4 13 c4 11 05 01 13 .3d...q.........
0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example.
0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d net.sip:bob@exam
0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali
0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a
0070: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 1-1.tr-88h@examp
0080: 6c 65 2e 63 6f 6d 00 06 73 2d 31 2d 74 72 01 02 le.com..s-1-tr..
0090: 00 6c 00 00 01 29 13 66 14 c1 00 00 00 2b cb 00 .l...).f.....+..
00a0: 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13 q..3d.........d.
00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example.
Trammell, et al. Expires October 13, 2011 [Page 15]
Internet-Draft SIP Messages in IPFIX April 2011
00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 net..sip:alice@e
00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1.
00e0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c
00f0: 6f 6d 00 06 73 2d 31 2d 74 72 01 01 00 89 00 00 om..s-1-tr......
0100: 01 29 13 66 18 a6 00 00 00 2b cb 00 71 c8 cb 00 .).f.....+..q...
0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f q.........sip:bo
0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n
0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp
0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 le.net..sip:alic
0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 e@example.com.a1
0160: 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c -1.tr-88h@exampl
0170: 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 e.com.c-1-tr.s-1
0180: 2d 74 72 01 05 00 95 00 00 01 29 13 66 1a 9c 00 -tr.......).f...
0190: 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 00 00 00 ..+..q. ........
01a0: 00 00 00 00 00 00 09 13 c4 13 c4 11 05 02 18 73 ...............s
01b0: 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 78 61 6d ip:bob@bob2.exam
01c0: 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 ple.net.sip:bob@
01d0: 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 70 example.net..sip
01e0: 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 :alice@example.c
01f0: 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 om.a1-1.tr-88h@e
0200: 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 xample.com.c-2-t
0210: 72 06 73 2d 31 2d 74 72 01 02 00 76 00 00 01 29 r.s-1-tr...v...)
0220: 13 66 1b c8 00 00 00 2b cb 00 71 01 cb 00 71 c8 .f.....+..q...q.
0230: 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a 62 6f ........d.sip:bo
0240: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 b@example.net.b1
0250: 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 -1.sip:alice@exa
0260: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 mple.com.a1-1.tr
0270: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d -88h@example.com
0280: 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72 01 08 .c-1-tr.s-1-tr..
0290: 00 82 00 00 01 29 13 66 1c f4 00 00 00 2b 20 01 .....).f.....+ .
02a0: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00 ................
02b0: 71 c8 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a q.........d.sip:
02c0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 bob@example.net.
02d0: 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 40 65 b2-2.sip:alice@e
02e0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1.
02f0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c
0300: 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72 om.c-2-tr.s-1-tr
0310: 01 08 00 82 00 00 01 29 13 66 1f 4c 00 00 00 2b .......).f.L...+
0320: 20 01 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 ...............
0330: cb 00 71 c8 13 c4 13 c4 11 05 01 00 b4 13 73 69 ..q...........si
0340: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 p:bob@example.ne
0350: 74 04 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 t.b2-2.sip:alice
0360: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d @example.com.a1-
0370: 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 1.tr-88h@example
0380: 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d .com.c-2-tr.s-1-
0390: 74 72 01 02 00 72 00 00 01 29 13 66 20 6e 00 00 tr...r...).f n..
03a0: 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 .+..q..3d.......
03b0: 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 61 6d ....sip:bob@exam
Trammell, et al. Expires October 13, 2011 [Page 16]
Internet-Draft SIP Messages in IPFIX April 2011
03c0: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali
03d0: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a
03e0: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 1-1.tr-88h@examp
03f0: 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d le.com.c-2-tr.s-
0400: 31 2d 74 72 01 02 00 76 00 00 01 29 13 66 21 a4 1-tr...v...).f!.
0410: 00 00 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 ...+..q..3d.....
0420: 11 05 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 ......sip:bob@ex
0430: 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 ample.net.b1-1.s
0440: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 ip:alice@example
0450: 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 .com.a1-1.tr-88h
0460: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 @example.com.c-1
0470: 2d 74 72 06 73 2d 31 2d 74 72 01 02 00 76 00 00 -tr.s-1-tr...v..
0480: 01 29 13 66 23 98 00 00 00 2b cb 00 71 01 cb 00 .).f#....+..q...
0490: 71 c8 13 c4 13 c4 11 05 01 00 c8 13 73 69 70 3a q...........sip:
04a0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 bob@example.net.
04b0: 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 b1-1.sip:alice@e
04c0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1.
04d0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c
04e0: 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72 om.c-1-tr.s-1-tr
04f0: 01 02 00 76 00 00 01 29 13 66 24 60 00 00 00 2b ...v...).f$`...+
0500: cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 ..q..3d.........
