Subject: [IPFIX] Export Switch Port Identifier

From: Dominik Elsbroek <[email-masked]>
Date: Fri, 29 Jun 2012 08:59:05 +0200

Hi list,

I am currently working on an lightweight network intrusion detection
system based on IPFIX flow-records. A was seeking for an element that
identifies the switch or router port at which the traffic described by
flow-record has emerged. This is needed to detect for MAC Address
spoofing and might be useful in some more scenarios.

Is there such a field? I would expect such a field to be defined in
RFC 5102 or any RFC updating RFC 5102? I just found transport layer
ports of exporter and collector. Any hints and help are very
appreciated.

Kind regards,
Dominik

---

From: "Tarun Saxena (tasaxena)" <[email-masked]>
Date: Fri, 29 Jun 2012 11:40:26 +0000

Dominik,

By emerged, do you mean "entered" the router/switch or "exited" it? This is very basic information and is available in ingressInterface/egressinterface fields.

Thanks
Tarun

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dominik Elsbroek
Sent: Friday, June 29, 2012 12:29 PM
To: [email-masked]
Subject: [IPFIX] Export Switch Port Identifier

Hi list,

Kind regards,
Dominik
_______________________________________________
IPFIX mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipfix

---

From: Andrew Feren <[email-masked]>
Date: Fri, 29 Jun 2012 10:26:26 -0400

Hi Dominik,

Tarun is right about the ingress/egress interface fields.

For a current list of information elements your best source is probably 
IANA ( https://www.iana.org/assignments/ipfix/ipfix.xml)

-Andrew

---

From: Dominik Elsbroek <[email-masked]>
Date: Fri, 29 Jun 2012 17:07:58 +0200

Hi Tarun, hi Andrew,

thank you very much for your help. Both fields will help me with my
work I think.

Thank you very much!
Dominik

On Fri, Jun 29, 2012 at 4:26 PM, Andrew Feren <[email-masked]> wrote:
> By emerged, do you mean "entered" the router/switch or "exited" it? This is
> very basic information and is available in ingressInterface/egressinterface
> fields.
>
> Thanks
> Tarun
>