Network Working Group B. Trammell Internet-Draft ETH Zurich Intended status: Informational S. Niccolini Expires: April 29, 2012 NEC B. Claise Cisco Systems Inc. H. Kaplan Acme Packet October 27, 2011 SIP Message Information Export using IPFIX draft-trammell-ipfix-sip-msg-02 Abstract This draft defines a set of Information Elements and example Templates for IP Flow Information Export (IPFIX) based on the SIP Common Log Format data model, as well as additional useful SIP Information Elements, to allow IPFIX export of application-layer information about SIP messages. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on April 29, 2012. Copyright Notice Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents Trammell, et al. Expires April 29, 2012 [Page 1] Internet-Draft SIP Messages in IPFIX October 2011 carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 2. Base Information Elements for SIP Message Information Export . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2.1. sipObservationType . . . . . . . . . . . . . . . . . . . . 5 2.2. sipMethod . . . . . . . . . . . . . . . . . . . . . . . . 5 2.3. sipSequenceNumber . . . . . . . . . . . . . . . . . . . . 5 2.4. sipRequestURI . . . . . . . . . . . . . . . . . . . . . . 5 2.5. sipFromURI . . . . . . . . . . . . . . . . . . . . . . . . 6 2.6. sipFromTag . . . . . . . . . . . . . . . . . . . . . . . . 6 2.7. sipToURI . . . . . . . . . . . . . . . . . . . . . . . . . 6 2.8. sipToTag . . . . . . . . . . . . . . . . . . . . . . . . . 6 2.9. sipCallId . . . . . . . . . . . . . . . . . . . . . . . . 6 2.10. sipResponseStatus . . . . . . . . . . . . . . . . . . . . 6 2.11. sipServerTransaction . . . . . . . . . . . . . . . . . . . 7 2.12. sipClientTransaction . . . . . . . . . . . . . . . . . . . 7 2.13. sipMethod subregistry . . . . . . . . . . . . . . . . . . 7 3. Additional Information Elements for SIP Message Information Export . . . . . . . . . . . . . . . . . . . . . . 8 3.1. sipContactURI . . . . . . . . . . . . . . . . . . . . . . 8 3.2. sipRouteURI . . . . . . . . . . . . . . . . . . . . . . . 8 3.3. sipPaiURI . . . . . . . . . . . . . . . . . . . . . . . . 9 3.4. sipPpiURI . . . . . . . . . . . . . . . . . . . . . . . . 9 3.5. sipPAssocURI . . . . . . . . . . . . . . . . . . . . . . . 9 3.6. sipPCalledPartyURI . . . . . . . . . . . . . . . . . . . . 9 3.7. sipVia . . . . . . . . . . . . . . . . . . . . . . . . . . 10 3.8. sipAuthUsername . . . . . . . . . . . . . . . . . . . . . 10 3.9. sipSubscriptionEvent . . . . . . . . . . . . . . . . . . . 10 3.10. sipSubscriptionState . . . . . . . . . . . . . . . . . . . 10 3.11. sipExpires . . . . . . . . . . . . . . . . . . . . . . . . 10 3.12. sipPVisitedNetworkID . . . . . . . . . . . . . . . . . . . 11 3.13. sipPAccessNetworkInfo . . . . . . . . . . . . . . . . . . 11 3.14. sipPChargingFunctionAddr . . . . . . . . . . . . . . . . . 11 3.15. sipPChargingVector . . . . . . . . . . . . . . . . . . . . 11 4. Recommended Templates for SIP Message Information Export . . . 12 5. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 5.1. Base Template Export . . . . . . . . . . . . . . . . . . . 13 5.2. UAC registration . . . . . . . . . . . . . . . . . . . . . 14 5.3. Direct Call . . . . . . . . . . . . . . . . . . . . . . . 16 5.4. Single Downstream Branch Call . . . . . . . . . . . . . . 19 Trammell, et al. Expires April 29, 2012 [Page 2] Internet-Draft SIP Messages in IPFIX October 2011 5.5. Forked Call . . . . . . . . . . . . . . . . . . . . . . . 25 6. Security Considerations . . . . . . . . . . . . . . . . . . . 35 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 35 8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 35 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 35 9.1. Normative References . . . . . . . . . . . . . . . . . . . 35 9.2. Informative References . . . . . . . . . . . . . . . . . . 36 Appendix A. Definition of Base SIP Message Information Elements in IANA XML Registry format . . . . . . . . 37 Appendix B. Definition of sipMethod registry in IANA XML Registry format . . . . . . . . . . . . . . . . . . . 40 Appendix C. Definition of Additional SIP Message Information Elements in IANA XML Registry format . . . . . . . . 43 Appendix D. Example messages in base64 . . . . . . . . . . . . . 47 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 50 Trammell, et al. Expires April 29, 2012 [Page 3] Internet-Draft SIP Messages in IPFIX October 2011 1. Introduction IPFIX [RFC5101] provides a standardized means of exporting flow information from IPFIX exporters to IPFIX collectors. This allows collectors to analyze flows from one or more sources for numerous uses, such as traffic patterns/trends, anomalies, failures, attacks, and much more. IPFIX supports exporting data in near real-time, in a secure manner, over multiple transports; as well as in local storage with a defined file format. The core IPFIX information model is maintained by IANA as a registry of Information Elements at http://www.iana.org/assignments/ipfix/. In addition to these, which cover many network measurement and management applications, enterprise-specific Information Elements may be defined, scoped to an SMI private enterprise number, for vendor-proprietary Information Elements. Session Initiation Protocol (SIP), defined by [RFC3261] and its extensions, is used by many devices to perform a rendezvous service, initiate and manage real-time communication sessions, install and monitor state information, and more. In many deployments, SIP messages cross multiple systems managed by the same administrative entity, and thus providing a means of exporting and collecting SIP message information from such systems using a standard protocol is highly desirable. This document defines a set of IPFIX Information Elements to enable SIP devices, such as user agents and proxies, to export SIP message information to IPFIX collectors using the IPFIX protocol. The purpose of doing so is to enable collectors to analyze the SIP "traffic", for similar purposes as those for any other IPFIX flows. Defining IANA-registered (i.e., well-known) IPFIX IE fields enables IPFIX records of SIP message information to be generated and consumed by different vendors. Within the context of this document's IPFIX IE fields, a single SIP message is a complete IPFIX Flow as defined in [RFC5101] The SIPCLF Working Group has defined a data model [I-D.ietf-sipclf-problem-statement] for logging information about SIP messages to ASCII-based SIPCLF files. While useful for on-box storage and analysis with ASCII-based tools, SIPCLF does not provide a means of exporting such information, nor is that its goal. This document borrows the data model from SIPCLF and represents these in IPFIX Information Elements. It additionally provides examples for IPFIX representation of the example SIP Messages provided in the SIPCLF problem statement. Trammell, et al. Expires April 29, 2012 [Page 4] Internet-Draft SIP Messages in IPFIX October 2011 2. Base Information Elements for SIP Message Information Export The following Information Elements represent SIP-specific mandatory fields defined in [I-D.ietf-sipclf-problem-statement], many themselves taken from [RFC3261]. Together with Information Elements already available in the IPFIX IANA Information Elements registry, these can be used to export information about SIP Messages. 2.1. sipObservationType Description: Denotes whether the entry was corresponds to a SIP message received, sent, or merely seen by a passive observer, as follows: 0: unknown: The Metering Process does not specify the observation type. 1: receiver: The Metering Process is, or is co-located with, the receiver of the SIP message. 2: sender: The Metering Process is, or is co-located with, the sender of the SIP message. 3: passive: The Metering Process passively observed the SIP message. Data Type: unsigned8 Data Type Semantics: identifier PEN (provisional): 35566 (trammell.ch) ElementId (provisional): 419 2.2. sipMethod Description: The SIP method from the CSeq header, encoded as per the IPFIX sipMethod subregistry. Data Type: unsigned8 Data Type Semantics: identifier PEN (provisional): 35566 (trammell.ch) ElementId (provisional): 402 2.3. sipSequenceNumber Description: The sequence number from the CSeq header. Data Type: unsigned32 Data Type Semantics: identifier PEN (provisional): 35566 (trammell.ch) ElementId (provisional): 409 2.4. sipRequestURI Trammell, et al. Expires April 29, 2012 [Page 5] Internet-Draft SIP Messages in IPFIX October 2011 Description: The SIP Request URI, including any parameters, as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string PEN (provisional): 35566 (trammell.ch) ElementId (provisional): 403 2.5. sipFromURI Description: The URI from the SIP From: header Data Type: string PEN (provisional): 35566 (trammell.ch) ElementId (provisional): 404 2.6. sipFromTag Description: The Tag parameter value from the SIP From: header Data Type: string PEN (provisional): 35566 (trammell.ch) ElementId (provisional): 405 2.7. sipToURI Description: The URI from the SIP To: header Data Type: string PEN (provisional): 35566 (trammell.ch) ElementId (provisional): 406 2.8. sipToTag Description: The Tag parameter value from the SIP To: header Data Type: string PEN (provisional): 35566 (trammell.ch) ElementId (provisional): 407 2.9. sipCallId Description: The value of the SIP Call-ID: header Data Type: string PEN (provisional): 35566 (trammell.ch) ElementId (provisional): 408 2.10. sipResponseStatus Trammell, et al. Expires April 29, 2012 [Page 6] Internet-Draft SIP Messages in IPFIX October 2011 Description: The SIP Response code. The presence of this Information Element in a SIP Message record marks it as describing a SIP response; if absent, the record describes a SIP request. Data Type: unsigned16 Data Type Semantics: identifier PEN (provisional): 35566 (trammell.ch) ElementId (provisional): 412 2.11. sipServerTransaction Description: The transaction identifier associated with the server transaction. Data Type: string Data Type Semantics: identifier PEN (provisional): 35566 (trammell.ch) ElementId (provisional): 413 2.12. sipClientTransaction Description: The transaction identifier associated with the client transaction. Data Type: string Data Type Semantics: identifier PEN (provisional): 35566 (trammell.ch) ElementId (provisional): 414 2.13. sipMethod subregistry The sipMethod subregistry assigns a number to encode each of the SIP methods encoded in the Methods and Response Codes registry at http://www.iana.org/assignments/sip-parameters in a 16-bit integer Information Element. These numbers are assigned from 1 in alphabetical order for the Methods defined as of the publication time of this document; subsequent Methods added to the Methods and Response Codes registry will be added to the IPFIX sipMethod subregistry at such time they are added to the Methods and Response Codes registry, using the lowest available unassigned number at the time of addition. Trammell, et al. Expires April 29, 2012 [Page 7] Internet-Draft SIP Messages in IPFIX October 2011 +----------+------------+-----------+ | Number | Method | Reference | +----------+------------+-----------+ | 0 | Unknown | | | 1 | ACK | [RFC3261] | | 2 | BYE | [RFC3261] | | 3 | CANCEL | [RFC3261] | | 4 | INFO | [RFC6086] | | 5 | INVITE | [RFC3261] | | 6 | MESSAGE | [RFC3428] | | 7 | NOTIFY | [RFC3265] | | 8 | OPTIONS | [RFC3261] | | 9 | PRACK | [RFC3262] | | 10 | PUBLISH | [RFC3903] | | 11 | REFER | [RFC3515] | | 12 | REGISTER | [RFC3261] | | 13 | SUBSCRIBE | [RFC3265] | | 14 | UPDATE | [RFC3311] | | 15-65535 | Unassigned | | +----------+------------+-----------+ 3. Additional Information Elements for SIP Message Information Export [TODO frontmatter] 3.1. sipContactURI Description: The addr-spec URI, including any URI parameters, of the first/top-most SIP Contact header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 415 3.2. sipRouteURI Description: The addr-spec URI, including any URI parameters, of the first/top-most SIP Route header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 Trammell, et al. Expires April 29, 2012 [Page 8] Internet-Draft SIP Messages in IPFIX October 2011 ElementId (provisional): 416 3.3. sipPaiURI Description: The addr-spec URI, including any URI parameters, of the first/top-most SIP P-Asserted-Identity header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 417 3.4. sipPpiURI Description: The addr-spec URI, including any URI parameters, of the first/top-most SIP P-Preferred-Identity header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 418 3.5. sipPAssocURI Description: The addr-spec URI, including any URI parameters, of the first/top-most SIP P-Associated-Identity header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 430 3.6. sipPCalledPartyURI Description: The addr-spec URI, including any URI parameters, of the SIP P-Called-Party-ID header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 420 Trammell, et al. Expires April 29, 2012 [Page 9] Internet-Draft SIP Messages in IPFIX October 2011 3.7. sipVia Description: The value of the first/top-most Via header as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 421 3.8. sipAuthUsername Description: The value of the username field of the first/top-most Authorization header as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 422 3.9. sipSubscriptionEvent Description: The value of the Event header as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 423 3.10. sipSubscriptionState Description: The value of the Subscription-State header as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 424 3.11. sipExpires Description: The numeric value of the expires parameter of the first/top-most Contact header of a REGISTER request or response, or Subscription-State header of a SUBSCRIBE or NOTIFY request or response, or the Expires header if the expires parameter does not exist, as received by the metering process. Trammell, et al. Expires April 29, 2012 [Page 10] Internet-Draft SIP Messages in IPFIX October 2011 Data Type: unsigned32 Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 425 3.12. sipPVisitedNetworkID Description: The value of the first/top-most P-Visited-Network-ID header as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 426 3.13. sipPAccessNetworkInfo Description: The value of the P-Access-Network-Info header as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 427 3.14. sipPChargingFunctionAddr Description: The value of the first/top-most P-Charging-Function- Addresses header as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 428 3.15. sipPChargingVector Description: The value of the P-Charging-Vector header as a UTF-8 string, escaped according to SIP rules as received by the metering process. Data Type: string Data Type Semantics: PEN (provisional): 35566 ElementId (provisional): 429 Trammell, et al. Expires April 29, 2012 [Page 11] Internet-Draft SIP Messages in IPFIX October 2011 4. Recommended Templates for SIP Message Information Export The SIPCLF data model represents SIP requests and SIP responses with separate records. The following Templates are defined as recommended base Templates for records describing requests and responses. Optional Information Elements MAY be added to them, and the IPv4 addresses within these Templates MUST be replaced with IPv6 addresses for logging IPv6 transport of SIP messages. A sipServerTransaction Information Element SHOULD be added for all messages logged by a User Agent Server, and a sipClientTransaction Information Element SHOULD be added for all messages logged by a User Agent Client. These templates follow the recommended fields for request and response logging in [I-D.ietf-sipclf-problem-statement], and are defined using the representation in section 9 of [I-D.trammell-ipfix-ie-doctors]. observationTimeMilliseconds(323)[8] sipSequenceNumber(35566/409)[4] sourceIPv4Address(8)[4] destinationIPv4Address(12)[4] sourceTransportPort(7)[2] destinationTransportPort(11)[2] protocolIdentifier(4)[1] sipMethod(35566/402)[1] sipObservationType(35566/419)[1] sipRequestURI(35566/403)[v] sipToURI(35566/406)[v] sipToTag(35566/407)[v] sipFromURI(35566/404)[v] sipFromTag(35566/405)[v] sipCallId(35566/408)[v] Figure 1: Base Request Template (IPv4) Trammell, et al. Expires April 29, 2012 [Page 12] Internet-Draft SIP Messages in IPFIX October 2011 observationTimeMilliseconds(323)[8] sipSequenceNumber(35566/409)[4] sourceIPv4Address(8)[4] destinationIPv4Address(12)[4] sourceTransportPort(7)[2] destinationTransportPort(11)[2] protocolIdentifier(4)[1] sipMethod(35566/402)[1] sipObservationType(35566/419)[1] sipResponseStatus(35566/412)[2] sipToURI(35566/406)[v] sipToTag(35566/407)[v] sipFromURI(35566/404)[v] sipFromTag(35566/405)[v] sipCallId(35566/408)[v] Figure 2: Base Response Template (IPv4) Note that the Information Elements in these templates are ordered to place the fixed-length elements before the variable-length ones, which speeds random access to fixed-length elements. However, since element order within a record is unimportant in IPFIX, any ordering of the mandatory Information Elements within a record MUST be accepted by a Collecting Process as a valid SIP request or response record for that record type. The record type is determined by the presence of the sipResponseStatus field. If present in the Template, the Template describes a response record. If absent, it describes a request record. 5. Examples This section presents several views of an example SIP messages exported using the IPFIX templates described in this document. We present both binary and textual forms. The tools to generate this section are based upon the open-source ripfix [ripfix] implementation of IPFIX, maintained by one of the authors of this draft. Here we show the IPFIX Messages generated by the situations in sections 9.1 through 9.4 of [I-D.ietf-sipclf-problem-statement]. 5.1. Base Template Export Before exporting any Request or Response records, the Templates describing them must be exported. In this example, the templates These Templates are derived from the base Templates as shown in Trammell, et al. Expires April 29, 2012 [Page 13] Internet-Draft SIP Messages in IPFIX October 2011 Figure 1 and Figure 2, with the sipClientTransaction and sipServerTransaction Information Elements appended. We use two templates here, one each for request and response for IPv4. Exporting these Templates results in the following IPFIX message, illustrated as an annotated hexdump in Figure 3. 0000: 00 0a 00 fc 4c c0 2a a2 00 00 00 00 00 00 30 39 ....L.*.......09 [ IPFIX message header, length 252 ] 0010: 00 02 00 ec .... [ Template set (ID 2) header, length 236 ] 0014: 01 01 00 11 01 43 00 08 81 99 00 04 .....C...... 0020: 00 00 8a ee 00 08 00 04 00 0c 00 04 00 07 00 02 ................ 0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee ................ 0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee ................ 0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee ................ 0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee ................ 0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee ................ 0080: 81 9d ff ff 00 00 8a ee ........ [ Template 257, 17 elements (v4 request) ] 0088: 01 02 00 11 01 43 00 08 .....C.. 0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 0c 00 04 ................ 00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01 ................ 00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02 ................ 00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff ................ 00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff ................ 00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff ................ 00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee ............ [ Template 258, 17 elements (v4 response) ] Figure 3: Base template message export 5.2. UAC registration Having exported templates, now we create a simple IPFIX Message representing a UAC registration as seen from the UAC, corresponding to example 9.1 in [I-D.ietf-sipclf-problem-statement]. This message contains two records, including the UAS registration request, and the response received. This is shown in the annotated hexdump in Figure 4. Trammell, et al. Expires April 29, 2012 [Page 14] Internet-Draft SIP Messages in IPFIX October 2011 0000: 00 0a 00 d8 4c 90 7f c1 00 00 00 00 00 00 30 39 ....L.........09 [ IPFIX message header, length 218 ] 0010: 01 01 00 6b ...k [ Data set (ID 257) header, length 107 ] 0014: 00 00 01 29 13 66 13 93 00 00 00 01 ...).f...... 0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 0c 02 0f .3d..3d......... 0030: 73 69 70 3a 65 78 61 6d 70 6c 65 2e 63 6f 6d 00 sip:example.com. 0040: 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d ..sip:alice@exam 0050: 70 6c 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 ple.com.76yhh.f8 0060: 31 2d 64 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 1-d4-f6@example. 0070: 63 6f 6d 06 63 2d 74 72 2d 31 00 com.c-tr-1. [ Request record content ] 007b: 01 02 00 5d ...] [ Data set (ID 258) header, length 93 ] 007f: 00 . 0080: 00 01 29 13 66 15 24 00 00 00 01 c6 33 64 0a c6 ..).f.$.....3d.. 0090: 33 64 01 13 c4 13 c4 11 0c 01 00 c8 00 00 15 73 3d.............s 00a0: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 ip:alice@example 00b0: 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 31 2d 64 .com.76yhh.f81-d 00c0: 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 4-f6@example.com 00d0: 06 63 2d 74 72 2d 31 00 .c-tr-1. [ Response record content ] Figure 4: Message containing two log entries for UAC registration While this demonstrates the binary nature of the SIPCLF-IPFIX format, and shows the content framing for this message, it is not readable for illustration purposes. In Figure 5, we run the message through the ripcollect tool provided with ripfix to provide a more human- readable view. Note that the sipMethod and sipObservationType are encoded according to the registries in Section 2. Trammell, et al. Expires April 29, 2012 [Page 15] Internet-Draft SIP Messages in IPFIX October 2011 ==== message sequence 0 in domain 12345 at 2010-08-11 11:53:27 UTC ==== ---- record 12345/257 ---- observationTimeMilliseconds => 2010-06-07 17:12:23 UTC sipSequenceNumber => 1 sourceIPv4Address => 198.51.100.1 destinationIPv4Address => 198.51.100.10 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 12 sipObservationType => 2 sipRequestURI => sip:example.com sipToURI => sipToTag => sipFromURI => sip:alice@example.com sipFromTag => 76yhh sipCallId => f81-d4-f6@example.com sipClientTransaction => c-tr-1 sipServerTransaction => ---- record 12345/258 ---- observationTimeMilliseconds => 2010-06-07 17:12:24 UTC sipSequenceNumber => 1 sourceIPv4Address => 198.51.100.10 destinationIPv4Address => 198.51.100.1 sourceTransportPort => 5060 destinationTransportPort => 5060 sipResponseStatus => 200 protocolIdentifier => 17 sipMethod => 12 sipObservationType => 1 sipToURI => sipToTag => sipFromURI => sip:alice@example.com sipFromTag => 76yhh sipCallId => f81-d4-f6@example.com sipClientTransaction => c-tr-1 sipServerTransaction => Figure 5: Message containing two log entries for UAC registration 5.3. Direct Call This example demonstrates the export of a direct call from Alice to Bob, as seen by Bob's agent, corresponding to example 9.2 in [I-D.ietf-sipclf-problem-statement]. Here we have four records: an INVITE received from Alice, a 180 Ringing sent back followed by a 200 OK, and an ACK received from Alice. This is shown in the ripfix dump in Figure 6 and the hexdump in Figure 7. In the hexdump, message Trammell, et al. Expires April 29, 2012 [Page 16] Internet-Draft SIP Messages in IPFIX October 2011 headers, set headers, and data records are separated by '|' characters for compactness. Note here that each record has its own data set to support high-speed seeking to a specific record, even when two messages using the same template are adjacent in the message. ===== message 12345/0 @2010-10-21 13:11:43 UTC (#2) ===== --- record 12345/257 (#1)--- observationTimeMilliseconds => 2010-06-07 17:12:23 UTC sipSequenceNumber => 32 sourceIPv4Address => 198.51.100.1 destinationIPv4Address => 203.0.113.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 2 sipRequestURI => sip:bob@bob1.example.net sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com sipFromTag => 76yhh sipCallId => f82-d4-f7@example.com sipClientTransaction => c-1-xt6 sipServerTransaction => --- record 12345/258 (#2)--- observationTimeMilliseconds => 2010-06-07 17:12:25 UTC sipSequenceNumber => 32 sourceIPv4Address => 203.0.113.1 destinationIPv4Address => 198.51.100.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 1 sipResponseStatus => 180 sipToURI => sip:bob@example.net sipToTag => b-in6-iu sipFromURI => sip:alice@example.com sipFromTag => 76yhh sipCallId => f82-d4-f7@example.com sipClientTransaction => c-1-xt6 sipServerTransaction => --- record 12345/258 (#3)--- observationTimeMilliseconds => 2010-06-07 17:12:26 UTC sipSequenceNumber => 32 sourceIPv4Address => 203.0.113.1 destinationIPv4Address => 198.51.100.1 Trammell, et al. Expires April 29, 2012 [Page 17] Internet-Draft SIP Messages in IPFIX October 2011 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 1 sipResponseStatus => 200 sipToURI => sip:bob@example.net sipToTag => b-in6-iu sipFromURI => sip:alice@example.com sipFromTag => 76yhh sipCallId => f82-d4-f7@example.com sipClientTransaction => c-1-xt6 sipServerTransaction => --- record 12345/257 (#4)--- observationTimeMilliseconds => 2010-06-07 17:12:26 UTC sipSequenceNumber => 32 sourceIPv4Address => 198.51.100.1 destinationIPv4Address => 203.0.113.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 1 sipObservationType => 2 sipRequestURI => sip:bob@bob1.example.net sipToURI => sip:bob@example.net sipToTag => b-in6-iu sipFromURI => sip:alice@example.com sipFromTag => 76yhh sipCallId => f82-d4-f7@example.com sipClientTransaction => c-1-xt6 sipServerTransaction => Figure 6: Message containing four records for a simple call (ripfix dump) Trammell, et al. Expires April 29, 2012 [Page 18] Internet-Draft SIP Messages in IPFIX October 2011 0000: 00 0a 02 1a 4c c0 2c b3 00 00 00 00 00 00 30 39| ....L.,.......09 0010: 01 01 00 88|00 00 01 29 13 66 13 93 00 00 00 20 .......).f..... 0020: c6 33 64 01 cb 00 71 01 13 c4 13 c4 11 05 02 18 .3d...q......... 0030: 73 69 70 3a 62 6f 62 40 62 6f 62 31 2e 65 78 61 sip:bob@bob1.exa 0040: 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 mple.net.sip:bob 0050: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 @example.net..si 0060: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example. 0070: 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d 64 34 com.76yhh.f82-d4 0080: 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 07 -f7@example.com. 0090: 63 2d 31 2d 78 74 36 00|01 02 00 79|00 00 01 29 c-1-xt6....y...) 00a0: 13 66 18 aa 00 00 00 20 cb 00 71 01 c6 33 64 01 .f..... ..q..3d. 00b0: 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 6f ..........sip:bo 00c0: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 08 62 2d b@example.net.b- 00d0: 69 6e 36 2d 69 75 15 73 69 70 3a 61 6c 69 63 65 in6-iu.sip:alice 00e0: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 05 37 36 79 @example.com.76y 00f0: 68 68 15 66 38 32 2d 64 34 2d 66 37 40 65 78 61 hh.f82-d4-f7@exa 0100: 6d 70 6c 65 2e 63 6f 6d 07 63 2d 31 2d 78 74 36 mple.com.c-1-xt6 0110: 00|01 02 00 79|00 00 01 29 13 66 1c f4 00 00 00 ....y...).f..... 0120: 20 cb 00 71 01 c6 33 64 01 13 c4 13 c4 11 05 01 ..q..3d........ 0130: 00 c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 ...sip:bob@examp 0140: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15 le.net.b-in6-iu. 0150: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl 0160: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d e.com.76yhh.f82- 0170: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f d4-f7@example.co 0180: 6d 07 63 2d 31 2d 78 74 36 00|01 01 00 90|00 00 m.c-1-xt6....... 0190: 01 29 13 66 1d 08 00 00 00 20 c6 33 64 01 cb 00 .).f..... .3d... 01a0: 71 01 13 c4 13 c4 11 01 02 18 73 69 70 3a 62 6f q.........sip:bo 01b0: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n 01c0: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp 01d0: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15 le.net.b-in6-iu. 01e0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl 01f0: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d e.com.76yhh.f82- 0200: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f d4-f7@example.co 0210: 6d 07 63 2d 31 2d 78 74 36 00 m.c-1-xt6. Figure 7: Message containing four records for a simple call (hexdump) 5.4. Single Downstream Branch Call The example in Figure 8and Figure 9 demonstrates the export of a call with a downstream branch to Bob, as seen by the proxy which the call traverses, corresponding to example 9.3 in [I-D.ietf-sipclf-problem-statement]. See this example in the problem statement for more details. ===== message 12345/0 @2010-10-21 13:12:42 UTC (#2) ===== --- record 12345/257 (#1)--- observationTimeMilliseconds => 2010-06-07 17:12:23 UTC Trammell, et al. Expires April 29, 2012 [Page 19] Internet-Draft SIP Messages in IPFIX October 2011 sipSequenceNumber => 43 sourceIPv4Address => 198.51.100.1 destinationIPv4Address => 198.51.100.10 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 1 sipRequestURI => sip:bob@example.net sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com sipFromTag => al-1 sipCallId => tr-87h@example.com sipClientTransaction => sipServerTransaction => s-x-tr --- record 12345/258 (#2)--- observationTimeMilliseconds => 2010-06-07 17:12:24 UTC sipSequenceNumber => 43 sourceIPv4Address => 198.51.100.10 destinationIPv4Address => 198.51.100.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 2 sipResponseStatus => 100 sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com sipFromTag => al-1 sipCallId => tr-87h@example.com sipClientTransaction => sipServerTransaction => s-x-tr --- record 12345/257 (#3)--- observationTimeMilliseconds => 2010-06-07 17:12:24 UTC sipSequenceNumber => 43 sourceIPv4Address => 198.51.100.10 destinationIPv4Address => 203.0.113.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 2 sipRequestURI => sip:bob@bob1.example.net sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com Trammell, et al. Expires April 29, 2012 [Page 20] Internet-Draft SIP Messages in IPFIX October 2011 sipFromTag => al-1 sipCallId => tr-87h@example.com sipClientTransaction => c-x-tr sipServerTransaction => s-x-tr --- record 12345/258 (#4)--- observationTimeMilliseconds => 2010-06-07 17:12:25 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.1 destinationIPv4Address => 198.51.100.10 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 1 sipResponseStatus => 100 sipToURI => sip:bob@example.net sipToTag => b1-1 sipFromURI => sip:alice@example.com sipFromTag => al-1 sipCallId => tr-87h@example.com sipClientTransaction => c-x-tr sipServerTransaction => s-x-tr --- record 12345/258 (#5)--- observationTimeMilliseconds => 2010-06-07 17:12:25 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.1 destinationIPv4Address => 198.51.100.10 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 1 sipResponseStatus => 180 sipToURI => sip:bob@example.net sipToTag => b1-1 sipFromURI => sip:alice@example.com sipFromTag => al-1 sipCallId => tr-87h@example.com sipClientTransaction => c-x-tr sipServerTransaction => s-x-tr --- record 12345/258 (#6)--- observationTimeMilliseconds => 2010-06-07 17:12:26 UTC sipSequenceNumber => 43 sourceIPv4Address => 198.51.100.10 destinationIPv4Address => 198.51.100.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 Trammell, et al. Expires April 29, 2012 [Page 21] Internet-Draft SIP Messages in IPFIX October 2011 sipMethod => 5 sipObservationType => 2 sipResponseStatus => 180 sipToURI => sip:bob@example.net sipToTag => b1-1 sipFromURI => sip:alice@example.com sipFromTag => al-1 sipCallId => tr-87h@example.com sipClientTransaction => c-x-tr sipServerTransaction => s-x-tr --- record 12345/258 (#7)--- observationTimeMilliseconds => 2010-06-07 17:12:27 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.1 destinationIPv4Address => 198.51.100.10 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 1 sipResponseStatus => 200 sipToURI => sip:bob@example.net sipToTag => b1-1 sipFromURI => sip:alice@example.com sipFromTag => al-1 sipCallId => tr-87h@example.com sipClientTransaction => c-x-tr sipServerTransaction => s-x-tr --- record 12345/258 (#8)--- observationTimeMilliseconds => 2010-06-07 17:12:27 UTC sipSequenceNumber => 43 sourceIPv4Address => 198.51.100.10 destinationIPv4Address => 198.51.100.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 2 sipResponseStatus => 200 sipToURI => sip:bob@example.net sipToTag => b1-1 sipFromURI => sip:alice@example.com sipFromTag => al-1 sipCallId => tr-87h@example.com sipClientTransaction => c-x-tr sipServerTransaction => s-x-tr --- record 12345/257 (#9)--- observationTimeMilliseconds => 2010-06-07 17:12:29 UTC Trammell, et al. Expires April 29, 2012 [Page 22] Internet-Draft SIP Messages in IPFIX October 2011 sipSequenceNumber => 43 sourceIPv4Address => 198.51.100.1 destinationIPv4Address => 198.51.100.10 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 1 sipObservationType => 1 sipRequestURI => sip:bob@example.net sipToURI => sip:bob@example.net sipToTag => b1-1 sipFromURI => sip:alice@example.com sipFromTag => al-1 sipCallId => tr-87h@example.com sipClientTransaction => c-x-tr sipServerTransaction => s-x-tr --- record 12345/257 (#10)--- observationTimeMilliseconds => 2010-06-07 17:12:29 UTC sipSequenceNumber => 43 sourceIPv4Address => 198.51.100.10 destinationIPv4Address => 203.0.113.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 1 sipObservationType => 2 sipRequestURI => sip:bob@example.net sipToURI => sip:bob@example.net sipToTag => b1-1 sipFromURI => sip:alice@example.com sipFromTag => al-1 sipCallId => tr-87h@example.com sipClientTransaction => c-x-tr sipServerTransaction => s-x-tr Figure 8: Message containing ten records for a downstream branch call (ripfix dump) 0000: 00 0a 04 e1|4c c0 2c e5 00 00 00 00 00 00 30 39| ....L.,.......09 0010: 01 01 00 7e|00 00 01 29 13 66 13 93 00 00 00 2b ...~...).f.....+ 0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 05 01 13 .3d..3d......... 0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example. 0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d net.sip:bob@exam 0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali 0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a 0070: 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 l-1.tr-87h@examp 0080: 6c 65 2e 63 6f 6d 00 06 73 2d 78 2d 74 72|01 02 le.com..s-x-tr.. Trammell, et al. Expires April 29, 2012 [Page 23] Internet-Draft SIP Messages in IPFIX October 2011 0090: 00 6c|00 00 01 29 13 66 14 c1 00 00 00 2b c6 33 .l...).f.....+.3 00a0: 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13 d..3d.........d. 00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example. 00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 net..sip:alice@e 00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 xample.com.al-1. 00e0: 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 tr-87h@example.c 00f0: 6f 6d 00 06 73 2d 78 2d 74 72|01 01 00 89|00 00 om..s-x-tr...... 0100: 01 29 13 66 18 a6 00 00 00 2b c6 33 64 0a cb 00 .).f.....+.3d... 0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f q.........sip:bo 0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n 0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp 0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 le.net..sip:alic 0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c e@example.com.al 0160: 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c -1.tr-87h@exampl 0170: 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 e.com.c-x-tr.s-x 0180: 2d 74 72|01 02 00 76|00 00 01 29 13 66 19 70 00 -tr...v...).f.p. 0190: 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 c4 11 ..+..q..3d...... 01a0: 05 01 00 64 13 73 69 70 3a 62 6f 62 40 65 78 61 ...d.sip:bob@exa 01b0: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 mple.net.b1-1.si 01c0: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example. 01d0: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40 com.al-1.tr-87h@ 01e0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d example.com.c-x- 01f0: 74 72 06 73 2d 78 2d 74 72|01 02 00 76|00 00 01 tr.s-x-tr...v... 0200: 29 13 66 1b c8 00 00 00 2b cb 00 71 01 c6 33 64 ).f.....+..q..3d 0210: 0a 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 ...........sip:b 0220: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 ob@example.net.b 0230: 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 1-1.sip:alice@ex 0240: 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 ample.com.al-1.t 0250: 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 6f r-87h@example.co 0260: 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 72|01 m.c-x-tr.s-x-tr. 0270: 02 00 76|00 00 01 29 13 66 1c 98 00 00 00 2b c6 ..v...).f.....+. 0280: 33 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 b4 3d..3d.......... 0290: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 .sip:bob@example 02a0: 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 6c .net.b1-1.sip:al 02b0: 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 ice@example.com. 02c0: 61 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d al-1.tr-87h@exam 02d0: 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 ple.com.c-x-tr.s 02e0: 2d 78 2d 74 72|01 02 00 76|00 00 01 29 13 66 20 -x-tr...v...).f 02f0: f0 00 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 ....+..q..3d.... 0300: c4 11 05 01 00 c8 13 73 69 70 3a 62 6f 62 40 65 .......sip:bob@e 0310: 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 xample.net.b1-1. 0320: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl 0330: 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 e.com.al-1.tr-87 0340: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d h@example.com.c- 0350: 78 2d 74 72 06 73 2d 78 2d 74 72|01 02 00 76|00 x-tr.s-x-tr...v. 0360: 00 01 29 13 66 21 a4 00 00 00 2b c6 33 64 0a c6 ..).f!....