0510: c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c ..sip:bob@exampl
0520: 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 e.net.b1-1.sip:a
0530: 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d lice@example.com
0540: 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 .a1-1.tr-88h@exa
0550: 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 mple.com.c-1-tr.
0560: 73 2d 31 2d 74 72 01 05 00 95 00 00 01 29 13 66 s-1-tr.......).f
0570: 25 29 00 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 %)...+..q. .....
0580: 00 00 00 00 00 00 00 00 00 09 13 c4 13 c4 11 03 ................
0590: 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 ..sip:bob@bob2.e
05a0: 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 xample.net.sip:b
05b0: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 ob@example.net..
05c0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl
05d0: 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 e.com.a1-1.tr-88
05e0: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d h@example.com.c-
05f0: 32 2d 74 72 06 73 2d 31 2d 74 72 01 08 00 7e 00 2-tr.s-1-tr...~.
0600: 00 01 29 13 66 28 3f 00 00 00 2b 20 01 0d b8 00 ..).f(?...+ ....
0610: 00 00 00 00 00 00 00 00 00 00 09 cb 00 71 c8 13 .............q..
0620: c4 13 c4 11 05 01 01 e7 13 73 69 70 3a 62 6f 62 .........sip:bob
0630: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 @example.net..si
0640: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example.
0650: 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 com.a1-1.tr-88h@
0660: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d example.com.c-2-
0670: 74 72 06 73 2d 31 2d 74 72 01 05 00 95 00 00 01 tr.s-1-tr.......
0680: 29 13 66 2a 0f 00 00 00 2b cb 00 71 c8 20 01 0d ).f*....+..q. ..
0690: b8 00 00 00 00 00 00 00 00 00 00 00 09 13 c4 13 ................
06a0: c4 11 01 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 .....sip:bob@bob
06b0: 32 2e 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 2.example.net.si
Trammell, et al. Expires October 13, 2011 [Page 17]
Internet-Draft SIP Messages in IPFIX April 2011
06c0: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 p:bob@example.ne
06d0: 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 t..sip:alice@exa
06e0: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 mple.com.a1-1.tr
06f0: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d -88h@example.com
0700: 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72 01 08 .c-2-tr.s-1-tr..
0710: 00 7e 00 00 01 29 13 66 2c 31 00 00 00 2b 20 01 .~...).f,1...+ .
0720: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00 ................
0730: 71 c8 13 c4 13 c4 11 03 01 00 c8 13 73 69 70 3a q...........sip:
0740: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 bob@example.net.
0750: 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 .sip:alice@examp
0760: 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 le.com.a1-1.tr-8
0770: 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 8h@example.com.c
0780: 2d 32 2d 74 72 06 73 2d 31 2d 74 72 -2-tr.s-1-tr
Figure 9: Message containing sixteen log entries for a forked call
5. Security Considerations
[TODO]
6. IANA Considerations
[EDITOR'S NOTE: IANA has added the new Information Elements defined
in this document and replaced all Information Element numbers in PEN
34455 with ...]
7. Acknowledgments
Thanks to Cullen Jennings for his provided insightful discussions,
specific comments and much needed corrections, and to Nico d'Heureuse
for his help with the RFC 3665 examples.
8. References
8.1. Normative References
[I-D.ietf-sipclf-problem-statement]
Gurbani, V., Burger, E., Anjali, T., Abdelnur, H., and O.
Festor, "The Common Log Format (CLF) for the Session
Initiation Protocol (SIP)",
draft-ietf-sipclf-problem-statement-05 (work in progress),
March 2011.
[RFC5101] Claise, B., "Specification of the IP Flow Information
Trammell, et al. Expires October 13, 2011 [Page 18]
Internet-Draft SIP Messages in IPFIX April 2011
Export (IPFIX) Protocol for the Exchange of IP Traffic
Flow Information", RFC 5101, January 2008.
[RFC5655] Trammell, B., Boschi, E., Mark, L., Zseby, T., and A.
Wagner, "Specification of the IP Flow Information Export
(IPFIX) File Format", RFC 5655, October 2009.
8.2. Informative References
[I-D.kaplan-dispatch-session-id]
Kaplan, H., "A Session Identifier for the Session
Initiation Protocol (SIP)",
draft-kaplan-dispatch-session-id-03 (work in progress),
March 2011.
[I-D.trammell-ipfix-ie-doctors]
Trammell, B. and B. Claise, "Guidelines for Authors and
Reviewers of IPFIX Information Elements",
draft-trammell-ipfix-ie-doctors-01 (work in progress),
March 2011.
[RFC2976] Donovan, S., "The SIP INFO Method", RFC 2976,
October 2000.
[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
A., Peterson, J., Sparks, R., Handley, M., and E.
Schooler, "SIP: Session Initiation Protocol", RFC 3261,
June 2002.
[RFC3262] Rosenberg, J. and H. Schulzrinne, "Reliability of
Provisional Responses in Session Initiation Protocol
(SIP)", RFC 3262, June 2002.
[RFC3265] Roach, A., "Session Initiation Protocol (SIP)-Specific
Event Notification", RFC 3265, June 2002.
[RFC3311] Rosenberg, J., "The Session Initiation Protocol (SIP)
UPDATE Method", RFC 3311, October 2002.
[RFC3428] Campbell, B., Rosenberg, J., Schulzrinne, H., Huitema, C.,
and D. Gurle, "Session Initiation Protocol (SIP) Extension
for Instant Messaging", RFC 3428, December 2002.
[RFC3515] Sparks, R., "The Session Initiation Protocol (SIP) Refer
Method", RFC 3515, April 2003.
[RFC3665] Johnston, A., Donovan, S., Sparks, R., Cunningham, C., and
K. Summers, "Session Initiation Protocol (SIP) Basic Call
Trammell, et al. Expires October 13, 2011 [Page 19]
Internet-Draft SIP Messages in IPFIX April 2011
Flow Examples", BCP 75, RFC 3665, December 2003.
[RFC3903] Niemi, A., "Session Initiation Protocol (SIP) Extension
for Event State Publication", RFC 3903, October 2004.
[RFC4475] Sparks, R., Hawrylyshen, A., Johnston, A., Rosenberg, J.,
and H. Schulzrinne, "Session Initiation Protocol (SIP)
Torture Test Messages", RFC 4475, May 2006.
[ripfix] Trammell, B., "ripfix: IPFIX for Ruby", available at
http://ripfix.rubyforge.org/.
Appendix A. Definition of SIP Message Information Elements in IANA XML
Registry format
[EDITOR'S NOTE: frontmatter]
sipObservationType
unsigned8
identifier
35566
419
current
Denotes whether the entry was
corresponds to a SIP message received, sent, or merely
seen by a passive observer, as follows:
0: unknown: The Metering Process does not
specify the observation type.
1: receiver: The Metering Process is, or is
co-located with, the receiver of the SIP message.
2: sender: The Metering Process is, or is
co-located with, the sender of the SIP message.
3: passive: The Metering Process passively
observed the SIP message.
sipMethod
unsigned8
identifier
35566
Trammell, et al. Expires October 13, 2011 [Page 20]
Internet-Draft SIP Messages in IPFIX April 2011
402
current
The SIP method from the CSeq header, encoded as per
the IPFIX sipMethod subregistry.
sipSequenceNumber
unsigned32
identifier
35566
409
current
The sequence number from the CSeq header.
sipRequestURI
string
35566
403
current
The SIP Request URI, including any parameters,
as a UTF-8 string, escaped according to SIP rules as
received by the metering process.
sipFromURI
string
35566
404
current
The URI from the SIP From: header
sipFromTag
string
35566
405
current
Trammell, et al. Expires October 13, 2011 [Page 21]
Internet-Draft SIP Messages in IPFIX April 2011
The Tag parameter value from the SIP
From: header
sipToURI
string
35566
406
current
The URI from the SIP To: header
sipToTag
string
35566
407
current
The Tag parameter value from the SIP To:
header
sipCallId
string
35566
408
current
The value of the SIP Call-ID: header
sipResponseStatus
unsigned16
identifier
35566
412
current
The SIP Response code. The presence of this
Information Element in a SIP Message record marks it as
describing a SIP response; if absent, the record describes
a SIP request.
Trammell, et al. Expires October 13, 2011 [Page 22]
Internet-Draft SIP Messages in IPFIX April 2011
sipServerTransaction
string
identifier
35566
413
current
The transaction identifier associated with
the server transaction.
sipClientTransaction
string
identifier
35566
414
current
The transaction identifier associated with
the client transaction.
SIP Message Information Element definitions
Appendix B. Definition of sipMethod registry in IANA XML Registry
format
[EDITOR'S NOTE: frontmatter]
IPFIX sipMethod
Expert Review
0
Unknown
The Metering Process did not
recognize the SIP method.
