Operations D. Voyer Internet-Draft S. Gopalakrishnan Intended status: Standards Track Cisco Systems Expires: 6 May 2027 T. Graf Swisscom V. Satyanarayana HPE C. Staicu Bell Canada 2 November 2026 Export of GTP-U Information in IP Flow Information Export (IPFIX) draft-ietf-opsawg-ipfix-gtpu-19 Abstract This document specifies IP Flow Information Export (IPFIX) Information Elements to report information contained in the Generic Packet Radio Service Tunneling Protocol (GTP) User Plane header such as Tunnel Endpoint Identifier, and data contained in its session container extension header. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 6 May 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Voyer, et al. Expires 6 May 2027 [Page 1] Internet-Draft IPFIX support for GTP-U November 2026 Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. IPFIX GTP-U Information Elements . . . . . . . . . . . . . . 3 4. Sample Use Cases . . . . . . . . . . . . . . . . . . . . . . 5 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6 5.1. gtpuFlags . . . . . . . . . . . . . . . . . . . . . . . . 8 5.2. gtpuMsgType . . . . . . . . . . . . . . . . . . . . . . . 9 5.3. gtpuTEid . . . . . . . . . . . . . . . . . . . . . . . . 9 5.4. gtpuSequenceNum . . . . . . . . . . . . . . . . . . . . . 10 5.5. gtpuQFI . . . . . . . . . . . . . . . . . . . . . . . . . 10 5.6. gtpuPduType . . . . . . . . . . . . . . . . . . . . . . . 12 5.7. gtpuTotalHdrLength . . . . . . . . . . . . . . . . . . . 13 5.8. gtpuHeaderSection . . . . . . . . . . . . . . . . . . . . 13 6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 13 7. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 14 8. Implementation Status . . . . . . . . . . . . . . . . . . . . 14 8.1. Cisco IOS XR . . . . . . . . . . . . . . . . . . . . . . 14 9. Security Considerations . . . . . . . . . . . . . . . . . . . 14 10. Operational Considerations . . . . . . . . . . . . . . . . . 15 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 15 11.1. Normative References . . . . . . . . . . . . . . . . . . 15 11.2. Informative References . . . . . . . . . . . . . . . . . 16 Appendix A. IPFIX Encoding Examples . . . . . . . . . . . . . . 17 A.1. Template Record . . . . . . . . . . . . . . . . . . . . . 17 A.1.1. Template Record and Data Set . . . . . . . . . . . . 17 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 19 1. Introduction A dedicated header, called GPRS Tunneling Protocol (GTP) Header, is defined by 3GPP for the GTP User Plane (GTP-U) [TS.29281] traffic of mobile subscribers. This document specifies eight IPFIX Information Elements (IEs) [RFC7012] to export GTP-U information. Specifically, these IEs are used to export the GTP-U Tunnel Endpoint Identifier (TEID), QoS Flow Identifier (QFI), and PDU Type from the PDU Session Container extension header. Voyer, et al. Expires 6 May 2027 [Page 2] Internet-Draft IPFIX support for GTP-U November 2026 Some examples are provided in Appendix A. 2. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. This document makes use of the terms defined in [RFC7011] * IPFIX * IPFIX Information Element * Template * Template Record * Data Record * Data Set This document uses the term "User Plane" as used by 3GPP GTP-U in [TS.29281] and the term "Uplink Classifier" as used in [TS.23501]. The document uses the following abbreviations: * IE: Information Element * GTP: GPRS Tunneling Protocol * GTP-U: GTP User Plane * PDU: Protocol Data Unit * TEID: Tunnel Endpoint Identifier * UPF: User Plane Function * QFI: QoS Flow Identifier 3. IPFIX GTP-U Information Elements This section defines IPFIX IEs corresponding to various fields in the GTP-U header. The GTP-U header includes a mandatory header and optional fields and extension headers. Voyer, et al. Expires 6 May 2027 [Page 3] Internet-Draft IPFIX support for GTP-U November 2026 gtpuFlags 8-bit flags field indicating the version of GTP-U header, protocol type, and presence of extension header, sequence number and N-PDU number defined in Section 5.1 of the 3GPP specification [TS.29281]. The bits are exported as observed. gtpuMsgType 8-bit field which indicates the type of the GTP-U message as mentioned in Section 5.1 of the 3GPP specification [TS.29281]. gtpuTEid 32-bit tunnel endpoint identifier field defined in Section 5.1 of the 3GPP specification [TS.29281]. This field unambiguously identifies a tunnel endpoint in the receiving GTP-U protocol entity for a given UDP/IP endpoint. gtpuSequenceNum 16-bit sequence number field defined in Section 5.1 of the 3GPP specification [TS.29281]. This field is interpreted based on the sequence number flag value from gtpuFlags. The sequence number is meaningful only when the S (Sequence Number) flag in the observed GTP-U header is set to 1. When the S flag is set to 0, the Exporting Process MUST export a value of zero for this IE if it is included in the Template. The Collecting Process MUST interpret the sequence number only when the S flag is set to 1. gtpuQFI 6-bit QoS flow identifier field defined in PDU Session Container extension header of GTP-U [TS.29281]. This may be used to determine the QoS flow and QoS profile which are associated with the received packet. The E (Extension Header) bit in the gtpuFlags IE indicates the presence of extension headers but does not necessarily indicate the presence of a PDU Session Container extension header. The Exporting Process MUST parse the GTP-U extension-header chain to locate a valid PDU Session Container extension header before exporting a meaningful value for this Information Element. When the Exporting Process cannot identify a valid PDU Session Container extension header in the observed GTP-U header, it MUST export a value of zero for this IE if it is included in the Template. The two most significant bits MUST be exported as zero and MUST be ignored on receipt. gtpuPduType 4-bit PDU type field defined in PDU Session Container extension header of GTP-U [TS.29281]. This field indicates the structure of the PDU session user plane frame. The E (Extension Header) bit in the gtpuFlags IE indicates the presence of extension headers but does not necessarily indicate the presence of a PDU Session Voyer, et al. Expires 6 May 2027 [Page 4] Internet-Draft IPFIX support for GTP-U November 2026 Container extension header. The Exporting Process MUST parse the GTP-U extension-header chain to locate a valid PDU Session Container extension header before exporting a meaningful value for this Information Element. When the Exporting Process cannot identify a valid PDU Session Container extension header in the observed GTP-U header, it MUST export a value of zero for this IE if it is included in the Template. The four most significant bits MUST be exported as zero and MUST be ignored on receipt. gtpuTotalHdrLength 16-bit field indicating the total length in octets of the observed GTP-U header, including the mandatory 8-octet header and any optional fields and extension headers as defined in Sections 5.1 and 5.2 of the 3GPP specification [TS.29281]. This IE is computed from the observed packet header and does not export the GTP-U Length field defined in Section 5.1 of [TS.29281]. gtpuHeaderSection This Information Element carries the complete observed GTP-U header as a contiguous sequence of n octets, beginning at the first octet of the mandatory header and including all optional fields and extension headers, if present, as defined in Sections 5.1 and 5.2 of the 3GPP specification [TS.29281]. 4. Sample Use Cases The GTP-U related IPFIX IEs are helpful in order to identify the transport performance of PDU Sessions, e.g., with specific QoS class within a network slice (refer to [RFC9889]) or within a group of network slices hosted on the same User Plane Function (UPF). For example, when a set of UPFs are deployed per 5G slice, the slice is identified first using a list of gNB (refer to section 4 of [TS.38300]) IP addresses composing the slice and a list of IP addresses of UPFs dedicated for the slice. The gNB and the UPF form the tunnel endpoints. The traffic for each individual PDU Session per direction is identified using the GTP-U TEID, GTP-U PDU Type together with the above mentioned GTP-U tunnel endpoints. Furthermore, the traffic for a specific QoS class within a PDU Session per traffic direction is identified using the combination of GTP-U TEID, GTP-U PDU Type, and GTP-U QFI attributes. It is possible that for a single PDU session there might be multiple IP flows with different GTP-U QFI but with same GTP-U TEID. In another scenario when multiple 5G slices share the same UPF, each slice is identified using a separated list of gNB IPv4 or IPv6 addresses per slice. If an Uplink Classifier (refer to section 5.6.4.2 of [TS.23501]) is deployed there is an addition of a GTP-U Voyer, et al. Expires 6 May 2027 [Page 5] Internet-Draft IPFIX support for GTP-U November 2026 tunnel between the Intermediate/Uplink-Classifier UPF and the final UPF. This brings a challenge for identifying the end-to-end path for a certain PDU Session - the GTP-U PDU Type and GTP-U QFI attributes from the gNB and Intermediate/Uplink-Classifier UPF tunnel will be the same on the Intermediate/Uplink-Classifier and final UPF tunnels, however the GTP-U TEIDs will be different on each tunnel. The use of the IPFIX GTP-U IEs is to identify either a particular PDU Session on a particular slice (using GTP-U TEID in combination with the gNB and the UPF IP addresses) or all the IP traffic flows for a 3GPP QoS flow on a slice (using GTP-U QFI in combination with the gNB and the UPF IP addresses) or a 3GPP QoS flow for a particular PDU Session on a slice (using both GTP-U TEID and GTP-U QFI in combination with the gNB and UPF IP addresses). Additionally, exporting GTP-U IEs together with the transportChecksum IE 503 registered in the IANA IPFIX registry [IANA-IPFIX] can help identify GTP-U endpoints that transmit UDP packets with a zero checksum over IPv6. As specified in [TS.29281], UDP zero-checksum operation is permitted only when the peer GTP-U endpoint and the path between the endpoints support it. Such packets may otherwise be discarded by the receiving endpoint or intermediate IPv6 devices. The exported information can help operators identify the affected GTP-U traffic and investigate potential interoperability issues. 5. IANA Considerations IANA has registered the following IEs in the "IPFIX Information Elements" registry available at [IANA-IPFIX]. Table 1 lists the GTP-U IEs: Voyer, et al. Expires 6 May 2027 [Page 6] Internet-Draft IPFIX support for GTP-U November 2026 +-------+-------------------+ |Element| Name | | | | | ID | | | | | +-------+-------------------+ | 505 | gtpuFlags | | | | +-------+-------------------+ | 506 | gtpuMsgType | | | | +-------+-------------------+ | 507 | gtpuTEid | | | | +-------+-------------------+ | 508 | gtpuSequenceNum | | | | +-------+-------------------+ | 509 | gtpuQFI | | | | +-------+-------------------+ | 510 | gtpuPduType | | | | +-------+-------------------+ Table 1: GTP-U IEs in the "IPFIX Information Elements" Registry Table 2 lists the GTP-U IEs to be registered: +-------+-------------------+ |Element| Name | | | | | ID | | | | | +-------+-------------------+ | TBD1 | gtpuTotalHdrLength| | | | +-------+-------------------+ | TBD2 | gtpuHeaderSection | | | | +-------+-------------------+ Table 2: GTP-U IEs to be registered in the "IPFIX Information Elements" Registry Voyer, et al. Expires 6 May 2027 [Page 7] Internet-Draft IPFIX support for GTP-U November 2026 IANA is requested to update the references for the existing GTP-U Information Elements listed in Table 1 to point to this RFC and update their descriptions. IANA is also requested to allocate two new Information Element IDs listed in Table 2 for gtpuTotalHdrLength and gtpuHeaderSection in the "IPFIX Information Elements" registry. 5.1. gtpuFlags Name: gtpuFlags ElementID: 505 Description: 8-bit flags field indicating the version of GTP-U header, protocol type, and presence of extension header, sequence number and N-PDU number defined in Section 5.1 of the 3GPP specification [TS.29281]. The bits are exported as observed. The basic encoding is 8 bits. The layout of the encoding is as follows: MSB - 0 1 2 3 4 5 6 7 - LSB +----+----+----+----+----+----+----+----+ | Version | PT | * | E | S | PN | +----+----+----+----+----+----+----+----+ Version is the 3-bit GTP-U protocol version field defined in Section 5.1 of the 3GPP specification [TS.29281] PT means Protocol Type Flag E means Extension Header Flag S means Sequence Number Flag PN means N-PDU Number Flag (*) indicates the spare bit in the GTP-U header defined in Section 5.1 of the 3GPP specification [TS.29281]. Examples: value : 0x34 binary: 00110100 decode: Version=1, PT=1, spare=0, E=1, S=0, PN=0 Voyer, et al. Expires 6 May 2027 [Page 8] Internet-Draft IPFIX support for GTP-U November 2026 value : 0x36 binary: 00110110 decode: Version=1, PT=1, spare=0, E=1, S=1, PN=0 Abstract Data Type: unsigned8 Data Type Semantics: flags Additional Information: Refer to Section 5.1 of [TS.29281]. Reference: [RFC-to-be] 5.2. gtpuMsgType Name: gtpuMsgType ElementID: 506 Description: 8-bit field which indicates the type of the GTP-U message as mentioned in Section 5.1 of the 3GPP specification [TS.29281]. Abstract Data Type: unsigned8 Data Type Semantics: identifier Additional Information: Refer to Section 5.1 of the 3GPP specification [TS.29281]. Reference: [RFC-to-be] 5.3. gtpuTEid Name: gtpuTEid ElementID: 507 Description: 32-bit tunnel endpoint identifier field defined in Section 5.1 of the 3GPP specification [TS.29281]. This field unambiguously identifies a tunnel endpoint in the receiving GTP-U protocol entity for a given UDP/IP endpoint. Abstract Data Type: unsigned32 Data Type Semantics: identifier Voyer, et al. Expires 6 May 2027 [Page 9] Internet-Draft IPFIX support for GTP-U November 2026 Additional Information: Refer to Section 5.1 of the 3GPP specification [TS.29281]. Reference: [RFC-to-be] 5.4. gtpuSequenceNum Name: gtpuSequenceNum ElementID: 508 Description: 16-bit sequence number field defined in Section 5.1 of the 3GPP specification [TS.29281]. This field is interpreted based on the sequence number flag value from gtpuFlags. The sequence number is meaningful only when the S (Sequence Number) flag in the observed GTP-U header is set to 1. When the S flag is set to 0, the Exporting Process MUST export a value of zero for this IE if it is included in the Template. The Collecting Process MUST interpret the sequence number only when the S flag is set to 1. Abstract Data Type: unsigned16 Data Type Semantics: identifier Additional Information: Refer to Section 5.1 of the 3GPP specification [TS.29281]. Reference: [RFC-to-be] 5.5. gtpuQFI Name: gtpuQFI ElementID: 509 Description: 6-bit QoS flow identifier field defined in PDU Session Voyer, et al. Expires 6 May 2027 [Page 10] Internet-Draft IPFIX support for GTP-U November 2026 Container extension header of GTP-U [TS.29281]. This may be used to determine the QoS flow and QoS profile which are associated with the received packet. The E (Extension Header) bit in the gtpuFlags IE indicates the presence of extension headers but does not necessarily indicate the presence of a PDU Session Container extension header. The Exporting Process MUST parse the GTP-U extension-header chain to locate a valid PDU Session Container extension header before exporting a meaningful value for this Information Element. When the Exporting Process cannot identify a valid PDU Session Container extension header in the observed GTP-U header, it MUST export a value of zero for