Export of BGP FlowSpec Treatment Information in IPFIX

Introduction BGP Flow Specification (FlowSpec) provides a mechanism for distributing traffic filtering and traffic treatment rules using BGP. A FlowSpec rule can identify traffic and request a treatment such as traffic discard, rate limiting, redirection, or traffic marking. When traffic is processed under a FlowSpec rule, operators often need visibility into traffic that matched the rule and was observed by enforcement devices. Control-plane information can describe distribution, validation, or installation of a FlowSpec route, but it does not by itself provide forwarding-plane statistics for traffic observed after FlowSpec processing. For example, after a mitigation system installs a FlowSpec rule for traffic toward a victim prefix, an operator may need to collect IPFIX statistics from enforcement devices and determine which exported Flow Records were associated with that rule and which treatment class was reported at the Observation Point. IP Flow Information Export (IPFIX) provides a mechanism for exporting Flow Records from Exporters to Collectors. Existing IPFIX Information Elements can describe flow keys, counters, timestamps, interfaces, Observation Points, and other properties of an observed Flow . This document defines additional IPFIX Information Elements that allow a Flow Record to carry FlowSpec rule correlation and treatment context. IPFIX supports enterprise-specific Information Elements, but use of enterprise-specific elements for this information can make cross-vendor collection and analysis difficult. Standard Information Elements allow Collectors to recognize FlowSpec-treated Flow Records in a common way while still relying on existing IPFIX elements for generic flow properties and counters. The Information Elements defined in this document are intended to be used together with existing IPFIX Information Elements.

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. This document uses the IPFIX terminology defined in . The following terms are used in this document:

FlowSpec rule: A BGP FlowSpec route together with its associated traffic treatment information.
FlowSpec-treated Flow Record: An IPFIX Flow Record that reports traffic observed after the traffic matched a FlowSpec rule and includes one or more Information Elements defined in this document.
FlowSpec rule identifier: A local identifier, scoped to an Observation Domain, that associates a FlowSpec-treated Flow Record with the FlowSpec rule used by the Exporter for correlation.
FlowSpec treatment class: A coarse-grained class of FlowSpec-derived treatment that the Exporter reports for metered packets at an Observation Point.

Scope This document defines two new IPFIX Information Elements for traffic processed by BGP FlowSpec:

flowSpecRuleIdentifier, which provides a local identifier, scoped to an Observation Domain, for the FlowSpec rule associated with an exported Flow Record.
flowSpecTreatmentClass, which identifies the FlowSpec-derived treatment class reported by the Exporter for the metered packets.

Used together with existing IPFIX Information Elements for flow keys, counters, timestamps, interfaces, Observation Points, sampling information, and other generic flow properties, these Information Elements enable a Collector to correlate Flow Records with the FlowSpec rule and treatment reported by the Exporter. Typical uses include correlating IPFIX Flow Records with FlowSpec rules during DDoS mitigation, accounting for traffic observed under FlowSpec-derived treatment, and troubleshooting whether traffic observed at an Observation Point is associated with a specific FlowSpec rule.

Relationship to FlowSpec Monitoring The broader FlowSpec monitoring problem includes route lifecycle information, constrained realization information, enforcement status information, traffic-treatment outcome information, and correlation information across those sources . This document addresses only the IPFIX component of that problem: forwarding-plane observations of traffic associated with FlowSpec-derived behavior. BGP route status, FlowSpec validation status, and structured enforcement state are expected to be reported, when needed, by other mechanisms such as BGP control-plane telemetry or YANG-based operational models.

FlowSpec Data-Plane Statistics Export

Export Model A FlowSpec-treated Flow Record extends an ordinary IPFIX Flow Record with FlowSpec-specific Information Elements. For example, an Exporter can combine source and destination addresses, transport ports, protocol information, timestamps, packet and octet counters, a FlowSpec rule identifier, and a FlowSpec treatment class in one Flow Record. This model allows a Collector to process FlowSpec-treated traffic together with other IPFIX Flow Records while retaining the FlowSpec context needed for operational analysis.