Trammell, et al. Expires October 13, 2011 [Page 23]
Internet-Draft SIP Messages in IPFIX April 2011
1
ACK
2
BYE
3
CANCEL
4
INFO
5
INVITE
6
MESSAGE
7
NOTIFY
8
OPTIONS
Trammell, et al. Expires October 13, 2011 [Page 24]
Internet-Draft SIP Messages in IPFIX April 2011
9
PRACK
10
PUBLISH
11
REFER
12
REGISTER
13
SUBSCRIBE
14
UPDATE
15-65535
Unassigned
sipMethod subregistry
Trammell, et al. Expires October 13, 2011 [Page 25]
Internet-Draft SIP Messages in IPFIX April 2011
Appendix C. Example messages in base64
This section contains the example messages from this revision of this
draft in base64 encoding, for ease of processing by automated tools.
The base templates are in this message:
AAoA/EzALZsAAAAAAAAwOQACAOwBAQARAUMACIGZAAQAAIruAAgABAAMAAQA
BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX
//8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK
7gECABEBQwAIgZkABAAAiu4ACAAEAAwABAAHAAIACwACAAQAAYGSAAEAAIru
gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A
AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIru
The extended 4to6 and 6to4 templates are in this message:
AAoB5EzALZsAAAAAAAAwOQACAdQBBQARAUMACIGZAAQAAIruAAgABAAcABAA
BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX
//8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK
7gEGABEBQwAIgZkABAAAiu4ACAAEABwAEAAHAAIACwACAAQAAYGSAAEAAIru
gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A
AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIruAQcAEQFDAAiBmQAEAACK7gAb
ABAADAAEAAcAAgALAAIABAABgZIAAQAAiu6BowABAACK7oGT//8AAIrugZb/
/wAAiu6Bl///AACK7oGU//8AAIrugZX//wAAiu6BmP//AACK7oGe//8AAIru gZ3//
wAAiu4BCAARAUMACIGZAAQAAIruABsAEAAMAAQABwACAAsAAgAEAAGB
kgABAACK7oGjAAEAAIrugZwAAgAAiu6Blv//AACK7oGX//8AAIrugZT//wAA iu6Blf//
AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK7g==
The UAC registration in Section 4.2 is in this message:
AAoA2EzAO88AAAAAAAAwOQEBAGsAAAEpE2YTkwAAAAHGM2QBxjNkChPEE8QR
DAIPc2lwOmV4YW1wbGUuY29tAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2
eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEAAQIAXQAAASkTZhUk
AAAAAcYzZArGM2QBE8QTxBEMAQDIAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t
BTc2eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEA
The direct call in Section 4.3 is in this message:
AAoCGkzAPA8AAAAAAAAwOQEBAIgAAAEpE2YTkwAAACDGM2QBywBxARPEE8QR
BQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5u
ZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQU3NnloaBVmODItZDQtZjdAZXhh
bXBsZS5jb20HYy0xLXh0NgABAgB5AAABKRNmGKoAAAAgywBxAcYzZAETxBPE
EQUBALQTc2lwOmJvYkBleGFtcGxlLm5ldAhiLWluNi1pdRVzaXA6YWxpY2VA
ZXhhbXBsZS5jb20FNzZ5aGgVZjgyLWQ0LWY3QGV4YW1wbGUuY29tB2MtMS14
dDYAAQIAeQAAASkTZhz0AAAAIMsAcQHGM2QBE8QTxBEFAQDIE3NpcDpib2JA
ZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2
eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AAEBAJAAAAEpE2Yd
CAAAACDGM2QBywBxARPEE8QRAQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0
Trammell, et al. Expires October 13, 2011 [Page 26]
Internet-Draft SIP Messages in IPFIX April 2011
E3NpcDpib2JAZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1w
bGUuY29tBTc2eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AA==
The downstream branch call in Section 4.4 is in this message:
AAoE4UzAPEoAAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBxjNkChPEE8QR
BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz
aXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20A
BnMteC10cgECAGwAAAEpE2YUwQAAACvGM2QKxjNkARPEE8QRBQIAZBNzaXA6
Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0
ci04N2hAZXhhbXBsZS5jb20ABnMteC10cgEBAIkAAAEpE2YYpgAAACvGM2QK
ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA
ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3
aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZhlwAAAAK8sA
cQHGM2QKE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6
YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14
LXRyBnMteC10cgECAHYAAAEpE2YbyAAAACvLAHEBxjNkChPEE8QRBQEAtBNz
aXA6Ym9iQGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29t
BGFsLTESdHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAgB2AAAB
KRNmHJgAAAArxjNkCsYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l
dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3aEBleGFt
cGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZiDwAAAAK8sAcQHGM2QK
