IPFIX templates provides the visibility into the VXLAN and non- VXLAN flows. The templates have additional parameters that provide more information regarding the encapsulated traffic.
The templates are supported in vSphere Distributed Switch (exporter). IPFIX support on vSphere Distributed Switch provides the required visibility into the virtual machine flows and VXLAN flows. If you are using any third party collector tool , you can use additional information available in the templates to provide correlation between the internal and external flows and the port connections.
The following table describes the information elements that are used in the IPFIX templates of the logical switch.
| Name | Data Type | Size (Octet) | Description |
|---|---|---|---|
| sourceIPv4Address | ipv4Address | 4 | The IPv4 source address in the IP packet header. |
| destinationIPv4Address | ipv4Address | 4 | The IPv4 destination address in the IP packet header. |
| sourceIPv6Address | ipv6Address | 16 | The IPv6 source address in the IP packet header. |
| destinationIPv6Address | ipv^Address | 16 | The IPv6 destination address in the IP packet header. |
| octetDeltaCount | unsigned64 | 8 | The number of octets since the previous report (if any) in incoming packets for the flow at the observation point. The number of octets includes IP headers and IP payload. |
| packetDeltaCount | unsigned64 | 8 | The number of incoming packets since the previous report (if any) for the flow at the observation point. |
| flowStartSysUpTime | unsigned32 | 8 | The relative timestamp of the first packet of the flow. It indicates the number of milliseconds since the last reinitialization of the IPFIX device (sysUpTime). |
| flowEndSysUpTime | unsigned32 | 8 | The relative timestamp of the last packet of the flow. It indicates the number of milliseconds since the last reinitialization of the IPFIX device (sysUpTime). |
| sourceTransportPort | unsigned16 | 2 | The source port identifier in the transport header |
| destinationTransportPort | unsigned16 | 2 | The destination port identifier in the transport header |
| ingressInterface | unsigned32 | 4 | The index of the IP interface where packets of the flow are received. |
| egressInterface | unsigned32 | 4 | The index of the IP interface where packets of the flow are sent. |
| vxlanId | unsigned64 | 8 | Identifier of a layer 2 network segment in an overlay network. The most significant byte identifies the layer 2 network overlay network encapsulation type:
The lowest three significant bytes hold the value of the layer 2 overlay network segment identifier.
For example:
|
| protocolIdentifier | unsigned8 | 1 | The value of the protocol number in the IP packet header. |
| flowEndReason | unsigned8 | 1 | The reason for terminating the flow. Valid values are:
|
| tcpFlags | unsigned8 | 1 | TCP control bits observed for the packets of the flow. This information is encoded as a bit field. For each TCP control bit, there is a bit in this set. The bit is set to 1 if any observed packet of the flow has the corresponding TCP control bit set to 1. The bit is cleared to 0 otherwise. |
| IPv4TOS | unsigned8 | 1 | The value of the TOS field in the IPv4 packet header. |
| IPv6TOS | unsigned8 | 1 | The value of the Traffic Class field in the IPv6 packet header. |
| maxTTL | unsigned8 | 1 | Maximum TTL value observed for any packet in the flow. |
| flowDir | unsigned8 | 1 | The direction of the flow observed at the observation point. Valid values are:
|
| ingressInterfaceAttr | unsigned16 | 2 | The ingress interface attributes can take the following values based on type of the port:
|
| egressInterfaceAttr | unsigned16 | 2 | The egress interface attributes can take the following values based on type of the port:
|
| vxlanExportRole | unsigned8 | 1 | Defines whether the exporter is an ESXi host or any other network device. IPFIX_END_POINT 0X01 means host is exporting the data. If other devices export the IPFIX templates, this field might have a different value (not defined yet). |
| paddingOctets | OctetArray | 1 | A sequence of 0x00 values. |
| tenantSourceIPv4 | ipv4Address | 4 | The IPv4 source address in the IP header of the tenant packet, which is inside of the IP packet. |
| tenantDestIPv4 | ipv4Address | 4 | The IPv4 destination address in the IP header of the tenant packet, which is inside of the IP packet. |
| tenantSourceIPv6 | ipv6Address | 16 | The IPv6 source address in the IP header of the tenant packet, which is inside of the IP packet. |
| tenantDestIPv6 | ipv6Address | 16 | The IPv6 destination address in the IP header of the tenant packet, which is inside of the IP packet. |
| tenantSourcePort | unsigned16 | 2 | The source port identifier in the transport header of the tenant packet, which is inside of the IP packet. |
| tenantDestPort | unsigned16 | 2 | The destination port identifier in the transport header of the tenant packet, which is inside of the IP packet. |
| tenantProtocol | unsigned8 | 1 | The value of the protocol number in the IP header of the tenant packet, which is inside of the IP packet. |
IPv4 Template
IPFIX_TEMPLATE_START(IPFIX_FLOW_TYPE_IPv4) IPFIX_TEMPLATE_FIELD(sourceIPv4Address, 4) IPFIX_TEMPLATE_FIELD(destinationIPv4Address, 4) IPFIX_TEMPLATE_FIELD(octetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(packetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(flowStartSysUpTime, 8) IPFIX_TEMPLATE_FIELD(flowEndSysUpTime, 8) IPFIX_TEMPLATE_FIELD(sourceTransportPort, 2) IPFIX_TEMPLATE_FIELD(destinationTransportPort, 2) IPFIX_TEMPLATE_FIELD(ingressInterface, 