Re: [IPFIX] Export Switch Port Identifier

Hi Dominik,

Tarun is right about the ingress/egress interface fields.

For a current list of information elements your best source is probably 
IANA ( https://www.iana.org/assignments/ipfix/ipfix.xml)

-Andrew

On 06/29/2012 07:40 AM, Tarun Saxena (tasaxena) wrote:
> Dominik,
>
> By emerged, do you mean "entered" the router/switch or "exited" it? This is very basic information and is available in ingressInterface/egressinterface fields.
>
> Thanks
> Tarun
>
> -----Original Message-----
> From: [email protected] [mailto:[email protected]] On Behalf Of Dominik Elsbroek
> Sent: Friday, June 29, 2012 12:29 PM
> To: [email protected]
> Subject: [IPFIX] Export Switch Port Identifier
>
> Hi list,
>
> I am currently working on an lightweight network intrusion detection
> system based on IPFIX flow-records. A was seeking for an element that
> identifies the switch or router port at which the traffic described by
> flow-record has emerged. This is needed to detect for MAC Address
> spoofing and might be useful in some more scenarios.
>
> Is there such a field? I would expect such a field to be defined in
> RFC 5102 or any RFC updating RFC 5102? I just found transport layer
> ports of exporter and collector. Any hints and help are very
> appreciated.
>
> Kind regards,
> Dominik
> _______________________________________________
> IPFIX mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/ipfix
> _______________________________________________
> IPFIX mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/ipfix

_______________________________________________
IPFIX mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipfix