Export of UDP Options Information in IP Flow Information Export (IPFIX)

Export of UDP Options Information in IP Flow Information Export (IPFIX) Orange

Rennes 35000 France mohamed.boucadair@orange.com

Nokia

India kondtir@gmail.com

OPS opsawg surplus area UDP options This document specifies new IP Flow Information Export (IPFIX) Information Elements for UDP Options.

Introduction IP Flow Information Export (IPFIX) is a protocol that is widely deployed in networks for traffic management purposes (). The protocol specifies the encoding of a set of basic data types and how the various Information Elements (IEs) are transmitted. In order to support the export of new Flow-related measurement data, new IEs can be defined and registered in a dedicated IANA registry for interoperability. This document specifies new IPFIX Information Elements for UDP Options (). A brief overview of UDP Options is provided in . The IE specified in uses the new abstract data type ("unsigned256") defined in . Transport (including MTU) considerations are discussed in . Examples to illustrate the use of the new IPFIX Information Elements are provided in .

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. This document uses the IPFIX-specific terminology (e.g., Flow) defined in . As in the base IPFIX specification , these IPFIX-specific terms have the first letter of a word capitalized. The document adheres to the naming conventions for Information Elements per . Also, this document uses the terms defined in , especially "datagram" and "surplus area".

UDP Options at a Glance UDP does not support an extension mechanism similar to the options supported by other transport protocols, such as TCP , Stream Control Transmission Protocol (SCTP) , or Datagram Congestion Control Protocol (DCCP) . Such a mechanism can be useful for various applications, e.g., to discover a path MTU or share timestamps. To fill that void, extends UDP with a mechanism to insert extensions in datagrams. To do so, and unlike the conventional approach that relies upon transport headers, uses trailers. Concretely, UDP Options are placed in the surplus area (that is, the area of an IP payload that follows a UDP packet). See . An example of the use of UDP Options for Datagram Packetization Layer Path MTU Discovery (DPLPMTUD) is described in .

Surplus Area +--------+---------+----------------------+------------------+ | IP Hdr | UDP Hdr | UDP user data | surplus area | +--------+---------+----------------------+------------------+ <------------------------------> UDP Length]]> Sections and introduce new IEs to export the observed UDP Options. UDP Options are unambiguously identified by means of a 1-byte field, called "Kind". Options indicated by Kind values in the range 0-191 are called SAFE Options. Such options can be silently ignored by legacy receivers because they do not alter the UDP user data (). SAFE Options are exported using the IE defined in . Options indicated by Kind values in the range 192-255 are called UNSAFE Options. Such options are not safe for legacy receivers to ignore because they alter the UDP user data (). UNSAFE Options are exported using the IE defined in . UDP Options occur per-packet within a Flow and can be inserted at any time in the Flow. reserves two options for experiments: the Experimental (EXP, Kind=127) Option for SAFE Options and the UNSAFE Experimental (UEXP, Kind=254) Option. For both options, Experiment Identifiers (ExIDs) are used to differentiate concurrent use of these options. Known ExIDs are expected to be registered within IANA. specifies a new IPFIX IE to export observed ExIDs in the EXP Options. Also, specifies a new IPFIX IE to export observed ExIDs in the UEXP Options. Only 16-bit ExIDs are supported in . This document does not intend to elaborate operational guidance/implications of UDP Options. The document focuses exclusively on exporting observed UDP Options in datagrams.

New UDP IPFIX Information Elements Given the Kind structure of SAFE and UNSAFE UDP Options, using one single IE that would multiplex both types of options will limit the benefits of reduced-size encoding in the presence of UNSAFE Options. For example, at least 24 octets would be needed to report mandatory SAFE Options that are observed in a Flow. In order to use less bits to report observed UDP Options, distinct IEs are thus defined to report SAFE () and UNSAFE () UDP Options. As further detailed in , only one octet is needed to report mandatory SAFE Options.

udpSafeOptions

Name:: udpSafeOptions
ElementID:: 525
Description:: Observed SAFE UDP Options in a Flow. The information is encoded in a set of bit fields.
: Options are mapped to bits according to their option numbers. UDP Option Kind 0 corresponds to the least significant bit in the udpSafeOptions IE, while Kind 191 corresponds to the 65th most significant bit of the IE. The bit is set to 1 if the corresponding SAFE UDP Option is observed at least once in the Flow. The bit is set to 0 if the option is never observed in the Flow. The 64 most significant bits MUST be set to 0.
: The reduced-size encoding per is followed whenever fewer octets are needed to report observed SAFE UDP Options. For example, if only option Kinds <= 31 are observed, then the value of the udpSafeOptions IE can be encoded as unsigned32, or if only option Kinds <= 63 are observed, then the value of the udpSafeOptions IE can be encoded as unsigned64.
: The presence of udpSafeExIDList is an indication that the SAFE Experimental Option is observed in a Flow. The presence of udpSafeExIDList takes precedence over setting the corresponding bit in the udpSafeOptions IE for the same Flow. In order to optimize the use of the reduced-size encoding in the presence of udpSafeExIDList IE, the Exporter MUST NOT set the EXP flag of the udpSafeOptions IE that is reported for the same Flow to 1.
Abstract Data Type:: unsigned256
Data Type Semantics:: flags
Additional Information:: See the "UDP Option Kind Numbers" registry at .
: See for more details about UDP Options.
Reference:: RFC 9870

