



Internet Engineering Task Force (IETF)                      M. Boucadair
Request for Comments: 9740                                        Orange
Category: Standards Track                                      B. Claise
ISSN: 2070-1721                                                   Huawei
                                                              March 2025


   New IPFIX Information Elements for TCP Options and IPv6 Extension
                                Headers

Abstract

   This document specifies new IP Flow Information Export (IPFIX)
   Information Elements (IEs) to solve issues with existing
   ipv6ExtensionHeaders and tcpOptions IPFIX IEs, especially the ability
   to export any observed IPv6 extension headers or TCP options.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 7841.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   https://www.rfc-editor.org/info/rfc9740.

Copyright Notice

   Copyright (c) 2025 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Revised BSD License text as described in Section 4.e of the
   Trust Legal Provisions and are provided without warranty as described
   in the Revised BSD License.

Table of Contents

   1.  Introduction
     1.1.  Issues with ipv6ExtensionHeaders Information Element
     1.2.  Issues with tcpOptions Information Element
   2.  Conventions and Definitions
   3.  Information Elements for IPv6 Extension Headers
     3.1.  ipv6ExtensionHeaderType Information Element
     3.2.  ipv6ExtensionHeaderCount Information Element
     3.3.  ipv6ExtensionHeadersFull Information Element
     3.4.  ipv6ExtensionHeaderTypeCountList Information Element
     3.5.  ipv6ExtensionHeadersLimit Information Element
     3.6.  ipv6ExtensionHeadersChainLength Information Element
     3.7.  ipv6ExtensionHeaderChainLengthList Information Element
   4.  Information Elements for TCP Options
     4.1.  tcpOptionsFull Information Element
     4.2.  tcpSharedOptionExID16 Information Element
     4.3.  tcpSharedOptionExID32 Information Element
     4.4.  tcpSharedOptionExID16List Information Element
     4.5.  tcpSharedOptionExID32List Information Element
   5.  Implementation and Operational Considerations
   6.  Examples
     6.1.  IPv6 Extension Headers
     6.2.  TCP Options
       6.2.1.  Reduced-Size Encoding
       6.2.2.  Shared Options
   7.  Security Considerations
   8.  IANA Considerations
     8.1.  Deprecate ipv6ExtensionHeaders and tcpOptions Information
           Elements
     8.2.  IPFIX Information Elements
     8.3.  IPFIX Information Element Data Type
       8.3.1.  unsigned256
     8.4.  IPFIX Registry for IPv6 Extension Headers
       8.4.1.  Initial Values
       8.4.2.  Guidelines for the Designated Experts
   9.  References
     9.1.  Normative References
     9.2.  Informative References
   Acknowledgments
   Authors' Addresses

1.  Introduction

   This document specifies new IP Flow Information Export (IPFIX)
   [RFC7011] Information Elements (IEs) to solve a set of issues
   encountered with the specifications of two IEs --
   ipv6ExtensionHeaders (to export IPv6 extension headers) and
   tcpOptions (to export TCP options) [IANA-IPFIX].  More details about
   these issues are provided in the following subsections.

   This document deprecates the ipv6ExtensionHeaders and tcpOptions
   IPFIX IEs that were initially defined in [RFC5102].

      Note that [RFC7012] obsoletes [RFC5102] and specifies that
      [IANA-IPFIX] is the normative reference for these IEs.

1.1.  Issues with ipv6ExtensionHeaders Information Element

   The specification of the ipv6ExtensionHeaders IPFIX IE (64) does not:

   *  Cover the full extension headers' range defined in the IPv6
      specification (Section 4 of [RFC8200]).

   *  Specify the procedure to follow when all bits are exhausted.

   *  Specify a means to export the order and the number of occurrences
      of a given extension header.

   *  Specify how to automatically update the IANA IPFIX registry
      [IANA-IPFIX] when a new value is assigned in the IPv6 Extension
      Header Types registry [IANA-EH].  Only a frozen set of extension
      headers can be exported using the ipv6ExtensionHeaders IE.  For
      example, the ipv6ExtensionHeaders IE can't report some IPv6 EHs,
      specifically EHs for the Host Identity Protocol (139), Shim6
      Protocol (140), or extension headers for experimentation and
      testing.

   *  Specify whether the exported values match the full enclosed values
      or only up to a limit imposed by hardware or software (e.g.,
      Section 1.1 of [RFC8883]).  Note that some implementations may not
      be able to export all observed extension headers in a Flow because
      of a hardware or software limit (see, e.g., [EH-LIMITS]).

   *  Discuss whether it covers all enclosed extension headers or only
      up to a limit.

   *  Specify how to report the length of IPv6 extension headers.

   *  Optimize the encoding.

   *  Explain the reasoning for reporting values that do not correspond
      to extension headers (e.g., "Unknown Layer 4 header" or "Payload
      compression header").

   *  Specify how to report extension header chains or aggregate lengths
      of extension headers.

   Section 3 addresses these issues.

   This specification deprecates the ipv6ExtensionHeaders IPFIX IE in
   favor of the new IEs defined in this document.

1.2.  Issues with tcpOptions Information Element

   The specification of the tcpOptions IPFIX IE (209) does not:

   *  Describe how some observed TCP options in a Flow can be exported
      using IPFIX.  Only TCP options having a Kind <= 63 can be exported
      in a tcpOptions IE.

   *  Allow reporting the observed Experiment Identifiers (ExIDs) that
      are carried in shared Experimental TCP options (Kind=253 or 254)
      [RFC6994].

   *  Optimize the encoding.

   Section 4 addresses these issues.

   This specification deprecates the tcpOptions IE in favor of the new
   IEs defined in this document.

2.  Conventions and Definitions

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in
   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.

   This document uses the IPFIX-specific terminology (Information
   Element, Template Record, Flow, etc.) defined in Section 2 of
   [RFC7011].  As in the base IPFIX specification [RFC7011], these
   IPFIX-specific terms have the first letter of a word capitalized.

   Also, the document uses the terms defined in the IPv6 [RFC8200] and
   TCP [RFC9293] specifications.

   In addition, the document makes use of the following terms:

   Extension header chain:  Refers to the chain of extension headers
      that are present in an IPv6 packet.

      This term should not be confused with the IPv6 header chain, which
      includes the IPv6 header, zero or more IPv6 extension headers, and
      zero or a single Upper-Layer Header.

   Flow with varying extension header chains:  Refers to a Flow where
      distinct extension header chains are observed.  Concretely,
      different packets in such a Flow will have a different sequence of
      extension header type codes.

3.  Information Elements for IPv6 Extension Headers

3.1.  ipv6ExtensionHeaderType Information Element

   Name:  ipv6ExtensionHeaderType

   ElementID:  513

   Description:  Type of an IPv6 extension header observed in at least
      one packet of this Flow.

   Abstract Data Type:  unsigned8

   Data Type Semantics:  identifier

   Additional Information:  See the "IPv6 Extension Header Types"
      registry at [IANA-EH].

      See Section 4 of [RFC8200] for the general definition of IPv6
      extension headers.

   Reference:  RFC 9740

3.2.  ipv6ExtensionHeaderCount Information Element

   Name:  ipv6ExtensionHeaderCount

   ElementID:  514

   Description:  The number of consecutive occurrences of the same
      extension header type in a Flow.

      This IE is reported, e.g., in the ipv6ExtensionHeaderTypeCountList
      IE.

      The type of the extension header is provided in the
      ipv6ExtensionHeaderType IE.

   Abstract Data Type:  unsigned8

   Data Type Semantics:  totalCounter

   Additional Information:  See the "IPv6 Extension Header Types"
      registry at [IANA-EH].

      See Section 4 of [RFC8200] for the general definition of IPv6
      extension headers.

   Reference:  RFC 9740

3.3.  ipv6ExtensionHeadersFull Information Element

   Name:  ipv6ExtensionHeadersFull

   ElementID:  515

   Description:  IPv6 extension headers observed in packets of this
      Flow.  The information is encoded in a set of bit fields.  For
      each IPv6 extension header, there is a bit in this set.  The bit
      is set to 1 if any observed packet of this Flow contains the
      corresponding IPv6 extension header.  Otherwise, if no observed
      packet of this Flow contains the respective IPv6 extension header,
      the value of the corresponding bit is 0.

      The IPv6 extension header associated with each bit is provided in
      [IANA-IPFIX-IPv6EH].  Bit 0 corresponds to the least significant
      bit (LSB) in the ipv6ExtensionHeadersFull IE, while bit 255
      corresponds to the most significant bit (MSB) of the IE.  In doing
      so, few octets will be needed to encode common IPv6 extension
      headers when observed in a Flow.

      The "No Next Header" (bit 2) value (Section 4.7 of [RFC8200]) is
      used if there is no upper-layer header in an IPv6 packet.  Even if
      the value is not considered as an extension header as such, the
      corresponding bit is set in the ipv6ExtensionHeadersFull IE
      whenever that value is encountered in the Flow.

      Extension headers observed in a Flow with varying extension header
      chains MUST NOT be grouped in the ipv6ExtensionHeadersFull IE if
      the ipv6ExtensionHeaderChainLengthList IE is also present.

      If the ipv6ExtensionHeaderChainLengthList IE is not present, then
      extension headers observed in a Flow with varying extension header
      chains MAY be grouped in one single ipv6ExtensionHeadersFull IE or
      be exported in separate ipv6ExtensionHeadersFull IEs, one for each
      extension header chain.

      The ipv6ExtensionHeadersFull IE MUST NOT be exported if
      ipv6ExtensionHeaderTypeCountList IE is also present because of the
      overlapping scopes of these two IEs.

      The value of ipv6ExtensionHeadersFull IE may be encoded in fewer
      octets per the guidelines in Section 6.2 of [RFC7011].

   Abstract Data Type:  unsigned256

   Data Type Semantics:  flags

   Additional Information:  See the "IPFIX ipv6ExtensionHeaders Bits"
      registry at [IANA-IPFIX-IPv6EH].

      See the "IPv6 Extension Header Types" registry at [IANA-EH].

      See Section 4 of [RFC8200] for the general definition of IPv6
      extension headers.

      The ipv6ExtensionHeadersFull IE deprecates the
      ipv6ExtensionHeaders IE (64) that was initially defined in
      [RFC5102].

      [RFC7012] obsoletes [RFC5102] and specifies that [IANA-IPFIX] is
      the normative reference for the ipv6ExtensionHeaders IE (64).

   Reference:  RFC 9740

3.4.  ipv6ExtensionHeaderTypeCountList Information Element

   Name:  ipv6ExtensionHeaderTypeCountList

   ElementID:  516

   Description:  As per Section 4.1 of [RFC8200], IPv6 nodes must accept
      and attempt to process extension headers occurring any number of
      times in the same packet.  This IE echoes the order of extension
      headers and number of consecutive occurrences of the same
      extension header type in a Flow.

      This IE is a subTemplateList of ipv6ExtensionHeaderType and
      ipv6ExtensionHeaderCount IEs.

      Each header chain in a Flow with varying extension header chains
      MUST be exported in a separate IE.

      The same extension header type may appear several times in an
      ipv6ExtensionHeaderTypeCountList IE.  For example, if an IPv6
      packet of a Flow includes a Hop-by-Hop Options header, a
      Destination Options header, a Fragment header, and a Destination
      Options header, the ipv6ExtensionHeaderTypeCountList IE will
      report:

      *  the count of Hop-by-Hop Options headers,

      *  the occurrences of the Destination Options headers that are
         observed before a Fragment header,

      *  the occurrences of the Fragment headers, and

      *  the occurrences of the Destination Options headers that are
         observed right after a Fragment header.

      If an implementation determines that an observed packet of a Flow
      includes an extension header (including an extension header that
      it does not support), then the exact observed code of that
      extension header MUST be echoed in the
      ipv6ExtensionHeaderTypeCountList IE.  How an implementation
      disambiguates between unknown upper-layer protocols vs. extension
      headers is not IPFIX-specific.  Refer, for example, to Section 2.2
      of [RFC8883] for a behavior of an intermediate node that
      encounters an unknown Next Header type.

   Abstract Data Type:  subTemplateList

   Data Type Semantics:  list

   Additional Information:  See the "IPv6 Extension Header Types"
      registry at [IANA-EH].

      See Section 4 of [RFC8200] for the general definition of IPv6
      extension headers.

   Reference:  RFC 9740

3.5.  ipv6ExtensionHeadersLimit Information Element

   Name:  ipv6ExtensionHeadersLimit

   ElementID:  517

   Description:  When set to "false", this IE indicates that the
      exported extension header information (e.g.,
      ipv6ExtensionHeadersFull or ipv6ExtensionHeaderTypeCountList) does
      not match the full enclosed extension headers, but only up to a
      limit that is typically set by hardware or software.

      When set to "true", this IE indicates that the exported extension
      header information matches the full enclosed extension headers.

   Abstract Data Type:  boolean

   Data Type Semantics:  default

   Additional Information:  See Section 4 of [RFC8200] for the general
      definition of IPv6 extension headers.

      See [RFC8883] for an example of IPv6 packet processing due to
      limits on extension headers.

   Reference:  RFC 9740

3.6.  ipv6ExtensionHeadersChainLength Information Element

   Name:  ipv6ExtensionHeadersChainLength

   ElementID:  518

   Description:  In theory, there are no limits on the number of IPv6
      extension headers that may be present in a packet other than the
      path MTU.  However, it was regularly reported that IPv6 packets
      with extension headers were often dropped in the Internet (e.g.,
      [RFC7872]).

      As discussed in Section 1.2 of [RFC8883], some hardware devices
      implement a parsing buffer of a fixed size to process packets,
      including all the headers.  When the aggregate length of headers
      of an IPv6 packet exceeds that size, the packet will be discarded
      or deferred to a slow path.

      The ipv6ExtensionHeadersChainLength IE is used to report, in
      octets, the length of an extension header chain observed in a
      Flow.  The length is the sum of the lengths of all extension
      headers of the chain.  Exporting such information might help
      identifying root causes of performance degradation, including
      packet drops.

      Each header chain length of a Flow with varying extension header
      chains MUST be exported in a separate
      ipv6ExtensionHeadersChainLength IE.

   Abstract Data Type:  unsigned32

   Data Type Semantics:  identifier

   Units:  octets

   Additional Information:  See Section 4 of [RFC8200] for the general
      definition of IPv6 extension headers.

      See [RFC9098] for an overview of operational implications of IPv6
      packets with extension headers.

   Reference:  RFC 9740

3.7.  ipv6ExtensionHeaderChainLengthList Information Element

   Name:  ipv6ExtensionHeaderChainLengthList

   ElementID:  519

   Description:  This IE is used to report the chains and their lengths
      as observed in a Flow with varying extension header chains.

      This IE is a subTemplateList of ipv6ExtensionHeadersFull and
      ipv6ExtensionHeadersChainLength IEs.

      If several extension header chains are observed in a Flow, each
      header chain MUST be exported in a separate
      ipv6ExtensionHeaderChainLengthList IE.

   Abstract Data Type:  subTemplateList

   Data Type Semantics:  list

   Additional Information:  See the "IPv6 Extension Header Types"
      registry at [IANA-EH].

      See Section 4 of [RFC8200] for the general definition of IPv6
      extension headers.

   Reference:  RFC 9740

4.  Information Elements for TCP Options

4.1.  tcpOptionsFull Information Element

   This section specifies a new IE to cover the full TCP options range.

   Name:  tcpOptionsFull

   ElementID:  520

   Description:  TCP options in packets of this Flow.  The information
      is encoded in a set of bit fields.  For each TCP option, there is
      a bit in this set.  The bit is set to 1 if any observed packet of
      this Flow contains the corresponding TCP option.  Otherwise, if no
      observed packet of this Flow contains the respective TCP option,
      the value of the corresponding bit is 0.

      Options are mapped to bits according to their option numbers.  TCP
      option Kind 0 corresponds to the least significant bit in the
      tcpOptionsFull IE, while Kind 255 corresponds to the most
      significant bit of the IE.  This approach allows an observer to
      export any observed TCP option even if it does not support that
      option and without requiring updating a mapping table.

      The value of tcpOptionsFull IE may be encoded in fewer octets per
      the guidelines in Section 6.2 of [RFC7011].

      The presence of tcpSharedOptionExID16List or
      tcpSharedOptionExID32List IEs is an indication that a shared TCP
      option (Kind=253 or 254) is observed in a Flow.  The presence of
      tcpSharedOptionExID16List or tcpSharedOptionExID32List IEs takes
      precedence over setting the corresponding bits in the
      tcpOptionsFull IE for the same Flow.  In order to optimize the use
      of the reduced-size encoding in the presence of
      tcpSharedOptionExID16List or tcpSharedOptionExID32List IEs, the
      Exporter MUST NOT set to 1 the shared TCP options (Kind=253 or
      254) of the tcpOptionsFull IE that is reported for the same Flow.

   Abstract Data Type:  unsigned256

   Data Type Semantics:  flags

   Additional Information:  See the "TCP Option Kind Numbers" registry
      at [IANA-TCP].

      See [RFC9293] for the general definition of TCP options.

      The tcpOptionsFull IE deprecates the tcpOptions IE (209) that was
      initially defined in [RFC5102].

      [RFC7012] obsoletes [RFC5102] and specifies that [IANA-IPFIX] is
      the normative reference for the tcpOptions IE (209).

   Reference:  RFC 9740

4.2.  tcpSharedOptionExID16 Information Element

   Name:  tcpSharedOptionExID16

   ElementID:  521

   Description:  Reports an observed 2-byte ExID in a shared TCP option
      (Kind=253 or 254) in a Flow.

      A basicList of tcpSharedOptionExID16 is used to report
      tcpSharedOptionExID16List values.

   Abstract Data Type:  unsigned16

   Data Type Semantics:  identifier

   Additional Information:  See the "TCP Experimental Option Experiment
      Identifiers (TCP ExIDs)" registry at [IANA-TCP-ExIDs].

      See [RFC9293] for the general definition of TCP options.

      See [RFC6994] for the shared use of experimental TCP Options.

   Reference:  RFC 9740

4.3.  tcpSharedOptionExID32 Information Element

   Name:  tcpSharedOptionExID32

   ElementID:  522

   Description:  Reports an observed 4-byte ExID in a shared TCP option
      (Kind=253 or 254) in a Flow.

      A basicList of tcpSharedOptionExID32 is used to report
      tcpSharedOptionExID32List values.

   Abstract Data Type:  unsigned32

   Data Type Semantics:  identifier

   Additional Information:  See the "TCP Experimental Option Experiment
      Identifiers (TCP ExIDs)" registry at [IANA-TCP-ExIDs].

      See [RFC9293] for the general definition of TCP options.

      See [RFC6994] for the shared use of experimental TCP Options.

   Reference:  RFC 9740

4.4.  tcpSharedOptionExID16List Information Element

   Name:  tcpSharedOptionExID16List

   ElementID:  523

   Description:  Reports observed 2-byte ExIDs in shared TCP options
      (Kind=253 or 254) in a Flow.

      A basicList of tcpSharedOptionExID16 IEs in which each
      tcpSharedOptionExID16 IE carries an observed 2-byte ExID in a
      shared option.

   Abstract Data Type:  basicList

   Data Type Semantics:  list

   Additional Information:  See the "TCP Experimental Option Experiment
      Identifiers (TCP ExIDs)" registry at [IANA-TCP-ExIDs].

      See [RFC9293] for the general definition of TCP options.

      See [RFC6994] for the shared use of experimental TCP Options.

   Reference:  RFC 9740

4.5.  tcpSharedOptionExID32List Information Element

   Name:  tcpSharedOptionExID32List

   ElementID:  524

   Description:  Reports observed 4-byte ExIDs in shared TCP options
      (Kind=253 or 254) in a Flow.

      A basicList of tcpSharedOptionExID32 IEs in which each
      tcpSharedOptionExID32 IE carries an observed 4-byte ExID in a
      shared option.

   Abstract Data Type:  basicList

   Data Type Semantics:  list

   Additional Information:  See the "TCP Experimental Option Experiment
      Identifiers (TCP ExIDs)" registry at [IANA-TCP-ExIDs].

      See [RFC9293] for the general definition of TCP options.

      See [RFC6994] for the shared use of experimental TCP Options.

   Reference:  RFC 9740

5.  Implementation and Operational Considerations

   Implementations of tcpSharedOptionExID16, tcpSharedOptionExID32,
   tcpSharedOptionExID16List, and tcpSharedOptionExID32List IEs are
   assumed to be provided with a list of valid ExIDs [IANA-TCP-ExIDs].
   How that list is maintained is implementation-specific.  Absent that
   list, an implementation can't autonomously determine whether an ExID
   is present and, if so, whether its length is 2 or 4 bytes.

   If a TCP Flow contains packets with a mix of 2-byte and 4-byte ExIDs,
   the same Template Record is used with both tcpSharedOptionExID16 and
   tcpSharedOptionExID32 IEs.

6.  Examples

   This section provides a few examples to illustrate the use of some
   IEs defined in this document.

6.1.  IPv6 Extension Headers

   Figure 1 provides an example of EH/bit mappings in an
   ipv6ExtensionHeadersFull IE for an IPv6 Flow in which only the IPv6
   Destination Options (0) header is observed.  The bits are set
   following the table provided in Section 8.4.1.

       MSB                                                      LSB
                            1                          25
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 ... 8 9 0 1 2 3 4 5
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+...+-+-+-+-+-+-+-+-+
       |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|   |0|0|0|0|0|0|0|1|
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+...+-+-+-+-+-+-+-+-+

                Figure 1: Example of EH/Bit Mappings in the
                        ipv6ExtensionHeadersFull IE

   The leading zeros are dropped per the reduced-size encoding guidance.
   One octet is thus sufficient to send these observed options on the
   wire.  Concretely, the ipv6ExtensionHeadersFull IE will be set to
   0x01 (Figure 2).

                             MSB           LSB
                              0 1 2 3 4 5 6 7
                             +-+-+-+-+-+-+-+-+
                             |0|0|0|0|0|0|0|1|
                             +-+-+-+-+-+-+-+-+

      Figure 2: Example A of ipv6ExtensionHeadersFull IE with Reduced-
                               Size Encoding

   Figure 3 provides another example of reported values in an
   ipv6ExtensionHeadersFull IE for an IPv6 Flow in which the Destination
   Options (0), IPv6 Hop-by-Hop Options (1), and Routing (5) headers are
   observed.  One octet is sufficient to report these observed options.
   Concretely, the ipv6ExtensionHeadersFull IE will be set to 0x23.

                             MSB           LSB
                              0 1 2 3 4 5 6 7
                             +-+-+-+-+-+-+-+-+
                             |0|0|1|0|0|0|1|1|
                             +-+-+-+-+-+-+-+-+

      Figure 3: Example B of ipv6ExtensionHeadersFull IE with Reduced-
                               Size Encoding

   Let us now consider an IPv6 Flow in which the following EH chain is
   observed: Routing (5), Mobility (7), and Authentication (9) header.
   Figure 4 shows the ipv6ExtensionHeadersFull IE (0x02A0) to report
   this individual chain.

                     MSB                          LSB
                                          1
                      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
                     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                     |0|0|0|0|0|0|1|0|1|0|1|0|0|0|0|0|
                     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      Figure 4: Example of ipv6ExtensionHeadersFull IE Reported for an
                           Extension Header Chain

6.2.  TCP Options

6.2.1.  Reduced-Size Encoding

   Given TCP Kind allocation practices and the option mapping defined in
   Section 4.1, fewer octets are likely to be used for Flows with common
   TCP options.

   Figure 5 shows an example of Kind/bit mappings in a tcpOptionsFull IE
   for a TCP Flow in which End of Option List (0), Maximum Segment Size
   (2), and Window Scale (3) options are observed.

       MSB                                                      LSB
                            1                          25
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 ... 8 9 0 1 2 3 4 5
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+...+-+-+-+-+-+-+-+-+
       |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|   |0|0|0|0|1|1|0|1|
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+...+-+-+-+-+-+-+-+-+

            Figure 5: Example of TCP Options / Bit Mappings in a
                             tcpOptionsFull IE

   One octet is sufficient to report these observed options.
   Concretely, the tcpOptionsFull IE will be set to 0x0D (Figure 6).

                             MSB           LSB
                              0 1 2 3 4 5 6 7
                             +-+-+-+-+-+-+-+-+
                             |0|0|0|0|1|1|0|1|
                             +-+-+-+-+-+-+-+-+

     Figure 6: Example of tcpOptionsFull IE with Reduced-Size Encoding

6.2.2.  Shared Options

   Let us consider a TCP Flow in which shared options with ExIDs 0x0348
   (HOST_ID) [RFC7974], 0x454E (TCP-ENO) [RFC8547], and 0xE2D4C3D9
   (Shared Memory Communications over RDMA protocol) [RFC7609] are
   observed.  Figure 7 shows an excerpt of the Data Set encoding with a
   focus on the tcpSharedOptionExID16 and tcpSharedOptionExID32 IEs.
   The meaning of the fields is defined in [RFC6313].

      MSB                                                          LSB
      0                   1                   2                   3
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
     :                           ...                                 :
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     |      255      |        List Length = 9        |semantic=allof |
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     |tcpSharedOptionExID16 = 521    |         Field Length = 2      |
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     |              0x0348           |             0x454E            |
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     |      255      |        List Length = 9        |semantic=allof |
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     |tcpSharedOptionExID32 = 522    |         Field Length = 4      |
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     |                           0xE2D4C3D9                          |
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     :                           ...                                 :

                    Figure 7: Example of TCP Shared IEs

7.  Security Considerations

   IPFIX security considerations are discussed in Section 11 of
   [RFC7011].

   ipv6ExtensionHeadersChainLength and ipv6ExtensionHeadersLimit IEs can
   be exploited by an unauthorized observer as a means to deduce the
   processing capabilities of nodes.  Section 8 of [RFC7012] discusses
   the required measures to guarantee the integrity and confidentiality
   of the exported information.