+.3d.. 0370: 33 64 01 13 c4 13 c4 11 05 02 00 c8 13 73 69 70 3d...........sip 0380: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 :bob@example.net Trammell, et al. Expires April 29, 2012 [Page 24] Internet-Draft SIP Messages in IPFIX October 2011 0390: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 .b1-1.sip:alice@ 03a0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 example.com.al-1 03b0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e .tr-87h@example. 03c0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 com.c-x-tr.s-x-t 03d0: 72|01 01 00 88|00 00 01 29 13 66 28 ac 00 00 00 r.......).f(.... 03e0: 2b c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 01 01 +.3d..3d........ 03f0: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 .sip:bob@example 0400: 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 .net.sip:bob@exa 0410: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 mple.net.b1-1.si 0420: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example. 0430: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40 com.al-1.tr-87h@ 0440: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d example.com.c-x- 0450: 74 72 06 73 2d 78 2d 74 72|01 01 00 88|00 00 01 tr.s-x-tr....... 0460: 29 13 66 28 ac 00 00 00 2b c6 33 64 0a cb 00 71 ).f(....+.3d...q 0470: 01 13 c4 13 c4 11 01 02 13 73 69 70 3a 62 6f 62 .........sip:bob 0480: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 @example.net.sip 0490: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 :bob@example.net 04a0: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 .b1-1.sip:alice@ 04b0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 example.com.al-1 04c0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e .tr-87h@example. 04d0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 com.c-x-tr.s-x-t 04e0: 72 r Figure 9: Message containing ten log entries for a downstream branch call (hexdump) 5.5. Forked Call The example in Figure 11 and Figure 12 demonstrates the export of forked call to Bob, as seen by one of Bob's instances which forks the call traverses, corresponding to example 9.4 in [I-D.ietf-sipclf-problem-statement]. See this example for more details. Note that, since Bob's first instance is multihomed IPv4- IPv6, this example requires additional templates: request and response templates for IPv4 to IPv6 and back, these are shown in Figure 10. Trammell, et al. Expires April 29, 2012 [Page 25] Internet-Draft SIP Messages in IPFIX October 2011 0000: 00 0a 01 e4 4c c0 2d 9b 00 00 00 00 00 00 30 39 ....L.-.......09 0010: 00 02 01 d4 01 05 00 11 01 43 00 08 81 99 00 04 .........C...... 0020: 00 00 8a ee 00 08 00 04 00 1c 00 10 00 07 00 02 ................ 0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee ................ 0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee ................ 0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee ................ 0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee ................ 0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee ................ 0080: 81 9d ff ff 00 00 8a ee 01 06 00 11 01 43 00 08 .............C.. 0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 1c 00 10 ................ 00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01 ................ 00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02 ................ 00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff ................ 00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff ................ 00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff ................ 00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee 01 07 00 11 ................ 0100: 01 43 00 08 81 99 00 04 00 00 8a ee 00 1b 00 10 .C.............. 0110: 00 0c 00 04 00 07 00 02 00 0b 00 02 00 04 00 01 ................ 0120: 81 92 00 01 00 00 8a ee 81 a3 00 01 00 00 8a ee ................ 0130: 81 93 ff ff 00 00 8a ee 81 96 ff ff 00 00 8a ee ................ 0140: 81 97 ff ff 00 00 8a ee 81 94 ff ff 00 00 8a ee ................ 0150: 81 95 ff ff 00 00 8a ee 81 98 ff ff 00 00 8a ee ................ 0160: 81 9e ff ff 00 00 8a ee 81 9d ff ff 00 00 8a ee ................ 0170: 01 08 00 11 01 43 00 08 81 99 00 04 00 00 8a ee .....C.......... 0180: 00 1b 00 10 00 0c 00 04 00 07 00 02 00 0b 00 02 ................ 0190: 00 04 00 01 81 92 00 01 00 00 8a ee 81 a3 00 01 ................ 01a0: 00 00 8a ee 81 9c 00 02 00 00 8a ee 81 96 ff ff ................ 01b0: 00 00 8a ee 81 97 ff ff 00 00 8a ee 81 94 ff ff ................ 01c0: 00 00 8a ee 81 95 ff ff 00 00 8a ee 81 98 ff ff ................ 01d0: 00 00 8a ee 81 9e ff ff 00 00 8a ee 81 9d ff ff ................ 01e0: 00 00 8a ee .... Figure 10: Message containing templates for IPv4 to IPv6 requests and responses, and vice versa ===== message 12345/0 @2010-10-21 13:13:01 UTC (#3) ===== --- record 12345/257 (#1)--- observationTimeMilliseconds => 2010-06-07 17:12:23 UTC sipSequenceNumber => 43 sourceIPv4Address => 198.51.100.1 destinationIPv4Address => 203.0.113.200 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 1 sipRequestURI => sip:bob@example.net Trammell, et al. Expires April 29, 2012 [Page 26] Internet-Draft SIP Messages in IPFIX October 2011 sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => sipServerTransaction => s-1-tr --- record 12345/258 (#2)--- observationTimeMilliseconds => 2010-06-07 17:12:24 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.200 destinationIPv4Address => 198.51.100.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 2 sipResponseStatus => 100 sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => sipServerTransaction => s-1-tr --- record 12345/257 (#3)--- observationTimeMilliseconds => 2010-06-07 17:12:24 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.200 destinationIPv4Address => 203.0.113.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 2 sipRequestURI => sip:bob@bob1.example.net sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-1-tr sipServerTransaction => s-1-tr --- record 12345/261 (#4)--- observationTimeMilliseconds => 2010-06-07 17:12:25 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.200 destinationIPv6Address => 2001:db8::9 Trammell, et al. Expires April 29, 2012 [Page 27] Internet-Draft SIP Messages in IPFIX October 2011 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 2 sipRequestURI => sip:bob@bob2.example.net sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-2-tr sipServerTransaction => s-1-tr --- record 12345/258 (#5)--- observationTimeMilliseconds => 2010-06-07 17:12:25 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.1 destinationIPv4Address => 203.0.113.200 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 1 sipResponseStatus => 100 sipToURI => sip:bob@example.net sipToTag => b1-1 sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-1-tr sipServerTransaction => s-1-tr --- record 12345/264 (#6)--- observationTimeMilliseconds => 2010-06-07 17:12:26 UTC sipSequenceNumber => 43 sourceIPv6Address => 2001:db8::9 destinationIPv4Address => 203.0.113.200 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 1 sipResponseStatus => 100 sipToURI => sip:bob@example.net sipToTag => b2-2 sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-2-tr Trammell, et al. Expires April 29, 2012 [Page 28] Internet-Draft SIP Messages in IPFIX October 2011 sipServerTransaction => s-1-tr --- record 12345/264 (#7)--- observationTimeMilliseconds => 2010-06-07 17:12:26 UTC sipSequenceNumber => 43 sourceIPv6Address => 2001:db8::9 destinationIPv4Address => 203.0.113.200 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 1 sipResponseStatus => 180 sipToURI => sip:bob@example.net sipToTag => b2-2 sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-2-tr sipServerTransaction => s-1-tr --- record 12345/258 (#8)--- observationTimeMilliseconds => 2010-06-07 17:12:26 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.200 destinationIPv4Address => 198.51.100.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 2 sipResponseStatus => 180 sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-2-tr sipServerTransaction => s-1-tr --- record 12345/258 (#9)--- observationTimeMilliseconds => 2010-06-07 17:12:27 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.200 destinationIPv4Address => 198.51.100.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 2 sipResponseStatus => 180 Trammell, et al. Expires April 29, 2012 [Page 29] Internet-Draft SIP Messages in IPFIX October 2011 sipToURI => sip:bob@example.net sipToTag => b1-1 sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-1-tr sipServerTransaction => s-1-tr --- record 12345/258 (#10)--- observationTimeMilliseconds => 2010-06-07 17:12:27 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.1 destinationIPv4Address => 203.0.113.200 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 1 sipResponseStatus => 200 sipToURI => sip:bob@example.net sipToTag => b1-1 sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-1-tr sipServerTransaction => s-1-tr --- record 12345/258 (#11)--- observationTimeMilliseconds => 2010-06-07 17:12:28 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.200 destinationIPv4Address => 198.51.100.1 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 2 sipResponseStatus => 200 sipToURI => sip:bob@example.net sipToTag => b1-1 sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-1-tr sipServerTransaction => s-1-tr --- record 12345/261 (#12)--- observationTimeMilliseconds => 2010-06-07 17:12:28 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.200 destinationIPv6Address => 2001:db8::9 Trammell, et al. Expires April 29, 2012 [Page 30] Internet-Draft SIP Messages in IPFIX October 2011 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 