4) IPFIX_TEMPLATE_FIELD(egressInterface, 4) IPFIX_TEMPLATE_FIELD(vxlanId, 8) IPFIX_TEMPLATE_FIELD(protocolIdentifier, 1) IPFIX_TEMPLATE_FIELD(flowEndReason, 1) IPFIX_TEMPLATE_FIELD(tcpFlags, 1) IPFIX_TEMPLATE_FIELD(IPv4TOS, 1) IPFIX_TEMPLATE_FIELD(maxTTL, 1) IPFIX_TEMPLATE_FIELD(flowDir, 1) // Specify the Interface port- Uplink Port, Access port,N.A IPFIX_VMW_TEMPLATE_FIELD(ingressInterfaceAttr, 2) IPFIX_VMW_TEMPLATE_FIELD(egressInterfaceAttr, 2) IPFIX_VMW_TEMPLATE_FIELD(vxlanExportRole, 1) IPFIX_TEMPLATE_PADDING(paddingOctets, 1) IPFIX_TEMPLATE_END()
IPv4 VXLAN Template
IPFIX_TEMPLATE_START(IPFIX_FLOW_TYPE_IPv4_VXLAN) IPFIX_TEMPLATE_FIELD(sourceIPv4Address, 4) IPFIX_TEMPLATE_FIELD(destinationIPv4Address, 4) IPFIX_TEMPLATE_FIELD(octetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(packetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(flowStartSysUpTime, 8) IPFIX_TEMPLATE_FIELD(flowEndSysUpTime, 8) IPFIX_TEMPLATE_FIELD(sourceTransportPort, 2) IPFIX_TEMPLATE_FIELD(destinationTransportPort, 2) IPFIX_TEMPLATE_FIELD(ingressInterface, 4) IPFIX_TEMPLATE_FIELD(egressInterface, 4) IPFIX_TEMPLATE_FIELD(protocolIdentifier, 1) IPFIX_TEMPLATE_FIELD(flowEndReason, 1) IPFIX_TEMPLATE_FIELD(tcpFlags, 1) IPFIX_TEMPLATE_FIELD(IPv4TOS, 1) IPFIX_TEMPLATE_FIELD(maxTTL, 1) IPFIX_TEMPLATE_FIELD(flowDir, 1) IPFIX_TEMPLATE_FIELD(vxlanId, 8) IPFIX_VMW_TEMPLATE_FIELD(tenantSourceIPv4, 4) IPFIX_VMW_TEMPLATE_FIELD(tenantDestIPv4, 4) IPFIX_VMW_TEMPLATE_FIELD(tenantSourcePort, 2) IPFIX_VMW_TEMPLATE_FIELD(tenantDestPort, 2) IPFIX_VMW_TEMPLATE_FIELD(tenantProtocol, 1) // Specify the Interface port- Uplink Port, Access port,N.A IPFIX_VMW_TEMPLATE_FIELD(ingressInterfaceAttr, 2) IPFIX_VMW_TEMPLATE_FIELD(egressInterfaceAttr, 2) // TUNNEL-GW or no. IPFIX_VMW_TEMPLATE_FIELD(vxlanExportRole, 1) IPFIX_TEMPLATE_END()
IPv4 ICMP VXLAN Template
IPFIX_TEMPLATE_START(IPFIX_FLOW_TYPE_IPv4_ICMP_VXLAN) IPFIX_TEMPLATE_FIELD(sourceIPv4Address, 4) IPFIX_TEMPLATE_FIELD(destinationIPv4Address, 4) IPFIX_TEMPLATE_FIELD(octetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(packetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(flowStartSysUpTime, 8) IPFIX_TEMPLATE_FIELD(flowEndSysUpTime, 8) IPFIX_TEMPLATE_FIELD(sourceTransportPort, 2) IPFIX_TEMPLATE_FIELD(destinationTransportPort, 2) IPFIX_TEMPLATE_FIELD(ingressInterface, 4) IPFIX_TEMPLATE_FIELD(egressInterface, 4) IPFIX_TEMPLATE_FIELD(protocolIdentifier, 1) IPFIX_TEMPLATE_FIELD(flowEndReason, 1) IPFIX_TEMPLATE_FIELD(IPv4TOS, 1) IPFIX_TEMPLATE_FIELD(maxTTL, 1) IPFIX_TEMPLATE_FIELD(flowDir, 1) IPFIX_TEMPLATE_FIELD(vxlanId, 8) IPFIX_VMW_TEMPLATE_FIELD(tenantSourceIPv4, 4) IPFIX_VMW_TEMPLATE_FIELD(tenantDestIPv4, 4) IPFIX_VMW_TEMPLATE_FIELD(tenantProtocol, 1) // Specify the Interface port- Uplink Port, Access port,N.A IPFIX_VMW_TEMPLATE_FIELD(ingressInterfaceAttr, 2) IPFIX_VMW_TEMPLATE_FIELD(egressInterfaceAttr, 2) // TUNNEL-GW or no. IPFIX_VMW_TEMPLATE_FIELD(vxlanExportRole, 1) IPFIX_TEMPLATE_PADDING(paddingOctets, 1) IPFIX_TEMPLATE_END()