Correlation with FlowSpec Rules The FlowSpec rule identifier defined in this document is used to correlate a FlowSpec-treated Flow Record with a FlowSpec rule referenced by the Exporter. The identifier is scoped to the Observation Domain that exports the Flow Record. The identifier is intended only for correlation within the Observation Domain. The detailed representation of the FlowSpec rule and the mechanism used to distribute the mapping between a FlowSpec rule identifier and a FlowSpec rule are outside the scope of this document. A Collector that requires the complete rule needs to obtain that mapping from the Exporter or from an operational system that maintains the corresponding FlowSpec rule context. An Exporter SHOULD keep the association between a FlowSpec rule identifier and a FlowSpec rule stable for as long as Flow Records that use the identifier may be interpreted by a Collector. If a FlowSpec rule identifier is derived from an identifier signaled or configured by another mechanism, the Exporter SHOULD preserve the scope and collision properties of that mechanism. If no such identifier is available, the Exporter can assign a local identifier, provided that the identifier is unique within the Observation Domain for the relevant lifetime.

Reporting Treatment Class The FlowSpec treatment class defined in this document reports the coarse-grained FlowSpec-derived treatment that the Exporter determines was associated with the metered packets at the Observation Point. It is not a complete encoding of the BGP FlowSpec Traffic Filtering Actions, not proof that the requested action was successfully enforced, and not a replacement for forwarding status or counters. Collectors SHOULD interpret this Information Element together with existing IPFIX Information Elements for counters, timestamps, interfaces, Observation Points, forwarding status, and sampling. A reported treatment class does not by itself demonstrate whether a mitigation policy was effective. More than one Traffic Filtering Action can be associated with the FlowSpec rule selected by the Exporter. This document reports one treatment class for a Flow Record. When multiple treatments apply, the Exporter MUST report the treatment class using the following order of precedence: discard, rate-limit, redirect, traffic-marking. If the Exporter cannot determine a treatment class using this order, it MUST report unknown. Specification of simultaneous multiple treatment classes is outside the scope of this document.

Relationship to Existing IPFIX Information Elements Existing IPFIX Information Elements are used for generic flow properties and statistics. Examples include IP addresses, transport ports, protocol identifiers, packet and octet counters, flow timestamps, interfaces, and Observation Point information. Existing IPFIX Information Elements can also describe forwarding outcomes where they are available from the Exporter. The Information Elements defined in this document add FlowSpec-specific rule correlation and treatment context to those records; they do not replace existing IPFIX Information Elements for counters, forwarding status, metering, or sampling.

FlowSpec Information Elements This section defines the initial set of IPFIX Information Elements for FlowSpec data-plane statistics export.

ElementID	Name	Description
TBD1	flowSpecRuleIdentifier	Provides a local identifier for the FlowSpec rule associated with the Flow Record.
TBD2	flowSpecTreatmentClass	Identifies the FlowSpec-derived treatment class reported for the metered packets.

flowSpecRuleIdentifier

Name:: flowSpecRuleIdentifier
ElementID:: TBD1
Description:: An identifier assigned or reported by the Exporter for the FlowSpec rule associated with the Flow Record. The identifier is scoped to the Observation Domain that exports the Flow Record. This Information Element is not reversible.
Abstract Data Type:: unsigned64
Data Type Semantics:: identifier
Units:: none
Range:: 0..18446744073709551615
Status:: current
Reference:: This document.

flowSpecTreatmentClass

Name:: flowSpecTreatmentClass
ElementID:: TBD2
Description:: A coarse-grained class of FlowSpec-derived treatment that the Exporter determines was associated with the metered packets at the Observation Point. This Information Element does not encode the complete set of BGP FlowSpec Traffic Filtering Actions or action parameters carried by the FlowSpec rule. This Information Element is not reversible.
Abstract Data Type:: unsigned8
Data Type Semantics:: identifier
Units:: none
Range:: 0..255
Additional Information:: Values are defined in the "FlowSpec Treatment Class" subregistry.
Status:: current
Reference:: This document.