udpUnsafeOptions

Name:: udpUnsafeOptions
ElementID:: 526
Description:: Observed UNSAFE UDP Options in a Flow. The information is encoded in a set of bit fields.
: Options are mapped to bits according to their option numbers. UDP Option Kind 192 corresponds to the least significant bit in the udpUnsafeOptions IE, while Kind 255 corresponds to the most significant bit of the IE. The bit is set to 1 if the corresponding UNSAFE UDP Option is observed at least once in the Flow. The bit is set to 0 if the option is never observed in the Flow.
: The reduced-size encoding per is followed whenever fewer octets are needed to report observed UNSAFE UDP Options.
: The presence of udpUnsafeExIDList is an indication that the UNSAFE Experimental Option is observed in a Flow. The presence of udpUnsafeExIDList takes precedence over setting the corresponding bit in the udpUnsafeOptions IE for the same Flow. In order to optimize the use of the reduced-size encoding in the presence of udpUnsafeExIDList IE, the Exporter MUST NOT set the UEXP flag of the udpUnsafeOptions IE that is reported for the same Flow to 1.
Abstract Data Type:: unsigned64
Data Type Semantics:: flags
Additional Information:: See the "UDP Option Kind Numbers" registry at .
: See for more details about UDP Options.
Reference:: RFC 9870

udpExID

Name:: udpExID
ElementID:: 527
Description:: Observed ExID in an Experimental (EXP, Kind=127) Option or an UNSAFE Experimental (UEXP, Kind=254) Option.
: A basicList of udpExID is used to report udpSafeExIDList and udpUnsafeExIDList values.
Abstract Data Type:: unsigned16
Data Type Semantics:: identifier
Additional Information:: See the "TCP/UDP Experimental Option Experiment Identifiers (TCP/UDP ExIDs)" registry at .
: See for more details about ExIDs.
Reference:: RFC 9870

udpSafeExIDList

Name:: udpSafeExIDList
ElementID:: 528
Description:: Observed ExIDs in the Experimental (EXP, Kind=127) Option.
: A basicList of udpExID Information Elements in which each udpExID Information Element carries the ExID observed in an EXP Option.
Abstract Data Type:: basicList
Data Type Semantics:: list
Additional Information:: See the "TCP/UDP Experimental Option Experiment Identifiers (TCP/UDP ExIDs)" registry at .
: See for more details about ExIDs.
Reference:: RFC 9870

udpUnsafeExIDList

Name:: udpUnsafeExIDList
ElementID:: 529
Description:: Observed ExIDs in the UNSAFE Experimental (UEXP, Kind=254) Option.
: A basicList of udpExID Information Elements in which each udpExID Information Element carries the ExID observed in an UEXP Option.
Abstract Data Type:: basicList
Data Type Semantics:: list
Additional Information:: See the "TCP/UDP Experimental Option Experiment Identifiers (TCP/UDP ExIDs)" registry at .
: See for more details about ExIDs.
Reference:: RFC 9870

Examples

Reduced-Size Encoding Given the UDP Kind allocation in and the option mapping defined in of this document, fewer octets are likely to be used for Flows with mandatory UDP Options. shows an example of the Kind/bit mappings in the udpSafeOptions IE for a Flow in which End of Options List (EOL, Kind=0) and Additional Payload Checksum (APC, Kind=2) Options are observed. Only the bits that corresponds to EOL and APC Options are set to 1.

An Example of udpSafeOptions IE with EOL and APC Options One octet is sufficient to report these observed options because the leading zeros are dropped per the reduced-size encoding guidance. Concretely, the reported udpSafeOptions IE will be set to 0x05 ().

An Example of the Wire udpSafeOptions IE Value with EOL and APC Options

SAFE Experimental Option Let us now consider a UDP Flow in which SAFE Experimental Options are observed. If a udpSafeOptions IE is exported for this Flow, then that IE will have the EXP bit set to 1 (). This example does not make any assumption about the presence of other UDP Options ("X" can be set to 0 or 1).

An Example of udpSafeOptions with EXP Option

ExIDs and Reduced-Size Encoding Now assume that EOL, APC, EXP, and UEXP Options are observed in a Flow. Let us also consider that the observed SAFE Experimental Options have ExIDs set to 0x9858 and 0xE2D4 and UNSAFE Experimental Options have ExIDs set to 0xC3D9 and 0x1234. shows an excerpt of the Data Set encoding with a focus on SAFE Experimental Options that have ExIDs. The fields are defined in .

Example of UDP Experimental Option ExID IEs Following the guidance in , the reported udpSafeOptions IE will be set to 0x05 even in the presence of EXP Options.

Security Considerations This document does not introduce new security considerations other than those already discussed in and . The reader may refer to for the security considerations related to UDP Options.

IANA Considerations

IPFIX Information Elements IANA has added the following new IEs to the "IPFIX Information Elements" registry under the "IP Flow Information Export (IPFIX) Entities" registry group : New IPFIX Information Elements

ElementID	Name	Reference
525	udpSafeOptions	of RFC 9870
526	udpUnsafeOptions	of RFC 9870
527	udpExID	of RFC 9870
528	udpSafeExIDList	of RFC 9870
529	udpUnsafeExIDList	of RFC 9870

udpSafeOptions uses the abstract data type ("unsigned256") defined in .

References Normative References Transport Options for UDP Independent Consultant Unaffiliated Informative References IP Flow Information Export (IPFIX) Entities IANA UDP Option Kind Numbers IANA TCP/UDP Experimental Option Experiment Identifiers (TCP/UDP ExIDs) IANA Datagram Packetization Layer Path MTU Discovery (DPLPMTUD) for UDP Options University of Aberdeen University of Aberdeen

Acknowledgments Thanks to for the discussion on the ordering of IPFIX IEs. Thanks to for the review and comments. Thanks to for the TSVART review, for the INTDIR review, for the GENART review, for the SECDIR review, and for the OPSDIR review. Thanks to for the shepherd review. Thanks to for the AD review. Thanks to , , and for the IESG review.