IPv4 ICMP Template
IPFIX_TEMPLATE_START(IPFIX_FLOW_TYPE_IPv4_ICMP) IPFIX_TEMPLATE_FIELD(sourceIPv4Address, 4) IPFIX_TEMPLATE_FIELD(destinationIPv4Address, 4) IPFIX_TEMPLATE_FIELD(octetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(packetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(flowStartSysUpTime, 8) IPFIX_TEMPLATE_FIELD(flowEndSysUpTime, 8) IPFIX_TEMPLATE_FIELD(ingressInterface, 4) IPFIX_TEMPLATE_FIELD(egressInterface, 4) IPFIX_TEMPLATE_FIELD(protocolIdentifier, 1) IPFIX_TEMPLATE_FIELD(flowEndReason, 1) IPFIX_TEMPLATE_FIELD(IPv4TOS, 1) IPFIX_TEMPLATE_FIELD(maxTTL, 1) IPFIX_TEMPLATE_FIELD(flowDir, 1) IPFIX_TEMPLATE_FIELD(vxlanId, 8) // Specify the Interface port- Uplink Port, Access Port,or NA. IPFIX_VMW_TEMPLATE_FIELD(ingressInterfaceAttr, 2) IPFIX_VMW_TEMPLATE_FIELD(egressInterfaceAttr, 2) IPFIX_VMW_TEMPLATE_FIELD(vxlanExportRole, 1) IPFIX_TEMPLATE_PADDING(paddingOctets, 2) IPFIX_TEMPLATE_END()
IPv6 ICMP VXLAN Template
IPFIX_TEMPLATE_START(IPFIX_FLOW_TYPE_IPv6_ICMP_VXLAN) IPFIX_TEMPLATE_FIELD(sourceIPv4Address, 4) IPFIX_TEMPLATE_FIELD(destinationIPv4Address, 4) IPFIX_TEMPLATE_FIELD(octetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(packetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(flowStartSysUpTime, 8) IPFIX_TEMPLATE_FIELD(flowEndSysUpTime, 8) IPFIX_VMW_TEMPLATE_FIELD(sourceTransportPort, 2) IPFIX_VMW_TEMPLATE_FIELD(destinationTransportPort, 2) IPFIX_TEMPLATE_FIELD(ingressInterface, 4) IPFIX_TEMPLATE_FIELD(egressInterface, 4) IPFIX_TEMPLATE_FIELD(protocolIdentifier, 1) IPFIX_TEMPLATE_FIELD(IPv6TOS, 1) IPFIX_TEMPLATE_FIELD(maxTTL, 1) IPFIX_TEMPLATE_FIELD(flowDir, 1) IPFIX_TEMPLATE_FIELD(flowEndReason, 1) //VXLAN Specific IPFIX_TEMPLATE_FIELD(vxlanId, 8) IPFIX_VMW_TEMPLATE_FIELD(tenantSourceIPv6, 16) IPFIX_VMW_TEMPLATE_FIELD(tenantDestIPv6, 16) IPFIX_VMW_TEMPLATE_FIELD(tenantProtocol, 1) // Specify the Interface port- Uplink Port, Access Port, or NA. IPFIX_VMW_TEMPLATE_FIELD(ingressInterfaceAttr, 2) IPFIX_VMW_TEMPLATE_FIELD(egressInterfaceAttr, 2) // TUNNEL-GW or no. IPFIX_VMW_TEMPLATE_FIELD(vxlanExportRole, 1) IPFIX_TEMPLATE_PADDING(paddingOctets, 1) IPFIX_TEMPLATE_END()
IPv6 ICMP Template
