Individual Submission B. Xu Internet-Draft C. Liu Intended status: Standards Track J. Xu Expires: 29 April 2027 C. Wen China Unicom W. Cheng J. Wang F. Hong Y. Yang Centec 26 October 2026 IPFIX Export of Buffer Snapshots draft-xu-opsawg-ipfix-buffer-snapshot-00 Abstract This document specifies an IP Flow Information Export (IPFIX) profile for exporting buffer occupancy snapshots. It separates the number of objects selected for acquisition, the number successfully captured, and the number of distinct object records validated by a collector. A capture span bounds the temporal separation of the reported measurements. The profile defines ten Information Elements, object identity and accounting rules, and an ordered export procedure in which final metadata closes a snapshot. The resulting collector procedure uses bounded state and distinguishes partial acquisition from incomplete delivery. It does not define a buffer implementation, a trigger configuration protocol, or a congestion control algorithm. Discussion and Implementation Status This note is to be removed before publishing as an RFC. This is an individual proposal intended for the Standards Track. No working group adoption or independent interoperability implementation is claimed. The authors invite review of the problem statement, overlap with existing work, and implementation experience. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Xu, et al. Expires 29 April 2027 [Page 1] Internet-Draft IPFIX Buffer Snapshots October 2026 Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 29 April 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Relationship to Existing Work . . . . . . . . . . . . . . 3 2. Requirements Language . . . . . . . . . . . . . . . . . . . . 4 3. Terminology and Scope . . . . . . . . . . . . . . . . . . . . 4 4. Object Identity and Accounting . . . . . . . . . . . . . . . 5 5. Capture Contract . . . . . . . . . . . . . . . . . . . . . . 6 5.1. Temporal Bound and Flags . . . . . . . . . . . . . . . . 7 5.2. Optional Wall-Clock Context . . . . . . . . . . . . . . . 7 6. Ordered IPFIX Export Profile . . . . . . . . . . . . . . . . 7 6.1. Templates and Field Presence . . . . . . . . . . . . . . 8 6.2. Snapshot Serialization and Seal . . . . . . . . . . . . . 9 7. Collector State and Validation . . . . . . . . . . . . . . . 10 8. Information Element Definitions . . . . . . . . . . . . . . . 12 8.1. snapshotId . . . . . . . . . . . . . . . . . . . . . . . 12 8.2. snapshotExpectedObjectCount . . . . . . . . . . . . . . . 13 8.3. snapshotCapturedObjectCount . . . . . . . . . . . . . . . 14 8.4. snapshotCaptureSpanNanoseconds . . . . . . . . . . . . . 14 8.5. snapshotTriggerType . . . . . . . . . . . . . . . . . . . 15 8.6. snapshotFlags . . . . . . . . . . . . . . . . . . . . . . 16 8.7. bufferObjectType . . . . . . . . . . . . . . . . . . . . 17 Xu, et al. Expires 29 April 2027 [Page 2] Internet-Draft IPFIX Buffer Snapshots October 2026 8.8. bufferObjectIndex . . . . . . . . . . . . . . . . . . . . 18 8.9. bufferOccupancyOctets . . . . . . . . . . . . . . . . . . 19 8.10. bufferAccountingGranularity . . . . . . . . . . . . . . . 20 9. Flag Masks . . . . . . . . . . . . . . . . . . . . . . . . . 21 10. Examples and Implementation Checks . . . . . . . . . . . . . 22 11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 24 11.1. Value Subregistries . . . . . . . . . . . . . . . . . . 24 11.2. Flag Subregistry . . . . . . . . . . . . . . . . . . . . 24 12. Security Considerations . . . . . . . . . . . . . . . . . . . 25 13. Normative References . . . . . . . . . . . . . . . . . . . . 25 14. Informative References . . . . . . . . . . . . . . . . . . . 26 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 27 1. Introduction Buffer measurements taken during a short congestion event can describe different resource sets and different sample instants. A collector receiving two records for one queue cannot treat them as evidence that two distinct queues were measured. Similarly, a complete transport stream cannot establish whether the device successfully read every object in its configured monitoring scope. The interoperability problem addressed here is the interpretation of a multi-object snapshot between independently implemented IPFIX Exporting and Collecting Processes. This document defines a shared interpretation of object identity, acquisition counts, sampling span, and finalization. It uses the IPFIX protocol and information model [RFC7011] [RFC7012]. The proposed profile is appropriate when IPFIX is already the export channel and the receiver needs these snapshot properties. Deployments using an existing management interface with adequate grouping and timing semantics need not add another export protocol. Independent deployment demand for this profile remains to be established. 1.1. Relationship to Existing Work The SAI queue and buffer interfaces expose occupancy and watermark statistics [SAI-QUEUE] [SAI-BUFFER]. Those interfaces establish that buffer observations are useful implementation data. They do not themselves establish demand for this IPFIX profile or specify its collector finalization rules. Xu, et al. Expires 29 April 2027 [Page 3] Internet-Draft IPFIX Buffer Snapshots October 2026 IPFIX common properties [RFC5473] and structured data [RFC6313] can associate or aggregate measurements. They remain alternatives for future encodings. This profile specifies the meaning of capture counts and bounds, then uses ordinary Data Records and an Options Data Record so a snapshot can span several IPFIX Messages without requiring a single large structured record. YANG-Push [RFC8641] provides another telemetry delivery mechanism. The QoS model [I-D.ietf-rtgwg-qos-model] and data manifest [MANIFEST] are related work in progress. Their configuration, subscription, and metadata functions are not replaced. This profile does not claim that IPFIX has an intrinsic performance advantage over those mechanisms. Delay performance export [RFC9951] describes packet-path delay metrics, while the packet discard model [DISCARD-MODEL] describes discard reporting. An occupancy sample is neither a path-delay measurement nor a discard counter. This profile introduces no alternate discard taxonomy and MUST NOT infer a particular discard cause solely from occupancy. 2. Requirements Language The key words MUST, MUST NOT, REQUIRED, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 3. Terminology and Scope IPFIX terms follow [RFC7011] and [RFC7012]. A buffer object is an egress queue, ingress priority group, shared buffer pool, or headroom pool with defined occupancy accounting. A snapshot scope is a finite set of distinct objects frozen at the start of one capture attempt. N is the number of objects in the frozen scope. C is the number of distinct objects successfully captured before acquisition ends. D is the number of distinct object records accepted by the collector before final metadata. The metadata declares N and C; the collector derives D. A snapshot is identified by (Transport Session, Observation Domain ID, snapshotId). A seal is the single final Snapshot Metadata Options Data Record. It closes the export of that identifier. Capture-complete is an exporter assertion that C equals N. Delivery- complete is a collector result that the sealed records are internally consistent and D equals C. Xu, et al. Expires 29 April 2027 [Page 4] Internet-Draft IPFIX Buffer Snapshots October 2026 These properties are distinct from inventory-verified coverage, simultaneous sampling, measurement precision, and authenticity of the exporter. Neither counts nor transport reliability prove that a compromised exporter sampled the asserted objects. Metering Process Exporting Process Collecting Process freeze scope N ordered TCP stream buffer distinct keys capture C objects -> object(k), ... -> validate and count D finalize metadata metadata(k) [seal] -> close k; emit result next snapshot k+1 retain closed-ID floor 4. Object Identity and Accounting Within one Transport Session and Observation Domain, the canonical key is (bufferObjectType, applicable interface index, bufferObjectIndex). For types without interface scope the interface component is absent. Indices need not be contiguous. Type and interface scope are part of the key; an object index alone is insufficient. +=======+================+=======================+=============+ | Value | Object | Required interface IE | Index scope | +=======+================+=======================+=============+ | 0 | Reserved | None | Invalid | +-------+----------------+-----------------------+-------------+ | 1 | Egress queue | egressInterface (14), | Egress | | | | nonzero | interface | +-------+----------------+-----------------------+-------------+ | 2 | Ingress | ingressInterface | Ingress | | | priority group | (10), nonzero | interface | +-------+----------------+-----------------------+-------------+ | 3 | Shared buffer | None | Observation | | | pool | | Domain | +-------+----------------+-----------------------+-------------+ | 4 | Headroom pool | None | Observation | | | | | Domain | +-------+----------------+-----------------------+-------------+ Table 1: Initial Buffer Object Types The exporter MUST ensure that each key denotes one resource and one accounting interpretation for the Transport Session. If a key is reassigned, an interface index is reused, or its accounting interpretation changes, the exporter MUST establish a new Transport Session before exporting the changed meaning. Adding or removing keys between snapshot scopes does not change the meanings of surviving keys. Xu, et al. Expires 29 April 2027 [Page 5] Internet-Draft IPFIX Buffer Snapshots October 2026 Snapshot scope membership MUST be frozen before acquisition and MUST contain no duplicate keys. Every captured object MUST belong to that scope. N and C alone do not identify uncaptured objects. A collector requiring inventory-verified coverage MUST obtain an independently provisioned scope inventory, bind it to the relevant session and capture attempt, and compare the received keys with it. This profile does not transport that inventory or negotiate its version. bufferOccupancyOctets is a gauge of currently accounted buffer storage, not a traffic counter, watermark, capacity, or threshold. bufferAccountingGranularity is the nonzero accounting quantum in octets. An exact cell counter with quantum G is exported as allocated cells multiplied by G. A quantum of one permits octet resolution but does not prove estimator accuracy. The approximateOccupancy flag qualifies an estimated measurement even when its quantum is one. Each occupancy MUST be a multiple of its stated quantum. An estimator MUST be expressed in that same accounting unit and flagged approximate; the exporter MUST document its rounding and estimation method. Values that overflow unsigned64 MUST be omitted from acquisition, reducing C, rather than wrapped or saturated without qualification. Overlapping queue and pool measurements MUST NOT be summed unless an external accounting model establishes that the quantities are disjoint. 5. Capture Contract At the start of each attempt the exporter MUST allocate a nonzero snapshotId greater than every previously allocated identifier in the same Transport Session and Observation Domain. Identifiers MUST NOT wrap or be reused. If monotonic allocation or object identity cannot be preserved after restart, the exporter MUST open a new session. Allocation need not be contiguous; identifier gaps MUST NOT be interpreted as a count of physical events or lost snapshots. Acquisition MUST finish or terminate before any record for the snapshot is exported. Metadata and the captured object set MUST then remain immutable. The exporter MUST preserve 0 <= C <= N and set incompleteCapture if and only if C < N. C MUST NOT be reduced later to conceal an export-queue drop. Empty scopes are permitted: N=C=0 describes an empty selection, not successful observation of any resource. Capture MUST NOT change live packet counters, queue admission, scheduling, ECN marking, PFC behavior, or discard policy. Implementations SHOULD bound capture work and export rate so Xu, et al. Expires 29 April 2027 [Page 6] Internet-Draft IPFIX Buffer Snapshots October 2026 observation does not materially impair forwarding. Trigger suppression and coalescing MAY occur before an attempt starts; their local policy MUST be documented. 5.1. Temporal Bound and Flags snapshotCaptureSpanNanoseconds is a conservative upper bound on the separation between the earliest and latest sample instants among the C captured objects. The bound MUST include uncertainty in locating those instants. A hardware simultaneity guarantee, a monotonic measurement, or a justified deterministic readout bound MAY be used. Subtracting adjustable wall-clock timestamps MUST NOT be used to establish the bound. For C > 0, zero span is permitted only when simultaneous capture is established; a single exact observation satisfies this condition. A positive finite span MUST set nonAtomic. Zero span MUST clear nonAtomic and spanUnknown. If simultaneity cannot be established, the exporter MUST use a positive conservative bound, or UINT64_MAX if no finite bound is known. UINT64_MAX is reserved for unknown span and MUST set both spanUnknown and nonAtomic. For C=0, the span MUST be UINT64_MAX and both spanUnknown and nonAtomic MUST be set. A bound on C measurements says nothing about the N-C uncaptured objects. The collector MUST validate these combinations before reporting delivery completeness. 5.2. Optional Wall-Clock Context The final metadata MAY contain observationTimeNanoseconds (IE 325) when C>0, referring to the first sample. This IE uses the IPFIX dateTimeNanoseconds type: the NTP seconds and fractional-seconds representation specified by [RFC7011] [RFC7012], rather than integer Unix nanoseconds. It MUST be absent when C=0. Cross-device correlation requires separately established clock accuracy and synchronization; timestamp syntax does not provide that assurance. 6. Ordered IPFIX Export Profile This profile MUST use IPFIX over TCP as specified in [RFC7011]. UDP and SCTP are outside this profile. Exporters and collectors MUST support TLS for IPFIX and SHOULD use mutually authenticated TLS 1.3 [RFC8446] on deployments that support it. Plain TCP is permissible only under a deployment security policy that supplies equivalent protection and access control. Xu, et al. Expires 29 April 2027 [Page 7] Internet-Draft IPFIX Buffer Snapshots October 2026 The profile is configured out of band at both peers. It defines no new IPFIX version or transport negotiation. Before IANA assignment, experiments MUST use enterprise-specific IEs under an appropriate Private Enterprise Number and an explicitly agreed mapping. Symbolic TBD labels are not wire identifiers. An endpoint MUST NOT infer this profile solely from numeric experimental identifiers used by another enterprise. 6.1. Templates and Field Presence Templates MUST precede their Data Records in the session. Template lifetimes, Set framing, padding, and Sequence Numbers follow [RFC7011]. A profile record MUST contain each required IE exactly once, with its full field length shown below; reduced-size encoding is not used for these fields in this profile. Extra IEs MAY carry context if they do not change the meaning of required fields. Snapshot metadata MUST use an Options Template with snapshotId as its only scope field and the other five required fields as non-scope fields. The protocol Observation Domain ID and Transport Session supply the outer scope. A metadata record is always a final seal, never a preliminary estimate. Object records use an ordinary Data Template. Egress queues MUST include egressInterface and MUST NOT include ingressInterface; ingress priority groups MUST include ingressInterface and MUST NOT include egressInterface; shared and headroom pools MUST include neither. Separate Templates MUST be used where field presence differs. A field cannot be omitted on selected records of the same Template. These rules avoid assigning new sentinel semantics to the existing interface IEs. Xu, et al. Expires 29 April 2027 [Page 8] Internet-Draft IPFIX Buffer Snapshots October 2026 +==========+============================================+==========+ | Record | Fields in recommended order (length in | Required | | | octets) | fields | +==========+============================================+==========+ | Final | snapshotId (8, scope); | 6; scope | | metadata | snapshotExpectedObjectCount (4); | count 1 | | | snapshotCapturedObjectCount (4); | | | | snapshotCaptureSpanNanoseconds (8); | | | | snapshotTriggerType (1); snapshotFlags (2) | | +----------+--------------------------------------------+----------+ | Egress | snapshotId (8); bufferObjectType (1); | 6 | | queue | egressInterface (4); bufferObjectIndex | | | | (4); bufferOccupancyOctets (8); | | | | bufferAccountingGranularity (4) | | +----------+--------------------------------------------+----------+ | Ingress | snapshotId (8); bufferObjectType (1); | 6 | | priority | ingressInterface (4); bufferObjectIndex | | | group | (4); bufferOccupancyOctets (8); | | | | bufferAccountingGranularity (4) | | +----------+--------------------------------------------+----------+ | Pool | snapshotId (8); bufferObjectType (1); | 5 | | | bufferObjectIndex (4); | | | | bufferOccupancyOctets (8); | | | | bufferAccountingGranularity (4) | | +----------+--------------------------------------------+----------+ Table 2: Required Fields and Lengths Field order is determined by the Template, not by the example order in the table. Required metadata occupies 27 octets per record; queue and priority-group records occupy 29, and pool records occupy 25, excluding optional fields and IPFIX framing. Unknown optional IEs MUST NOT change snapshot counting or finalization. 6.2. Snapshot Serialization and Seal For each Transport Session and Observation Domain, the exporter MUST emit snapshots in increasing snapshotId order. All object records of one snapshot MUST precede its single metadata seal. Records of another snapshot in that same Observation Domain MUST NOT be interleaved. Different Observation Domains and unrelated IPFIX records MAY interleave. Ordering means the order of records in Sets and IPFIX Messages as parsed from the TCP byte stream. The exporter MUST emit every captured object exactly once in normal operation. A collector nevertheless tolerates identical duplicates before the seal. The exporter MUST emit no further record for an identifier after its seal, including repeated metadata. If a Xu, et al. Expires 29 April 2027 [Page 9] Internet-Draft IPFIX Buffer Snapshots October 2026 snapshot cannot be fully exported, the exporter MUST omit its seal or terminate the session. It MAY move to a larger identifier, thereby abandoning the unfinished earlier snapshot. A seal is emitted only after all C records have been handed to the same ordered stream. TCP delivery does not guarantee that internal application queues preserved them. D=C at the seal is the independent application check. The final record permits bounded receiver history; a later conflicting record is a protocol violation, not an amendment of the finalized snapshot. 7. Collector State and Validation A collector MUST parse and process this profile in stream order even if internal workers run concurrently. For each Observation Domain it maintains a closed-ID floor F (initially zero), at most one active identifier K, and a bounded map of accepted object keys for K. F represents identifiers that MUST NOT be reopened. This requires no retained object cache for completed snapshots. Before allocating state, the collector MUST enforce configured limits on sessions, Observation Domains per session, records and bytes per active snapshot, processing rate, and reassembly duration. It MUST NOT allocate memory proportional to an untrusted N or C. Limits and incomplete-result reasons MUST be exposed to the application. Xu, et al. Expires 29 April 2027 [Page 10] Internet-Draft IPFIX Buffer Snapshots October 2026 +=======================+===========================================+ | Input or event | Required processing | +=======================+===========================================+ | Identifier 0 | Reject as invalid; do not create a | | | snapshot | +-----------------------+-------------------------------------------+ | Identifier k <= F | Discard as a late or repeated closed | | | record; report a protocol diagnostic | +-----------------------+-------------------------------------------+ | First k > F with no | Set F=k-1; create K=k | | active K | | +-----------------------+-------------------------------------------+ | k > active K | Finalize K as incomplete (missing | | | seal); set F=k-1; start K=k | +-----------------------+-------------------------------------------+ | F < k < active K | Impossible after the start rule; | | | reject defensively | +-----------------------+-------------------------------------------+ | Object for active K | Validate key and fields; accept one | | | value per key; handle duplicates below | +-----------------------+-------------------------------------------+ | Seal for active K, or | Validate metadata, classify the | | seal starting a new k | result, then set F=k and release all | | | active state | +-----------------------+-------------------------------------------+ | Timeout, size cap, or | Finalize K as expired, resource- | | invalid record for K | limited, or invalid; set F=K; release | | | active state | +-----------------------+-------------------------------------------+ | Transport Session | Close any active snapshot as | | ends | incomplete; discard session floors and | | | Templates | +-----------------------+-------------------------------------------+ Table 3: Ordered Collector Transitions For each accepted object, the collector MUST validate the type- specific interface rule, nonzero granularity, and occupancy divisibility by granularity. Identical duplicates are compared by decoded required fields and counted once; optional context is not part of the count. A duplicate with a different required value MUST invalidate the active snapshot. An unrecognized object type prevents interpreted delivery completeness; the collector MUST close that snapshot as unsupported and retire its identifier. At a seal the collector MUST check C<=N, incompleteCapture==(CC it MUST report invalid. If D0,C=0 with valid metadata is complete delivery of a failed capture, never a report that N objects have zero occupancy. C=N without an inventory check is a source assertion plus consistency check, not independent proof of scope coverage. Closed results are immutable under this profile. Records with k<=F are diagnostic violations and MUST NOT reopen, complete, or silently replace an archived result. A collector MAY terminate a session after such a violation. Finality applies to the accepted sealed prefix, not to the truthfulness of a peer that later violates the protocol. This explicit rule replaces indefinite post-delivery conflict retention. 8. Information Element Definitions The following proposed IEs use the specification template of [RFC7012] and review guidance of [RFC7013]. All have status current and reference this document. IANA identifiers remain TBD until assigned. Units are taken from the existing IPFIX units registry; object counts use none, not a newly invented objects unit. 8.1. snapshotId Identifier scoped by Transport Session and Observation Domain. It increases for successive capture attempts. The final Options Data Record for the identifier seals the snapshot; subsequent records for it are prohibited. Xu, et al. Expires 29 April 2027 [Page 12] Internet-Draft IPFIX Buffer Snapshots October 2026 +=====================+==========================+ | Property | Value | +=====================+==========================+ | Name | snapshotId | +---------------------+--------------------------+ | ElementId | TBD1 | +---------------------+--------------------------+ | Abstract Data Type | unsigned64 | +---------------------+--------------------------+ | Data Type Semantics | identifier | +---------------------+--------------------------+ | Units | none | +---------------------+--------------------------+ | Range | 1..18446744073709551615 | +---------------------+--------------------------+ | Status | current | +---------------------+--------------------------+ | Reference | RFC XXXX (this document) | +---------------------+--------------------------+ Table 4: Registration Properties 8.2. snapshotExpectedObjectCount N: the number of distinct objects in the scope frozen at acquisition start. This is a count, not an inventory of their identities. +=====================+=============================+ | Property | Value | +=====================+=============================+ | Name | snapshotExpectedObjectCount | +---------------------+-----------------------------+ | ElementId | TBD2 | +---------------------+-----------------------------+ | Abstract Data Type | unsigned32 | +---------------------+-----------------------------+ | Data Type Semantics | quantity | +---------------------+-----------------------------+ | Units | none | +---------------------+-----------------------------+ | Range | 0..4294967295 | +---------------------+-----------------------------+ | Status | current | +---------------------+-----------------------------+ | Reference | RFC XXXX (this document) | +---------------------+-----------------------------+ Table 5: Registration Properties Xu, et al. Expires 29 April 2027 [Page 13] Internet-Draft IPFIX Buffer Snapshots October 2026 8.3. snapshotCapturedObjectCount C: the number of distinct scoped objects successfully captured before acquisition ends. It cannot exceed N and cannot be changed to conceal a subsequent export failure. +=====================+=============================+ | Property | Value | +=====================+=============================+ | Name | snapshotCapturedObjectCount | +---------------------+-----------------------------+ | ElementId | TBD3 | +---------------------+-----------------------------+ | Abstract Data Type | unsigned32 | +---------------------+-----------------------------+ | Data Type Semantics | quantity | +---------------------+-----------------------------+ | Units | none | +---------------------+-----------------------------+ | Range | 0..4294967295 | +---------------------+-----------------------------+ | Status | current | +---------------------+-----------------------------+ | Reference | RFC XXXX (this document) | +---------------------+-----------------------------+ Table 6: Registration Properties 8.4. snapshotCaptureSpanNanoseconds Conservative upper bound on the separation of sample instants among captured objects, including uncertainty. Zero means established simultaneity. UINT64_MAX means unknown and is required for C=0. Xu, et al. Expires 29 April 2027 [Page 14] Internet-Draft IPFIX Buffer Snapshots October 2026 +=====================+================================+ | Property | Value | +=====================+================================+ | Name | snapshotCaptureSpanNanoseconds | +---------------------+--------------------------------+ | ElementId | TBD4 | +---------------------+--------------------------------+ | Abstract Data Type | unsigned64 | +---------------------+--------------------------------+ | Data Type Semantics | quantity | +---------------------+--------------------------------+ | Units | nanoseconds | +---------------------+--------------------------------+ | Range | 0..18446744073709551615 | +---------------------+--------------------------------+ | Status | current | +---------------------+--------------------------------+ | Reference | RFC XXXX (this document) | +---------------------+--------------------------------+ Table 7: Registration Properties 8.5. snapshotTriggerType Class of local stimulus that initiated capture. Initial assignments are in the Snapshot Trigger Types registry. This value does not identify the root cause of congestion. Xu, et al. Expires 29 April 2027 [Page 15] Internet-Draft IPFIX Buffer Snapshots October 2026 +=====================+==========================+ | Property | Value | +=====================+==========================+ | Name | snapshotTriggerType | +---------------------+--------------------------+ | ElementId | TBD5 | +---------------------+--------------------------+ | Abstract Data Type | unsigned8 | +---------------------+--------------------------+ | Data Type Semantics | identifier | +---------------------+--------------------------+ | Units | none | +---------------------+--------------------------+ | Range | 0..255 | +---------------------+--------------------------+ | Status | current | +---------------------+--------------------------+ | Reference | RFC XXXX (this document) | +---------------------+--------------------------+ Table 8: Registration Properties 8.6. snapshotFlags Mask qualifying acquisition completeness, simultaneity, span knowledge, and measurement approximation. Masks and receiver handling are defined below. Xu, et al. Expires 29 April 2027 [Page 16] Internet-Draft IPFIX Buffer Snapshots October 2026 +=====================+==========================+ | Property | Value | +=====================+==========================+ | Name | snapshotFlags | +---------------------+--------------------------+ | ElementId | TBD6 | +---------------------+--------------------------+ | Abstract Data Type | unsigned16 | +---------------------+--------------------------+ | Data Type Semantics | flags | +---------------------+--------------------------+ | Units | none | +---------------------+--------------------------+ | Range | 0..65535 | +---------------------+--------------------------+ | Status | current | +---------------------+--------------------------+ | Reference | RFC XXXX (this document) | +---------------------+--------------------------+ Table 9: Registration Properties 8.7. bufferObjectType Object class. The class determines whether the index is scoped by an egress interface, ingress interface, or Observation Domain. Zero is reserved. Xu, et al. Expires 29 April 2027 [Page 17] Internet-Draft IPFIX Buffer Snapshots October 2026 +=====================+==========================+ | Property | Value | +=====================+==========================+ | Name | bufferObjectType | +---------------------+--------------------------+ | ElementId | TBD7 | +---------------------+--------------------------+ | Abstract Data Type | unsigned8 | +---------------------+--------------------------+ | Data Type Semantics | identifier | +---------------------+--------------------------+ | Units | none | +---------------------+--------------------------+ | Range | 1..255 | +---------------------+--------------------------+ | Status | current | +---------------------+--------------------------+ | Reference | RFC XXXX (this document) | +---------------------+--------------------------+ Table 10: Registration Properties 8.8. bufferObjectIndex Object index within the namespace selected by bufferObjectType and its applicable interface. It remains semantically stable for the Transport Session. Xu, et al. Expires 29 April 2027 [Page 18] Internet-Draft IPFIX Buffer Snapshots October 2026 +=====================+==========================+ | Property | Value | +=====================+==========================+ | Name | bufferObjectIndex | +---------------------+--------------------------+ | ElementId | TBD8 | +---------------------+--------------------------+ | Abstract Data Type | unsigned32 | +---------------------+--------------------------+ | Data Type Semantics | identifier | +---------------------+--------------------------+ | Units | none | +---------------------+--------------------------+ | Range | 0..4294967295 | +---------------------+--------------------------+ | Status | current | +---------------------+--------------------------+ | Reference | RFC XXXX (this document) | +---------------------+--------------------------+ Table 11: Registration Properties 8.9. bufferOccupancyOctets Instantaneous accounted storage of the identified object, in octets, including allocation overhead where applicable. The value is a multiple of bufferAccountingGranularity and may be flagged approximate. Xu, et al. Expires 29 April 2027 [Page 19] Internet-Draft IPFIX Buffer Snapshots October 2026 +=====================+==========================+ | Property | Value | +=====================+==========================+ | Name | bufferOccupancyOctets | +---------------------+--------------------------+ | ElementId | TBD9 | +---------------------+--------------------------+ | Abstract Data Type | unsigned64 | +---------------------+--------------------------+ | Data Type Semantics | quantity | +---------------------+--------------------------+ | Units | octets | +---------------------+--------------------------+ | Range | 