this IE if it is included in the Template. The two most significant bits MUST be exported as zero and MUST be ignored on receipt. The basic encoding is 8 bits. The layout of basic encoding is as follows: MSB - 0 1 2 3 4 5 6 7 - LSB +----+----+----+----+----+----+----+----+ | 0 | 6 bit QFI value | +----+----+----+----+----+----+----+----+ Examples: value : 0x08 binary: 00001000 decode: 001000 - QFI value value : 0x3e binary: 00111110 decode: 111110 - QFI value Abstract Data Type: unsigned8 Data Type Semantics: identifier Additional Information: Refer to Section 5.5.3.3 of the 3GPP specification [TS.38415] and Section 5.7.1.1 of the 3GPP specification [TS.23501]. Reference: [RFC-to-be] Voyer, et al. Expires 6 May 2027 [Page 11] Internet-Draft IPFIX support for GTP-U November 2026 5.6. gtpuPduType Name: gtpuPduType ElementID: 510 Description: 4-bit PDU type field defined in PDU Session Container extension header of GTP-U [TS.29281]. This field indicates the structure of the PDU session user plane frame. The E (Extension Header) bit in the gtpuFlags IE indicates the presence of extension headers but does not necessarily indicate the presence of a PDU Session Container extension header. The Exporting Process MUST parse the GTP-U extension-header chain to locate a valid PDU Session Container extension header before exporting a meaningful value for this Information Element. When the Exporting Process cannot identify a valid PDU Session Container extension header in the observed GTP-U header, it MUST export a value of zero for this IE if it is included in the Template. The four most significant bits MUST be exported as zero and MUST be ignored on receipt. The basic encoding is 8 bits. The layout of basic encoding is as follows: MSB - 0 1 2 3 4 5 6 7 - LSB +----+----+----+----+----+----+----+----+ | 0 | 4 bit PDU Type | +----+----+----+----+----+----+----+----+ Example: value : 0x01 binary: 00000001 decode: 0001 - PDU Type value Abstract Data Type: unsigned8 Data Type Semantics: identifier Additional Information: Refer to Section 5.5.3 of the 3GPP specification [TS.38415]. Reference: [RFC-to-be] Voyer, et al. Expires 6 May 2027 [Page 12] Internet-Draft IPFIX support for GTP-U November 2026 5.7. gtpuTotalHdrLength Name: gtpuTotalHdrLength ElementID: TBD1 Description: 16-bit field indicating the total length in octets of the observed GTP-U header, including the mandatory 8-octet header and any optional fields and extension headers as defined in Sections 5.1 and 5.2 of the 3GPP specification [TS.29281]. This IE is computed from the observed packet header and does not export the GTP-U Length field defined in Section 5.1 of [TS.29281]. Abstract Data Type: unsigned16 Data Type Semantics: quantity Additional Information: Refer to Sections 5.1 and 5.2 of [TS.29281]. Reference: [RFC-to-be] 5.8. gtpuHeaderSection Name: gtpuHeaderSection ElementID: TBD2 Description: This Information Element carries the complete observed GTP-U header as a contiguous sequence of n octets, beginning at the first octet of the mandatory header and including all optional fields and extension headers, if present, as defined in Sections 5.1 and 5.2 of the 3GPP specification [TS.29281]. Abstract Data Type: octetArray Data Type Semantics: default Additional Information: Refer to Section 5 of [TS.29281]. Reference: [RFC-to-be] 6. Acknowledgements The authors would like to thank Benoit Claise, Ketan Talaulikar, Dhananjay Patki, Paul Aitken, Shraddha Hegde, Chongfeng Liu, and Mahesh Jethanandani for their reviews and valuable comments. Voyer, et al. Expires 6 May 2027 [Page 13] Internet-Draft IPFIX support for GTP-U November 2026 7. Contributors Kandhla Chandi Bell Canada Email: kandhla.chandi@bell.ca Ralu Johny Cisco Email: rjohny@cisco.com 8. Implementation Status Note to the RFC-Editor: Please remove this section before publishing. 8.1. Cisco IOS XR Cisco implemented the following IEs as part of a test implementation in the IOS XR platform. This implementation currently covers six of the eight IEs defined in this document; it does not yet cover gtpuTotalHdrLength or gtpuHeaderSection: * gtpuFlags * gtpuMsgType * gtpuTEid * gtpuSequenceNum * gtpuQFI * gtpuPduType 9. Security Considerations The IEs described in this document export GTP user plane information about packet forwarding in a 3GPP network. In particular, TEIDs, QFIs, PDU types, and GTP-U header sections can enable correlation of traffic with individual PDU sessions and, depending on deployment, with subscriber activity. Implementations and operators therefore MUST treat this data as sensitive network telemetry data. Applications and operators using the IEs specified in this document MUST evaluate the sensitivity of this information in their deployment context, and apply the data-at-rest storage guidance in Section 11.8 of [RFC7011] as appropriate. Voyer, et al. Expires 6 May 2027 [Page 14] Internet-Draft IPFIX support for GTP-U November 2026 Operators MUST restrict access to these exported IEs, apply retention limits appropriate to sensitive operational telemetry, and MUST NOT export gtpuHeaderSection unless required by the operational use case. An Exporting Process MUST NOT include octets beyond the observed GTP-U header in gtpuHeaderSection. Exporting Processes and Collecting Processes that exchange the Information Elements defined in this document SHOULD use the secure transport mechanisms specified in Section 11 of [RFC7011] to provide confidentiality, integrity, and peer authentication, particularly when exporting gtpuHeaderSection. 10. Operational Considerations The IPFIX IEs defined in this document require extraction of fields from packets. There may exist older devices in the network that do not support extensions defined in this document. For those devices [RFC7133] defines dataLinkFrameSection which is a useful mechanism to export the packet header as a fallback scenario. However, when dataLinkFrameSection is used, Flow aggregation as per [RFC7015] can't be applied. This document will serve as a guideline to extract the necessary fields from the GTP-U header for the above scenarios. When 3GPP specifications indicate that a GTP-U field is not to be interpreted, an Exporting Process can use a Template that omits the corresponding IE. If the IE is included in the Template, the Exporting Process follows the rules specified in the corresponding IE definition for representing values that are not meaningful. When gtpuQFI or gtpuPduType is exported with a value of zero, the Collecting Process cannot determine solely from that value or the E flag whether the PDU Session Container extension header was present. Applications requiring this distinction need additional information, such as the observed GTP-U header exported using gtpuHeaderSection. 11. References 11.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . Voyer, et al. Expires 6 May 2027 [Page 15] Internet-Draft IPFIX support for GTP-U November 2026 [RFC7011] Claise, B., Ed., Trammell, B., Ed., and P. Aitken, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information", STD 77, RFC 7011, DOI 10.17487/RFC7011, September 2013, . [RFC7012] Claise, B., Ed. and B. Trammell, Ed., "Information Model for IP Flow Information Export (IPFIX)", RFC 7012, DOI 10.17487/RFC7012, September 2013, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [TS.23501] 3GPP, "5G; System architecture for the 5G System (5GS)", Version 17.11.0, 3GPP TS 23.501, January 2024. [TS.29281] 3GPP, "General Packet Radio System (GPRS) Tunnelling Protocol User Plane (GTPv1-U)", Version 17.4.0, 3GPP TS 29.281, October 2022. [TS.38300] 3GPP, "NR; NR and NG-RAN Overall description; Stage-2", Version 17.11.0, 3GPP TS 38.300, January 2025. [TS.38415] 3GPP, "NG-RAN; PDU Session User Plane Protocol", Version 17.1.0, 3GPP TS 38.415, February 2024. 