Export of BGP FlowSpec Treatment Information in IPFIX

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 20 January 2027.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

BGP Flow Specification (FlowSpec) [RFC8955] [RFC8956] provides a mechanism for distributing traffic filtering and traffic treatment rules using BGP. A FlowSpec rule can identify traffic and request a treatment such as traffic discard, rate limiting, redirection, or traffic marking.¶

When traffic is processed under a FlowSpec rule, operators often need visibility into traffic that matched the rule and was observed by enforcement devices. Control-plane information can describe distribution, validation, or installation of a FlowSpec route, but it does not by itself provide forwarding-plane statistics for traffic observed after FlowSpec processing.¶

For example, after a mitigation system installs a FlowSpec rule for traffic toward a victim prefix, an operator may need to collect IPFIX statistics from enforcement devices and determine which exported Flow Records were associated with that rule and which treatment class was reported at the Observation Point.¶

IP Flow Information Export (IPFIX) [RFC7011] provides a mechanism for exporting Flow Records from Exporters to Collectors. Existing IPFIX Information Elements can describe flow keys, counters, timestamps, interfaces, Observation Points, and other properties of an observed Flow [RFC7012]. This document defines additional IPFIX Information Elements that allow a Flow Record to carry FlowSpec rule correlation and treatment context.¶

IPFIX supports enterprise-specific Information Elements, but use of enterprise-specific elements for this information can make cross-vendor collection and analysis difficult. Standard Information Elements allow Collectors to recognize FlowSpec-treated Flow Records in a common way while still relying on existing IPFIX elements for generic flow properties and counters.¶

The Information Elements defined in this document are intended to be used together with existing IPFIX Information Elements.¶

2. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

This document uses the IPFIX terminology defined in [RFC7011].¶

The following terms are used in this document:¶

• FlowSpec rule: A BGP FlowSpec route together with its associated traffic treatment information.¶

• FlowSpec-treated Flow Record: An IPFIX Flow Record that reports traffic observed after the traffic matched a FlowSpec rule and includes one or more Information Elements defined in this document.¶

• FlowSpec rule identifier: A local identifier, scoped to an Observation Domain, that associates a FlowSpec-treated Flow Record with the FlowSpec rule used by the Exporter for correlation.¶

• FlowSpec treatment class: A coarse-grained class of FlowSpec-derived treatment that the Exporter reports for metered packets at an Observation Point.¶

3. Scope

This document defines two new IPFIX Information Elements for traffic processed by BGP FlowSpec:¶

• flowSpecRuleIdentifier, which provides a local identifier, scoped to an Observation Domain, for the FlowSpec rule associated with an exported Flow Record.¶

• flowSpecTreatmentClass, which identifies the FlowSpec-derived treatment class reported by the Exporter for the metered packets.¶

Used together with existing IPFIX Information Elements for flow keys, counters, timestamps, interfaces, Observation Points, sampling information, and other generic flow properties, these Information Elements enable a Collector to correlate Flow Records with the FlowSpec rule and treatment reported by the Exporter.¶

Typical uses include correlating IPFIX Flow Records with FlowSpec rules during DDoS mitigation, accounting for traffic observed under FlowSpec-derived treatment, and troubleshooting whether traffic observed at an Observation Point is associated with a specific FlowSpec rule.¶

4. Relationship to FlowSpec Monitoring

The broader FlowSpec monitoring problem includes route lifecycle information, constrained realization information, enforcement status information, traffic-treatment outcome information, and correlation information across those sources [draft-cui-idr-flowspec-feedback-roadmap-00].¶

This document addresses only the IPFIX component of that problem: forwarding-plane observations of traffic associated with FlowSpec-derived behavior. BGP route status, FlowSpec validation status, and structured enforcement state are expected to be reported, when needed, by other mechanisms such as BGP control-plane telemetry or YANG-based operational models.¶

5. FlowSpec Data-Plane Statistics Export

6. FlowSpec Information Elements

This section defines the initial set of IPFIX Information Elements for FlowSpec data-plane statistics export.¶

7. Export Example

The following example illustrates a Template for exporting an IPv4 Flow Record for traffic processed by a FlowSpec rule.¶

The existing Information Elements provide the flow keys, statistics, timestamps, and observation context. The FlowSpec-specific Information Elements provide the local FlowSpec rule identifier and the treatment class reported for the metered packets.¶

8. Operational Considerations

The interpretation of FlowSpec data-plane statistics depends on the Observation Point and metering behavior of the Exporter. A Collector needs to consider where the traffic was observed and whether the exported counters are affected by aggregation, sampling, filtering, or local implementation behavior.¶

The Information Elements defined in this document provide correlation and treatment context for IPFIX Flow Records. They do not by themselves provide the full FlowSpec rule, its control-plane state, or the state of enforcement objects derived from the rule.¶

A Collector needs to treat absence of a FlowSpec-specific Information Element differently from an explicit value. For example, a Flow Record without a FlowSpec rule identifier does not necessarily mean that no FlowSpec rule existed; it may mean that the Exporter did not support or did not apply this export.¶

When multiple Exporters report records for the same FlowSpec rule, a Collector needs to use the Observation Domain, Observation Point, timestamps, and other IPFIX context to avoid treating independent observations as duplicate or equivalent measurements.¶

9. Security Considerations

FlowSpec-treated Flow Records can reveal sensitive information about traffic filtering policy, DDoS mitigation behavior, victim prefixes, attack traffic characteristics, and platform or deployment capabilities. Exporters, Collectors, and transport paths need to protect this information according to the sensitivity of the exported Flow Records.¶

Forged, modified, delayed, replayed, or suppressed Flow Records could cause an operator or automated system to draw an incorrect conclusion about whether FlowSpec treatment is active or effective. Deployments need appropriate authentication, integrity protection, confidentiality, access control, and replay or staleness handling for IPFIX export.¶

High-volume FlowSpec-related export can create load on Exporters, Collectors, and transport paths. Deployments need to consider filtering, aggregation, sampling, rate control, and retention policies that are appropriate for the operational use case.¶

10. IANA Considerations

IANA is requested to allocate the following Information Elements in the "IPFIX Information Elements" registry. New IPFIX Information Elements are reviewed according to the Expert Review process described in [RFC7012] and [RFC7013].¶

IANA is also requested to create and maintain a new subregistry named "FlowSpec Treatment Class" under the "IPFIX Information Elements" registry. The initial values are:¶

New values in the "FlowSpec Treatment Class" registry are assigned by Expert Review [RFC8126].¶

11. References

Authors' Addresses