[Docs] [txt|pdf|xml] [Tracker] [Email] [Diff1] [Diff2] [Nits]

Versions: 00 01 02

Network Working Group                                        B. Trammell
Internet-Draft                                                ETH Zurich
Intended status: Informational                              S. Niccolini
Expires: April 29, 2012                                              NEC
                                                               B. Claise
                                                      Cisco Systems Inc.
                                                               H. Kaplan
                                                             Acme Packet
                                                        October 27, 2011


               SIP Message Information Export using IPFIX
                    draft-trammell-ipfix-sip-msg-02

Abstract

   This draft defines a set of Information Elements and example
   Templates for IP Flow Information Export (IPFIX) based on the SIP
   Common Log Format data model, as well as additional useful SIP
   Information Elements, to allow IPFIX export of application-layer
   information about SIP messages.

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on April 29, 2012.

Copyright Notice

   Copyright (c) 2011 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents



Trammell, et al.         Expires April 29, 2012                 [Page 1]


Internet-Draft            SIP Messages in IPFIX             October 2011


   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.


Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  4
   2.  Base Information Elements for SIP Message Information
       Export . . . . . . . . . . . . . . . . . . . . . . . . . . . .  5
     2.1.  sipObservationType . . . . . . . . . . . . . . . . . . . .  5
     2.2.  sipMethod  . . . . . . . . . . . . . . . . . . . . . . . .  5
     2.3.  sipSequenceNumber  . . . . . . . . . . . . . . . . . . . .  5
     2.4.  sipRequestURI  . . . . . . . . . . . . . . . . . . . . . .  5
     2.5.  sipFromURI . . . . . . . . . . . . . . . . . . . . . . . .  6
     2.6.  sipFromTag . . . . . . . . . . . . . . . . . . . . . . . .  6
     2.7.  sipToURI . . . . . . . . . . . . . . . . . . . . . . . . .  6
     2.8.  sipToTag . . . . . . . . . . . . . . . . . . . . . . . . .  6
     2.9.  sipCallId  . . . . . . . . . . . . . . . . . . . . . . . .  6
     2.10. sipResponseStatus  . . . . . . . . . . . . . . . . . . . .  6
     2.11. sipServerTransaction . . . . . . . . . . . . . . . . . . .  7
     2.12. sipClientTransaction . . . . . . . . . . . . . . . . . . .  7
     2.13. sipMethod subregistry  . . . . . . . . . . . . . . . . . .  7
   3.  Additional Information Elements for SIP Message
       Information Export . . . . . . . . . . . . . . . . . . . . . .  8
     3.1.  sipContactURI  . . . . . . . . . . . . . . . . . . . . . .  8
     3.2.  sipRouteURI  . . . . . . . . . . . . . . . . . . . . . . .  8
     3.3.  sipPaiURI  . . . . . . . . . . . . . . . . . . . . . . . .  9
     3.4.  sipPpiURI  . . . . . . . . . . . . . . . . . . . . . . . .  9
     3.5.  sipPAssocURI . . . . . . . . . . . . . . . . . . . . . . .  9
     3.6.  sipPCalledPartyURI . . . . . . . . . . . . . . . . . . . .  9
     3.7.  sipVia . . . . . . . . . . . . . . . . . . . . . . . . . . 10
     3.8.  sipAuthUsername  . . . . . . . . . . . . . . . . . . . . . 10
     3.9.  sipSubscriptionEvent . . . . . . . . . . . . . . . . . . . 10
     3.10. sipSubscriptionState . . . . . . . . . . . . . . . . . . . 10
     3.11. sipExpires . . . . . . . . . . . . . . . . . . . . . . . . 10
     3.12. sipPVisitedNetworkID . . . . . . . . . . . . . . . . . . . 11
     3.13. sipPAccessNetworkInfo  . . . . . . . . . . . . . . . . . . 11
     3.14. sipPChargingFunctionAddr . . . . . . . . . . . . . . . . . 11
     3.15. sipPChargingVector . . . . . . . . . . . . . . . . . . . . 11
   4.  Recommended Templates for SIP Message Information Export . . . 12
   5.  Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
     5.1.  Base Template Export . . . . . . . . . . . . . . . . . . . 13
     5.2.  UAC registration . . . . . . . . . . . . . . . . . . . . . 14
     5.3.  Direct Call  . . . . . . . . . . . . . . . . . . . . . . . 16
     5.4.  Single Downstream Branch Call  . . . . . . . . . . . . . . 19



Trammell, et al.         Expires April 29, 2012                 [Page 2]


Internet-Draft            SIP Messages in IPFIX             October 2011


     5.5.  Forked Call  . . . . . . . . . . . . . . . . . . . . . . . 25
   6.  Security Considerations  . . . . . . . . . . . . . . . . . . . 35
   7.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 35
   8.  Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 35
   9.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 35
     9.1.  Normative References . . . . . . . . . . . . . . . . . . . 35
     9.2.  Informative References . . . . . . . . . . . . . . . . . . 36
   Appendix A.  Definition of Base SIP Message Information
                Elements in IANA XML Registry format  . . . . . . . . 37
   Appendix B.  Definition of sipMethod registry in IANA XML
                Registry format . . . . . . . . . . . . . . . . . . . 40
   Appendix C.  Definition of Additional SIP Message Information
                Elements in IANA XML Registry format  . . . . . . . . 43
   Appendix D.  Example messages in base64  . . . . . . . . . . . . . 47
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 50




































Trammell, et al.         Expires April 29, 2012                 [Page 3]


Internet-Draft            SIP Messages in IPFIX             October 2011


1.  Introduction

   IPFIX [RFC5101] provides a standardized means of exporting flow
   information from IPFIX exporters to IPFIX collectors.  This allows
   collectors to analyze flows from one or more sources for numerous
   uses, such as traffic patterns/trends, anomalies, failures, attacks,
   and much more.  IPFIX supports exporting data in near real-time, in a
   secure manner, over multiple transports; as well as in local storage
   with a defined file format.  The core IPFIX information model is
   maintained by IANA as a registry of Information Elements at
   http://www.iana.org/assignments/ipfix/.  In addition to these, which
   cover many network measurement and management applications,
   enterprise-specific Information Elements may be defined, scoped to an
   SMI private enterprise number, for vendor-proprietary Information
   Elements.

   Session Initiation Protocol (SIP), defined by [RFC3261] and its
   extensions, is used by many devices to perform a rendezvous service,
   initiate and manage real-time communication sessions, install and
   monitor state information, and more.  In many deployments, SIP
   messages cross multiple systems managed by the same administrative
   entity, and thus providing a means of exporting and collecting SIP
   message information from such systems using a standard protocol is
   highly desirable.

   This document defines a set of IPFIX Information Elements to enable
   SIP devices, such as user agents and proxies, to export SIP message
   information to IPFIX collectors using the IPFIX protocol.  The
   purpose of doing so is to enable collectors to analyze the SIP
   "traffic", for similar purposes as those for any other IPFIX flows.
   Defining IANA-registered (i.e., well-known) IPFIX IE fields enables
   IPFIX records of SIP message information to be generated and consumed
   by different vendors.  Within the context of this document's IPFIX IE
   fields, a single SIP message is a complete IPFIX Flow as defined in
   [RFC5101]

   The SIPCLF Working Group has defined a data model
   [I-D.ietf-sipclf-problem-statement] for logging information about SIP
   messages to ASCII-based SIPCLF files.  While useful for on-box
   storage and analysis with ASCII-based tools, SIPCLF does not provide
   a means of exporting such information, nor is that its goal.  This
   document borrows the data model from SIPCLF and represents these in
   IPFIX Information Elements.  It additionally provides examples for
   IPFIX representation of the example SIP Messages provided in the
   SIPCLF problem statement.






Trammell, et al.         Expires April 29, 2012                 [Page 4]


Internet-Draft            SIP Messages in IPFIX             October 2011


2.  Base Information Elements for SIP Message Information Export

   The following Information Elements represent SIP-specific mandatory
   fields defined in [I-D.ietf-sipclf-problem-statement], many
   themselves taken from [RFC3261].  Together with Information Elements
   already available in the IPFIX IANA Information Elements registry,
   these can be used to export information about SIP Messages.

2.1.  sipObservationType

   Description:   Denotes whether the entry was corresponds to a SIP
      message received, sent, or merely seen by a passive observer, as
      follows:
      0: unknown: The Metering Process does not specify the observation
      type.
      1: receiver: The Metering Process is, or is co-located with, the
      receiver of the SIP message.
      2: sender: The Metering Process is, or is co-located with, the
      sender of the SIP message.
      3: passive: The Metering Process passively observed the SIP
      message.
   Data Type:   unsigned8
   Data Type Semantics:   identifier
   PEN (provisional):   35566 (trammell.ch)
   ElementId (provisional):   419

2.2.  sipMethod

   Description:   The SIP method from the CSeq header, encoded as per
      the IPFIX sipMethod subregistry.
   Data Type:   unsigned8
   Data Type Semantics:   identifier
   PEN (provisional):   35566 (trammell.ch)
   ElementId (provisional):   402

2.3.  sipSequenceNumber

   Description:   The sequence number from the CSeq header.
   Data Type:   unsigned32
   Data Type Semantics:   identifier
   PEN (provisional):   35566 (trammell.ch)
   ElementId (provisional):   409

2.4.  sipRequestURI







Trammell, et al.         Expires April 29, 2012                 [Page 5]


Internet-Draft            SIP Messages in IPFIX             October 2011


   Description:   The SIP Request URI, including any parameters, as a
      UTF-8 string, escaped according to SIP rules as received by the
      metering process.
   Data Type:   string
   PEN (provisional):   35566 (trammell.ch)
   ElementId (provisional):   403

2.5.  sipFromURI

   Description:   The URI from the SIP From: header
   Data Type:   string
   PEN (provisional):   35566 (trammell.ch)
   ElementId (provisional):   404

2.6.  sipFromTag

   Description:   The Tag parameter value from the SIP From: header
   Data Type:   string
   PEN (provisional):   35566 (trammell.ch)
   ElementId (provisional):   405

2.7.  sipToURI

   Description:   The URI from the SIP To: header
   Data Type:   string
   PEN (provisional):   35566 (trammell.ch)
   ElementId (provisional):   406

2.8.  sipToTag

   Description:   The Tag parameter value from the SIP To: header
   Data Type:   string
   PEN (provisional):   35566 (trammell.ch)
   ElementId (provisional):   407

2.9.  sipCallId

   Description:   The value of the SIP Call-ID: header
   Data Type:   string
   PEN (provisional):   35566 (trammell.ch)
   ElementId (provisional):   408

2.10.  sipResponseStatus








Trammell, et al.         Expires April 29, 2012                 [Page 6]


Internet-Draft            SIP Messages in IPFIX             October 2011


   Description:   The SIP Response code.  The presence of this
      Information Element in a SIP Message record marks it as describing
      a SIP response; if absent, the record describes a SIP request.
   Data Type:   unsigned16
   Data Type Semantics:   identifier
   PEN (provisional):   35566 (trammell.ch)
   ElementId (provisional):   412

2.11.  sipServerTransaction

   Description:   The transaction identifier associated with the server
      transaction.
   Data Type:   string
   Data Type Semantics:   identifier
   PEN (provisional):   35566 (trammell.ch)
   ElementId (provisional):   413

2.12.  sipClientTransaction

   Description:   The transaction identifier associated with the client
      transaction.
   Data Type:   string
   Data Type Semantics:   identifier
   PEN (provisional):   35566 (trammell.ch)
   ElementId (provisional):   414

2.13.  sipMethod subregistry

   The sipMethod subregistry assigns a number to encode each of the SIP
   methods encoded in the Methods and Response Codes registry at
   http://www.iana.org/assignments/sip-parameters in a 16-bit integer
   Information Element.  These numbers are assigned from 1 in
   alphabetical order for the Methods defined as of the publication time
   of this document; subsequent Methods added to the Methods and
   Response Codes registry will be added to the IPFIX sipMethod
   subregistry at such time they are added to the Methods and Response
   Codes registry, using the lowest available unassigned number at the
   time of addition.













Trammell, et al.         Expires April 29, 2012                 [Page 7]


Internet-Draft            SIP Messages in IPFIX             October 2011


                   +----------+------------+-----------+
                   | Number   | Method     | Reference |
                   +----------+------------+-----------+
                   | 0        | Unknown    |           |
                   | 1        | ACK        | [RFC3261] |
                   | 2        | BYE        | [RFC3261] |
                   | 3        | CANCEL     | [RFC3261] |
                   | 4        | INFO       | [RFC6086] |
                   | 5        | INVITE     | [RFC3261] |
                   | 6        | MESSAGE    | [RFC3428] |
                   | 7        | NOTIFY     | [RFC3265] |
                   | 8        | OPTIONS    | [RFC3261] |
                   | 9        | PRACK      | [RFC3262] |
                   | 10       | PUBLISH    | [RFC3903] |
                   | 11       | REFER      | [RFC3515] |
                   | 12       | REGISTER   | [RFC3261] |
                   | 13       | SUBSCRIBE  | [RFC3265] |
                   | 14       | UPDATE     | [RFC3311] |
                   | 15-65535 | Unassigned |           |
                   +----------+------------+-----------+


3.  Additional Information Elements for SIP Message Information Export

   [TODO frontmatter]

3.1.  sipContactURI

   Description:   The addr-spec URI, including any URI parameters, of
      the first/top-most SIP Contact header, as a UTF-8 string, escaped
      according to SIP rules as received by the metering process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   415

3.2.  sipRouteURI

   Description:   The addr-spec URI, including any URI parameters, of
      the first/top-most SIP Route header, as a UTF-8 string, escaped
      according to SIP rules as received by the metering process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566







Trammell, et al.         Expires April 29, 2012                 [Page 8]


Internet-Draft            SIP Messages in IPFIX             October 2011


   ElementId (provisional):   416

3.3.  sipPaiURI

   Description:   The addr-spec URI, including any URI parameters, of
      the first/top-most SIP P-Asserted-Identity header, as a UTF-8
      string, escaped according to SIP rules as received by the metering
      process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   417

3.4.  sipPpiURI

   Description:   The addr-spec URI, including any URI parameters, of
      the first/top-most SIP P-Preferred-Identity header, as a UTF-8
      string, escaped according to SIP rules as received by the metering
      process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   418

3.5.  sipPAssocURI

   Description:   The addr-spec URI, including any URI parameters, of
      the first/top-most SIP P-Associated-Identity header, as a UTF-8
      string, escaped according to SIP rules as received by the metering
      process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   430

3.6.  sipPCalledPartyURI

   Description:   The addr-spec URI, including any URI parameters, of
      the SIP P-Called-Party-ID header, as a UTF-8 string, escaped
      according to SIP rules as received by the metering process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   420







Trammell, et al.         Expires April 29, 2012                 [Page 9]


Internet-Draft            SIP Messages in IPFIX             October 2011


3.7.  sipVia

   Description:   The value of the first/top-most Via header as a UTF-8
      string, escaped according to SIP rules as received by the metering
      process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   421

3.8.  sipAuthUsername

   Description:   The value of the username field of the first/top-most
      Authorization header as a UTF-8 string, escaped according to SIP
      rules as received by the metering process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   422

3.9.  sipSubscriptionEvent

   Description:   The value of the Event header as a UTF-8 string,
      escaped according to SIP rules as received by the metering
      process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   423

3.10.  sipSubscriptionState

   Description:   The value of the Subscription-State header as a UTF-8
      string, escaped according to SIP rules as received by the metering
      process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   424

3.11.  sipExpires

   Description:   The numeric value of the expires parameter of the
      first/top-most Contact header of a REGISTER request or response,
      or Subscription-State header of a SUBSCRIBE or NOTIFY request or
      response, or the Expires header if the expires parameter does not
      exist, as received by the metering process.




Trammell, et al.         Expires April 29, 2012                [Page 10]


Internet-Draft            SIP Messages in IPFIX             October 2011


   Data Type:   unsigned32
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   425

3.12.  sipPVisitedNetworkID

   Description:   The value of the first/top-most P-Visited-Network-ID
      header as a UTF-8 string, escaped according to SIP rules as
      received by the metering process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   426

3.13.  sipPAccessNetworkInfo

   Description:   The value of the P-Access-Network-Info header as a
      UTF-8 string, escaped according to SIP rules as received by the
      metering process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   427

3.14.  sipPChargingFunctionAddr

   Description:   The value of the first/top-most P-Charging-Function-
      Addresses header as a UTF-8 string, escaped according to SIP rules
      as received by the metering process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   428

3.15.  sipPChargingVector

   Description:   The value of the P-Charging-Vector header as a UTF-8
      string, escaped according to SIP rules as received by the metering
      process.
   Data Type:   string
   Data Type Semantics:
   PEN (provisional):   35566
   ElementId (provisional):   429







Trammell, et al.         Expires April 29, 2012                [Page 11]


Internet-Draft            SIP Messages in IPFIX             October 2011


4.  Recommended Templates for SIP Message Information Export

   The SIPCLF data model represents SIP requests and SIP responses with
   separate records.  The following Templates are defined as recommended
   base Templates for records describing requests and responses.
   Optional Information Elements MAY be added to them, and the IPv4
   addresses within these Templates MUST be replaced with IPv6 addresses
   for logging IPv6 transport of SIP messages.  A sipServerTransaction
   Information Element SHOULD be added for all messages logged by a User
   Agent Server, and a sipClientTransaction Information Element SHOULD
   be added for all messages logged by a User Agent Client.  These
   templates follow the recommended fields for request and response
   logging in [I-D.ietf-sipclf-problem-statement], and are defined using
   the representation in section 9 of [I-D.trammell-ipfix-ie-doctors].

   observationTimeMilliseconds(323)[8]
   sipSequenceNumber(35566/409)[4]
   sourceIPv4Address(8)[4]
   destinationIPv4Address(12)[4]
   sourceTransportPort(7)[2]
   destinationTransportPort(11)[2]
   protocolIdentifier(4)[1]
   sipMethod(35566/402)[1]
   sipObservationType(35566/419)[1]
   sipRequestURI(35566/403)[v]
   sipToURI(35566/406)[v]
   sipToTag(35566/407)[v]
   sipFromURI(35566/404)[v]
   sipFromTag(35566/405)[v]
   sipCallId(35566/408)[v]

                  Figure 1: Base Request Template (IPv4)



















Trammell, et al.         Expires April 29, 2012                [Page 12]


Internet-Draft            SIP Messages in IPFIX             October 2011


   observationTimeMilliseconds(323)[8]
   sipSequenceNumber(35566/409)[4]
   sourceIPv4Address(8)[4]
   destinationIPv4Address(12)[4]
   sourceTransportPort(7)[2]
   destinationTransportPort(11)[2]
   protocolIdentifier(4)[1]
   sipMethod(35566/402)[1]
   sipObservationType(35566/419)[1]
   sipResponseStatus(35566/412)[2]
   sipToURI(35566/406)[v]
   sipToTag(35566/407)[v]
   sipFromURI(35566/404)[v]
   sipFromTag(35566/405)[v]
   sipCallId(35566/408)[v]

                  Figure 2: Base Response Template (IPv4)

   Note that the Information Elements in these templates are ordered to
   place the fixed-length elements before the variable-length ones,
   which speeds random access to fixed-length elements.  However, since
   element order within a record is unimportant in IPFIX, any ordering
   of the mandatory Information Elements within a record MUST be
   accepted by a Collecting Process as a valid SIP request or response
   record for that record type.

   The record type is determined by the presence of the
   sipResponseStatus field.  If present in the Template, the Template
   describes a response record.  If absent, it describes a request
   record.


5.  Examples

   This section presents several views of an example SIP messages
   exported using the IPFIX templates described in this document.  We
   present both binary and textual forms.  The tools to generate this
   section are based upon the open-source ripfix [ripfix] implementation
   of IPFIX, maintained by one of the authors of this draft.

   Here we show the IPFIX Messages generated by the situations in
   sections 9.1 through 9.4 of [I-D.ietf-sipclf-problem-statement].

5.1.  Base Template Export

   Before exporting any Request or Response records, the Templates
   describing them must be exported.  In this example, the templates
   These Templates are derived from the base Templates as shown in



Trammell, et al.         Expires April 29, 2012                [Page 13]


Internet-Draft            SIP Messages in IPFIX             October 2011


   Figure 1 and Figure 2, with the sipClientTransaction and
   sipServerTransaction Information Elements appended.  We use two
   templates here, one each for request and response for IPv4.

   Exporting these Templates results in the following IPFIX message,
   illustrated as an annotated hexdump in Figure 3.

 0000: 00 0a 00 fc 4c c0 2a a2 00 00 00 00 00 00 30 39  ....L.*.......09
      [ IPFIX message header, length 252              ]
 0010: 00 02 00 ec                                      ....
      [ Template set (ID 2) header, length 236 ]
 0014:             01 01 00 11 01 43 00 08 81 99 00 04      .....C......
 0020: 00 00 8a ee 00 08 00 04 00 0c 00 04 00 07 00 02  ................
 0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee  ................
 0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee  ................
 0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee  ................
 0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee  ................
 0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee  ................
 0080: 81 9d ff ff 00 00 8a ee                          ........
      [ Template 257, 17 elements (v4 request)        ]
 0088:                         01 02 00 11 01 43 00 08          .....C..
 0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 0c 00 04  ................
 00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01  ................
 00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02  ................
 00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff  ................
 00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff  ................
 00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff  ................
 00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee              ............
      [ Template 258, 17 elements (v4 response)        ]

                  Figure 3: Base template message export

5.2.  UAC registration

   Having exported templates, now we create a simple IPFIX Message
   representing a UAC registration as seen from the UAC, corresponding
   to example 9.1 in [I-D.ietf-sipclf-problem-statement].  This message
   contains two records, including the UAS registration request, and the
   response received.  This is shown in the annotated hexdump in
   Figure 4.











