-1

I configure Netflow Flexible use IPFIX protocol on a Cisco ASR 1001-X router and receive IPFIX packet from it successfully. The router exports data-sets with an exporter (Observation Domain ID = 0) and template-sets with another exporter (Observation Domain ID = 1).

I was tested that before, by configuring a router on GNS3, but I received data-sets and template-sets from same exporter (Observation Domain ID).

Is it important to match data and template by their observation-domain-id and template-id? or I should match data and template by their template-id and source-ip!

Foad Tahmasebi
  • 1,333
  • 4
  • 16
  • 33

1 Answers1

1

From https://www.rfc-editor.org/rfc/rfc7011 (ipfix rfc):

Observation Domain ID (In Message Header)

  A 32-bit identifier of the Observation Domain that is locally
  unique to the Exporting Process.  The Exporting Process uses the
  Observation Domain ID to uniquely identify to the Collecting
  Process the Observation Domain that metered the Flows.  It is
  RECOMMENDED that this identifier also be unique per IPFIX Device.
  Collecting Processes SHOULD use the Transport Session and the
  Observation Domain ID field to separate different export streams
  originating from the same Exporter.  The Observation Domain ID
  SHOULD be 0 when no specific Observation Domain ID is relevant for
  the entire IPFIX Message, for example, when exporting the
  Exporting Process Statistics, or in the case of a hierarchy of
  Collectors when aggregated Data Records are exported.

Template ID (In Template Record)

  Each Template Record is given a unique Template ID in the range
  256 to 65535.  This uniqueness is local to the Transport Session
  and Observation Domain that generated the Template ID.  Since
  Template IDs are used as Set IDs in the Sets they describe, 
  values 0-255 are reserved for special Set types
  (e.g., Template Sets themselves), and Templates and Options
  Templates cannot share Template IDs within a
  Transport Session and Observation Domain.  There are no
  constraints regarding the order of the Template ID allocation.  As
  Exporting Processes are free to allocate Template IDs as they see
  fit, Collecting Processes MUST NOT assume incremental Template
  IDs, or anything about the contents of a Template based on its
  Template ID alone.

That is to say, "Observation Domain ID" (source id in your case) and "Template ID" uniquely defines the corresponding Data Record. So it is important to match data and template by their source-id and template-id.

Community
  • 1
  • 1
Zangetsu
  • 1,900
  • 17
  • 25
  • thank you, I read this before, but I want to know why the `Cisco ASR` router export data-sets and template-sets from two different "observation domain id"? according to `ipfix rfc7011`, it should export data-sets and template-sets from same observation domain id. – Foad Tahmasebi Feb 01 '16 at 06:26