En la siguiente tabla, se enumeran las definiciones de elementos de información de IPFIX.
| 384 | valueDistributionMethod | Una descripción del método utilizado para distribuir los contadores de los flujos contribuyentes a los registros de flujo agregados descritos por un ámbito asociado, por lo general, una plantilla. Se considera que el método se aplica a todos los elementos de información que no sean clave en el ámbito al que se hace referencia donde la distribución de valores es una operación válida. Si los elementos de información originalFlowsInitiated y/o originalFlowsCompleted aparecen en la plantilla, no están sujetos a este método de distribución, ya que cada uno infiere su propio método de distribución. Esto está pensado como un conjunto completo de métodos de distribución de valores posibles; se codifica de la siguiente manera: +-------+-----------------------------------------------------------+ | Value | Description | +-------+-----------------------------------------------------------+ | 0 | Unspecified: The counters for an Original Flow are | | | explicitly not distributed according to any other method | | | defined for this Information Element; use for arbitrary | | | distribution, or distribution algorithms not described by | | | any other codepoint. | | | --------------------------------------------------------- | | | | | 1 | Start Interval: The counters for an Original Flow are | | | added to the counters of the appropriate Aggregated Flow | | | containing the start time of the Original Flow. This | | | must be assumed the default if value distribution | | | information is not available at a Collecting Process for | | | an Aggregated Flow. | | | --------------------------------------------------------- | | | | | 2 | End Interval: The counters for an Original Flow are added | | | to the counters of the appropriate Aggregated Flow | | | containing the end time of the Original Flow. | | | --------------------------------------------------------- | | | | | 3 | Mid Interval: The counters for an Original Flow are added | | | to the counters of a single appropriate Aggregated Flow | | | containing some timestamp between start and end time of | | | the Original Flow. | | | --------------------------------------------------------- | | | | | 4 | Simple Uniform Distribution: Each counter for an Original | | | Flow is divided by the number of time intervals the | | | Original Flow covers (that is, of appropriate Aggregated | | | Flows sharing the same Flow Key), and this number is | | | added to each corresponding counter in each Aggregated | | | Flow. | | | --------------------------------------------------------- | | | | | 5 | Proportional Uniform Distribution: Each counter for an | | | Original Flow is divided by the number of time units the | | | Original Flow covers, to derive a mean count rate. This | | | mean count rate is then multiplied by the number of times | | | units in the intersection of the duration of the Original | | | Flow and the time interval of each Aggregated Flow. This | | | is like simple uniform distribution, but accounts for the | | | fractional portions of a time interval covered by an | | | Original Flow in the first- and last-time interval. | | | --------------------------------------------------------- | | | | | 6 | Simulated Process: Each counter of the Original Flow is | | | distributed among the intervals of the Aggregated Flows | | | according to some function the Intermediate Aggregation | | | Process uses based upon properties of Flows presumed to | | | be like the Original Flow. This is essentially an | | | assertion that the Intermediate Aggregation Process has | | | no direct packet timing information but is nevertheless | | | not using one of the other simpler distribution methods. | | | The Intermediate Aggregation Process specifically makes | | | no assertion as to the correctness of the simulation. | | | --------------------------------------------------------- | | | | | 7 | Direct: The Intermediate Aggregation Process has access | | | to the original packet timings from the packets making up | | | the Original Flow, and uses these to distribute or | | | recalculate the counters. | +-------+-----------------------------------------------------------+ |
| 239 | biflowDirection | Una descripción del método de asignación de direcciones utilizado para asignar el origen y el destino en doble dirección. Este elemento de información puede estar presente en un registro de datos de flujo o aplicarse a todos los flujos exportados desde un proceso de exportación o un dominio de observación con las opciones de IPFIX. Si este elemento de información no está presente en un registro de flujos o está asociado a una doble dirección a través de un ámbito, se supone que la configuración del método de asignación de dirección se realiza fuera de banda.
Nota: Cuando se utilizan las opciones de IPFIX para aplicar este elemento de información a todos los flujos dentro de un dominio de observación o desde un proceso de exportación, la opción debe enviarse de manera confiable. Si no hay disponible un transporte confiable (es decir, cuando se utiliza UDP), este elemento de información debe aparecer en cada registro de flujo.
Este campo puede tener los siguientes valores: +-------+------------------+----------------------------------------+ | Value | Name | Description | +-------+------------------+----------------------------------------+ | 0x00 | arbitrary | Direction is assigned arbitrarily. | | 0x01 | initiator | The Biflow Source is the flow | | | | initiator, as determined by the | | | | Metering Process' best effort to | | | | detect the initiator. | | 0x02 | reverseInitiator | The Biflow Destination is the flow | | | | initiator, as determined by the | | | | Metering Process' best effort to | | | | detect the initiator. This value is | | | | provided for the convenience of | | | | Exporting Processes to revise an | | | | initiator estimate without re-encoding | | | | the Biflow Record. | | 0x03 | perimeter | The Biflow Source is the endpoint | | | | outside of a defined perimeter. The | | | | perimeter's definition is implicit in | | | | the set of Biflow Source and Biflow | | | | Destination addresses exported in the | | | | Biflow Records. | +-------+------------------+----------------------------------------+ |
