Subject: [IPFIX] NAT/FW information elements.

From: "Senthil Sivakumar \(ssenthil\)" <[email-masked]>
Date: Tue, 17 Apr 2007 13:38:06 -0700

Some time back I sent a request to the list requesting some IPFIX IEs
for NAT and FW. Some IDs are reserved for us pending discussion. I would
like to start the discussion on this by explaining the usage of the
fields. In the meantime, we have changed the names of the fields so that
the terminolgy is self-explanatory. This is the new proposal:

225 	 translatedSrcAddr    nat      ipv4Address  identifier 
226 	 translatedDstAddr    nat      ipv4Address  identifier
227 	 translatedSrcPort    nat      unsigned16   identifier
228 	 translatedDstPort    nat      unsigned16   identifier
229 	 origAddressRealm     nat      unsigned8    identifier  (NEW)
230 	 natEvent             nat      unsigned16   identifier
231 	 fwInitiatorOctets    counter  unsigned64   quantity    octets
232 	 fwResponderOctets    counter  unsigned64   quantity    octets
233 	 fwEvent              ???      unsigned8    identifier
234    Unused
235    Unused
236    Unused

translatedSrcAddr - The value of the source address after NAT
translation.
translatedDstAddr - The value of the destination address after NAT
translation.
translatedSrcPort - The value of the source port after NAT translation.
translatedDstPort - The value of the destination port after NAT
translation.   
origAddressRealm  - The realm where the packet was originate 
                    Possible values : Private(0), Public (1).
                    See RFC 2663 for definition of address realms.
natEvent          - Whether this is a add event (Creation of NAT
session)
                    or a delete event (deletion of a NAT session).
fwInitiatorOctets - Number of octets sent by the initiator of the
firewall session.
fwResponderOctets - Number of octets sent by the responder of the
firewall session.
fwEvent           - Whether this is a add event (Creation of NAT
session)
                    or a delete event (deletion of a NAT session).

Please let me know if there are any questions/comments.

Thanks
Senthil

_______________________________________________
IPFIX mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipfix