Re: [IPFIX] ipNextHopIPv6Address reported address

Brian Trammell <> Thu, 04 June 2015 13:57 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id D43261B34D4 for <>; Thu, 4 Jun 2015 06:57:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, T_SUBJ_BRKN_WORDNUMS=0.01] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 9klHG-QGPxSW for <>; Thu, 4 Jun 2015 06:57:26 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 0BDD21B34FB for <>; Thu, 4 Jun 2015 06:47:22 -0700 (PDT)
Received: from [IPv6:2001:67c:10ec:52c8:8000::e9e] (unknown [IPv6:2001:67c:10ec:52c8:8000::e9e]) by (Postfix) with ESMTPSA id 497201A0302; Thu, 4 Jun 2015 15:47:21 +0200 (CEST)
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\))
Content-Type: multipart/signed; boundary="Apple-Mail=_58534407-8080-4E58-8A79-2EC8DB3A6BA2"; protocol="application/pgp-signature"; micalg=pgp-sha512
X-Pgp-Agent: GPGMail 2.5b6
From: Brian Trammell <>
In-Reply-To: <>
Date: Thu, 4 Jun 2015 15:47:21 +0200
Message-Id: <>
References: <>
To: Nick Brown <>
X-Mailer: Apple Mail (2.2098)
Archived-At: <>
Cc: Luca Boccassi <>, Doug Gordon <>, Derek Fawcus <>, "" <>, Paul Atkins <>
Subject: Re: [IPFIX] ipNextHopIPv6Address reported address
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IPFIX WG discussion list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 04 Jun 2015 13:57:29 -0000

> On 04 Jun 2015, at 13:07, Nick Brown <> wrote:
> Hi All,
> In a sentence, is it expected that ipNextHopIPv6Address should report
> the global ipv6 address of the next hop when it has one, or may the link
> local address be reported instead?

First, the proper reference for the definitions of IEs in the IPFIX information model is; per 7012, 5102 is no longer considered authoritative for IE definitions.

(In this case, though, this is an admittedly pedantic distinction; the content is identical).

> There are obvious cases where the next hop may only have link local
> address, if example it's only configured that way. But in other cases
> where it may have both a link local and global address it's often the
> case that routing protocols may use local addresses to setup the
> forwarding plane where traffic is being observed. Thus at the point in
> the forwarding path that traffic is being observed this all that is
> available, and it's not apparent that a mapping from link local address
> to global address (where is exists) can be done.

The way I read this, if the address is not being changed as part of the packet handing (on which see the fifth point in section 2.3 of RFC 7012), the address to report is the address the packets are sent to in the context of the egress interface. If the connection between the device the MP is on and the next hop has link-local addresses only, then the link-local address is the correct one to export.