Summary

  • OPSAWG's 28 September revision 01 is an active Internet-Draft, not an RFC or completed IPFIX registry allocation.
  • Its new profiles distinguish a datagram parse boundary, packet-processing result, field presence and local export omission; collapsing those states would make an incomplete record look like a negative observation.

An exporter may have seen a QUIC-carrying datagram and still leave a field blank. The field could be absent in that packet, protected from the observation point, beyond a parser's supported version, lost to capture truncation, or deliberately suppressed from the export. A dashboard that renders all of those conditions as “not present” reports more certainty than the measurement possesses.

That is the practical change in draft-ietf-opsawg-ipfix-quic-header-01. Compared with revision 00's seven proposed QUIC Information Elements, the 28 September working-group revision proposes 24 and describes four export profiles. The network-wire profile has a particularly exact unit: one top-level Data Record for an unfragmented IP packet carrying a complete UDP datagram. Successfully delimited coalesced QUIC packets appear as ordered children with offsets, not as unrelated top-level records. The other profiles cover endpoint packet observations, flow aggregates and optional connection state. None is a claim that QUIC has become generally visible to passive monitors.

The new statuses divide the failure question. The parent quicDatagramParseStatus says whether the exporter could enumerate packet boundaries in the UDP payload. A child quicProcessingStatus records what happened while handling that packet. quicExportFlags instead says whether otherwise available information was withheld by local policy or cut off by a local size or resource limit. Those values are separate, not rungs on a confidence ladder. A parent can report a complete boundary parse while a child was malformed or capture-truncated; the parent can also remain complete when local export omitted data.

quicFieldPresence addresses a quieter ambiguity. An IPFIX fixed Template still encodes a value for every declared field. If the presence bit is clear, a zero or empty value is a placeholder that the collector must ignore. If set, zero may be a genuine observed value. A blank cell produced from a placeholder therefore cannot establish that a zero-length Token, Connection ID or other field did not exist. This is a record-interpretation rule, not proof that an observer authenticated the field.

There is also a boundary at an unsupported QUIC version. The draft says invariant fields alone may not reveal the later packet boundary. An exporter can retain earlier packets it fully delimited and mark a terminal partial observation, but must not imply that later coalesced packets were absent. The wire profile does not export packet numbers, frame types or stream IDs. Their absence from this profile says nothing about their presence in the traffic.

For a collector, the immediate test is modest: preserve the parent parse state, child processing state, field-presence bit and export flags as separate dimensions before presenting a negative finding. Version 01 remains a working draft with proposed element identifiers, not approved IANA assignments or evidence that any operator has implemented these profiles.

Sources