IPFIX_TEMPLATE_START(IPFIX_FLOW_TYPE_IPv6_ICMP) IPFIX_TEMPLATE_FIELD(sourceIPv6Address, 16) IPFIX_TEMPLATE_FIELD(destinationIPv6Address, 16) IPFIX_TEMPLATE_FIELD(octetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(packetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(flowStartSysUpTime, 8) IPFIX_TEMPLATE_FIELD(flowEndSysUpTime, 8) IPFIX_TEMPLATE_FIELD(ingressInterface, 4) IPFIX_TEMPLATE_FIELD(egressInterface, 4) IPFIX_TEMPLATE_FIELD(protocolIdentifier, 1) IPFIX_TEMPLATE_FIELD(flowEndReason, 1) IPFIX_TEMPLATE_FIELD(IPv6TOS, 1) IPFIX_TEMPLATE_FIELD(maxTTL, 1) IPFIX_TEMPLATE_FIELD(flowDir, 1) IPFIX_TEMPLATE_FIELD(vxlanId, 8) // Specify the Interface port- Uplink Port, Access Port,or NA. IPFIX_VMW_TEMPLATE_FIELD(ingressInterfaceAttr, 2) IPFIX_VMW_TEMPLATE_FIELD(egressInterfaceAttr, 2) IPFIX_VMW_TEMPLATE_FIELD(vxlanExportRole, 1) IPFIX_TEMPLATE_PADDING(paddingOctets, 2) IPFIX_TEMPLATE_END()
IPv6 Template
IPFIX_TEMPLATE_START(IPFIX_FLOW_TYPE_IPv6) IPFIX_TEMPLATE_FIELD(sourceIPv6Address, 16) IPFIX_TEMPLATE_FIELD(destinationIPv6Address, 16) IPFIX_TEMPLATE_FIELD(octetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(packetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(flowStartSysUpTime, 8) IPFIX_TEMPLATE_FIELD(flowEndSysUpTime, 8) IPFIX_TEMPLATE_FIELD(sourceTransportPort, 2) IPFIX_TEMPLATE_FIELD(destinationTransportPort, 2) IPFIX_TEMPLATE_FIELD(ingressInterface, 4) IPFIX_TEMPLATE_FIELD(egressInterface, 4) IPFIX_TEMPLATE_FIELD(vxlanId, 8) IPFIX_TEMPLATE_FIELD(protocolIdentifier, 1) IPFIX_TEMPLATE_FIELD(flowEndReason, 1) IPFIX_TEMPLATE_FIELD(tcpFlags, 1) IPFIX_TEMPLATE_FIELD(IPv6TOS,1) IPFIX_TEMPLATE_FIELD(maxTTL, 1) IPFIX_TEMPLATE_FIELD(flowDir, 1) // Specify the Interface port- Uplink Port, Access Port, or NA. IPFIX_VMW_TEMPLATE_FIELD(ingressInterfaceAttr, 2) IPFIX_VMW_TEMPLATE_FIELD(egressInterfaceAttr, 2) IPFIX_VMW_TEMPLATE_FIELD(vxlanExportRole, 1) IPFIX_TEMPLATE_PADDING(paddingOctets, 1) IPFIX_TEMPLATE_END()
IPv6 VXLAN Template
IPFIX_TEMPLATE_FIELD(sourceIPv4Address, 4) IPFIX_TEMPLATE_FIELD(destinationIPv4Address, 4) IPFIX_TEMPLATE_FIELD(octetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(packetDeltaCount, 8) IPFIX_TEMPLATE_FIELD(flowStartSysUpTime, 8) IPFIX_TEMPLATE_FIELD(flowEndSysUpTime, 8) IPFIX_TEMPLATE_FIELD(sourceTransportPort, 2) IPFIX_TEMPLATE_FIELD(destinationTransportPort, 2) IPFIX_TEMPLATE_FIELD(ingressInterface, 4) IPFIX_TEMPLATE_FIELD(egressInterface, 4) IPFIX_TEMPLATE_FIELD(protocolIdentifier, 1) IPFIX_TEMPLATE_FIELD(flowEndReason, 1) IPFIX_TEMPLATE_FIELD(tcpFlags, 1) IPFIX_TEMPLATE_FIELD(IPv6TOS, 1) IPFIX_TEMPLATE_FIELD(maxTTL, 1) IPFIX_TEMPLATE_FIELD(flowDir, 1) //VXLAN specific IPFIX_TEMPLATE_FIELD(vxlanId, 8) IPFIX_VMW_TEMPLATE_FIELD(tenantSourceIPv6, 16) IPFIX_VMW_TEMPLATE_FIELD(tenantDestIPv6, 16) IPFIX_VMW_TEMPLATE_FIELD(tenantSourcePort, 2) IPFIX_VMW_TEMPLATE_FIELD(tenantDestPort, 2) IPFIX_VMW_TEMPLATE_FIELD(tenantProtocol, 1) // Specify the Interface port- Uplink Port, Access Port,or NA. IPFIX_VMW_TEMPLATE_FIELD(ingressInterfaceAttr, 2) IPFIX_VMW_TEMPLATE_FIELD(egressInterfaceAttr, 2) // TUNNEL-GW or no. IPFIX_VMW_TEMPLATE_FIELD(vxlanExportRole, 1) IPFIX_TEMPLATE_END()