11.2. Informative References [IANA-IPFIX] "IANA, "IP Flow Information Export (IPFIX) Entities"", . [RFC7015] Trammell, B., Wagner, A., and B. Claise, "Flow Aggregation for the IP Flow Information Export (IPFIX) Protocol", RFC 7015, DOI 10.17487/RFC7015, September 2013, . [RFC7133] Kashima, S., Kobayashi, A., Ed., and P. Aitken, "Information Elements for Data Link Layer Traffic Measurement", RFC 7133, DOI 10.17487/RFC7133, May 2014, . Voyer, et al. Expires 6 May 2027 [Page 16] Internet-Draft IPFIX support for GTP-U November 2026 [RFC9889] Szarkowicz, K. G., Ed., Roberts, R., Ed., Lucek, J., Boucadair, M., Ed., and L. M. Contreras, "A Realization of Network Slices for 5G Networks Using Current IP/MPLS Technologies", RFC 9889, November 2025, . Appendix A. IPFIX Encoding Examples In this section, an example is provided to show IPFIX encoding format for the GTP-U introduced IEs. Template definition and data set corresponding to an observed GTP-U header is illustrated below. Observed GTP-U Header: Flags = 0x37, Message Type = 0xff, GTP-U Length = 0x0064, TEID = 0x208c1180, Sequence Number = 0x0501, N-PDU Number = 0x0a, Next Extension Header Type = 0x85 (PDU Session Container), PDU Session Container bytes = 0x01 0x10 0x08 0x00, PDU Type = 1, QFI = 8, gtpuTotalHdrLength = 16 A.1. Template Record A.1.1. Template Record and Data Set Sample template consisting of the GTP-U IEs: Voyer, et al. Expires 6 May 2027 [Page 17] Internet-Draft IPFIX support for GTP-U November 2026 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | SET ID = 2 | Length = 40 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID = 256 | Field Count = 8 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| gtpuFlags = 505 | Field Length = 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| gtpuMsgType = 506 | Field Length = 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| gtpuSequenceNum = 508 | Field Length = 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| gtpuTEid = 507 | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| gtpuQFI = 509 | Field Length = 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| gtpuPduType = 510 | Field Length = 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| gtpuTotalHdrLength = TBD1 | Field Length = 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0| gtpuHeaderSection = TBD2 | Field Length = 0xFFFF | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 1: Sample Template Record In this example, the Template ID is 256, which will be used in the Data Record. The data set is represented as follows: Voyer, et al. Expires 6 May 2027 [Page 18] Internet-Draft IPFIX support for GTP-U November 2026 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | SET ID = 256 | Length = 33 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | gtpuFlags | gtpuMsgType | gtpuSequenceNum= 0x0501 | | = 0x37 | = 0xff | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | gtpuTEid = 0x208c1180 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | gtpuQFI = 8 | gtpuPduType | gtpuTotalHdrLength = 16 | | | = 1 | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | VarLength | 0x37 0xff 0x00 | | = 16 | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 0x64 0x20 0x8c 0x11 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 0x80 0x05 0x01 0x0a | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 0x85 0x01 0x10 0x08 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 0x00 | +-+-+-+-+-+-+-+-+ Figure 2: Data Set Encoding Format Authors' Addresses Daniel Voyer Cisco Systems Email: davoyer@cisco.com Sriram Gopalakrishnan Cisco Systems India Email: sriragop@cisco.com Thomas Graf Swisscom Email: thomas.graf@swisscom.com Vyasraj Satyanarayana HPE Email: vyasraj.satyanarayana@hpe.com Voyer, et al. Expires 6 May 2027 [Page 19] Internet-Draft IPFIX support for GTP-U November 2026 Cristian Staicu Bell Canada Email: cristis0@gmail.com Voyer, et al. Expires 6 May 2027 [Page 20]