   This document does not add new security considerations for exporting
   IEs other than those already discussed in Section 8 of [RFC7012].

8.  IANA Considerations

8.1.  Deprecate ipv6ExtensionHeaders and tcpOptions Information Elements

   IANA has updated the "IPFIX Information Elements" registry under the
   "IP Flow Information Export (IPFIX) Entities" registry group
   [IANA-IPFIX] as follows:

   *  The ipv6ExtensionHeaders IE (64) entry has been marked as
      deprecated in favor of the ipv6ExtensionHeadersFull IE defined in
      this document.  This note is echoed in the "Additional
      Information" of the ipv6ExtensionHeaders IE.

   *  The tcpOptions IE (209) entry has been marked as deprecated in
      favor of the tcpOptionsFull IE defined in this document.  This
      note is echoed in the "Additional Information" of the tcpOptions
      IE.

   *  The following has been added to the "Additional Information" of
      both the ipv6ExtensionHeaders and tcpOptions IEs:

      -  This Information Element was initially specified in [RFC5102].

      -  [RFC7012] has obsoleted [RFC5102] and specifies that
         [IANA-IPFIX] is the normative reference for this Information
         Element.

   Also, IANA has updated the reference of ipv6ExtensionHeaders IE (64)
   and tcpOptions IE (209) to point to this document.

8.2.  IPFIX Information Elements

   IANA has added the following new IPFIX IEs to the "IPFIX Information
   Elements" registry under the "IP Flow Information Export (IPFIX)
   Entities" registry group [IANA-IPFIX]:

    +===========+====================================+===============+
    | ElementID | Name                               | Specification |
    +===========+====================================+===============+
    | 513       | ipv6ExtensionHeaderType            | Section 3.1   |
    |           |                                    | of RFC 9740   |
    +-----------+------------------------------------+---------------+
    | 514       | ipv6ExtensionHeaderCount           | Section 3.2   |
    |           |                                    | of RFC 9740   |
    +-----------+------------------------------------+---------------+
    | 515       | ipv6ExtensionHeadersFull           | Section 3.3   |
    |           |                                    | of RFC 9740   |
    +-----------+------------------------------------+---------------+
    | 516       | ipv6ExtensionHeaderTypeCountList   | Section 3.4   |
    |           |                                    | of RFC 9740   |
    +-----------+------------------------------------+---------------+
    | 517       | ipv6ExtensionHeadersLimit          | Section 3.5   |
    |           |                                    | of RFC 9740   |
    +-----------+------------------------------------+---------------+
    | 518       | ipv6ExtensionHeadersChainLength    | Section 3.6   |
    |           |                                    | of RFC 9740   |
    +-----------+------------------------------------+---------------+
    | 519       | ipv6ExtensionHeaderChainLengthList | Section 3.7   |
    |           |                                    | of RFC 9740   |
    +-----------+------------------------------------+---------------+
    | 520       | tcpOptionsFull                     | Section 4.1   |
    |           |                                    | of RFC 9740   |
    +-----------+------------------------------------+---------------+
    | 521       | tcpSharedOptionExID16              | Section 4.2   |
    |           |                                    | of RFC 9740   |
    +-----------+------------------------------------+---------------+
    | 522       | tcpSharedOptionExID32              | Section 4.3   |
    |           |                                    | of RFC 9740   |
    +-----------+------------------------------------+---------------+
    | 523       | tcpSharedOptionExID16List          | Section 4.4   |
    |           |                                    | of RFC 9740   |
    +-----------+------------------------------------+---------------+
    | 524       | tcpSharedOptionExID32List          | Section 4.5   |
    |           |                                    | of RFC 9740   |
    +-----------+------------------------------------+---------------+

                 Table 1: New IPFIX Information Elements

8.3.  IPFIX Information Element Data Type

   IANA has added the following new abstract data type to the "IPFIX
   Information Element Data Types" registry under the "IP Flow
   Information Export (IPFIX) Entities" registry group [IANA-IPFIX]:

                    +=======+=============+===========+
                    | Value | Description | Reference |
                    +=======+=============+===========+
                    | 23    | unsigned256 | RFC 9740  |
                    +-------+-------------+-----------+

                       Table 2: New IPFIX Information
                             Element Data Type

8.3.1.  unsigned256

   The type "unsigned256" represents a non-negative integer value in the
   range of '0' to '2^256 - 1'.  Similar to Section 6.1.1 of [RFC7011],
   this type MUST be encoded using the default canonical format in
   network byte order.

   Reduced-size encoding (Section 6.2 of [RFC7011]) applies to this data
   type.  The reduction in size can be to any number of octets smaller
   than the unsigned256 type if the data value still fits, i.e., so that
   only leading zeros are dropped.

8.4.  IPFIX Registry for IPv6 Extension Headers

   IANA has created a new registry entitled "IPFIX ipv6ExtensionHeaders
   Bits" in the IANA IPFIX registry group [IANA-IPFIX].

   When a new code is assigned to an IPv6 EH in [IANA-EH], the next
   available free bit is selected by IANA for this EH from the "IPFIX
   ipv6ExtensionHeaders Bits" registry, and the registry is updated with
   the details that mirror the assigned EH.  The "Label" mirrors the
   "keyword" of an EH as indicated in [IANA-Protocols], while the
   "Protocol Number" mirrors the "Protocol Number" in [IANA-EH].  IANA
   has added the following note to [IANA-EH]:

      Note: When a new code is assigned to an IPv6 Extension Header, the
      next available free bit in [IANA-IPFIX-IPv6EH] is selected for
      this new Extension Header.  [IANA-IPFIX-IPv6EH] is updated
      accordingly.  Modifications to existing registrations must be
      mirrored in [IANA-IPFIX-IPv6EH].

   Otherwise, the registration policy for the registry is Expert Review
   (Section 4.5 of [RFC8126]).  See more details in Section 8.4.2.

8.4.1.  Initial Values

   The initial values of this registry are provided in Table 3.

    +=======+=======+==========+=========================+===========+
    | Bit   | Label | Protocol | Description             | Reference |
    |       |       | Number   |                         |           |
    +=======+=======+==========+=========================+===========+
    | 0     | DST   | 60       | Destination Options for | RFC 9740  |
    |       |       |          | IPv6                    |           |
    +-------+-------+----------+-------------------------+-----------+
    | 1     | HOP   | 0        | IPv6 Hop-by-Hop Options | RFC 9740  |
    +-------+-------+----------+-------------------------+-----------+
    | 2     | NoNxt | 59       | No Next Header for IPv6 | RFC 9740  |
    +-------+-------+----------+-------------------------+-----------+
    | 3     | UNK   |          | Unknown extension or    | RFC 9740  |
    |       |       |          | transport header        |           |
    +-------+-------+----------+-------------------------+-----------+
    | 4     | FRA0  | 44       | Fragment header - first | RFC 9740  |
    |       |       |          | fragment                |           |
    +-------+-------+----------+-------------------------+-----------+
    | 5     | RH    | 43       | Routing header          | RFC 9740  |
    +-------+-------+----------+-------------------------+-----------+
    | 6     | FRA1  | 44       | Fragmentation header -  | RFC 9740  |
    |       |       |          | not first fragment      |           |
    +-------+-------+----------+-------------------------+-----------+
    | 7     | MOB   | 135      | Mobility Header         | RFC 9740  |
    +-------+-------+----------+-------------------------+-----------+
    | 8     | ESP   | 50       | Encapsulating Security  | RFC 9740  |
    |       |       |          | Payload                 |           |
    +-------+-------+----------+-------------------------+-----------+
    | 9     | AH    | 51       | Authentication Header   | RFC 9740  |
    +-------+-------+----------+-------------------------+-----------+
    | 10    | HIP   | 139      | Host Identity Protocol  | RFC 9740  |
    +-------+-------+----------+-------------------------+-----------+
    | 11    | SHIM6 | 140      | Shim6 Protocol          | RFC 9740  |
    +-------+-------+----------+-------------------------+-----------+
    | 12    |       | 253      | Use for experimentation | RFC 9740  |
    |       |       |          | and testing             |           |
    +-------+-------+----------+-------------------------+-----------+
    | 13    |       | 254      | Use for experimentation | RFC 9740  |
    |       |       |          | and testing             |           |
    +-------+-------+----------+-------------------------+-----------+
    | 14 to |       |          | Unassigned              |           |
    | 255   |       |          |                         |           |
    +-------+-------+----------+-------------------------+-----------+

        Table 3: Initial Values of the "IPFIX ipv6ExtensionHeaders
                              Bits" Registry

8.4.2.  Guidelines for the Designated Experts

   It is suggested that multiple designated experts be appointed for
   registry change requests.

   Designated experts are solicited only for changes that are not
   covered by the automatic mirroring described above.  For example, a
   registration may request two bits for a new EH to cover specific
   behaviors or uses of that EH.

   Criteria that should be applied by the designated experts include
   determining whether the proposed registration duplicates existing
   entries, whether the exception to the automatic mirroring procedure
   is justified, and whether the registration description is clear and
   fits the purpose of this registry.

   Within the review period, the designated experts will either approve
   or deny the registration request, communicating this decision to the
   IANA.  Denials should include an explanation and, if applicable,
   suggestions as to how to make the request successful.

9.  References

9.1.  Normative References

   [IANA-EH]  IANA, "IPv6 Extension Header Types",
              <https://www.iana.org/assignments/ipv6-parameters>.

   [IANA-IPFIX]
              IANA, "IP Flow Information Export (IPFIX) Entities",
              <https://www.iana.org/assignments/ipfix>.

   [IANA-IPFIX-IPv6EH]
              IANA, "IPFIX ipv6ExtensionHeaders Bits",
              <https://www.iana.org/assignments/ipfix>.

   [IANA-Protocols]
              IANA, "Protocol Numbers",
              <https://www.iana.org/assignments/protocol-numbers>.

   [IANA-TCP] IANA, "TCP Option Kind Numbers",
              <https://www.iana.org/assignments/tcp-parameters>.

   [IANA-TCP-ExIDs]
              IANA, "TCP Experimental Option Experiment Identifiers (TCP
              ExIDs)",
              <https://www.iana.org/assignments/tcp-parameters>.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

   [RFC6313]  Claise, B., Dhandapani, G., Aitken, P., and S. Yates,
              "Export of Structured Data in IP Flow Information Export
              (IPFIX)", RFC 6313, DOI 10.17487/RFC6313, July 2011,
              <https://www.rfc-editor.org/info/rfc6313>.

   [RFC6994]  Touch, J., "Shared Use of Experimental TCP Options",
              RFC 6994, DOI 10.17487/RFC6994, August 2013,
              <https://www.rfc-editor.org/info/rfc6994>.

   [RFC7011]  Claise, B., Ed., Trammell, B., Ed., and P. Aitken,
              "Specification of the IP Flow Information Export (IPFIX)
              Protocol for the Exchange of Flow Information", STD 77,
              RFC 7011, DOI 10.17487/RFC7011, September 2013,
              <https://www.rfc-editor.org/info/rfc7011>.

   [RFC7012]  Claise, B., Ed. and B. Trammell, Ed., "Information Model
              for IP Flow Information Export (IPFIX)", RFC 7012,
              DOI 10.17487/RFC7012, September 2013,
              <https://www.rfc-editor.org/info/rfc7012>.

   [RFC8126]  Cotton, M., Leiba, B., and T. Narten, "Guidelines for
              Writing an IANA Considerations Section in RFCs", BCP 26,
              RFC 8126, DOI 10.17487/RFC8126, June 2017,
              <https://www.rfc-editor.org/info/rfc8126>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

   [RFC8200]  Deering, S. and R. Hinden, "Internet Protocol, Version 6
              (IPv6) Specification", STD 86, RFC 8200,
              DOI 10.17487/RFC8200, July 2017,
              <https://www.rfc-editor.org/info/rfc8200>.

   [RFC9293]  Eddy, W., Ed., "Transmission Control Protocol (TCP)",
              STD 7, RFC 9293, DOI 10.17487/RFC9293, August 2022,
              <https://www.rfc-editor.org/info/rfc9293>.

9.2.  Informative References

   [EH-LIMITS]
              Herbert, T., "Limits on Sending and Processing IPv6
              Extension Headers", Work in Progress, Internet-Draft,
              draft-ietf-6man-eh-limits-19, 27 February 2025,
              <https://datatracker.ietf.org/api/v1/doc/document/draft-
              ietf-6man-eh-limits/>.

   [RFC5102]  Quittek, J., Bryant, S., Claise, B., Aitken, P., and J.
              Meyer, "Information Model for IP Flow Information Export",
              RFC 5102, DOI 10.17487/RFC5102, January 2008,
              <https://www.rfc-editor.org/info/rfc5102>.

   [RFC7609]  Fox, M., Kassimis, C., and J. Stevens, "IBM's Shared
              Memory Communications over RDMA (SMC-R) Protocol",
              RFC 7609, DOI 10.17487/RFC7609, August 2015,
              <https://www.rfc-editor.org/info/rfc7609>.

   [RFC7872]  Gont, F., Linkova, J., Chown, T., and W. Liu,
              "Observations on the Dropping of Packets with IPv6
              Extension Headers in the Real World", RFC 7872,
              DOI 10.17487/RFC7872, June 2016,
              <https://www.rfc-editor.org/info/rfc7872>.

   [RFC7974]  Williams, B., Boucadair, M., and D. Wing, "An Experimental
              TCP Option for Host Identification", RFC 7974,
              DOI 10.17487/RFC7974, October 2016,
              <https://www.rfc-editor.org/info/rfc7974>.

   [RFC8547]  Bittau, A., Giffin, D., Handley, M., Mazieres, D., and E.
              Smith, "TCP-ENO: Encryption Negotiation Option", RFC 8547,
              DOI 10.17487/RFC8547, May 2019,
              <https://www.rfc-editor.org/info/rfc8547>.

   [RFC8883]  Herbert, T., "ICMPv6 Errors for Discarding Packets Due to
              Processing Limits", RFC 8883, DOI 10.17487/RFC8883,
              September 2020, <https://www.rfc-editor.org/info/rfc8883>.

   [RFC9098]  Gont, F., Hilliard, N., Doering, G., Kumari, W., Huston,
              G., and W. Liu, "Operational Implications of IPv6 Packets
              with Extension Headers", RFC 9098, DOI 10.17487/RFC9098,
              September 2021, <https://www.rfc-editor.org/info/rfc9098>.

Acknowledgments

   Thanks to Paul Aitken, Éric Vyncke, and Joe Touch for the reviews and
   comments.  Special thanks to Andrew Feren for sharing data about
   scans of IPFIX data he collected.

   Thanks to Wesley Eddy for the tsvart review, Yingzhen Qu for the
   opsdir review, Dirk Von Hugo for intdir review, Joel Halpern for the
   genart review, and Tero Kivinen for the secdir review.

   Thanks to Thomas Graf for the Shepherd review.

   Thanks to Mahesh Jethanandani for the AD review.

   Thanks to Éric Vyncke, Erik Kline, Roman Danyliw, and Zaheduzzaman
   Sarker for the IESG review.

Authors' Addresses

   Mohamed Boucadair
   Orange
   Email: mohamed.boucadair@orange.com


   Benoit Claise
   Huawei
   Email: benoit.claise@huawei.com