3 sipObservationType => 2 sipRequestURI => sip:bob@bob2.example.net sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-2-tr sipServerTransaction => s-1-tr --- record 12345/264 (#13)--- observationTimeMilliseconds => 2010-06-07 17:12:28 UTC sipSequenceNumber => 43 sourceIPv6Address => 2001:db8::9 destinationIPv4Address => 203.0.113.200 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 5 sipObservationType => 1 sipResponseStatus => 487 sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-2-tr sipServerTransaction => s-1-tr --- record 12345/261 (#14)--- observationTimeMilliseconds => 2010-06-07 17:12:29 UTC sipSequenceNumber => 43 sourceIPv4Address => 203.0.113.200 destinationIPv6Address => 2001:db8::9 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 1 sipObservationType => 2 sipRequestURI => sip:bob@bob2.example.net sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-2-tr Trammell, et al. Expires April 29, 2012 [Page 31] Internet-Draft SIP Messages in IPFIX October 2011 sipServerTransaction => s-1-tr --- record 12345/264 (#15)--- observationTimeMilliseconds => 2010-06-07 17:12:30 UTC sipSequenceNumber => 43 sourceIPv6Address => 2001:db8::9 destinationIPv4Address => 203.0.113.200 sourceTransportPort => 5060 destinationTransportPort => 5060 protocolIdentifier => 17 sipMethod => 3 sipObservationType => 1 sipResponseStatus => 200 sipToURI => sip:bob@example.net sipToTag => sipFromURI => sip:alice@example.com sipFromTag => a1-1 sipCallId => tr-88h@example.com sipClientTransaction => c-2-tr sipServerTransaction => s-1-tr Figure 11: Message containing fifteen records for a forked call 0000: 00 0a 07 8c 4c c0 2d 9b 00 00 00 00 00 00 30 39| ....L.-.......09 0010: 01 01 00 7e|00 00 01 29 13 66 13 93 00 00 00 2b ...~...).f.....+ 0020: c6 33 64 01 cb 00 71 c8 13 c4 13 c4 11 05 01 13 .3d...q......... 0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example. 0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d net.sip:bob@exam 0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali 0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a 0070: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 1-1.tr-88h@examp 0080: 6c 65 2e 63 6f 6d 00 06 73 2d 31 2d 74 72|01 02 le.com..s-1-tr.. 0090: 00 6c|00 00 01 29 13 66 14 c1 00 00 00 2b cb 00 .l...).f.....+.. 00a0: 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13 q..3d.........d. 00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example. 00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 net..sip:alice@e 00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1. 00e0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c 00f0: 6f 6d 00 06 73 2d 31 2d 74 72|01 01 00 89|00 00 om..s-1-tr...... 0100: 01 29 13 66 18 a6 00 00 00 2b cb 00 71 c8 cb 00 .).f.....+..q... 0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f q.........sip:bo 0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n 0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp 0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 le.net..sip:alic 0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 e@example.com.a1 0160: 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c -1.tr-88h@exampl 0170: 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 e.com.c-1-tr.s-1 0180: 2d 74 72|01 05 00 95|00 00 01 29 13 66 1a 9c 00 -tr.......).f... Trammell, et al. Expires April 29, 2012 [Page 32] Internet-Draft SIP Messages in IPFIX October 2011 0190: 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 00 00 00 ..+..q. ........ 01a0: 00 00 00 00 00 00 09 13 c4 13 c4 11 05 02 18 73 ...............s 01b0: 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 78 61 6d ip:bob@bob2.exam 01c0: 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 ple.net.sip:bob@ 01d0: 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 70 example.net..sip 01e0: 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 :alice@example.c 01f0: 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 om.a1-1.tr-88h@e 0200: 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 xample.com.c-2-t 0210: 72 06 73 2d 31 2d 74 72|01 02 00 76|00 00 01 29 r.s-1-tr...v...) 0220: 13 66 1b c8 00 00 00 2b cb 00 71 01 cb 00 71 c8 .f.....+..q...q. 0230: 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a 62 6f ........d.sip:bo 0240: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 b@example.net.b1 0250: 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 -1.sip:alice@exa 0260: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 mple.com.a1-1.tr 0270: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d -88h@example.com 0280: 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72|01 08 .c-1-tr.s-1-tr.. 0290: 00 82|00 00 01 29 13 66 1c f4 00 00 00 2b 20 01 .....).f.....+ . 02a0: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00 ................ 02b0: 71 c8 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a q.........d.sip: 02c0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 bob@example.net. 02d0: 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 40 65 b2-2.sip:alice@e 02e0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1. 02f0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c 0300: 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72| om.c-2-tr.s-1-tr 0310: 01 08 00 82|00 00 01 29 13 66 1f 4c 00 00 00 2b .......).f.L...+ 0320: 20 01 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 ............... 0330: cb 00 71 c8 13 c4 13 c4 11 05 01 00 b4 13 73 69 ..q...........si 0340: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 p:bob@example.ne 0350: 74 04 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 t.b2-2.sip:alice 0360: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d @example.com.a1- 0370: 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 1.tr-88h@example 0380: 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d .com.c-2-tr.s-1- 0390: 74 72|01 02 00 72|00 00 01 29 13 66 20 6e 00 00 tr...r...).f n.. 03a0: 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 .+..q..3d....... 03b0: 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 61 6d ....sip:bob@exam 03c0: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali 03d0: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a 03e0: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 1-1.tr-88h@examp 03f0: 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d le.com.c-2-tr.s- 0400: 31 2d 74 72|01 02 00 76|00 00 01 29 13 66 21 a4 1-tr...v...).f!. 0410: 00 00 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 ...+..q..3d..... 0420: 11 05 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 ......sip:bob@ex 0430: 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 ample.net.b1-1.s 0440: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 ip:alice@example 0450: 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 .com.a1-1.tr-88h 0460: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 @example.com.c-1 0470: 2d 74 72 06 73 2d 31 2d 74 72|01 02 00 76|00 00 -tr.s-1-tr...v.. 0480: 01 29 13 66 23 98 00 00 00 2b cb 00 71 01 cb 00 .).f#....+..q... Trammell, et al. Expires April 29, 2012 [Page 33] Internet-Draft SIP Messages in IPFIX October 2011 0490: 71 c8 13 c4 13 c4 11 05 01 00 c8 13 73 69 70 3a q...........sip: 04a0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 bob@example.net. 04b0: 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 b1-1.sip:alice@e 04c0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1. 04d0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c 04e0: 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72| om.c-1-tr.s-1-tr 04f0: 01 02 00 76|00 00 01 29 13 66 24 60 00 00 00 2b ...v...).f$`...+ 0500: cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 ..q..3d......... 0510: c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c ..sip:bob@exampl 0520: 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 e.net.b1-1.sip:a 0530: 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d lice@example.com 0540: 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 .a1-1.tr-88h@exa 0550: 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 mple.com.c-1-tr. 0560: 73 2d 31 2d 74 72|01 05 00 95|00 00 01 29 13 66 s-1-tr.......).f 0570: 25 29 00 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 %)...+..q. ..... 0580: 00 00 00 00 00 00 00 00 00 09 13 c4 13 c4 11 03 ................ 0590: 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 ..sip:bob@bob2.e 05a0: 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 xample.net.sip:b 05b0: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 ob@example.net.. 05c0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl 05d0: 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 e.com.a1-1.tr-88 05e0: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d h@example.com.c- 05f0: 32 2d 74 72 06 73 2d 31 2d 74 72|01 08 00 7e|00 2-tr.s-1-tr...~. 0600: 00 01 29 13 66 28 3f 00 00 00 2b 20 01 0d b8 00 ..).f(?...+ .... 0610: 00 00 00 00 00 00 00 00 00 00 09 cb 00 71 c8 13 .............q.. 0620: c4 13 c4 11 05 01 01 e7 13 73 69 70 3a 62 6f 62 .........sip:bob 0630: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 @example.net..si 0640: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example. 0650: 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 com.a1-1.tr-88h@ 0660: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d example.com.c-2- 0670: 74 72 06 73 2d 31 2d 74 72|01 05 00 95|00 00 01 tr.s-1-tr....... 0680: 29 13 66 2a 0f 00 00 00 2b cb 00 71 c8 20 01 0d ).f*....+..q. .. 0690: b8 00 00 00 00 00 00 00 00 00 00 00 09 13 c4 13 ................ 