Trammell, et al.         Expires April 29, 2012                [Page 14]


Internet-Draft            SIP Messages in IPFIX             October 2011


 0000: 00 0a 00 d8 4c 90 7f c1 00 00 00 00 00 00 30 39  ....L.........09
      [ IPFIX message header, length 218              ]
 0010: 01 01 00 6b                                      ...k
      [ Data set (ID 257) header, length 107 ]
 0014:             00 00 01 29 13 66 13 93 00 00 00 01      ...).f......
 0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 0c 02 0f  .3d..3d.........
 0030: 73 69 70 3a 65 78 61 6d 70 6c 65 2e 63 6f 6d 00  sip:example.com.
 0040: 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d  ..sip:alice@exam
 0050: 70 6c 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38  ple.com.76yhh.f8
 0060: 31 2d 64 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e  1-d4-f6@example.
 0070: 63 6f 6d 06 63 2d 74 72 2d 31 00                 com.c-tr-1.
      [ Request record content                        ]
 007b:                                  01 02 00 5d                ...]
             [ Data set (ID 258) header, length 93 ]
 007f:                                              00                 .
 0080: 00 01 29 13 66 15 24 00 00 00 01 c6 33 64 0a c6  ..).f.$.....3d..
 0090: 33 64 01 13 c4 13 c4 11 0c 01 00 c8 00 00 15 73  3d.............s
 00a0: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65  ip:alice@example
 00b0: 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 31 2d 64  .com.76yhh.f81-d
 00c0: 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 63 6f 6d  4-f6@example.com
 00d0: 06 63 2d 74 72 2d 31 00                          .c-tr-1.
      [ Response record content                       ]

     Figure 4: Message containing two log entries for UAC registration

   While this demonstrates the binary nature of the SIPCLF-IPFIX format,
   and shows the content framing for this message, it is not readable
   for illustration purposes.  In Figure 5, we run the message through
   the ripcollect tool provided with ripfix to provide a more human-
   readable view.  Note that the sipMethod and sipObservationType are
   encoded according to the registries in Section 2.




















Trammell, et al.         Expires April 29, 2012                [Page 15]


Internet-Draft            SIP Messages in IPFIX             October 2011


 ==== message sequence 0 in domain 12345 at 2010-08-11 11:53:27 UTC ====
 ---- record 12345/257 ----
 observationTimeMilliseconds => 2010-06-07 17:12:23 UTC
 sipSequenceNumber => 1
 sourceIPv4Address => 198.51.100.1
 destinationIPv4Address => 198.51.100.10
 sourceTransportPort => 5060
 destinationTransportPort => 5060
 protocolIdentifier => 17
 sipMethod => 12
 sipObservationType => 2
 sipRequestURI => sip:example.com
 sipToURI =>
 sipToTag =>
 sipFromURI => sip:alice@example.com
 sipFromTag => 76yhh
 sipCallId => f81-d4-f6@example.com
 sipClientTransaction => c-tr-1
 sipServerTransaction =>
 ---- record 12345/258 ----
 observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
 sipSequenceNumber => 1
 sourceIPv4Address => 198.51.100.10
 destinationIPv4Address => 198.51.100.1
 sourceTransportPort => 5060
 destinationTransportPort => 5060
 sipResponseStatus => 200
 protocolIdentifier => 17
 sipMethod => 12
 sipObservationType => 1
 sipToURI =>
 sipToTag =>
 sipFromURI => sip:alice@example.com
 sipFromTag => 76yhh
 sipCallId => f81-d4-f6@example.com
 sipClientTransaction => c-tr-1
 sipServerTransaction =>

     Figure 5: Message containing two log entries for UAC registration

5.3.  Direct Call

   This example demonstrates the export of a direct call from Alice to
   Bob, as seen by Bob's agent, corresponding to example 9.2 in
   [I-D.ietf-sipclf-problem-statement].  Here we have four records: an
   INVITE received from Alice, a 180 Ringing sent back followed by a 200
   OK, and an ACK received from Alice.  This is shown in the ripfix dump
   in Figure 6 and the hexdump in Figure 7.  In the hexdump, message



Trammell, et al.         Expires April 29, 2012                [Page 16]


Internet-Draft            SIP Messages in IPFIX             October 2011


   headers, set headers, and data records are separated by '|'
   characters for compactness.  Note here that each record has its own
   data set to support high-speed seeking to a specific record, even
   when two messages using the same template are adjacent in the
   message.

   ===== message 12345/0 @2010-10-21 13:11:43 UTC (#2) =====
     --- record 12345/257 (#1)---
   observationTimeMilliseconds => 2010-06-07 17:12:23 UTC
   sipSequenceNumber => 32
   sourceIPv4Address => 198.51.100.1
   destinationIPv4Address => 203.0.113.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 2
   sipRequestURI => sip:bob@bob1.example.net
   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com
   sipFromTag => 76yhh
   sipCallId => f82-d4-f7@example.com
   sipClientTransaction => c-1-xt6
   sipServerTransaction =>
     --- record 12345/258 (#2)---
   observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
   sipSequenceNumber => 32
   sourceIPv4Address => 203.0.113.1
   destinationIPv4Address => 198.51.100.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 1
   sipResponseStatus => 180
   sipToURI => sip:bob@example.net
   sipToTag => b-in6-iu
   sipFromURI => sip:alice@example.com
   sipFromTag => 76yhh
   sipCallId => f82-d4-f7@example.com
   sipClientTransaction => c-1-xt6
   sipServerTransaction =>
     --- record 12345/258 (#3)---
   observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
   sipSequenceNumber => 32
   sourceIPv4Address => 203.0.113.1
   destinationIPv4Address => 198.51.100.1



Trammell, et al.         Expires April 29, 2012                [Page 17]


Internet-Draft            SIP Messages in IPFIX             October 2011


   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 1
   sipResponseStatus => 200
   sipToURI => sip:bob@example.net
   sipToTag => b-in6-iu
   sipFromURI => sip:alice@example.com
   sipFromTag => 76yhh
   sipCallId => f82-d4-f7@example.com
   sipClientTransaction => c-1-xt6
   sipServerTransaction =>
     --- record 12345/257 (#4)---
   observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
   sipSequenceNumber => 32
   sourceIPv4Address => 198.51.100.1
   destinationIPv4Address => 203.0.113.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 1
   sipObservationType => 2
   sipRequestURI => sip:bob@bob1.example.net
   sipToURI => sip:bob@example.net
   sipToTag => b-in6-iu
   sipFromURI => sip:alice@example.com
   sipFromTag => 76yhh
   sipCallId => f82-d4-f7@example.com
   sipClientTransaction => c-1-xt6
   sipServerTransaction =>

    Figure 6: Message containing four records for a simple call (ripfix
                                   dump)

















Trammell, et al.         Expires April 29, 2012                [Page 18]


Internet-Draft            SIP Messages in IPFIX             October 2011


 0000: 00 0a 02 1a 4c c0 2c b3 00 00 00 00 00 00 30 39| ....L.,.......09
 0010: 01 01 00 88|00 00 01 29 13 66 13 93 00 00 00 20  .......).f.....
 0020: c6 33 64 01 cb 00 71 01 13 c4 13 c4 11 05 02 18  .3d...q.........
 0030: 73 69 70 3a 62 6f 62 40 62 6f 62 31 2e 65 78 61  sip:bob@bob1.exa
 0040: 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62  mple.net.sip:bob
 0050: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69  @example.net..si
 0060: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e  p:alice@example.
 0070: 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d 64 34  com.76yhh.f82-d4
 0080: 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 07  -f7@example.com.
 0090: 63 2d 31 2d 78 74 36 00|01 02 00 79|00 00 01 29  c-1-xt6....y...)
 00a0: 13 66 18 aa 00 00 00 20 cb 00 71 01 c6 33 64 01  .f..... ..q..3d.
 00b0: 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 6f  ..........sip:bo
 00c0: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 08 62 2d  b@example.net.b-
 00d0: 69 6e 36 2d 69 75 15 73 69 70 3a 61 6c 69 63 65  in6-iu.sip:alice
 00e0: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 05 37 36 79  @example.com.76y
 00f0: 68 68 15 66 38 32 2d 64 34 2d 66 37 40 65 78 61  hh.f82-d4-f7@exa
 0100: 6d 70 6c 65 2e 63 6f 6d 07 63 2d 31 2d 78 74 36  mple.com.c-1-xt6
 0110: 00|01 02 00 79|00 00 01 29 13 66 1c f4 00 00 00  ....y...).f.....
 0120: 20 cb 00 71 01 c6 33 64 01 13 c4 13 c4 11 05 01   ..q..3d........
 0130: 00 c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70  ...sip:bob@examp
 0140: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15  le.net.b-in6-iu.
 0150: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c  sip:alice@exampl
 0160: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d  e.com.76yhh.f82-
 0170: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f  d4-f7@example.co
 0180: 6d 07 63 2d 31 2d 78 74 36 00|01 01 00 90|00 00  m.c-1-xt6.......
 0190: 01 29 13 66 1d 08 00 00 00 20 c6 33 64 01 cb 00  .).f..... .3d...
 01a0: 71 01 13 c4 13 c4 11 01 02 18 73 69 70 3a 62 6f  q.........sip:bo
 01b0: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e  b@bob1.example.n
 01c0: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70  et.sip:bob@examp
 01d0: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15  le.net.b-in6-iu.
 01e0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c  sip:alice@exampl
 01f0: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d  e.com.76yhh.f82-
 0200: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f  d4-f7@example.co
 0210: 6d 07 63 2d 31 2d 78 74 36 00                    m.c-1-xt6.

   Figure 7: Message containing four records for a simple call (hexdump)

5.4.  Single Downstream Branch Call

   The example in Figure 8and Figure 9 demonstrates the export of a call
   with a downstream branch to Bob, as seen by the proxy which the call
   traverses, corresponding to example 9.3 in
   [I-D.ietf-sipclf-problem-statement].  See this example in the problem
   statement for more details.

   ===== message 12345/0 @2010-10-21 13:12:42 UTC (#2) =====
     --- record 12345/257 (#1)---
   observationTimeMilliseconds => 2010-06-07 17:12:23 UTC



Trammell, et al.         Expires April 29, 2012                [Page 19]


Internet-Draft            SIP Messages in IPFIX             October 2011


   sipSequenceNumber => 43
   sourceIPv4Address => 198.51.100.1
   destinationIPv4Address => 198.51.100.10
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 1
   sipRequestURI => sip:bob@example.net
   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com
   sipFromTag => al-1
   sipCallId => tr-87h@example.com
   sipClientTransaction =>
   sipServerTransaction => s-x-tr
     --- record 12345/258 (#2)---
   observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 198.51.100.10
   destinationIPv4Address => 198.51.100.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 2
   sipResponseStatus => 100
   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com
   sipFromTag => al-1
   sipCallId => tr-87h@example.com
   sipClientTransaction =>
   sipServerTransaction => s-x-tr
     --- record 12345/257 (#3)---
   observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 198.51.100.10
   destinationIPv4Address => 203.0.113.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 2
   sipRequestURI => sip:bob@bob1.example.net
   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com



Trammell, et al.         Expires April 29, 2012                [Page 20]


Internet-Draft            SIP Messages in IPFIX             October 2011


   sipFromTag => al-1
   sipCallId => tr-87h@example.com
   sipClientTransaction => c-x-tr
   sipServerTransaction => s-x-tr
     --- record 12345/258 (#4)---
   observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.1
   destinationIPv4Address => 198.51.100.10
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 1
   sipResponseStatus => 100
   sipToURI => sip:bob@example.net
   sipToTag => b1-1
   sipFromURI => sip:alice@example.com
   sipFromTag => al-1
   sipCallId => tr-87h@example.com
   sipClientTransaction => c-x-tr
   sipServerTransaction => s-x-tr
     --- record 12345/258 (#5)---
   observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.1
   destinationIPv4Address => 198.51.100.10
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 1
   sipResponseStatus => 180
   sipToURI => sip:bob@example.net
   sipToTag => b1-1
   sipFromURI => sip:alice@example.com
   sipFromTag => al-1
   sipCallId => tr-87h@example.com
   sipClientTransaction => c-x-tr
   sipServerTransaction => s-x-tr
     --- record 12345/258 (#6)---
   observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 198.51.100.10
   destinationIPv4Address => 198.51.100.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17



Trammell, et al.         Expires April 29, 2012                [Page 21]


Internet-Draft            SIP Messages in IPFIX             October 2011


   sipMethod => 5
   sipObservationType => 2
   sipResponseStatus => 180
   sipToURI => sip:bob@example.net
   sipToTag => b1-1
   sipFromURI => sip:alice@example.com
   sipFromTag => al-1
   sipCallId => tr-87h@example.com
   sipClientTransaction => c-x-tr
   sipServerTransaction => s-x-tr
     --- record 12345/258 (#7)---
   observationTimeMilliseconds => 2010-06-07 17:12:27 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.1
   destinationIPv4Address => 198.51.100.10
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 1
   sipResponseStatus => 200
   sipToURI => sip:bob@example.net
   sipToTag => b1-1
   sipFromURI => sip:alice@example.com
   sipFromTag => al-1
   sipCallId => tr-87h@example.com
   sipClientTransaction => c-x-tr
   sipServerTransaction => s-x-tr
     --- record 12345/258 (#8)---
   observationTimeMilliseconds => 2010-06-07 17:12:27 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 198.51.100.10
   destinationIPv4Address => 198.51.100.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 2
   sipResponseStatus => 200
   sipToURI => sip:bob@example.net
   sipToTag => b1-1
   sipFromURI => sip:alice@example.com
   sipFromTag => al-1
   sipCallId => tr-87h@example.com
   sipClientTransaction => c-x-tr
   sipServerTransaction => s-x-tr
     --- record 12345/257 (#9)---
   observationTimeMilliseconds => 2010-06-07 17:12:29 UTC



Trammell, et al.         Expires April 29, 2012                [Page 22]


Internet-Draft            SIP Messages in IPFIX             October 2011


   sipSequenceNumber => 43
   sourceIPv4Address => 198.51.100.1
   destinationIPv4Address => 198.51.100.10
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 1
   sipObservationType => 1
   sipRequestURI => sip:bob@example.net
   sipToURI => sip:bob@example.net
   sipToTag => b1-1
   sipFromURI => sip:alice@example.com
   sipFromTag => al-1
   sipCallId => tr-87h@example.com
   sipClientTransaction => c-x-tr
   sipServerTransaction => s-x-tr
     --- record 12345/257 (#10)---
   observationTimeMilliseconds => 2010-06-07 17:12:29 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 198.51.100.10
   destinationIPv4Address => 203.0.113.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 1
   sipObservationType => 2
   sipRequestURI => sip:bob@example.net
   sipToURI => sip:bob@example.net
   sipToTag => b1-1
   sipFromURI => sip:alice@example.com
   sipFromTag => al-1
   sipCallId => tr-87h@example.com
   sipClientTransaction => c-x-tr
   sipServerTransaction => s-x-tr

   Figure 8: Message containing ten records for a downstream branch call
                               (ripfix dump)


 0000: 00 0a 04 e1|4c c0 2c e5 00 00 00 00 00 00 30 39| ....L.,.......09
 0010: 01 01 00 7e|00 00 01 29 13 66 13 93 00 00 00 2b  ...~...).f.....+
 0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 05 01 13  .3d..3d.........
 0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e  sip:bob@example.
 0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d  net.sip:bob@exam
 0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69  ple.net..sip:ali
 0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61  ce@example.com.a
 0070: 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70  l-1.tr-87h@examp
 0080: 6c 65 2e 63 6f 6d 00 06 73 2d 78 2d 74 72|01 02  le.com..s-x-tr..



Trammell, et al.         Expires April 29, 2012                [Page 23]


Internet-Draft            SIP Messages in IPFIX             October 2011


 0090: 00 6c|00 00 01 29 13 66 14 c1 00 00 00 2b c6 33  .l...).f.....+.3
 00a0: 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13  d..3d.........d.
 00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e  sip:bob@example.
 00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65  net..sip:alice@e
 00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12  xample.com.al-1.
 00e0: 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63  tr-87h@example.c
 00f0: 6f 6d 00 06 73 2d 78 2d 74 72|01 01 00 89|00 00  om..s-x-tr......
 0100: 01 29 13 66 18 a6 00 00 00 2b c6 33 64 0a cb 00  .).f.....+.3d...
 0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f  q.........sip:bo
 0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e  b@bob1.example.n
 0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70  et.sip:bob@examp
 0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63  le.net..sip:alic
 0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c  e@example.com.al
 0160: 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c  -1.tr-87h@exampl
 0170: 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78  e.com.c-x-tr.s-x
 0180: 2d 74 72|01 02 00 76|00 00 01 29 13 66 19 70 00  -tr...v...).f.p.
 0190: 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 c4 11  ..+..q..3d......
 01a0: 05 01 00 64 13 73 69 70 3a 62 6f 62 40 65 78 61  ...d.sip:bob@exa
 01b0: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69  mple.net.b1-1.si
 01c0: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e  p:alice@example.
 01d0: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40  com.al-1.tr-87h@
 01e0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d  example.com.c-x-
 01f0: 74 72 06 73 2d 78 2d 74 72|01 02 00 76|00 00 01  tr.s-x-tr...v...
 0200: 29 13 66 1b c8 00 00 00 2b cb 00 71 01 c6 33 64  ).f.....+..q..3d
 0210: 0a 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62  ...........sip:b
 0220: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62  ob@example.net.b
 0230: 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78  1-1.sip:alice@ex
 0240: 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 74  ample.com.al-1.t
 0250: 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 6f  r-87h@example.co
 0260: 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 72|01  m.c-x-tr.s-x-tr.
 0270: 02 00 76|00 00 01 29 13 66 1c 98 00 00 00 2b c6  ..v...).f.....+.
 0280: 33 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 b4  3d..3d..........
 0290: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65  .sip:bob@example
 02a0: 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 6c  .net.b1-1.sip:al
 02b0: 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04  ice@example.com.
 02c0: 61 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d  al-1.tr-87h@exam
 02d0: 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73  ple.com.c-x-tr.s
 02e0: 2d 78 2d 74 72|01 02 00 76|00 00 01 29 13 66 20  -x-tr...v...).f
 02f0: f0 00 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13  ....+..q..3d....
 0300: c4 11 05 01 00 c8 13 73 69 70 3a 62 6f 62 40 65  .......sip:bob@e
 0310: 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15  xample.net.b1-1.
 0320: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c  sip:alice@exampl
 0330: 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37  e.com.al-1.tr-87
 0340: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d  h@example.com.c-
 0350: 78 2d 74 72 06 73 2d 78 2d 74 72|01 02 00 76|00  x-tr.s-x-tr...v.
 0360: 00 01 29 13 66 21 a4 00 00 00 2b c6 33 64 0a c6  ..).f!....+.3d..
 0370: 33 64 01 13 c4 13 c4 11 05 02 00 c8 13 73 69 70  3d...........sip
 0380: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74  :bob@example.net



Trammell, et al.         Expires April 29, 2012                [Page 24]


Internet-Draft            SIP Messages in IPFIX             October 2011


 0390: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40  .b1-1.sip:alice@
 03a0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31  example.com.al-1
 03b0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e  .tr-87h@example.
 03c0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74  com.c-x-tr.s-x-t
 03d0: 72|01 01 00 88|00 00 01 29 13 66 28 ac 00 00 00  r.......).f(....
 03e0: 2b c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 01 01  +.3d..3d........
 03f0: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65  .sip:bob@example
 0400: 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61  .net.sip:bob@exa
 0410: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69  mple.net.b1-1.si
 0420: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e  p:alice@example.
 0430: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40  com.al-1.tr-87h@
 0440: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d  example.com.c-x-
 0450: 74 72 06 73 2d 78 2d 74 72|01 01 00 88|00 00 01  tr.s-x-tr.......
 0460: 29 13 66 28 ac 00 00 00 2b c6 33 64 0a cb 00 71  ).f(....+.3d...q
 0470: 01 13 c4 13 c4 11 01 02 13 73 69 70 3a 62 6f 62  .........sip:bob
 0480: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70  @example.net.sip
 0490: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74  :bob@example.net
 04a0: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40  .b1-1.sip:alice@
 04b0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31  example.com.al-1
 04c0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e  .tr-87h@example.
 04d0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74  com.c-x-tr.s-x-t
 04e0: 72                                               r

   Figure 9: Message containing ten log entries for a downstream branch
                              call (hexdump)

5.5.  Forked Call

   The example in Figure 11 and Figure 12 demonstrates the export of
   forked call to Bob, as seen by one of Bob's instances which forks the
   call traverses, corresponding to example 9.4 in
   [I-D.ietf-sipclf-problem-statement].  See this example for more
   details.  Note that, since Bob's first instance is multihomed IPv4-
   IPv6, this example requires additional templates: request and
   response templates for IPv4 to IPv6 and back, these are shown in
   Figure 10.















Trammell, et al.         Expires April 29, 2012                [Page 25]


Internet-Draft            SIP Messages in IPFIX             October 2011


 0000: 00 0a 01 e4 4c c0 2d 9b 00 00 00 00 00 00 30 39  ....L.-.......09
 0010: 00 02 01 d4 01 05 00 11 01 43 00 08 81 99 00 04  .........C......
 0020: 00 00 8a ee 00 08 00 04 00 1c 00 10 00 07 00 02  ................
 0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee  ................
 0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee  ................
 0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee  ................
 0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee  ................
 0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee  ................
 0080: 81 9d ff ff 00 00 8a ee 01 06 00 11 01 43 00 08  .............C..
 0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 1c 00 10  ................
 00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01  ................
 00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02  ................
 00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff  ................
 00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff  ................
 00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff  ................
 00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee 01 07 00 11  ................
 0100: 01 43 00 08 81 99 00 04 00 00 8a ee 00 1b 00 10  .C..............
 0110: 00 0c 00 04 00 07 00 02 00 0b 00 02 00 04 00 01  ................
 0120: 81 92 00 01 00 00 8a ee 81 a3 00 01 00 00 8a ee  ................
 0130: 81 93 ff ff 00 00 8a ee 81 96 ff ff 00 00 8a ee  ................
 0140: 81 97 ff ff 00 00 8a ee 81 94 ff ff 00 00 8a ee  ................
 0150: 81 95 ff ff 00 00 8a ee 81 98 ff ff 00 00 8a ee  ................
 0160: 81 9e ff ff 00 00 8a ee 81 9d ff ff 00 00 8a ee  ................
 0170: 01 08 00 11 01 43 00 08 81 99 00 04 00 00 8a ee  .....C..........
 0180: 00 1b 00 10 00 0c 00 04 00 07 00 02 00 0b 00 02  ................
 0190: 00 04 00 01 81 92 00 01 00 00 8a ee 81 a3 00 01  ................
 01a0: 00 00 8a ee 81 9c 00 02 00 00 8a ee 81 96 ff ff  ................
 01b0: 00 00 8a ee 81 97 ff ff 00 00 8a ee 81 94 ff ff  ................
 01c0: 00 00 8a ee 81 95 ff ff 00 00 8a ee 81 98 ff ff  ................
 01d0: 00 00 8a ee 81 9e ff ff 00 00 8a ee 81 9d ff ff  ................
 01e0: 00 00 8a ee                                      ....

   Figure 10: Message containing templates for IPv4 to IPv6 requests and
                         responses, and vice versa


   ===== message 12345/0 @2010-10-21 13:13:01 UTC (#3) =====
     --- record 12345/257 (#1)---
   observationTimeMilliseconds => 2010-06-07 17:12:23 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 198.51.100.1
   destinationIPv4Address => 203.0.113.200
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 1
   sipRequestURI => sip:bob@example.net



Trammell, et al.         Expires April 29, 2012                [Page 26]


Internet-Draft            SIP Messages in IPFIX             October 2011


   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction =>
   sipServerTransaction => s-1-tr
     --- record 12345/258 (#2)---
   observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.200
   destinationIPv4Address => 198.51.100.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 2
   sipResponseStatus => 100
   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction =>
   sipServerTransaction => s-1-tr
     --- record 12345/257 (#3)---
   observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.200
   destinationIPv4Address => 203.0.113.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 2
   sipRequestURI => sip:bob@bob1.example.net
   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-1-tr
   sipServerTransaction => s-1-tr
     --- record 12345/261 (#4)---
   observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.200
   destinationIPv6Address => 2001:db8::9



Trammell, et al.         Expires April 29, 2012                [Page 27]


Internet-Draft            SIP Messages in IPFIX             October 2011


   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 2
   sipRequestURI => sip:bob@bob2.example.net
   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-2-tr
   sipServerTransaction => s-1-tr
     --- record 12345/258 (#5)---
   observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.1
   destinationIPv4Address => 203.0.113.200
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 1
   sipResponseStatus => 100
   sipToURI => sip:bob@example.net
   sipToTag => b1-1
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-1-tr
   sipServerTransaction => s-1-tr
     --- record 12345/264 (#6)---
   observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
   sipSequenceNumber => 43
   sourceIPv6Address => 2001:db8::9
   destinationIPv4Address => 203.0.113.200
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 1
   sipResponseStatus => 100
   sipToURI => sip:bob@example.net
   sipToTag => b2-2
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-2-tr



Trammell, et al.         Expires April 29, 2012                [Page 28]


Internet-Draft            SIP Messages in IPFIX             October 2011


   sipServerTransaction => s-1-tr
     --- record 12345/264 (#7)---
   observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
   sipSequenceNumber => 43
   sourceIPv6Address => 2001:db8::9
   destinationIPv4Address => 203.0.113.200
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 1
   sipResponseStatus => 180
   sipToURI => sip:bob@example.net
   sipToTag => b2-2
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-2-tr
   sipServerTransaction => s-1-tr
     --- record 12345/258 (#8)---
   observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.200
   destinationIPv4Address => 198.51.100.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 2
   sipResponseStatus => 180
   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-2-tr
   sipServerTransaction => s-1-tr
     --- record 12345/258 (#9)---
   observationTimeMilliseconds => 2010-06-07 17:12:27 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.200
   destinationIPv4Address => 198.51.100.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 2
   sipResponseStatus => 180



Trammell, et al.         Expires April 29, 2012                [Page 29]


Internet-Draft            SIP Messages in IPFIX             October 2011


   sipToURI => sip:bob@example.net
   sipToTag => b1-1
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-1-tr
   sipServerTransaction => s-1-tr
     --- record 12345/258 (#10)---
   observationTimeMilliseconds => 2010-06-07 17:12:27 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.1
   destinationIPv4Address => 203.0.113.200
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 1
   sipResponseStatus => 200
   sipToURI => sip:bob@example.net
   sipToTag => b1-1
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-1-tr
   sipServerTransaction => s-1-tr
     --- record 12345/258 (#11)---
   observationTimeMilliseconds => 2010-06-07 17:12:28 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.200
   destinationIPv4Address => 198.51.100.1
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 2
   sipResponseStatus => 200
   sipToURI => sip:bob@example.net
   sipToTag => b1-1
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-1-tr
   sipServerTransaction => s-1-tr
     --- record 12345/261 (#12)---
   observationTimeMilliseconds => 2010-06-07 17:12:28 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.200
   destinationIPv6Address => 2001:db8::9



Trammell, et al.         Expires April 29, 2012                [Page 30]


Internet-Draft            SIP Messages in IPFIX             October 2011


   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 3
   sipObservationType => 2
   sipRequestURI => sip:bob@bob2.example.net
   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-2-tr
   sipServerTransaction => s-1-tr
     --- record 12345/264 (#13)---
   observationTimeMilliseconds => 2010-06-07 17:12:28 UTC
   sipSequenceNumber => 43
   sourceIPv6Address => 2001:db8::9
   destinationIPv4Address => 203.0.113.200
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 5
   sipObservationType => 1
   sipResponseStatus => 487
   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-2-tr
   sipServerTransaction => s-1-tr
     --- record 12345/261 (#14)---
   observationTimeMilliseconds => 2010-06-07 17:12:29 UTC
   sipSequenceNumber => 43
   sourceIPv4Address => 203.0.113.200
   destinationIPv6Address => 2001:db8::9
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 1
   sipObservationType => 2
   sipRequestURI => sip:bob@bob2.example.net
   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-2-tr



Trammell, et al.         Expires April 29, 2012                [Page 31]


Internet-Draft            SIP Messages in IPFIX             October 2011


   sipServerTransaction => s-1-tr
     --- record 12345/264 (#15)---
   observationTimeMilliseconds => 2010-06-07 17:12:30 UTC
   sipSequenceNumber => 43
   sourceIPv6Address => 2001:db8::9
   destinationIPv4Address => 203.0.113.200
   sourceTransportPort => 5060
   destinationTransportPort => 5060
   protocolIdentifier => 17
   sipMethod => 3
   sipObservationType => 1
   sipResponseStatus => 200
   sipToURI => sip:bob@example.net
   sipToTag =>
   sipFromURI => sip:alice@example.com
   sipFromTag => a1-1
   sipCallId => tr-88h@example.com
   sipClientTransaction => c-2-tr
   sipServerTransaction => s-1-tr

      Figure 11: Message containing fifteen records for a forked call


 0000: 00 0a 07 8c 4c c0 2d 9b 00 00 00 00 00 00 30 39| ....L.-.......09
 0010: 01 01 00 7e|00 00 01 29 13 66 13 93 00 00 00 2b  ...~...).f.....+
 0020: c6 33 64 01 cb 00 71 c8 13 c4 13 c4 11 05 01 13  .3d...q.........
 0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e  sip:bob@example.
 0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d  net.sip:bob@exam
 0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69  ple.net..sip:ali
 0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61  ce@example.com.a
 0070: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70  1-1.tr-88h@examp
 0080: 6c 65 2e 63 6f 6d 00 06 73 2d 31 2d 74 72|01 02  le.com..s-1-tr..
 0090: 00 6c|00 00 01 29 13 66 14 c1 00 00 00 2b cb 00  .l...).f.....+..
 00a0: 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13  q..3d.........d.
 00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e  sip:bob@example.
 00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65  net..sip:alice@e
 00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12  xample.com.a1-1.
 00e0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63  tr-88h@example.c
 00f0: 6f 6d 00 06 73 2d 31 2d 74 72|01 01 00 89|00 00  om..s-1-tr......
 0100: 01 29 13 66 18 a6 00 00 00 2b cb 00 71 c8 cb 00  .).f.....+..q...
 0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f  q.........sip:bo
 0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e  b@bob1.example.n
 0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70  et.sip:bob@examp
 0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63  le.net..sip:alic
 0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31  e@example.com.a1
 0160: 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c  -1.tr-88h@exampl
 0170: 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31  e.com.c-1-tr.s-1
 0180: 2d 74 72|01 05 00 95|00 00 01 29 13 66 1a 9c 00  -tr.......).f...



Trammell, et al.         Expires April 29, 2012                [Page 32]


Internet-Draft            SIP Messages in IPFIX             October 2011


 0190: 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 00 00 00  ..+..q. ........
 01a0: 00 00 00 00 00 00 09 13 c4 13 c4 11 05 02 18 73  ...............s
 01b0: 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 78 61 6d  ip:bob@bob2.exam
 01c0: 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40  ple.net.sip:bob@
 01d0: 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 70  example.net..sip
 01e0: 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63  :alice@example.c
 01f0: 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65  om.a1-1.tr-88h@e
 0200: 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74  xample.com.c-2-t
 0210: 72 06 73 2d 31 2d 74 72|01 02 00 76|00 00 01 29  r.s-1-tr...v...)
 0220: 13 66 1b c8 00 00 00 2b cb 00 71 01 cb 00 71 c8  .f.....+..q...q.
 0230: 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a 62 6f  ........d.sip:bo
 0240: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31  b@example.net.b1
 0250: 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61  -1.sip:alice@exa
 0260: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72  mple.com.a1-1.tr
 0270: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d  -88h@example.com
 0280: 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72|01 08  .c-1-tr.s-1-tr..
 0290: 00 82|00 00 01 29 13 66 1c f4 00 00 00 2b 20 01  .....).f.....+ .
 02a0: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00  ................
 02b0: 71 c8 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a  q.........d.sip:
 02c0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04  bob@example.net.
 02d0: 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 40 65  b2-2.sip:alice@e
 02e0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12  xample.com.a1-1.
 02f0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63  tr-88h@example.c
 0300: 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72| om.c-2-tr.s-1-tr
 0310: 01 08 00 82|00 00 01 29 13 66 1f 4c 00 00 00 2b  .......).f.L...+
 0320: 20 01 0d b8 00 00 00 00 00 00 00 00 00 00 00 09   ...............
 0330: cb 00 71 c8 13 c4 13 c4 11 05 01 00 b4 13 73 69  ..q...........si
 0340: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65  p:bob@example.ne
 0350: 74 04 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65  t.b2-2.sip:alice
 0360: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d  @example.com.a1-
 0370: 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65  1.tr-88h@example
 0380: 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d  .com.c-2-tr.s-1-
 0390: 74 72|01 02 00 72|00 00 01 29 13 66 20 6e 00 00  tr...r...).f n..
 03a0: 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05  .+..q..3d.......
 03b0: 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 61 6d  ....sip:bob@exam
 03c0: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69  ple.net..sip:ali
 03d0: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61  ce@example.com.a
 03e0: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70  1-1.tr-88h@examp
 03f0: 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d  le.com.c-2-tr.s-
 0400: 31 2d 74 72|01 02 00 76|00 00 01 29 13 66 21 a4  1-tr...v...).f!.
 0410: 00 00 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4  ...+..q..3d.....
 0420: 11 05 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78  ......sip:bob@ex
 0430: 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73  ample.net.b1-1.s
 0440: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65  ip:alice@example
 0450: 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68  .com.a1-1.tr-88h
 0460: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31  @example.com.c-1
 0470: 2d 74 72 06 73 2d 31 2d 74 72|01 02 00 76|00 00  -tr.s-1-tr...v..
 0480: 01 29 13 66 23 98 00 00 00 2b cb 00 71 01 cb 00  .).f#....+..q...



Trammell, et al.         Expires April 29, 2012                [Page 33]


Internet-Draft            SIP Messages in IPFIX             October 2011


 0490: 71 c8 13 c4 13 c4 11 05 01 00 c8 13 73 69 70 3a  q...........sip:
 04a0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04  bob@example.net.
 04b0: 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65  b1-1.sip:alice@e
 04c0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12  xample.com.a1-1.
 04d0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63  tr-88h@example.c
 04e0: 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72| om.c-1-tr.s-1-tr
 04f0: 01 02 00 76|00 00 01 29 13 66 24 60 00 00 00 2b  ...v...).f$`...+
 0500: cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00  ..q..3d.........
 0510: c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c  ..sip:bob@exampl
 0520: 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61  e.net.b1-1.sip:a
 0530: 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d  lice@example.com
 0540: 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61  .a1-1.tr-88h@exa
 0550: 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06  mple.com.c-1-tr.
 0560: 73 2d 31 2d 74 72|01 05 00 95|00 00 01 29 13 66  s-1-tr.......).f
 0570: 25 29 00 00 00 2b cb 00 71 c8 20 01 0d b8 00 00  %)...+..q. .....
 0580: 00 00 00 00 00 00 00 00 00 09 13 c4 13 c4 11 03  ................
 0590: 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65  ..sip:bob@bob2.e
 05a0: 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62  xample.net.sip:b
 05b0: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15  ob@example.net..
 05c0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c  sip:alice@exampl
 05d0: 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38  e.com.a1-1.tr-88
 05e0: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d  h@example.com.c-
 05f0: 32 2d 74 72 06 73 2d 31 2d 74 72|01 08 00 7e|00  2-tr.s-1-tr...~.
 0600: 00 01 29 13 66 28 3f 00 00 00 2b 20 01 0d b8 00  ..).f(?...+ ....
 0610: 00 00 00 00 00 00 00 00 00 00 09 cb 00 71 c8 13  .............q..
 0620: c4 13 c4 11 05 01 01 e7 13 73 69 70 3a 62 6f 62  .........sip:bob
 0630: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69  @example.net..si
 0640: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e  p:alice@example.
 0650: 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40  com.a1-1.tr-88h@
 0660: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d  example.com.c-2-
 0670: 74 72 06 73 2d 31 2d 74 72|01 05 00 95|00 00 01  tr.s-1-tr.......
 0680: 29 13 66 2a 0f 00 00 00 2b cb 00 71 c8 20 01 0d  ).f*....+..q. ..
 0690: b8 00 00 00 00 00 00 00 00 00 00 00 09 13 c4 13  ................
 06a0: c4 11 01 02 18 73 69 70 3a 62 6f 62 40 62 6f 62  .....sip:bob@bob
 06b0: 32 2e 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69  2.example.net.si
 06c0: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65  p:bob@example.ne
 06d0: 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61  t..sip:alice@exa
 06e0: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72  mple.com.a1-1.tr
 06f0: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d  -88h@example.com
 0700: 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72|01 08  .c-2-tr.s-1-tr..
 0710: 00 7e|00 00 01 29 13 66 2c 31 00 00 00 2b 20 01  .~...).f,1...+ .
 0720: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00  ................
 0730: 71 c8 13 c4 13 c4 11 03 01 00 c8 13 73 69 70 3a  q...........sip:
 0740: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00  bob@example.net.
 0750: 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70  .sip:alice@examp
 0760: 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38  le.com.a1-1.tr-8
 0770: 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63  8h@example.com.c
 0780: 2d 32 2d 74 72 06 73 2d 31 2d 74 72              -2-tr.s-1-tr



Trammell, et al.         Expires April 29, 2012                [Page 34]


Internet-Draft            SIP Messages in IPFIX             October 2011


    Figure 12: Message containing sixteen log entries for a forked call


6.  Security Considerations

   [TODO]


7.  IANA Considerations

   This document defines the sipMethod subregistry for the IANA IPFIX
   Information Element registry at http://www.iana.org/assignments/ipfix
   for the values taken by the sipMethod Information Element.  The
   initial content of this subregistry is specified in Section 2.13.
   Entries may be added to this subregistry subject to the same
   Standards Action [RFC5226] that adds new Methods to the Methods and
   Response Codes registry at
   http://www.iana.org/assignments/sip-parameters.

   At such time as this document is prepared for publication as an RFC,
   the Information Elements defined herein will be defined for inclusion
   in the IANA IPFIX Information Element registry at
   http://www.iana.org/assignments/ipfix.  Until such time, the
   Information Elements within this document are defined within Private
   Enterprise Number 35566, belonging to one of the authors.


8.  Acknowledgments

   Thanks to Cullen Jennings for his provided insightful discussions,
   specific comments and much needed corrections, and to Nico d'Heureuse
   for his help with the RFC 3665 examples.


9.  References

9.1.  Normative References

   [I-D.ietf-sipclf-problem-statement]
              Gurbani, V., Burger, E., Anjali, T., Abdelnur, H., and O.
              Festor, "The Common Log Format (CLF) for the Session
              Initiation Protocol (SIP)",
              draft-ietf-sipclf-problem-statement-07 (work in progress),
              June 2011.

   [RFC5101]  Claise, B., "Specification of the IP Flow Information
              Export (IPFIX) Protocol for the Exchange of IP Traffic
              Flow Information", RFC 5101, January 2008.



Trammell, et al.         Expires April 29, 2012                [Page 35]


Internet-Draft            SIP Messages in IPFIX             October 2011


   [RFC5655]  Trammell, B., Boschi, E., Mark, L., Zseby, T., and A.
              Wagner, "Specification of the IP Flow Information Export
              (IPFIX) File Format", RFC 5655, October 2009.

9.2.  Informative References

   [I-D.kaplan-dispatch-session-id]
              Kaplan, H., "A Session Identifier for the Session
              Initiation Protocol (SIP)",
              draft-kaplan-dispatch-session-id-03 (work in progress),
              March 2011.

   [I-D.trammell-ipfix-ie-doctors]
              Trammell, B. and B. Claise, "Guidelines for Authors and
              Reviewers of IPFIX Information Elements",
              draft-trammell-ipfix-ie-doctors-02 (work in progress),
              June 2011.

   [RFC2976]  Donovan, S., "The SIP INFO Method", RFC 2976,
              October 2000.

   [RFC3261]  Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
              A., Peterson, J., Sparks, R., Handley, M., and E.
              Schooler, "SIP: Session Initiation Protocol", RFC 3261,
              June 2002.

   [RFC3262]  Rosenberg, J. and H. Schulzrinne, "Reliability of
              Provisional Responses in Session Initiation Protocol
              (SIP)", RFC 3262, June 2002.

   [RFC3265]  Roach, A., "Session Initiation Protocol (SIP)-Specific
              Event Notification", RFC 3265, June 2002.

   [RFC3311]  Rosenberg, J., "The Session Initiation Protocol (SIP)
              UPDATE Method", RFC 3311, October 2002.

   [RFC3428]  Campbell, B., Rosenberg, J., Schulzrinne, H., Huitema, C.,
              and D. Gurle, "Session Initiation Protocol (SIP) Extension
              for Instant Messaging", RFC 3428, December 2002.

   [RFC3515]  Sparks, R., "The Session Initiation Protocol (SIP) Refer
              Method", RFC 3515, April 2003.

   [RFC3665]  Johnston, A., Donovan, S., Sparks, R., Cunningham, C., and
              K. Summers, "Session Initiation Protocol (SIP) Basic Call
              Flow Examples", BCP 75, RFC 3665, December 2003.

   [RFC3903]  Niemi, A., "Session Initiation Protocol (SIP) Extension



Trammell, et al.         Expires April 29, 2012                [Page 36]


Internet-Draft            SIP Messages in IPFIX             October 2011


              for Event State Publication", RFC 3903, October 2004.

   [RFC4475]  Sparks, R., Hawrylyshen, A., Johnston, A., Rosenberg, J.,
              and H. Schulzrinne, "Session Initiation Protocol (SIP)
              Torture Test Messages", RFC 4475, May 2006.

   [RFC5226]  Narten, T. and H. Alvestrand, "Guidelines for Writing an
              IANA Considerations Section in RFCs", BCP 26, RFC 5226,
              May 2008.

   [RFC6026]  Sparks, R. and T. Zourzouvillys, "Correct Transaction
              Handling for 2xx Responses to Session Initiation Protocol
              (SIP) INVITE Requests", RFC 6026, September 2010.

   [RFC6086]  Holmberg, C., Burger, E., and H. Kaplan, "Session
              Initiation Protocol (SIP) INFO Method and Package
              Framework", RFC 6086, January 2011.

   [ripfix]   Trammell, B., "ripfix: IPFIX for Ruby",  available at
              http://ripfix.rubyforge.org/.


