Re: [IPFIX] Export Switch Port Identifier

Hi Tarun, hi Andrew,

thank you very much for your help. Both fields will help me with my
work I think.

Thank you very much!
Dominik


On Fri, Jun 29, 2012 at 4:26 PM, Andrew Feren <[email protected]> wrote:
> Hi Dominik,
>
> Tarun is right about the ingress/egress interface fields.
>
> For a current list of information elements your best source is probably
> IANA ( https://www.iana.org/assignments/ipfix/ipfix.xml)
>
> -Andrew
>
>
> On 06/29/2012 07:40 AM, Tarun Saxena (tasaxena) wrote:
>
> Dominik,
>
> By emerged, do you mean "entered" the router/switch or "exited" it? This is
> very basic information and is available in ingressInterface/egressinterface
> fields.
>
> Thanks
> Tarun
>
> -----Original Message-----
> From: [email protected] [mailto:[email protected]] On Behalf Of
> Dominik Elsbroek
> Sent: Friday, June 29, 2012 12:29 PM
> To: [email protected]
> Subject: [IPFIX] Export Switch Port Identifier
>
> Hi list,
>
> I am currently working on an lightweight network intrusion detection
> system based on IPFIX flow-records. A was seeking for an element that
> identifies the switch or router port at which the traffic described by
> flow-record has emerged. This is needed to detect for MAC Address
> spoofing and might be useful in some more scenarios.
>
> Is there such a field? I would expect such a field to be defined in
> RFC 5102 or any RFC updating RFC 5102? I just found transport layer
> ports of exporter and collector. Any hints and help are very
> appreciated.
>
> Kind regards,
> Dominik
> _______________________________________________
> IPFIX mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/ipfix
> _______________________________________________
> IPFIX mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/ipfix
>
>
>
> _______________________________________________
> IPFIX mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/ipfix
>
_______________________________________________
IPFIX mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipfix