opsawg M. Han, Ed. Internet-Draft Z. Ruan Intended status: Standards Track X. Gao Expires: 6 May 2027 China Unicom Q. Xiong ZTE Corporation 2 November 2026 Export of Microburst Information in IP Flow Information Export draft-han-opsawg-ipfix-microburst-00 Abstract A microburst is a phenomenon in which arriving traffic exceeds the service capacity of an egress interface within a short period of time, causing queue occupancy to rise rapidly. It may result in transient queuing and packet loss even when the average link utilization is low, and is therefore difficult to detect through low- frequency interface statistics. This document defines a set of IPFIX Information Elements for exporting aggregated microburst statistics per egress interface, egress queue, and measurement window. Network operators can use these statistics to identify interfaces and queues where microbursts occur frequently, and apply the results to capacity planning, QoS optimization, and the remediation of critical links. This document does not specify microburst detection algorithms, threshold selection methods, or remediation policies. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 6 May 2027. Han, et al. Expires 6 May 2027 [Page 1] Internet-Draft Export of Microburst Information in IPFI November 2026 Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Conventions and Definitions . . . . . . . . . . . . . . . . . 3 3. Microburst Definition . . . . . . . . . . . . . . . . . . . . 3 4. Measurement Model . . . . . . . . . . . . . . . . . . . . . . 3 4.1. Observation Point . . . . . . . . . . . . . . . . . . . . 3 4.2. Detection . . . . . . . . . . . . . . . . . . . . . . . . 4 4.3. Aggregation and Statistics . . . . . . . . . . . . . . . 4 5. IPFIX Information Elements . . . . . . . . . . . . . . . . . 4 5.1. Reused Information Elements . . . . . . . . . . . . . . . 4 5.2. Proposed New Information Elements . . . . . . . . . . . . 5 6. Data or Option Template . . . . . . . . . . . . . . . . . . . 5 7. Use Cases . . . . . . . . . . . . . . . . . . . . . . . . . . 5 7.1. Network Planning . . . . . . . . . . . . . . . . . . . . 5 7.2. Distributed Training and Inference Networks . . . . . . . 6 8. relationship to FANN . . . . . . . . . . . . . . . . . . . . 6 9. Security Considerations . . . . . . . . . . . . . . . . . . . 6 10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6 11. Normative References . . . . . . . . . . . . . . . . . . . . 6 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 7 1. Introduction A microburst is a phenomenon in which arriving traffic exceeds the service capacity of an egress interface within a short period of time, causing queue occupancy to rise rapidly. It may result in transient queuing and packet loss even when the average link utilization is low, and is therefore difficult to detect through low- frequency interface statistics. This document defines a set of IPFIX Information Elements for exporting aggregated microburst statistics per egress interface, egress queue, and measurement window. Network operators can use Han, et al. Expires 6 May 2027 [Page 2] Internet-Draft Export of Microburst Information in IPFI November 2026 these statistics to identify interfaces and queues where microbursts occur frequently, and apply the results to capacity planning, QoS optimization, and the remediation of critical links. This document does not specify microburst detection algorithms, threshold selection methods, or remediation policies. 2. Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. IPFIX terminology as defined in [RFC7011] is used in this document. 3. Microburst Definition A microburst is defined in this document as a condition in which, within a short period of time, the traffic arrival rate exceeds the service rate of an egress queue, causing the occupancy of that queue to reach a locally configured detection condition. A microburst may occur while the average link utilization remains within its normal operating range, and it may result in transient congestion, packet loss, increased latency, or jitter. See [I-D.ruan-lsr-isis-te-extensions-for-microburst] for related descriptions. The microburst described above does not necessarily result in network congestion; it may only cause the queue to be transiently filled. It may nevertheless indicate the occurrence of congestion, or a high probability that congestion will occur. 4. Measurement Model 4.1. Observation Point Microburst statistics are measured at the egress queue. A monitoring instance is identified by the Observation Domain ID carried in the IPFIX Message Header, together with the observationPointId, egressInterface, and egressQueueId Information Elements. Han, et al. Expires 6 May 2027 [Page 3] Internet-Draft Export of Microburst Information in IPFI November 2026 4.2. Detection A microburst is detected when, for a given egress queue, the queue occupancy reaches a locally configured condition. Common implementations use a queue buffer occupancy threshold (e.g., rising and falling thresholds expressed in octets or as a percentage of the buffer allocated to, or referenced by, the queue), where the rising threshold starts an event and the falling threshold ends the event. This document does not mandate any specific threshold, percentage, or buffer allocation model. 4.3. Aggregation and Statistics The Exporter aggregates statistics on the device side over a measurement window; The Exporter may identify events locally and derive, from them, the number of events within the window and the number of events with packet loss. 5. IPFIX Information Elements This document follows [RFC7013] and reuses existing Information Elements (IEs) where applicable. 5.1. Reused Information Elements +=====================================+========================+ | IE | Usage | +=====================================+========================+ | observationPointId (138) | Observation Point | +-------------------------------------+------------------------+ | egressInterface (14) | Egress interface | +-------------------------------------+------------------------+ | interfaceName (82) | Optional; provides the | | | interface name | +-------------------------------------+------------------------+ | monitoringIntervalStartMilliSeconds | Start time of the | | (359) | measurement window | +-------------------------------------+------------------------+ | monitoringIntervalEndMilliSeconds | End time of the | | (360) | measurement window | +-------------------------------------+------------------------+ | droppedPacketDeltaCount (133) | Congestion-related | | | packet loss within the | | | measurement window | +-------------------------------------+------------------------+ Table 1 Han, et al. Expires 6 May 2027 [Page 4] Internet-Draft Export of Microburst Information in IPFI November 2026 The Observation Domain ID is carried in the IPFIX Message Header and need not be repeated in the record. The measurement window is represented by monitoringIntervalStartMilliSeconds and monitoringIntervalEndMilliSeconds. 5.2. Proposed New Information Elements Counter values represent increments within the corresponding measurement window. +===============================+==============================+ | Name | Definition | +===============================+==============================+ | egressQueueId | Device-local queue | | | identifier on the egress | | | interface | +-------------------------------+------------------------------+ | microburstEventDeltaCount | Number of microburst events | | | detected within the | | | measurement window | +-------------------------------+------------------------------+ | microburstLossEventDeltaCount | Number of microburst events | | | within the measurement | | | window during which at least | | | one congestion-related | | | packet loss occurred | +-------------------------------+------------------------------+ Table 2 6. Data or Option Template TBD 7. Use Cases 7.1. Network Planning * Identify interfaces and queues where microburst events or associated packet loss are frequent despite low average utilization; * Combine microburst statistics with average utilization, queue loss, and traffic growth trends to evaluate capacity expansion, ECMP, or QoS adjustment requirements; * Use long-term aggregated statistics to determine the links and queues that require focused attention. Han, et al. Expires 6 May 2027 [Page 5] Internet-Draft Export of Microburst Information in IPFI November 2026 7.2. Distributed Training and Inference Networks * Correlate periodic microbursts with training job time windows to analyze their relationship with collective communication performance; * Identify the upstream interfaces and queues where microbursts are concentrated; * Analyze microburst statistics together with PFC, ECN, and queue loss data [I-D.ietf-opsawg-ipfix-ecn]. 8. relationship to FANN FANN addresses forwarding-plane event notification at millisecond time scales to trigger reactions; this document addresses management- plane aggregated statistics export at second time scales for analysis and planning [I-D.ietf-fann-problem-statement]. The two are complementary. 9. Security Considerations TBD 10. IANA Considerations TBD 11. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC7011] Claise, B., Ed., Trammell, B., Ed., and P. Aitken, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information", STD 77, RFC 7011, DOI 10.17487/RFC7011, September 2013, . Han, et al. Expires 6 May 2027 [Page 6] Internet-Draft Export of Microburst Information in IPFI November 2026 [RFC7013] Trammell, B. and B. Claise, "Guidelines for Authors and Reviewers of IP Flow Information Export (IPFIX) Information Elements", BCP 184, RFC 7013, DOI 10.17487/RFC7013, September 2013, . [I-D.ruan-lsr-isis-te-extensions-for-microburst] Ruan, Z., Han, M., Huang, H., and R. Pang, "IS-IS Traffic Engineering Extensions For Microburst", Work in Progress, Internet-Draft, draft-ruan-lsr-isis-te-extensions-for- microburst-01, 19 July 2026, . [I-D.ietf-fann-problem-statement] Dong, J., McBride, M., Clad, F., Zhang, Z. J., Zhu, Y., Xu, X., Zhuang, R., Pang, R., Lu, H., Liu, Y., Contreras, L. M., Mehmet, D., and R. Rahman, "Fast Network Notifications Problem Statement", Work in Progress, Internet-Draft, draft-ietf-fann-problem-statement-01, 26 October 2026, . [I-D.ietf-opsawg-ipfix-ecn] Song, X., Moeller, S., Liu, Y., Newton, J., and J. Livingood, "Export of ECN Information in IPFIX", Work in Progress, Internet-Draft, draft-ietf-opsawg-ipfix-ecn-01, 30 October 2026, . Authors' Addresses Mengyao Han (editor) China Unicom Beijing China Email: hanmy12@chinaunicom.cn Zheng Ruan China Unicom Beijing China Email: ruanz6@chinaunicom.cn Han, et al. Expires 6 May 2027 [Page 7] Internet-Draft Export of Microburst Information in IPFI November 2026 Xing Gao China Unicom Beijing China Email: gaox60@chinaunicom.cn Quan Xiong ZTE Corporation Beijing China Email: xiong.quan@zte.com.cn Han, et al. Expires 6 May 2027 [Page 8]