Re: [IPFIX] Export Switch Port Identifier
"Tarun Saxena (tasaxena)" <[email protected]>
| Newsgroups | gmane.ietf.ipfix |
|---|---|
| Message-ID | <[email protected]> |
Dominik, By emerged, do you mean "entered" the router/switch or "exited" it? This is very basic information and is available in ingressInterface/egressinterface fields. Thanks Tarun -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Dominik Elsbroek Sent: Friday, June 29, 2012 12:29 PM To: [email protected] Subject: [IPFIX] Export Switch Port Identifier Hi list, I am currently working on an lightweight network intrusion detection system based on IPFIX flow-records. A was seeking for an element that identifies the switch or router port at which the traffic described by flow-record has emerged. This is needed to detect for MAC Address spoofing and might be useful in some more scenarios. Is there such a field? I would expect such a field to be defined in RFC 5102 or any RFC updating RFC 5102? I just found transport layer ports of exporter and collector. Any hints and help are very appreciated. Kind regards, Dominik _______________________________________________ IPFIX mailing list [email protected] https://www.ietf.org/mailman/listinfo/ipfix _______________________________________________ IPFIX mailing list [email protected] https://www.ietf.org/mailman/listinfo/ipfix