Appendix A.  Definition of Base SIP Message Information Elements in IANA
             XML Registry format

   [EDITOR'S NOTE: frontmatter]

<registry xmlns="http://www.iana.org/assignments" id="ipfix">
  <registry id="ipfix-information-element-definitions">
    <record>
      <name>sipObservationType</name>
      <dataType>unsigned8</dataType>
      <dataTypeSemantics>identifier</dataTypeSemantics>
      <enterpriseId>35566</enterpriseId>
      <elementId>419</elementId>
      <status>current</status>
      <description>
        <paragraph>
            Denotes whether the entry was
            corresponds to a SIP message received, sent, or merely
            seen by a passive observer, as follows:
        </paragraph>
        <paragraph>0: unknown: The Metering Process does not
          specify the observation type.</paragraph>
        <paragraph>1: receiver: The Metering Process is, or is
          co-located with, the receiver of the SIP message.</paragraph>
        <paragraph>2: sender: The Metering Process is, or is
          co-located with, the sender of the SIP message.</paragraph>



Trammell, et al.         Expires April 29, 2012                [Page 37]


Internet-Draft            SIP Messages in IPFIX             October 2011


        <paragraph>3: passive: The Metering Process passively
          observed the SIP message.</paragraph>
      </description>
    </record>
    <record>
      <name>sipMethod</name>
      <dataType>unsigned8</dataType>
      <dataTypeSemantics>identifier</dataTypeSemantics>
      <enterpriseId>35566</enterpriseId>
      <elementId>402</elementId>
      <status>current</status>
      <description>
        <paragraph>
          The SIP method from the CSeq header, encoded as per
          the IPFIX sipMethod subregistry.
          </paragraph>
      </description>
    </record>
    <record>
      <name>sipSequenceNumber</name>
      <dataType>unsigned32</dataType>
      <dataTypeSemantics>identifier</dataTypeSemantics>
      <enterpriseId>35566</enterpriseId>
      <elementId>409</elementId>
      <status>current</status>
      <description>
        <paragraph>The sequence number from the CSeq header.</paragraph>
      </description>
    </record>
    <record>
      <name>sipRequestURI</name>
      <dataType>string</dataType>
      <enterpriseId>35566</enterpriseId>
      <elementId>403</elementId>
      <status>current</status>
      <description>
        <paragraph>The SIP Request URI, including any parameters,
          as a UTF-8 string, escaped according to SIP rules as
          received by the metering process.</paragraph>
      </description>
    </record>
    <record>
      <name>sipFromURI</name>
      <dataType>string</dataType>
      <enterpriseId>35566</enterpriseId>
      <elementId>404</elementId>
      <status>current</status>
      <description>



Trammell, et al.         Expires April 29, 2012                [Page 38]


Internet-Draft            SIP Messages in IPFIX             October 2011


        <paragraph>The URI from the SIP From: header</paragraph>
      </description>
    </record>
    <record>
      <name>sipFromTag</name>
      <dataType>string</dataType>
      <enterpriseId>35566</enterpriseId>
      <elementId>405</elementId>
      <status>current</status>
      <description>
        <paragraph>The Tag parameter value from the SIP
          From: header</paragraph>
      </description>
    </record>
    <record>
      <name>sipToURI</name>
      <dataType>string</dataType>
      <enterpriseId>35566</enterpriseId>
      <elementId>406</elementId>
      <status>current</status>
      <description>
        <paragraph>The URI from the SIP To: header</paragraph>
      </description>
    </record>
    <record>
      <name>sipToTag</name>
      <dataType>string</dataType>
      <enterpriseId>35566</enterpriseId>
      <elementId>407</elementId>
      <status>current</status>
      <description>
        <paragraph>The Tag parameter value from the SIP To:
          header</paragraph>
      </description>
    </record>
    <record>
      <name>sipCallId</name>
      <dataType>string</dataType>
      <enterpriseId>35566</enterpriseId>
      <elementId>408</elementId>
      <status>current</status>
      <description>
        <paragraph>The value of the SIP Call-ID: header</paragraph>
      </description>
    </record>
    <record>
      <name>sipResponseStatus</name>
      <dataType>unsigned16</dataType>



Trammell, et al.         Expires April 29, 2012                [Page 39]


Internet-Draft            SIP Messages in IPFIX             October 2011


      <dataTypeSemantics>identifier</dataTypeSemantics>
      <enterpriseId>35566</enterpriseId>
      <elementId>412</elementId>
      <status>current</status>
      <description>
        <paragraph>The SIP Response code. The presence of this
          Information Element in a SIP Message record marks it as
          describing a SIP response; if absent, the record describes
          a SIP request.</paragraph>
      </description>
    </record>
    <record>
      <name>sipServerTransaction</name>
      <dataType>string</dataType>
      <dataTypeSemantics>identifier</dataTypeSemantics>
      <enterpriseId>35566</enterpriseId>
      <elementId>413</elementId>
      <status>current</status>
      <description>
        <paragraph>The transaction identifier associated with
          the server transaction.</paragraph>
      </description>
    </record>
    <record>
      <name>sipClientTransaction</name>
      <dataType>string</dataType>
      <dataTypeSemantics>identifier</dataTypeSemantics>
      <enterpriseId>35566</enterpriseId>
      <elementId>414</elementId>
      <status>current</status>
      <description>
        <paragraph>The transaction identifier associated with
          the client transaction.</paragraph>
      </description>
    </record>
  </registry>
</registry>

                SIP Message Information Element definitions


Appendix B.  Definition of sipMethod registry in IANA XML Registry
             format

   [EDITOR'S NOTE: frontmatter]

   <registry xmlns="http://www.iana.org/assignments" id="ipfix">
     <registry id="sipMethod">



Trammell, et al.         Expires April 29, 2012                [Page 40]


Internet-Draft            SIP Messages in IPFIX             October 2011


       <title>IPFIX sipMethod</title>
       <registration_rule>Expert Review</registration_rule>
       <record>
         <value>0</value>
         <description>Unknown</description>
         <comments>The Metering Process did not
           recognize the SIP method.</comments>
       </record>
       <record>
         <value>1</value>
         <description>ACK</description>
         <comments/>
         <xref type="rfc" data="rfc3261"/>
       </record>
       <record>
         <value>2</value>
         <description>BYE</description>
         <comments/>
         <xref type="rfc" data="rfc3261"/>
       </record>
       <record>
         <value>3</value>
         <description>CANCEL</description>
         <comments/>
         <xref type="rfc" data="rfc3261"/>
       </record>
       <record>
         <value>4</value>
         <description>INFO</description>
         <comments/>
         <xref type="rfc" data="rfc6086"/>
       </record>
       <record>
         <value>5</value>
         <description>INVITE</description>
         <comments/>
         <xref type="rfc" data="rfc3261"/>
       </record>
       <record>
         <value>6</value>
         <description>MESSAGE</description>
         <comments/>
         <xref type="rfc" data="rfc3428"/>
       </record>
       <record>
         <value>7</value>
         <description>NOTIFY</description>
         <comments/>



Trammell, et al.         Expires April 29, 2012                [Page 41]


Internet-Draft            SIP Messages in IPFIX             October 2011


         <xref type="rfc" data="rfc3265"/>
       </record>
       <record>
         <value>8</value>
         <description>OPTIONS</description>
         <comments/>
         <xref type="rfc" data="rfc3261"/>
       </record>
       <record>
         <value>9</value>
         <description>PRACK</description>
         <comments/>
         <xref type="rfc" data="rfc3262"/>
       </record>
       <record>
         <value>10</value>
         <description>PUBLISH</description>
         <comments/>
         <xref type="rfc" data="rfc3903"/>
       </record>
       <record>
         <value>11</value>
         <description>REFER</description>
         <comments/>
         <xref type="rfc" data="rfc3515"/>
       </record>
       <record>
         <value>12</value>
         <description>REGISTER</description>
         <comments/>
         <xref type="rfc" data="rfc3261"/>
       </record>
       <record>
         <value>13</value>
         <description>SUBSCRIBE</description>
         <comments/>
         <xref type="rfc" data="rfc3265"/>
       </record>
       <record>
         <value>14</value>
         <description>UPDATE</description>
         <comments/>
         <xref type="rfc" data="rfc3311"/>
       </record>
       <record>
         <value>15-65535</value>
         <description>Unassigned</description>
         <comments></comments>



Trammell, et al.         Expires April 29, 2012                [Page 42]


Internet-Draft            SIP Messages in IPFIX             October 2011


       </record>
     </registry>
   </registry>

                           sipMethod subregistry


Appendix C.  Definition of Additional SIP Message Information Elements
             in IANA XML Registry format

   [EDITOR'S NOTE: frontmatter]

  <?xml version="1.0" encoding="UTF-8"?>

  <registry xmlns="http://www.iana.org/assignments" id="ipfix">
    <registry id="ipfix-information-element-definitions">

     <record>
       <name>sipContactURI</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>415</elementId>
       <status>current</status>
       <description>
         <paragraph>The addr-spec URI, including any URI parameters,
           of the first/top-most SIP Contact header,
           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>
       <name>sipRouteURI</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>416</elementId>
       <status>current</status>
       <description>
         <paragraph>The addr-spec URI, including any URI parameters,
           of the first/top-most SIP Route header,
           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>
       <name>sipPaiURI</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>417</elementId>



Trammell, et al.         Expires April 29, 2012                [Page 43]


Internet-Draft            SIP Messages in IPFIX             October 2011


       <status>current</status>
       <description>
         <paragraph>The addr-spec URI, including any URI parameters,
           of the first/top-most SIP P-Asserted-Identity header,
           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>
       <name>sipPpiURI</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>418</elementId>
       <status>current</status>
       <description>
         <paragraph>The addr-spec URI, including any URI parameters,
           of the first/top-most SIP P-Preferred-Identity header,
           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>
       <name>sipPAssocURI</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>430</elementId>
       <status>current</status>
       <description>
         <paragraph>The addr-spec URI, including any URI parameters,
           of the first/top-most SIP P-Associated-Identity header,
           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>
       <name>sipPCalledPartyURI</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>420</elementId>
       <status>current</status>
       <description>
         <paragraph>The addr-spec URI, including any URI parameters,
           of the SIP P-Called-Party-ID header,
           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>



Trammell, et al.         Expires April 29, 2012                [Page 44]


Internet-Draft            SIP Messages in IPFIX             October 2011


       <name>sipVia</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>421</elementId>
       <status>current</status>
       <description>
         <paragraph>The value of the first/top-most Via header
           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>
       <name>sipAuthUsername</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>422</elementId>
       <status>current</status>
       <description>
         <paragraph>The value of the username field
           of the first/top-most Authorization header
           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>
       <name>sipSubscriptionEvent</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>423</elementId>
       <status>current</status>
       <description>
         <paragraph>The value of the Event header
           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>
       <name>sipSubscriptionState</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>424</elementId>
       <status>current</status>
       <description>
         <paragraph>The value of the Subscription-State header
           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>



