Le tableau suivant répertorie les définitions des éléments d'informations IPFIX.
| 384 | valueDistributionMethod | Description de la méthode utilisée pour distribuer les compteurs provenant des flux impliqués dans les enregistrements de flux agrégés décrits par une étendue associée, en général un modèle. La méthode est considérée comme s'appliquant à tous les éléments d'information non clés dans l'étendue référencée pour laquelle la distribution de valeurs est une opération valide. Si les éléments d'informations originalFlowsInitiated et/ou originalFlowsCompleted s'affichent dans le modèle, ils ne sont pas soumis à cette méthode de distribution, car ils déduisent chacun leur propre méthode de distribution. Il vise à être un ensemble complet de méthodes de distribution de valeurs possibles. Il est encodé comme suit : +-------+-----------------------------------------------------------+ | Value | Description | +-------+-----------------------------------------------------------+ | 0 | Unspecified: The counters for an Original Flow are | | | explicitly not distributed according to any other method | | | defined for this Information Element; use for arbitrary | | | distribution, or distribution algorithms not described by | | | any other codepoint. | | | --------------------------------------------------------- | | | | | 1 | Start Interval: The counters for an Original Flow are | | | added to the counters of the appropriate Aggregated Flow | | | containing the start time of the Original Flow. This | | | must be assumed the default if value distribution | | | information is not available at a Collecting Process for | | | an Aggregated Flow. | | | --------------------------------------------------------- | | | | | 2 | End Interval: The counters for an Original Flow are added | | | to the counters of the appropriate Aggregated Flow | | | containing the end time of the Original Flow. | | | --------------------------------------------------------- | | | | | 3 | Mid Interval: The counters for an Original Flow are added | | | to the counters of a single appropriate Aggregated Flow | | | containing some timestamp between start and end time of | | | the Original Flow. | | | --------------------------------------------------------- | | | | | 4 | Simple Uniform Distribution: Each counter for an Original | | | Flow is divided by the number of time intervals the | | | Original Flow covers (that is, of appropriate Aggregated | | | Flows sharing the same Flow Key), and this number is | | | added to each corresponding counter in each Aggregated | | | Flow. | | | --------------------------------------------------------- | | | | | 5 | Proportional Uniform Distribution: Each counter for an | | | Original Flow is divided by the number of time units the | | | Original Flow covers, to derive a mean count rate. This | | | mean count rate is then multiplied by the number of times | | | units in the intersection of the duration of the Original | | | Flow and the time interval of each Aggregated Flow. This | | | is like simple uniform distribution, but accounts for the | | | fractional portions of a time interval covered by an | | | Original Flow in the first- and last-time interval. | | | --------------------------------------------------------- | | | | | 6 | Simulated Process: Each counter of the Original Flow is | | | distributed among the intervals of the Aggregated Flows | | | according to some function the Intermediate Aggregation | | | Process uses based upon properties of Flows presumed to | | | be like the Original Flow. This is essentially an | | | assertion that the Intermediate Aggregation Process has | | | no direct packet timing information but is nevertheless | | | not using one of the other simpler distribution methods. | | | The Intermediate Aggregation Process specifically makes | | | no assertion as to the correctness of the simulation. | | | --------------------------------------------------------- | | | | | 7 | Direct: The Intermediate Aggregation Process has access | | | to the original packet timings from the packets making up | | | the Original Flow, and uses these to distribute or | | | recalculate the counters. | +-------+-----------------------------------------------------------+ |
| 239 | biflowDirection | Description de la méthode d'attribution de direction utilisée pour attribuer la source et la destination du flux bidirectionnel. Cet élément d'information peut être présent dans un enregistrement de données de flux ou appliqué à tous les flux exportés à partir d'un processus d'exportation ou d'un domaine d'observation à l'aide des options IPFIX. Si cet élément d'information n'est pas présent dans un enregistrement de flux ou associé à un flux bidirectionnel via l'étendue, la configuration de la méthode d'attribution de direction est considérée comme étant appliquée hors bande.
Note : Lorsque vous utilisez les options IPFIX pour appliquer cet élément d'information à tous les flux dans un domaine d'observation ou en provenance d'un processus d'exportation, l'option doit être envoyée de manière fiable. Si le transport fiable n'est pas disponible (c'est-à-dire, lors de l'utilisation d'UDP), cet élément d'information doit apparaître dans chaque enregistrement de flux.
Ce champ peut prendre les valeurs suivantes : +-------+------------------+----------------------------------------+ | Value | Name | Description | +-------+------------------+----------------------------------------+ | 0x00 | arbitrary | Direction is assigned arbitrarily. | | 0x01 | initiator | The Biflow Source is the flow | | | | initiator, as determined by the | | | | Metering Process' best effort to | | | | detect the initiator. | | 0x02 | reverseInitiator | The Biflow Destination is the flow | | | | initiator, as determined by the | | | | Metering Process' best effort to | | | | detect the initiator. This value is | | | | provided for the convenience of | | | | Exporting Processes to revise an | | | | initiator estimate without re-encoding | | | | the Biflow Record. | | 0x03 | perimeter | The Biflow Source is the endpoint | | | | outside of a defined perimeter. The | | | | perimeter's definition is implicit in | | | | the set of Biflow Source and Biflow | | | | Destination addresses exported in the | | | | Biflow Records. | +-------+------------------+----------------------------------------+ |