06a0: c4 11 01 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 .....sip:bob@bob 06b0: 32 2e 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 2.example.net.si 06c0: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 p:bob@example.ne 06d0: 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 t..sip:alice@exa 06e0: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 mple.com.a1-1.tr 06f0: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d -88h@example.com 0700: 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72|01 08 .c-2-tr.s-1-tr.. 0710: 00 7e|00 00 01 29 13 66 2c 31 00 00 00 2b 20 01 .~...).f,1...+ . 0720: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00 ................ 0730: 71 c8 13 c4 13 c4 11 03 01 00 c8 13 73 69 70 3a q...........sip: 0740: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 bob@example.net. 0750: 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 .sip:alice@examp 0760: 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 le.com.a1-1.tr-8 0770: 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 8h@example.com.c 0780: 2d 32 2d 74 72 06 73 2d 31 2d 74 72 -2-tr.s-1-tr Trammell, et al. Expires April 29, 2012 [Page 34] Internet-Draft SIP Messages in IPFIX October 2011 Figure 12: Message containing sixteen log entries for a forked call 6. Security Considerations [TODO] 7. IANA Considerations This document defines the sipMethod subregistry for the IANA IPFIX Information Element registry at http://www.iana.org/assignments/ipfix for the values taken by the sipMethod Information Element. The initial content of this subregistry is specified in Section 2.13. Entries may be added to this subregistry subject to the same Standards Action [RFC5226] that adds new Methods to the Methods and Response Codes registry at http://www.iana.org/assignments/sip-parameters. At such time as this document is prepared for publication as an RFC, the Information Elements defined herein will be defined for inclusion in the IANA IPFIX Information Element registry at http://www.iana.org/assignments/ipfix. Until such time, the Information Elements within this document are defined within Private Enterprise Number 35566, belonging to one of the authors. 8. Acknowledgments Thanks to Cullen Jennings for his provided insightful discussions, specific comments and much needed corrections, and to Nico d'Heureuse for his help with the RFC 3665 examples. 9. References 9.1. Normative References [I-D.ietf-sipclf-problem-statement] Gurbani, V., Burger, E., Anjali, T., Abdelnur, H., and O. Festor, "The Common Log Format (CLF) for the Session Initiation Protocol (SIP)", draft-ietf-sipclf-problem-statement-07 (work in progress), June 2011. [RFC5101] Claise, B., "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information", RFC 5101, January 2008. Trammell, et al. Expires April 29, 2012 [Page 35] Internet-Draft SIP Messages in IPFIX October 2011 [RFC5655] Trammell, B., Boschi, E., Mark, L., Zseby, T., and A. Wagner, "Specification of the IP Flow Information Export (IPFIX) File Format", RFC 5655, October 2009. 9.2. Informative References [I-D.kaplan-dispatch-session-id] Kaplan, H., "A Session Identifier for the Session Initiation Protocol (SIP)", draft-kaplan-dispatch-session-id-03 (work in progress), March 2011. [I-D.trammell-ipfix-ie-doctors] Trammell, B. and B. Claise, "Guidelines for Authors and Reviewers of IPFIX Information Elements", draft-trammell-ipfix-ie-doctors-02 (work in progress), June 2011. [RFC2976] Donovan, S., "The SIP INFO Method", RFC 2976, October 2000. [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002. [RFC3262] Rosenberg, J. and H. Schulzrinne, "Reliability of Provisional Responses in Session Initiation Protocol (SIP)", RFC 3262, June 2002. [RFC3265] Roach, A., "Session Initiation Protocol (SIP)-Specific Event Notification", RFC 3265, June 2002. [RFC3311] Rosenberg, J., "The Session Initiation Protocol (SIP) UPDATE Method", RFC 3311, October 2002. [RFC3428] Campbell, B., Rosenberg, J., Schulzrinne, H., Huitema, C., and D. Gurle, "Session Initiation Protocol (SIP) Extension for Instant Messaging", RFC 3428, December 2002. [RFC3515] Sparks, R., "The Session Initiation Protocol (SIP) Refer Method", RFC 3515, April 2003. [RFC3665] Johnston, A., Donovan, S., Sparks, R., Cunningham, C., and K. Summers, "Session Initiation Protocol (SIP) Basic Call Flow Examples", BCP 75, RFC 3665, December 2003. [RFC3903] Niemi, A., "Session Initiation Protocol (SIP) Extension Trammell, et al. Expires April 29, 2012 [Page 36] Internet-Draft SIP Messages in IPFIX October 2011 for Event State Publication", RFC 3903, October 2004. [RFC4475] Sparks, R., Hawrylyshen, A., Johnston, A., Rosenberg, J., and H. Schulzrinne, "Session Initiation Protocol (SIP) Torture Test Messages", RFC 4475, May 2006. [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, May 2008. [RFC6026] Sparks, R. and T. Zourzouvillys, "Correct Transaction Handling for 2xx Responses to Session Initiation Protocol (SIP) INVITE Requests", RFC 6026, September 2010. [RFC6086] Holmberg, C., Burger, E., and H. Kaplan, "Session Initiation Protocol (SIP) INFO Method and Package Framework", RFC 6086, January 2011. [ripfix] Trammell, B., "ripfix: IPFIX for Ruby", available at http://ripfix.rubyforge.org/. Appendix A. Definition of Base SIP Message Information Elements in IANA XML Registry format [EDITOR'S NOTE: frontmatter] sipObservationType unsigned8 identifier 35566 419 current Denotes whether the entry was corresponds to a SIP message received, sent, or merely seen by a passive observer, as follows: 0: unknown: The Metering Process does not specify the observation type. 1: receiver: The Metering Process is, or is co-located with, the receiver of the SIP message. 2: sender: The Metering Process is, or is co-located with, the sender of the SIP message. Trammell, et al. Expires April 29, 2012 [Page 37] Internet-Draft SIP Messages in IPFIX October 2011 3: passive: The Metering Process passively observed the SIP message. sipMethod unsigned8 identifier 35566 402 current The SIP method from the CSeq header, encoded as per the IPFIX sipMethod subregistry. sipSequenceNumber unsigned32 identifier 35566 409 current The sequence number from the CSeq header. sipRequestURI string 35566 403 current The SIP Request URI, including any parameters, as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipFromURI string 35566 404 current Trammell, et al. Expires April 29, 2012 [Page 38] Internet-Draft SIP Messages in IPFIX October 2011 The URI from the SIP From: header sipFromTag string 35566 405 current The Tag parameter value from the SIP From: header sipToURI string 35566 406 current The URI from the SIP To: header sipToTag string 35566 407 current The Tag parameter value from the SIP To: header sipCallId string 35566 408 current The value of the SIP Call-ID: header sipResponseStatus unsigned16 Trammell, et al. Expires April 29, 2012 [Page 39] Internet-Draft SIP Messages in IPFIX October 2011 identifier 35566 412 current The SIP Response code. The presence of this Information Element in a SIP Message record marks it as describing a SIP response; if absent, the record describes a SIP request. sipServerTransaction string identifier 35566 413 current The transaction identifier associated with the server transaction. sipClientTransaction string identifier 35566 414 current The transaction identifier associated with the client transaction. SIP Message Information Element definitions Appendix B. Definition of sipMethod registry in IANA XML Registry format [EDITOR'S NOTE: frontmatter] Trammell, et al. Expires April 29, 2012 [Page 40] Internet-Draft SIP Messages in IPFIX October 2011 IPFIX sipMethod Expert Review 0 Unknown The Metering Process did not recognize the SIP method. 1 ACK 2 BYE 3 CANCEL 4 INFO 5 INVITE 6 MESSAGE 7 NOTIFY Trammell, et al. Expires April 29, 2012 [Page 41] Internet-Draft SIP Messages in IPFIX October 2011 8 OPTIONS 9 PRACK 10 PUBLISH 11 REFER 12 REGISTER 13 SUBSCRIBE 14 UPDATE 15-65535 Unassigned Trammell, et al. Expires April 29, 2012 [Page 42] Internet-Draft SIP Messages in IPFIX October 2011 sipMethod subregistry Appendix C. Definition of Additional SIP Message Information Elements in IANA XML Registry format [EDITOR'S NOTE: frontmatter] sipContactURI string 35566 415 current The addr-spec URI, including any URI parameters, of the first/top-most SIP Contact header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipRouteURI string 35566 416 current The addr-spec URI, including any URI parameters, of the first/top-most SIP Route header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipPaiURI string 35566 417 Trammell, et al. Expires April 29, 2012 [Page 43] Internet-Draft SIP Messages in IPFIX October 2011 current The addr-spec URI, including any URI parameters, of the first/top-most SIP P-Asserted-Identity header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipPpiURI string 35566 418 current The addr-spec URI, including any URI parameters, of the first/top-most SIP P-Preferred-Identity header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipPAssocURI string 35566 430 current The addr-spec URI, including any URI parameters, of the first/top-most SIP P-Associated-Identity header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipPCalledPartyURI string 35566 420 current The addr-spec URI, including any URI parameters, of the SIP P-Called-Party-ID header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. Trammell, et al. Expires April 29, 2012 [Page 44] Internet-Draft SIP Messages in IPFIX October 2011 sipVia string 35566 421 current The value of the first/top-most Via header