E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA
ZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMt
eC10cgECAHYAAAEpE2YhpAAAACvGM2QKxjNkARPEE8QRBQIAyBNzaXA6Ym9i
QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGFsLTES
dHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAQCIAAABKRNmKKwA
AAArxjNkAcYzZAoTxBPEEQEBE3NpcDpib2JAZXhhbXBsZS5uZXQTc2lwOmJv
YkBleGFtcGxlLm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0x
EnRyLTg3aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQEAiAAAASkTZiis
AAAAK8YzZArLAHEBE8QTxBEBAhNzaXA6Ym9iQGV4YW1wbGUubmV0E3NpcDpi
b2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwt
MRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMteC10cg==
The forked call in Section 4.5 is in this message:
AAoHjEzAPF0AAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBywBxyBPEE8QR
BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz
aXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20A
BnMtMS10cgECAGwAAAEpE2YUwQAAACvLAHHIxjNkARPEE8QRBQIAZBNzaXA6
Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0
ci04OGhAZXhhbXBsZS5jb20ABnMtMS10cgEBAIkAAAEpE2YYpgAAACvLAHHI
ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA
ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4
aEBleGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQUAlQAAASkTZhqcAAAAK8sA
ccggAQ24AAAAAAAAAAAAAAAJE8QTxBEFAhhzaXA6Ym9iQGJvYjIuZXhhbXBs
ZS5uZXQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUu
Y29tBGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2
Trammell, et al. Expires October 13, 2011 [Page 27]
Internet-Draft SIP Messages in IPFIX April 2011
AAABKRNmG8gAAAArywBxAcsAccgTxBPEEQUBAGQTc2lwOmJvYkBleGFtcGxl
Lm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBl
eGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQgAggAAASkTZhz0AAAAKyABDbgA
AAAAAAAAAAAAAAnLAHHIE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQE
YjItMhVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBs
ZS5jb20GYy0yLXRyBnMtMS10cgEIAIIAAAEpE2YfTAAAACsgAQ24AAAAAAAA
AAAAAAAJywBxyBPEE8QRBQEAtBNzaXA6Ym9iQGV4YW1wbGUubmV0BGIyLTIV
c2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTESdHItODhoQGV4YW1wbGUuY29t
BmMtMi10cgZzLTEtdHIBAgByAAABKRNmIG4AAAArywBxyMYzZAETxBPEEQUC
ALQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t
BGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2AAAB
KRNmIaQAAAArywBxyMYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l
dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFt
cGxlLmNvbQZjLTEtdHIGcy0xLXRyAQIAdgAAASkTZiOYAAAAK8sAcQHLAHHI
E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA
ZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0xLXRyBnMt
MS10cgECAHYAAAEpE2YkYAAAACvLAHHIxjNkARPEE8QRBQIAyBNzaXA6Ym9i
QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTES
dHItODhoQGV4YW1wbGUuY29tBmMtMS10cgZzLTEtdHIBBQCVAAABKRNmJSkA
AAArywBxyCABDbgAAAAAAAAAAAAAAAkTxBPEEQMCGHNpcDpib2JAYm9iMi5l
eGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhh
bXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10
cgEIAH4AAAEpE2YoPwAAACsgAQ24AAAAAAAAAAAAAAAJywBxyBPEE8QRBQEB
5xNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20E
YTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10cgEFAJUAAAEp
E2YqDwAAACvLAHHIIAENuAAAAAAAAAAAAAAACRPEE8QRAQIYc2lwOmJvYkBi
b2IyLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGlj
ZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIG
cy0xLXRyAQgAfgAAASkTZiwxAAAAKyABDbgAAAAAAAAAAAAAAAnLAHHIE8QT
xBEDAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxl
LmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIGcy0xLXRy
Authors' Addresses
Brian Trammell
Swiss Federal Institute of Technology Zurich
Gloriastrasse 35
8092 Zurich
Switzerland
Email: trammell@tik.ee.ethz.ch
Trammell, et al. Expires October 13, 2011 [Page 28]
Internet-Draft SIP Messages in IPFIX April 2011
Saverio Niccolini
NEC Laboratories Europe, NEC Europe Ltd.
Kurfuersten-Anlage 36
Heidelberg 69115
Germany
Phone: +49 (0) 6221 4342 118
Email: niccolini@neclab.eu
URI: http://www.neclab.eu
Benoit Claise
Cisco Systems Inc.
De Kleetlaan 6a b1
Diegem, 1813
Belgium
Phone: +32 2 704 5622
Fax:
Email: bclaise@cisco.com
URI:
Hadriel Kaplan
Acme Packet
71 Third Ave.
Burlington, MA 01803
USA
Phone:
Email: hkaplan@acmepacket.com
Trammell, et al. Expires October 13, 2011 [Page 29]