Export of Path Segment Identifier Information in IPFIX

Abstract

This document introduces a new IPFIX Information Element to identify the Path Segment Identifier(PSID) in the SRH for SRv6 path identification purpose.¶

1. Introduction

[RFC9487] introduces new IP Flow Information Export (IPFIX) Information Elements (IEs) to identify a set of information related to Segment Routing over IPv6 (SRv6). For the SRv6 segment list, two IPFIX IPv6 SRH IEs are defined in [RFC9487], srhSegmentIPv6BasicList (elementID:496) and srhSegmentIPv6ListSection (elementID:497), both encoding the Segment List in the SRH starting from Segment List[0].¶

When monitoring a traffic flow in an SR network, a typical use case is to answer the following questions:¶

• How many packets are steered into an certain SR path ?¶
• Which SR Policy or candidate path or segment list this SR path belongs to ?¶

To answer these questions, when exporting the flow record using IPFIX messages, the SR path information needs to be included.¶

An SRv6 path could be identified by the content of a segment list in IPFIX using IE496 or IE497, but the segment list is not always the best key identifier due to the following reasons:¶

• When a segment list contains many SIDs, the size of IPFIX message (especially the data record) would be large, making the collecting and analyzing of flow records inefficient.¶
• In the cases that different SRv6 policies use the same segment list for traffic steering, it is difficult to distinguish the traffic flow of different SRv6 policies.¶
• An SRv6 path may not be identified by the segment list carried by the SRH in reduced mode [RFC8754] as the first SID is not present in the SRH.¶

Path Segment is a type of Segment Routing (SR) segment, and a Path Segment Identifier (PSID) is used to identify an SR path. PSID in SRv6 networks is defined in [I-D.ietf-spring-srv6-path-segment]. In SRH, the PSID appears as the last entry in the segment list.¶

This document introduces a new IPFIX Information Element to identify the Path Segment Identifier(PSID) in the SRH for SRv6 path identification purpose.¶

2. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

This document makes use of the terms defined in [RFC7011], [RFC8402], and [RFC8754].¶

The following terms are used as defined in [RFC7011]:¶

• IPFIX¶
• IPFIX Information Elements¶
• Metering Process¶
• Template Record¶
• Data Record¶
• Collector¶

The following terms are used as defined in [RFC8402]:¶

• Segment Routing (SR)¶
• Segment List¶
• SRv6¶

The following terms are used as defined in [RFC8754]:¶

• SRH¶
• Last Entry¶

3. IANA Considerations

This document requests IANA to create one new IE under the "IPFIX Information Elements" registry [RFC7012] available at [IANA-IPFIX].¶

     +-------+--------------------------------+
     |Element|              Name              |
     |   ID  |                                |
     +-------+--------------------------------+
     | TBD1  |      srhPSID                   |
     +-------+--------------------------------+

ElementID:

TBD1¶

Name:

srhPSID¶

Abstract Data Type:

ipv6Address¶

Data Type Semantics:

default¶

Description:

The 128-bit IPv6 address that represents an SRv6 PSID.¶

Additional Information:

Specified in Section 3 of [I-D.ietf-spring-srv6-path-segment].¶

Reference:

This document¶

4. Operational Considerations

As specified in [I-D.ietf-spring-srv6-path-segment], the P-flag in the SRH is set to indicate the presence of PSID. In order to generate Flow Records with PSID included, the metering process MUST understand the P-flag. Only when the P-flag is set SHOULD the metering process capture the last entry in the SRH to get the PSID. If the P-flag in the packet is unset, when the srhPSID appears in the template record, the corresponding field in the data record is RECOMMENDED to set to all zero.¶

After decoding the IPFIX messages to get the flow record with PSID included in it at the collector, the collector might process the flow record locally or send it to an analyzer for further analysis purpose. In order to recognize the SR path, the analysis node SHOULD be aware of which SR path the PSID identifies. How to get this information the is out of the scope of this document.¶

The IE srhPSID can be used together with srhSegmentIPv6BasicList or srhSegmentIPv6ListSection. As in [I-D.ietf-spring-srv6-path-segment] section 3, the PSID allocate metering is depending on the use case, including:¶

• each segment list may have its own PSID with different value;¶
• the same PSID may be used for some or all the segment list under a Candidate path;¶
• the same PSID may be used for some or all Candidate Path within an SRv6 policy.¶

So if srhPSID and srhSegmentIPv6BasicList/srhSegmentIPv6ListSection appear together, the srhPSID MAY be used to identify an SR Policy or candidate path, and the information carried in srhSegmentIPv6BasicList/srhSegmentIPv6ListSection shows the detailed segment list belonging to this SR Policy or candidate path. This document does not limit how to use srhPSID and the detail is out of scope.¶

5. Security Considerations

There are no additional security considerations regarding allocation of these new IPFIX IEs compared to [RFC7012].¶

Other security considerations for SRv6 PSID described in [I-D.ietf-spring-srv6-path-segment] apply to this document.¶

6. References