The initial values for flowSpecTreatmentClass are defined as follows:

Value	Treatment Class
0	unknown
1	discard
2	rate-limit
3	redirect
4	traffic-marking
255	reserved

Values 5 through 254 are unassigned.

Export Example The following example illustrates a Template for exporting an IPv4 Flow Record for traffic processed by a FlowSpec rule.

Information Element
sourceIPv4Address
destinationIPv4Address
sourceTransportPort
destinationTransportPort
protocolIdentifier
packetDeltaCount
octetDeltaCount
flowStartMilliseconds
flowEndMilliseconds
observationPointId
flowSpecRuleIdentifier
flowSpecTreatmentClass

The existing Information Elements provide the flow keys, statistics, timestamps, and observation context. The FlowSpec-specific Information Elements provide the local FlowSpec rule identifier and the treatment class reported for the metered packets.

Operational Considerations The interpretation of FlowSpec data-plane statistics depends on the Observation Point and metering behavior of the Exporter. A Collector needs to consider where the traffic was observed and whether the exported counters are affected by aggregation, sampling, filtering, or local implementation behavior. The Information Elements defined in this document provide correlation and treatment context for IPFIX Flow Records. They do not by themselves provide the full FlowSpec rule, its control-plane state, or the state of enforcement objects derived from the rule. A Collector needs to treat absence of a FlowSpec-specific Information Element differently from an explicit value. For example, a Flow Record without a FlowSpec rule identifier does not necessarily mean that no FlowSpec rule existed; it may mean that the Exporter did not support or did not apply this export. When multiple Exporters report records for the same FlowSpec rule, a Collector needs to use the Observation Domain, Observation Point, timestamps, and other IPFIX context to avoid treating independent observations as duplicate or equivalent measurements.

Security Considerations FlowSpec-treated Flow Records can reveal sensitive information about traffic filtering policy, DDoS mitigation behavior, victim prefixes, attack traffic characteristics, and platform or deployment capabilities. Exporters, Collectors, and transport paths need to protect this information according to the sensitivity of the exported Flow Records. Forged, modified, delayed, replayed, or suppressed Flow Records could cause an operator or automated system to draw an incorrect conclusion about whether FlowSpec treatment is active or effective. Deployments need appropriate authentication, integrity protection, confidentiality, access control, and replay or staleness handling for IPFIX export. High-volume FlowSpec-related export can create load on Exporters, Collectors, and transport paths. Deployments need to consider filtering, aggregation, sampling, rate control, and retention policies that are appropriate for the operational use case.

IANA Considerations IANA is requested to allocate the following Information Elements in the "IPFIX Information Elements" registry. New IPFIX Information Elements are reviewed according to the Expert Review process described in and .

ElementID	Name	Abstract Data Type	Data Type Semantics	Units	Range	Additional Information	Status	Reference
TBD1	flowSpecRuleIdentifier	unsigned64	identifier	none	0..18446744073709551615	This Information Element is not reversible.	current	This document
TBD2	flowSpecTreatmentClass	unsigned8	identifier	none	0..255	Values are defined in the "FlowSpec Treatment Class" subregistry. This Information Element is not reversible.	current	This document

IANA is also requested to create and maintain a new subregistry named "FlowSpec Treatment Class" under the "IPFIX Information Elements" registry. The initial values are:

Value	Description	Reference
0	unknown	This document
1	discard	This document
2	rate-limit	This document
3	redirect	This document
4	traffic-marking	This document
5-254	Unassigned	This document
255	Reserved	This document

New values in the "FlowSpec Treatment Class" registry are assigned by Expert Review .