idnits 2.17.00 (12 Aug 2021) /tmp/idnits24256/draft-fan-ipfix-content-info-ie-01.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (July 29, 2013) is 3218 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Unused Reference: 'RFC5322' is defined on line 360, but no explicit reference was found in the text == Outdated reference: draft-ietf-ipfix-information-model-rfc5102bis has been published as RFC 7012 == Outdated reference: draft-ietf-ipfix-protocol-rfc5101bis has been published as RFC 7011 -- Possible downref: Normative reference to a draft: ref. 'I-D.ietf-ipfix-protocol-rfc5101bis' ** Obsolete normative reference: RFC 2616 (Obsoleted by RFC 7230, RFC 7231, RFC 7232, RFC 7233, RFC 7234, RFC 7235) Summary: 1 error (**), 0 flaws (~~), 4 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group P. Fan 3 Internet-Draft China Mobile 4 Intended status: Standards Track July 29, 2013 5 Expires: January 30, 2014 7 Information Elements for Application Layer Information Export 8 draft-fan-ipfix-content-info-ie-01 10 Abstract 12 This document specifies extended Information Elements used in the IP 13 Flow Information Export (IPFIX) to export content related 14 information. 16 Status of This Memo 18 This Internet-Draft is submitted in full conformance with the 19 provisions of BCP 78 and BCP 79. 21 Internet-Drafts are working documents of the Internet Engineering 22 Task Force (IETF). Note that other groups may also distribute 23 working documents as Internet-Drafts. The list of current Internet- 24 Drafts is at http://datatracker.ietf.org/drafts/current/. 26 Internet-Drafts are draft documents valid for a maximum of six months 27 and may be updated, replaced, or obsoleted by other documents at any 28 time. It is inappropriate to use Internet-Drafts as reference 29 material or to cite them other than as "work in progress." 31 This Internet-Draft will expire on January 30, 2014. 33 Copyright Notice 35 Copyright (c) 2013 IETF Trust and the persons identified as the 36 document authors. All rights reserved. 38 This document is subject to BCP 78 and the IETF Trust's Legal 39 Provisions Relating to IETF Documents 40 (http://trustee.ietf.org/license-info) in effect on the date of 41 publication of this document. Please review these documents 42 carefully, as they describe your rights and restrictions with respect 43 to this document. Code Components extracted from this document must 44 include Simplified BSD License text as described in Section 4.e of 45 the Trust Legal Provisions and are provided without warranty as 46 described in the Simplified BSD License. 48 Table of Contents 50 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 51 2. New Information Elements . . . . . . . . . . . . . . . . . . 3 52 2.1. httpRequestMethod . . . . . . . . . . . . . . . . . . . . 3 53 2.2. httpRequestURI . . . . . . . . . . . . . . . . . . . . . 3 54 2.3. httpVersion . . . . . . . . . . . . . . . . . . . . . . . 3 55 2.4. httpResponseStatusCode . . . . . . . . . . . . . . . . . 4 56 2.5. httpRequestHost . . . . . . . . . . . . . . . . . . . . . 4 57 2.6. httpRequestReferer . . . . . . . . . . . . . . . . . . . 5 58 2.7. httpContentType . . . . . . . . . . . . . . . . . . . . . 5 59 2.8. httpOctetDeltaCount . . . . . . . . . . . . . . . . . . . 5 60 2.9. httpOctetTotalCount . . . . . . . . . . . . . . . . . . . 6 61 2.10. dnsQueryName . . . . . . . . . . . . . . . . . . . . . . 6 62 2.11. dnsQueryType . . . . . . . . . . . . . . . . . . . . . . 6 63 2.12. dnsQueryDeltaCount . . . . . . . . . . . . . . . . . . . 7 64 2.13. dnsQueryTotalCount . . . . . . . . . . . . . . . . . . . 7 65 3. Security Considerations . . . . . . . . . . . . . . . . . . . 7 66 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 67 5. Normative References . . . . . . . . . . . . . . . . . . . . 8 68 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 8 70 1. Introduction 72 Our internet today employs a large and increasing number of devices 73 with content aware ability. These devices detect packet content of 74 traffic flows rather than just packet headers, and perform specific 75 functions using content information together with traditional 76 information on layer 3 or layer 4. Content information is used for 77 various purposes: analyzing, optimizing, business, security, etc. 78 Examples of functions utilizing content information include traffic 79 visualizing, policy based control, content based charging, etc. 81 Although content related information is vital in the smart operation 82 of internet traffic and has already been widely referred to in the 83 network, there is still not an effective, well defined method to 84 export content information, especially in a standardized, 85 interoperable way. 87 The IP Flow Information Export (IPFIX) working group has produced a 88 series of specifications that help export flow information, including 89 protocol [I-D.ietf-ipfix-protocol-rfc5101bis] and information model 90 [I-D.ietf-ipfix-information-model-rfc5102bis]. However, higher-layer 91 content related information export is not yet well standardized. 92 This document specifies Information Elements used to export content 93 information. 95 2. New Information Elements 97 This section describes a list of new Information Elements that are 98 used to export content information. The list is subject to change in 99 later revisions of this documents. 