IPFIX Export
Introduced in ASN 2.5
Overview
ASN 2.5 introduces IPFIX export support for both Telco and Data Center (DC) deployments, enabling flow metadata to be exported to external IPFIX collectors in addition to the existing Kafka-based JSON export.
The feature provides standards-based flow export using IPFIX (RFC 7011) and supports simultaneous export to six collectors without impacting existing Kafka export functionality.
Key Features
IPFIX export support for Telco and Data Center (DC) modes.
Independent or simultaneous export to Kafka and IPFIX.
Support for up to six IPFIX collectors.
Standards-compliant IPFIX export based on RFC 7011.
Template-based export.
The following deployment modes are supported:
Kafka only
IPFIX only
Kafka and IPFIX simultaneously
IPFIX Collectors
ASN supports configuration of up to six IPFIX collectors.
Each collector requires:
Collector IPv4 address
Collector UDP port
Behavior:
If multiple collectors are configured, the same export data is sent to all active collectors
Collectors operate independently (no dependency between them)
Invalid collector config (Invalid IP format or 0 < PortNum > 65535) will be restricted via UI
Metadata Configuration
IPFIX uses the same metadata selection configuration as Kafka export.
Any metadata attribute enabled for export is included in both:
Kafka export
IPFIX export
No separate metadata configuration is required for IPFIX.
Export Behavior
Export Interval
IPFIX export follows the configured Kafka export interval.
A separate IPFIX export interval is not required.
Flow records are exported independently for each traffic direction:
Forward direction
Reverse direction
Each direction generates an independent record.
Export Conditions
IPFIX export follows the same filtering rules as Kafka export.
A record is not exported if any applicable condition is met:
#
Rule
Applies To
1
Invalid flow index
Both
2
SIP protocol with SIP/RTP disabled
Both
3
Session deleted / creation time invalid
Both
4
Session created after export timestamp
Both
5
Zero interval avg bandwidth
Both
6
Interval bytes below threshold
Both
7
Lost TCP packets ≥ total packets
Both
8
Retransmissions ≥ total packets
Both
9
KPI cache from a different session
Normal only
10
Single-packet flow with zero/negative duration
Normal only
11
No new bytes since last export
Normal only
Template ID Reference Table
256
Main
IPv4 Base — DC and TELCO U-plane IPv4 flows
257
Main
IPv6 Base — DC and TELCO U-plane IPv6 flows
258
Main
EPC Control — 4G/LTE bearer sessions (GTP-C S11/S5S8 correlated)
260
Main
5GC Control — 5G SA PDU sessions (NGAP/PFCP correlated)
310
Sub
EPC Bearer slot (carried inside template 258 via IE 500 BEARER_STL)
311
Sub
5GC PDU Session slot (carried inside template 260 via IE 520 5GC_BEARER_STL)
Sub-templates 310/311 are carried in their respective control templates.
DPI Fields Handling
Deep Packet Inspection (DPI) metadata is exported directly within the base IPFIX template.
The following protocol-specific DPI fields are supported:
DNS
gtpu_exp_attr.dns_data
SSL
gtpu_exp_attr.ssl_data
HTTP
gtpu_exp_attr.http_data
HTTP2
gtpu_exp_attr.http2_data
RTP
gtpu_exp_attr.rtp_data
QUIC
gtpu_exp_attr.quic_data
DHCP
gtpu_exp_attr.dhcp_data
NetBIOS
gtpu_exp_attr.netbios_data
Statistics and Monitoring
The following CLI commands are available to monitor IPFIX operation:
show ipfix summaryshow ipfix config
Kafka topic
Run ipfixcol2 -c ~/ipfixcol2.xml to collect IPFIX records.
Benefits
Enables standards-based IPFIX export for integration with third-party collectors.
Supports simultaneous Kafka and IPFIX exports without additional configuration.
Provides centralised metadata configuration for both export mechanisms.
Supports high availability through export to multiple independent collectors.
Simplifies collector management with automatic template generation and synchronisation.
Follow IPFIX collector deployment guide IPFIX collector KPI field
Last updated