Summary

  • An IPFIX field definition ID selects an ordered field contract only within its Transport Session and Observation Domain. The Observation Domain ID is local to an Exporting Process, not a global device, tenant, site or customer identity.
  • A valid decode says which reporting contract a collector applied. It does not prove that every packet was observed, every Flow became a record, every record arrived, every counter was accurate or every selection, aggregation and mediation step was disclosed.

The cache that crossed a boundary

Consider two consecutive TCP connections from the same exporter. In the first, field definition ID 256 describes an ordered set of addresses, ports and counters. The connection ends. In the second, the exporter legitimately assigns 256 to a different field definition. A collector that carries the earlier definition into the new connection can attach old names and units to new bytes.

The case is synthetic; it does not allege a defect in a named product. Nor will every stale field definition produce tidy output. The dangerous version is the one that does. Plausible values can survive range checks and travel into a traffic report, an abuse case or a bill before anyone asks which session supplied the schema.

RFC 7011 prohibits that shortcut. An Exporting Process maintains field definition IDs per Transport Session and Observation Domain. A Collecting Process must not use a field definition from one session to decode Data Sets in a later session, even when the exporter and number look familiar.

A number needs its provenance tuple

IPFIX divides the measurement chain into roles. Packets are visible at Observation Points. A Metering Process classifies, samples, timestamps and maintains Flow Records. An Exporting Process sends IPFIX Messages. A Collecting Process receives them and may store or transform the results.

An Observation Domain is the largest set of Observation Points across which one Metering Process can aggregate Flow information. Its 32-bit ID is locally unique to the Exporting Process. Uniqueness per IPFIX Device is recommended, not globally guaranteed. Domain 17 can therefore exist on many exporters without creating one shared place, network or customer.

The minimum decoding key is not the field-definition identifier. It includes the authenticated or otherwise identified exporter, Exporting Process, Transport Session, Observation Domain ID and field definition ID. With SCTP, the relevant stream also matters for sequence state. Storage systems that flatten this tuple turn scoped control information into accidental global identity.

The field definition supplies order, not truth

A field definition is an ordered sequence of Information Element and length specifications. In a Data Set, the Set ID is the field definition ID. The collector needs the matching field definition to divide bytes into fields and attach their defined data types, semantics and units.

Information Element identity is also scoped more carefully than a bare number suggests. IANA maintains the standard registry. Enterprise-specific fields carry an enterprise number as part of their identity. Treating an element ID without its enterprise context as universal can produce the same class of semantic collision as dropping the exporter from a field definition key.

RFC 5610 permits type information to be exported in-band, while RFC 7013 sets expectations for clear Information Element definitions and review. Neither mechanism allows a source to turn a syntactically valid value into an independently verified fact. The field definition can say that eight bytes represent an octet count. It cannot prove that the Metering Process observed the right interface, used the intended Flow Keys or counted accurately.

Withdrawal and reuse are events

On connection-oriented transport, an exporter can withdraw a field definition and later reuse its ID. The collector must stop applying the withdrawn definition to subsequent Data Sets. Withdrawals and replacements take effect in message order, and the exporter should allow earlier records to be processed before withdrawing the schema that describes them.

UDP has a different lifecycle. There is no connection teardown to clear state and field definition messages can be lost or reordered. Refresh, replacement and expiry policies therefore matter. A Data Set that arrives before its field definition is not permission to borrow one from another session or domain. The collector must record whether it buffered, discarded or later decoded the data and which field definition instance justified that decision.

Structured Data Information Elements can contain lists and nested records. They make a richer grammar possible, not a stronger source. A well-formed nested list can still contain sampled, aggregated, stale or incorrect values.

The sequence number counts records, not reality

The IPFIX Sequence Number advances by the number of Data Records sent in the current stream from the current Observation Domain, modulo 2^32. field definition and Options field definition Records do not advance it. A collector can use discontinuities to detect missing, reordered or duplicate Data Records in that scope.

That is useful evidence with a narrow denominator. It is not a packet counter. It cannot expose packets that never reached the Observation Point, were discarded by a sampling stage or failed to become Flow Records. It also cannot by itself reveal every record dropped before the exporter assigned sequence state.

Even reliable TCP delivery is not an end-to-end completeness proof. If congestion or a slow collector fills the export buffer, an Exporting Process may drop Data Records rather than block; RFC 7011 requires those drops to be accounted for. UDP adds transport loss and reordering. The useful statement is “no sequence discontinuity was seen for this scoped stream,” not “no traffic evidence was lost.”

Export Time is another tempting shortcut. It records when an IPFIX Message left the Exporting Process. It is not the start or end time of every Flow inside. Observation timestamps, export delay, aggregation windows and clock quality must remain separate.

Selection changes the population before the dashboard

IPFIX can report traffic that has already passed through packet selection, Flow selection or both. RFC 7014 describes deterministic filtering, hash selection and systematic or random Flow sampling. The configuration, selection counters and denominator determine what population the exported records represent.

The word “complete” is especially easy to overread. A selected Flow may contain all packets that reached a selection stage while earlier packet sampling has already removed others. Completeness is relative to the stage boundary, not necessarily the physical link.

Aggregation changes the evidence again. RFC 7015 describes how Flow records may be combined under an aggregation function. A Mediator can collect, transform, select, aggregate and re-export information under a new exporting context. Downstream provenance must say which original exporters and domains contributed, what was changed and which information was discarded. A mediator's valid field definition does not make the derived record identical to any original observation.

Authenticated transport authenticates a source

IPFIX includes mechanisms for confidentiality, integrity and peer authentication through TLS or DTLS where deployed correctly. Those protections matter: forged field definitions can corrupt every record that follows, and flow data can reveal sensitive communications patterns.

Transport authentication still ends at the Exporting Process. It does not attest to sensor placement, configuration review, counter correctness or honest mediation. An authenticated exporter can faithfully send a measurement generated by the wrong interface map or an undisclosed sample. Cryptographic origin and measurement truth require separate evidence.

Make the scope fail visibly

Reconnect an exporter and reuse one field definition ID with a different ordered schema; the collector must wait for the new field definition. Send the same ID from two Observation Domains and two exporters; storage must not merge them. Withdraw and reuse a field definition around delayed Data Sets. Lose the first UDP field definition and record the explicit missing-definition disposition.

Then inject Data Record loss and distinguish a sequence gap from packet loss. Fill an export buffer and verify the exporter drop statistics. Enable packet sampling, Flow selection, aggregation and mediation one at a time, requiring each configuration and provenance transition to remain visible. Finally, authenticate a transport while deliberately exporting wrong counters from the metering stage. The system should say “authenticated source, inconsistent measurement,” not upgrade one proof into the other.