as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipAuthUsername string 35566 422 current The value of the username field of the first/top-most Authorization header as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipSubscriptionEvent string 35566 423 current The value of the Event header as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipSubscriptionState string 35566 424 current The value of the Subscription-State header as a UTF-8 string, escaped according to SIP rules as received by the metering process. Trammell, et al. Expires April 29, 2012 [Page 45] Internet-Draft SIP Messages in IPFIX October 2011 sipExpires unsigned32 35566 425 current The numeric value of the expires parameter of the first/top-most Contact header of a REGISTER request or response, or Subscription-State header of a SUBSCRIBE or NOTIFY request or response, or the Expires header if the expires parameter does not exist, as received by the metering process. sipPVisitedNetworkID string 35566 426 current The value of the first/top-most P-Visited-Network-ID header as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipPAccessNetworkInfo string 35566 427 current The value of the P-Access-Network-Info header as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipPChargingFunctionAddr string 35566 428 current The value of the first/top-most P-Charging-Function-Addresses header Trammell, et al. Expires April 29, 2012 [Page 46] Internet-Draft SIP Messages in IPFIX October 2011 as a UTF-8 string, escaped according to SIP rules as received by the metering process. sipPChargingVector string 35566 429 current The value of the P-Charging-Vector header as a UTF-8 string, escaped according to SIP rules as received by the metering process. Additional SIP Message Information Element definitions Appendix D. Example messages in base64 This section contains the example messages from this revision of this draft in base64 encoding, for ease of processing by automated tools. The base templates are in this message: AAoA/EzALZsAAAAAAAAwOQACAOwBAQARAUMACIGZAAQAAIruAAgABAAMAAQA BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX //8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK 7gECABEBQwAIgZkABAAAiu4ACAAEAAwABAAHAAIACwACAAQAAYGSAAEAAIru gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIru The extended 4to6 and 6to4 templates are in this message: AAoB5EzALZsAAAAAAAAwOQACAdQBBQARAUMACIGZAAQAAIruAAgABAAcABAA BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX //8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK 7gEGABEBQwAIgZkABAAAiu4ACAAEABwAEAAHAAIACwACAAQAAYGSAAEAAIru gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIruAQcAEQFDAAiBmQAEAACK7gAb ABAADAAEAAcAAgALAAIABAABgZIAAQAAiu6BowABAACK7oGT//8AAIrugZb/ /wAAiu6Bl///AACK7oGU//8AAIrugZX//wAAiu6BmP//AACK7oGe//8AAIru gZ3// wAAiu4BCAARAUMACIGZAAQAAIruABsAEAAMAAQABwACAAsAAgAEAAGB kgABAACK7oGjAAEAAIrugZwAAgAAiu6Blv//AACK7oGX//8AAIrugZT//wAA iu6Blf// Trammell, et al. Expires April 29, 2012 [Page 47] Internet-Draft SIP Messages in IPFIX October 2011 AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK7g== The UAC registration in Section 5.2 is in this message: AAoA2EzAO88AAAAAAAAwOQEBAGsAAAEpE2YTkwAAAAHGM2QBxjNkChPEE8QR DAIPc2lwOmV4YW1wbGUuY29tAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2 eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEAAQIAXQAAASkTZhUk AAAAAcYzZArGM2QBE8QTxBEMAQDIAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t BTc2eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEA The direct call in Section 5.3 is in this message: AAoCGkzAPA8AAAAAAAAwOQEBAIgAAAEpE2YTkwAAACDGM2QBywBxARPEE8QR BQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5u ZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQU3NnloaBVmODItZDQtZjdAZXhh bXBsZS5jb20HYy0xLXh0NgABAgB5AAABKRNmGKoAAAAgywBxAcYzZAETxBPE EQUBALQTc2lwOmJvYkBleGFtcGxlLm5ldAhiLWluNi1pdRVzaXA6YWxpY2VA ZXhhbXBsZS5jb20FNzZ5aGgVZjgyLWQ0LWY3QGV4YW1wbGUuY29tB2MtMS14 dDYAAQIAeQAAASkTZhz0AAAAIMsAcQHGM2QBE8QTxBEFAQDIE3NpcDpib2JA ZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2 eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AAEBAJAAAAEpE2Yd CAAAACDGM2QBywBxARPEE8QRAQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0 E3NpcDpib2JAZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1w bGUuY29tBTc2eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AA== The downstream branch call in Section 5.4 is in this message: AAoE4UzAPEoAAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBxjNkChPEE8QR BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz aXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20A BnMteC10cgECAGwAAAEpE2YUwQAAACvGM2QKxjNkARPEE8QRBQIAZBNzaXA6 Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0 ci04N2hAZXhhbXBsZS5jb20ABnMteC10cgEBAIkAAAEpE2YYpgAAACvGM2QK ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3 aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZhlwAAAAK8sA cQHGM2QKE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6 YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14 LXRyBnMteC10cgECAHYAAAEpE2YbyAAAACvLAHEBxjNkChPEE8QRBQEAtBNz aXA6Ym9iQGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29t BGFsLTESdHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAgB2AAAB KRNmHJgAAAArxjNkCsYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3aEBleGFt cGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZiDwAAAAK8sAcQHGM2QK E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA ZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMt eC10cgECAHYAAAEpE2YhpAAAACvGM2QKxjNkARPEE8QRBQIAyBNzaXA6Ym9i QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGFsLTES Trammell, et al. Expires April 29, 2012 [Page 48] Internet-Draft SIP Messages in IPFIX October 2011 dHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAQCIAAABKRNmKKwA AAArxjNkAcYzZAoTxBPEEQEBE3NpcDpib2JAZXhhbXBsZS5uZXQTc2lwOmJv YkBleGFtcGxlLm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0x EnRyLTg3aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQEAiAAAASkTZiis AAAAK8YzZArLAHEBE8QTxBEBAhNzaXA6Ym9iQGV4YW1wbGUubmV0E3NpcDpi b2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwt MRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMteC10cg== The forked call in Section 5.5 is in this message: AAoHjEzAPF0AAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBywBxyBPEE8QR BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz aXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20A BnMtMS10cgECAGwAAAEpE2YUwQAAACvLAHHIxjNkARPEE8QRBQIAZBNzaXA6 Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0 ci04OGhAZXhhbXBsZS5jb20ABnMtMS10cgEBAIkAAAEpE2YYpgAAACvLAHHI ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4 aEBleGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQUAlQAAASkTZhqcAAAAK8sA ccggAQ24AAAAAAAAAAAAAAAJE8QTxBEFAhhzaXA6Ym9iQGJvYjIuZXhhbXBs ZS5uZXQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUu Y29tBGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2 AAABKRNmG8gAAAArywBxAcsAccgTxBPEEQUBAGQTc2lwOmJvYkBleGFtcGxl Lm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBl eGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQgAggAAASkTZhz0AAAAKyABDbgA AAAAAAAAAAAAAAnLAHHIE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQE YjItMhVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBs ZS5jb20GYy0yLXRyBnMtMS10cgEIAIIAAAEpE2YfTAAAACsgAQ24AAAAAAAA AAAAAAAJywBxyBPEE8QRBQEAtBNzaXA6Ym9iQGV4YW1wbGUubmV0BGIyLTIV c2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTESdHItODhoQGV4YW1wbGUuY29t BmMtMi10cgZzLTEtdHIBAgByAAABKRNmIG4AAAArywBxyMYzZAETxBPEEQUC ALQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t BGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2AAAB KRNmIaQAAAArywBxyMYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFt cGxlLmNvbQZjLTEtdHIGcy0xLXRyAQIAdgAAASkTZiOYAAAAK8sAcQHLAHHI E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA ZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0xLXRyBnMt MS10cgECAHYAAAEpE2YkYAAAACvLAHHIxjNkARPEE8QRBQIAyBNzaXA6Ym9i QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTES dHItODhoQGV4YW1wbGUuY29tBmMtMS10cgZzLTEtdHIBBQCVAAABKRNmJSkA AAArywBxyCABDbgAAAAAAAAAAAAAAAkTxBPEEQMCGHNpcDpib2JAYm9iMi5l eGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhh bXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10 cgEIAH4AAAEpE2YoPwAAACsgAQ24AAAAAAAAAAAAAAAJywBxyBPEE8QRBQEB 5xNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20E YTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10cgEFAJUAAAEp E2YqDwAAACvLAHHIIAENuAAAAAAAAAAAAAAACRPEE8QRAQIYc2lwOmJvYkBi Trammell, et al. Expires April 29, 2012 [Page 49] Internet-Draft SIP Messages in IPFIX October 2011 b2IyLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGlj ZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIG cy0xLXRyAQgAfgAAASkTZiwxAAAAKyABDbgAAAAAAAAAAAAAAAnLAHHIE8QT xBEDAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxl LmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIGcy0xLXRy Authors' Addresses Brian Trammell Swiss Federal Institute of Technology Zurich Gloriastrasse 35 8092 Zurich Switzerland Email: trammell@tik.ee.ethz.ch Saverio Niccolini NEC Laboratories Europe, NEC Europe Ltd. Kurfuersten-Anlage 36 Heidelberg 69115 Germany Phone: +49 (0) 6221 4342 118 Email: niccolini@neclab.eu URI: http://www.neclab.eu Benoit Claise Cisco Systems Inc. De Kleetlaan 6a b1 Diegem, 1813 Belgium Phone: +32 2 704 5622 Fax: Email: bclaise@cisco.com URI: Trammell, et al. Expires April 29, 2012 [Page 50] Internet-Draft SIP Messages in IPFIX October 2011 Hadriel Kaplan Acme Packet 71 Third Ave. Burlington, MA 01803 USA Phone: Email: hkaplan@acmepacket.com Trammell, et al. Expires April 29, 2012 [Page 51]