Trammell, et al.         Expires April 29, 2012                [Page 45]


Internet-Draft            SIP Messages in IPFIX             October 2011


     <record>
       <name>sipExpires</name>
       <dataType>unsigned32</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>425</elementId>
       <status>current</status>
       <description>
         <paragraph>The numeric value of the expires parameter of the
           first/top-most Contact header of a REGISTER request
           or response, or Subscription-State header of a SUBSCRIBE
           or NOTIFY request or response, or the Expires header
           if the expires parameter does not exist, as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>
       <name>sipPVisitedNetworkID</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>426</elementId>
       <status>current</status>
       <description>
         <paragraph>The value of the first/top-most P-Visited-Network-ID
           header as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>
       <name>sipPAccessNetworkInfo</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>427</elementId>
       <status>current</status>
       <description>
         <paragraph>The value of the P-Access-Network-Info header
           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>
       <name>sipPChargingFunctionAddr</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>428</elementId>
       <status>current</status>
       <description>
         <paragraph>The value of the first/top-most
           P-Charging-Function-Addresses header



Trammell, et al.         Expires April 29, 2012                [Page 46]


Internet-Draft            SIP Messages in IPFIX             October 2011


           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
     <record>
       <name>sipPChargingVector</name>
       <dataType>string</dataType>
       <enterpriseId>35566</enterpriseId>
       <elementId>429</elementId>
       <status>current</status>
       <description>
         <paragraph>The value of the P-Charging-Vector header
           as a UTF-8 string, escaped according to SIP rules as
           received by the metering process.</paragraph>
       </description>
     </record>
  </registry>
  </registry>

          Additional SIP Message Information Element definitions


Appendix D.  Example messages in base64

   This section contains the example messages from this revision of this
   draft in base64 encoding, for ease of processing by automated tools.

   The base templates are in this message:

   AAoA/EzALZsAAAAAAAAwOQACAOwBAQARAUMACIGZAAQAAIruAAgABAAMAAQA
   BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX
   //8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK
   7gECABEBQwAIgZkABAAAiu4ACAAEAAwABAAHAAIACwACAAQAAYGSAAEAAIru
   gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A
   AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIru

   The extended 4to6 and 6to4 templates are in this message:

   AAoB5EzALZsAAAAAAAAwOQACAdQBBQARAUMACIGZAAQAAIruAAgABAAcABAA
   BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX
   //8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK
   7gEGABEBQwAIgZkABAAAiu4ACAAEABwAEAAHAAIACwACAAQAAYGSAAEAAIru
   gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A
   AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIruAQcAEQFDAAiBmQAEAACK7gAb
   ABAADAAEAAcAAgALAAIABAABgZIAAQAAiu6BowABAACK7oGT//8AAIrugZb/
   /wAAiu6Bl///AACK7oGU//8AAIrugZX//wAAiu6BmP//AACK7oGe//8AAIru gZ3//
   wAAiu4BCAARAUMACIGZAAQAAIruABsAEAAMAAQABwACAAsAAgAEAAGB
   kgABAACK7oGjAAEAAIrugZwAAgAAiu6Blv//AACK7oGX//8AAIrugZT//wAA iu6Blf//



Trammell, et al.         Expires April 29, 2012                [Page 47]


Internet-Draft            SIP Messages in IPFIX             October 2011


   AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK7g==

   The UAC registration in Section 5.2 is in this message:

   AAoA2EzAO88AAAAAAAAwOQEBAGsAAAEpE2YTkwAAAAHGM2QBxjNkChPEE8QR
   DAIPc2lwOmV4YW1wbGUuY29tAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2
   eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEAAQIAXQAAASkTZhUk
   AAAAAcYzZArGM2QBE8QTxBEMAQDIAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t
   BTc2eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEA

   The direct call in Section 5.3 is in this message:

   AAoCGkzAPA8AAAAAAAAwOQEBAIgAAAEpE2YTkwAAACDGM2QBywBxARPEE8QR
   BQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5u
   ZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQU3NnloaBVmODItZDQtZjdAZXhh
   bXBsZS5jb20HYy0xLXh0NgABAgB5AAABKRNmGKoAAAAgywBxAcYzZAETxBPE
   EQUBALQTc2lwOmJvYkBleGFtcGxlLm5ldAhiLWluNi1pdRVzaXA6YWxpY2VA
   ZXhhbXBsZS5jb20FNzZ5aGgVZjgyLWQ0LWY3QGV4YW1wbGUuY29tB2MtMS14
   dDYAAQIAeQAAASkTZhz0AAAAIMsAcQHGM2QBE8QTxBEFAQDIE3NpcDpib2JA
   ZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2
   eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AAEBAJAAAAEpE2Yd
   CAAAACDGM2QBywBxARPEE8QRAQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0
   E3NpcDpib2JAZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1w
   bGUuY29tBTc2eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AA==

   The downstream branch call in Section 5.4 is in this message:

   AAoE4UzAPEoAAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBxjNkChPEE8QR
   BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz
   aXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20A
   BnMteC10cgECAGwAAAEpE2YUwQAAACvGM2QKxjNkARPEE8QRBQIAZBNzaXA6
   Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0
   ci04N2hAZXhhbXBsZS5jb20ABnMteC10cgEBAIkAAAEpE2YYpgAAACvGM2QK
   ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA
   ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3
   aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZhlwAAAAK8sA
   cQHGM2QKE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6
   YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14
   LXRyBnMteC10cgECAHYAAAEpE2YbyAAAACvLAHEBxjNkChPEE8QRBQEAtBNz
   aXA6Ym9iQGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29t
   BGFsLTESdHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAgB2AAAB
   KRNmHJgAAAArxjNkCsYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l
   dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3aEBleGFt
   cGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZiDwAAAAK8sAcQHGM2QK
   E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA
   ZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMt
   eC10cgECAHYAAAEpE2YhpAAAACvGM2QKxjNkARPEE8QRBQIAyBNzaXA6Ym9i
   QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGFsLTES



Trammell, et al.         Expires April 29, 2012                [Page 48]


Internet-Draft            SIP Messages in IPFIX             October 2011


   dHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAQCIAAABKRNmKKwA
   AAArxjNkAcYzZAoTxBPEEQEBE3NpcDpib2JAZXhhbXBsZS5uZXQTc2lwOmJv
   YkBleGFtcGxlLm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0x
   EnRyLTg3aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQEAiAAAASkTZiis
   AAAAK8YzZArLAHEBE8QTxBEBAhNzaXA6Ym9iQGV4YW1wbGUubmV0E3NpcDpi
   b2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwt
   MRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMteC10cg==

   The forked call in Section 5.5 is in this message:

   AAoHjEzAPF0AAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBywBxyBPEE8QR
   BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz
   aXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20A
   BnMtMS10cgECAGwAAAEpE2YUwQAAACvLAHHIxjNkARPEE8QRBQIAZBNzaXA6
   Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0
   ci04OGhAZXhhbXBsZS5jb20ABnMtMS10cgEBAIkAAAEpE2YYpgAAACvLAHHI
   ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA
   ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4
   aEBleGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQUAlQAAASkTZhqcAAAAK8sA
   ccggAQ24AAAAAAAAAAAAAAAJE8QTxBEFAhhzaXA6Ym9iQGJvYjIuZXhhbXBs
   ZS5uZXQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUu
   Y29tBGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2
   AAABKRNmG8gAAAArywBxAcsAccgTxBPEEQUBAGQTc2lwOmJvYkBleGFtcGxl
   Lm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBl
   eGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQgAggAAASkTZhz0AAAAKyABDbgA
   AAAAAAAAAAAAAAnLAHHIE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQE
   YjItMhVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBs
   ZS5jb20GYy0yLXRyBnMtMS10cgEIAIIAAAEpE2YfTAAAACsgAQ24AAAAAAAA
   AAAAAAAJywBxyBPEE8QRBQEAtBNzaXA6Ym9iQGV4YW1wbGUubmV0BGIyLTIV
   c2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTESdHItODhoQGV4YW1wbGUuY29t
   BmMtMi10cgZzLTEtdHIBAgByAAABKRNmIG4AAAArywBxyMYzZAETxBPEEQUC
   ALQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t
   BGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2AAAB
   KRNmIaQAAAArywBxyMYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l
   dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFt
   cGxlLmNvbQZjLTEtdHIGcy0xLXRyAQIAdgAAASkTZiOYAAAAK8sAcQHLAHHI
   E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA
   ZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0xLXRyBnMt
   MS10cgECAHYAAAEpE2YkYAAAACvLAHHIxjNkARPEE8QRBQIAyBNzaXA6Ym9i
   QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTES
   dHItODhoQGV4YW1wbGUuY29tBmMtMS10cgZzLTEtdHIBBQCVAAABKRNmJSkA
   AAArywBxyCABDbgAAAAAAAAAAAAAAAkTxBPEEQMCGHNpcDpib2JAYm9iMi5l
   eGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhh
   bXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10
   cgEIAH4AAAEpE2YoPwAAACsgAQ24AAAAAAAAAAAAAAAJywBxyBPEE8QRBQEB
   5xNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20E
   YTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10cgEFAJUAAAEp
   E2YqDwAAACvLAHHIIAENuAAAAAAAAAAAAAAACRPEE8QRAQIYc2lwOmJvYkBi



Trammell, et al.         Expires April 29, 2012                [Page 49]


Internet-Draft            SIP Messages in IPFIX             October 2011


   b2IyLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGlj
   ZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIG
   cy0xLXRyAQgAfgAAASkTZiwxAAAAKyABDbgAAAAAAAAAAAAAAAnLAHHIE8QT
   xBEDAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxl
   LmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIGcy0xLXRy


Authors' Addresses

   Brian Trammell
   Swiss Federal Institute of Technology Zurich
   Gloriastrasse 35
   8092 Zurich
   Switzerland

   Email: trammell@tik.ee.ethz.ch


   Saverio Niccolini
   NEC Laboratories Europe, NEC Europe Ltd.
   Kurfuersten-Anlage 36
   Heidelberg  69115
   Germany

   Phone: +49 (0) 6221 4342 118
   Email: niccolini@neclab.eu
   URI:   http://www.neclab.eu


   Benoit Claise
   Cisco Systems Inc.
   De Kleetlaan 6a b1
   Diegem,   1813
   Belgium

   Phone: +32 2 704 5622
   Fax:
   Email: bclaise@cisco.com
   URI:












Trammell, et al.         Expires April 29, 2012                [Page 50]


Internet-Draft            SIP Messages in IPFIX             October 2011


   Hadriel Kaplan
   Acme Packet
   71 Third Ave.
   Burlington, MA  01803
   USA

   Phone:
   Email: hkaplan@acmepacket.com











































Trammell, et al.         Expires April 29, 2012                [Page 51]


Html markup produced by rfcmarkup 1.129c, available from https://tools.ietf.org/tools/rfcmarkup/