101 2.1. httpRequestMethod 103 Description: 105 The request method of an HTTP request message to be performed on 106 the resource identified by the request URI. 108 Abstract Data Type: string 110 Data Type Semantics: 112 ElementId: TBD01 114 Status: current 116 Reference: [RFC2616] 118 2.2. httpRequestURI 120 Description: 122 The Uniform Resource Identifier indicated by the Request-URI field 123 in the first line of an HTTP request message. The URI is used to 124 identify the resource upon which to apply the request. 126 Abstract Data Type: string 128 Data Type Semantics: 130 ElementId: TBD02 132 Status: current 134 Reference: [RFC2616] 136 2.3. httpVersion 138 Description: 140 The version of the HTTP protocol indicated by the HTTP-Version 141 field in the first line of an HTTP message. 143 Abstract Data Type: string 145 Data Type Semantics: 147 ElementId: TBD03 149 Status: current 151 Reference: [RFC2616] 153 2.4. httpResponseStatusCode 155 Description: 157 The value of the Status-Code field in the first line of an HTTP 158 response message. The Information Element consists of 3 numeric 159 characters indicating the result of the attempt to understand and 160 satisfy the HTTP request. 162 Abstract Data Type: string 164 Data Type Semantics: 166 ElementId: TBD04 168 Status: current 170 Reference: [RFC2616] 172 2.5. httpRequestHost 174 Description: 176 The Host request-header field in an HTTP request message used to 177 specify the Internet host and port number of the resource being 178 requested. 180 Abstract Data Type: string 182 Data Type Semantics: 184 ElementId: TBD05 186 Status: current 188 Reference: [RFC2616] 190 2.6. httpRequestReferer 192 Description: 194 The Referer request-header field in an HTTP request message used 195 to specify the address (URI) of the resource from which the 196 Request-URI was obtained. 198 Abstract Data Type: string 200 Data Type Semantics: 202 ElementId: TBD06 204 Status: current 206 Reference: [RFC2616] 208 2.7. httpContentType 210 Description: 212 The Content-Type response-header field in an HTTP response message 213 indicating the type of the content. 215 Abstract Data Type: string 217 Data Type Semantics: 219 ElementId: TBD07 221 Status: current 223 Reference: [RFC2616] 225 2.8. httpOctetDeltaCount 227 Description: 229 The number of HTTP layer octets since the previous report (if any) 230 in incoming packets for this Flow at the Observation Point. The 231 number of octets includes HTTP message header(s) and message body. 233 Abstract Data Type: unsigned64 235 Data Type Semantics: deltaCounter 237 ElementId: TBD08 238 Status: current 240 Reference: 242 2.9. httpOctetTotalCount 244 Description: 246 The total number of HTTP layer octets in incoming packets for this 247 Flow at the Observation Point since the Metering Process 248 (re-)initialization for this Observation Point. The number of 249 octets includes HTTP message header(s) and message body. 251 Abstract Data Type: unsigned64 253 Data Type Semantics: totalCounter 255 ElementId: TBD09 257 Status: current 259 Reference: 261 2.10. dnsQueryName 263 Description: 265 The domain name a DNS query is made for. 267 Abstract Data Type: string 269 Data Type Semantics: 271 ElementId: TBD10 273 Status: current 275 Reference: [RFC1035] 277 2.11. dnsQueryType 279 Description: 281 A two octet code which specifies the type of a DNS query. 283 Abstract Data Type: unsigned16 285 Data Type Semantics: identifier 286 ElementId: TBD11 288 Status: current 290 Reference: [RFC1035] 292 2.12. dnsQueryDeltaCount 294 Description: 296 The number of incoming DNS query messages since the previous 297 report (if any) for this Flow at the Observation Point. The 298 number is counted at the DNS protocol layer, so possible 299 fragmentation at lower layer must not affect the counting. 301 Abstract Data Type: unsigned64 303 Data Type Semantics: deltaCounter 305 ElementId: TBD12 307 Status: current 309 Reference: 311 2.13. dnsQueryTotalCount 313 Description: 315 The total number of incoming DNS query message for this Flow at 316 the Observation Point since the Metering Process 317 (re-)initialization for this Observation Point. The number is 318 counted at the DNS protocol layer, so possible fragmentation at 319 lower layer must not affect the counting. 321 Abstract Data Type: unsigned64 323 Data Type Semantics: totalCounter 325 ElementId: TBD13 327 Status: current 329 Reference: 331 3. Security Considerations 333 TBD. 335 4. IANA Considerations 337 The document makes a request to IANA to register the Information 338 Elements defined in section 2. 340 5. Normative References 342 [I-D.ietf-ipfix-information-model-rfc5102bis] 343 Claise, B. and B. Trammell, "Information Model for IP Flow 344 Information eXport (IPFIX)", draft-ietf-ipfix-information- 345 model-rfc5102bis-10 (Work in Progress), February 2013. 347 [I-D.ietf-ipfix-protocol-rfc5101bis] 348 Claise, B., Trammell, B., Aitken, P., Bryant, S., Leinen, 349 S., and T. Dietz, "Specification of the IP Flow 350 Information eXport (IPFIX) Protocol for the Exchange of 351 Flow Information", draft-ietf-ipfix-protocol-rfc5101bis-08 352 (Work in Progress), June 2013. 354 [RFC1035] Mockapetris, P., "DOMAIN NAMES - IMPLEMENTATION AND 355 SPECIFICATION", RFC 1035, November 1987. 357 [RFC2616] Fielding, R., Gettys, J., and J. Mogul, "Hypertext 358 Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999. 360 [RFC5322] Resnick, P., "Internet Message Format", RFC 5322, October 361 2008. 363 Author's Address 365 Peng Fan 366 China Mobile 367 32 Xuanwumen West Street, Xicheng District 368 Beijing 100053 369 P.R. China 371 Email: fanpeng@chinamobile.com