0..18446744073709551615 | +---------------------+--------------------------+ | Status | current | +---------------------+--------------------------+ | Reference | RFC XXXX (this document) | +---------------------+--------------------------+ Table 12: Registration Properties 8.10. bufferAccountingGranularity Accounting quantum in octets for the object. One denotes octet resolution. A larger value denotes the cell or allocation-block quantum. This field does not establish estimator accuracy. Xu, et al. Expires 29 April 2027 [Page 20] Internet-Draft IPFIX Buffer Snapshots October 2026 +=====================+=============================+ | Property | Value | +=====================+=============================+ | Name | bufferAccountingGranularity | +---------------------+-----------------------------+ | ElementId | TBD10 | +---------------------+-----------------------------+ | Abstract Data Type | unsigned32 | +---------------------+-----------------------------+ | Data Type Semantics | quantity | +---------------------+-----------------------------+ | Units | octets | +---------------------+-----------------------------+ | Range | 1..4294967295 | +---------------------+-----------------------------+ | Status | current | +---------------------+-----------------------------+ | Reference | RFC XXXX (this document) | +---------------------+-----------------------------+ Table 13: Registration Properties 9. Flag Masks snapshotFlags is encoded as an unsigned16 in network byte order. The numeric masks below are authoritative. If bits are displayed from most significant to least significant, masks 0x0008 through 0x0001 occupy displayed positions 12 through 15. This display convention does not follow from byte order alone. Xu, et al. Expires 29 April 2027 [Page 21] Internet-Draft IPFIX Buffer Snapshots October 2026 +========+======================+===============================+ | Mask | Name | Rule | +========+======================+===============================+ | 0x0001 | incompleteCapture | Set exactly when C0 capture the span MUST be zero. These rules make the defined flags and span mutually checkable without asserting anything about uncaptured objects. 10. Examples and Implementation Checks +===========+=================================+==================+ | Object | Final metadata | Expected result | | records | | | | before | | | | seal | | | +===========+=================================+==================+ | Q0=128, | N=2,C=2,span=0,flags=0 | Complete | | Q1=256; | | delivery; source | | G=128 | | asserts complete | | | | simultaneous | | | | capture | +-----------+---------------------------------+------------------+ | Q0=128, | N=2,C=2,span=20,flags=2 | D=1; incomplete | | Q0=128; | | at seal | | G=128 | | | +-----------+---------------------------------+------------------+ | Q0=128, | N=2,C=2,span=20,flags=2 | D=2; complete; | | Q0=128, | | duplicate | | Q1=256 | | counted once | +-----------+---------------------------------+------------------+ Xu, et al. Expires 29 April 2027 [Page 22] Internet-Draft IPFIX Buffer Snapshots October 2026 | Q0=128, | Any seal | Conflicting | | Q0=256 | | duplicate; | | | | invalid before | | | | seal | +-----------+---------------------------------+------------------+ | Q0=128, | N=3,C=2,span=20,flags=3 | Complete | | Q1=256 | | delivery; | | | | partial | | | | acquisition | +-----------+---------------------------------+------------------+ | None | N=3,C=0,span=UINT64_MAX,flags=7 | Complete | | | | delivery; failed | | | | capture | +-----------+---------------------------------+------------------+ | None | N=0,C=0,span=UINT64_MAX,flags=6 | Complete | | | | delivery; empty | | | | scope | +-----------+---------------------------------+------------------+ | Q0 only; | No seal | Earlier snapshot | | then | | incomplete; old | | larger | | ID cannot reopen | | snapshot | | | | ID | | | +-----------+---------------------------------+------------------+ | Seal | N=1,C=1,span=0,flags=0 | Incomplete at | | arrives | | seal; late Q0 | | first, | | discarded | | then Q0 | | | +-----------+---------------------------------+------------------+ | Q0=129; | Any seal | Invalid | | G=128 | | accounting | | | | quantum | +-----------+---------------------------------+------------------+ | Q0 | Previously valid N=C=D | Closed result | | arrives | | unchanged; | | after | | protocol | | completed | | violation | | seal | | reported | +-----------+---------------------------------+------------------+ Table 15: Collector Test Cases Xu, et al. Expires 29 April 2027 [Page 23] Internet-Draft IPFIX Buffer Snapshots October 2026 A conforming implementation test SHOULD include two Observation Domains interleaving on one TCP stream, Template replacement rules, session restart with the same numeric snapshotId, timeout followed by a late seal, memory-cap exhaustion, unknown flags, malformed interface fields, and count overflow. Tests of the state machine alone do not demonstrate hardware capture accuracy or independent interoperability. 11. IANA Considerations IANA is requested to register the ten IEs in Section 8 in the IPFIX Information Elements registry [IANA-IPFIX]. No existing IE allocation is changed. Numeric TBD values MUST NOT be transmitted as if assigned. 11.1. Value Subregistries IANA is requested to create IPFIX Snapshot Trigger Types (unsigned8) and IPFIX Buffer Object Types (unsigned8), using Expert Review [RFC8126]. Each entry records Value, Name, Description, and Reference. Snapshot Trigger Types initially assigns 0 Unknown, 1 Management request, 2 Periodic timer, 3 Occupancy threshold crossing, 4 Buffer congestion discard, and 5 Local PFC assertion; 6-255 are unassigned. Buffer Object Types uses the values in Table 1; 5-255 are unassigned. A trigger registration MUST describe the observed stimulus without claiming causal diagnosis. An object-type registration MUST define its identity, interface scope, accounting meaning, and Template field presence. Experts should prefer existing types when their semantics suffice and require a public specification for a new interpretation. Allocating a new type does not make older collectors understand it. 11.2. Flag Subregistry IANA is requested to create IPFIX Snapshot Flags with columns Numeric Mask, Name, Meaning, and Reference. The four assigned masks and the unassigned mask space are in Table 14. New assignments use Standards Action [RFC8126] and MUST specify their effect on validation, finalization, and older collectors. The numeric mask convention MUST be retained. Xu, et al. Expires 29 April 2027 [Page 24] Internet-Draft IPFIX Buffer Snapshots October 2026 12. Security Considerations The IPFIX security considerations in [RFC7011] apply. Occupancy and trigger reports can reveal workload timing, topology, and resource stress. Export destinations MUST be authorized. Implementations MUST support transport protection, apply access controls, and limit retention according to deployment policy. TLS authenticates a peer and protects its messages; it cannot make a compromised exporter truthful. N, C, identifiers, and rate are untrusted inputs. The collector limits in Section 7 are mandatory. A peer can deliberately send a very large identifier, which retires smaller identifiers for that session; this affects only that authenticated session and Observation Domain. It MUST NOT affect another exporter or session. Replay from an earlier session MUST NOT be merged with current reassembly state. The absence of a snapshot or an incomplete result MUST NOT be interpreted as absence of congestion. Trigger suppression, an overloaded exporter, and resource limits can bias the observations. Using the telemetry to drive control decisions requires independent safeguards; this document defines no automatic congestion-control response. 13. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC7011] Claise, B., Ed., Trammell, B., Ed., and P. Aitken, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information", STD 77, RFC 7011, DOI 10.17487/RFC7011, September 2013, . [RFC7012] Claise, B., Ed. and B. Trammell, Ed., "Information Model for IP Flow Information Export (IPFIX)", RFC 7012, DOI 10.17487/RFC7012, September 2013, . [RFC8126] Cotton, M., Leiba, B., and T. Narten, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 8126, DOI 10.17487/RFC8126, June 2017, . Xu, et al. Expires 29 April 2027 [Page 25] Internet-Draft IPFIX Buffer Snapshots October 2026 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, . 14. Informative References [DISCARD-MODEL] IETF OPSAWG, "Information and Data Models for Packet Discard Reporting", Work in Progress, Internet-Draft, draft-ietf-opsawg-discardmodel-16, 30 July 2026, . [I-D.ietf-rtgwg-qos-model] Choudhary, A., Jethanandani, M., Aries, E., and I. Chen, "A YANG Data Model for Quality of Service (QoS) in IP Networks", Work in Progress, Internet-Draft, draft-ietf- rtgwg-qos-model-16, 25 September 2026, . [IANA-IPFIX] IANA, "IP Flow Information Export (IPFIX) Entities", . [MANIFEST] Claise, B., Quilbeuf, J., Lopez, D., Martinez-Casanueva, I. D., and T. Graf, "A Data Manifest for Contextualized Telemetry Data", Work in Progress, Internet-Draft, draft- ietf-opsawg-collected-data-manifest-16, 5 October 2026, . [RFC5473] Boschi, E., Mark, L., and B. Claise, "Reducing Redundancy in IP Flow Information Export (IPFIX) and Packet Sampling (PSAMP) Reports", RFC 5473, DOI 10.17487/RFC5473, March 2009, . [RFC6313] Claise, B., Dhandapani, G., Aitken, P., and S. Yates, "Export of Structured Data in IP Flow Information Export (IPFIX)", RFC 6313, DOI 10.17487/RFC6313, July 2011, . Xu, et al. Expires 29 April 2027 [Page 26] Internet-Draft IPFIX Buffer Snapshots October 2026 [RFC7013] Trammell, B. and B. Claise, "Guidelines for Authors and Reviewers of IP Flow Information Export (IPFIX) Information Elements", BCP 184, RFC 7013, DOI 10.17487/RFC7013, September 2013, . [RFC8641] Clemm, A. and E. Voit, "Subscription to YANG Notifications for Datastore Updates", RFC 8641, DOI 10.17487/RFC8641, September 2019, . [RFC9951] RFC Editor, "Export of Delay Performance Metrics in IP Flow Information Export (IPFIX)", RFC 9951, April 2026, . [SAI-BUFFER] Open Compute Project, "Switch Abstraction Interface: Buffer API", . [SAI-QUEUE] Open Compute Project, "Switch Abstraction Interface: Queue API", . Authors' Addresses Bohua Xu China Unicom Beijing 100000 China Email: xubh15@chinaunicom.cn Chang Liu China Unicom Beijing 100000 China Email: liuc131@chinaunicom.cn Xu, et al. Expires 29 April 2027 [Page 27] Internet-Draft IPFIX Buffer Snapshots October 2026 Jie Xu China Unicom Beijing 100000 China Email: xuj556@chinaunicom.cn Chenyang Wen China Unicom Beijing 100000 China Email: wency15@chinaunicom.cn Wei Cheng Centec Suzhou 215000 China Email: chengw@centec.com Junjie Wang Centec Suzhou 215000 China Email: wangjj@centec.com Fang Hong Centec Suzhou 215000 China Email: hongf@centec.com Yongtao Yang Centec Suzhou 215000 China Email: yangyt@centec.com Xu, et al. Expires 29 April 2027 [Page 28]