[IPFIX] Export Switch Port Identifier
Dominik Elsbroek <[email protected]>
| Newsgroups | gmane.ietf.ipfix |
|---|---|
| Message-ID | <CAAVMDnV5zakmbWVLK4zow8P-APOUmW4UtG4KuMMrp=X+NR80ag@mail.gmail.com> |
Hi list, I am currently working on an lightweight network intrusion detection system based on IPFIX flow-records. A was seeking for an element that identifies the switch or router port at which the traffic described by flow-record has emerged. This is needed to detect for MAC Address spoofing and might be useful in some more scenarios. Is there such a field? I would expect such a field to be defined in RFC 5102 or any RFC updating RFC 5102? I just found transport layer ports of exporter and collector. Any hints and help are very appreciated. Kind regards, Dominik _______________________________________________ IPFIX mailing list [email protected] https://www.ietf.org/mailman/listinfo/ipfix