IPFIX Protocol

IPFIX considers a flow to be any number of packets observed in a specific time slot and sharing a number of properties such as same source, same destination, or same protocol. Using IPFIX, devices such as routers can send information to a central monitoring station about their view of a potentially larger network.

IPFIX is a push protocol, meaning each sender periodically sends IPFIX messages to configured receivers without any interaction by the receiver.

The actual makeup of data in IPFIX messages is largely up to the sender. IPFIX introduces the makeup of these messages to the receiver with the help of special Templates. The sender also accepts user-defined data types in the messages, so the protocol is freely extensible and can adapt to different scenarios.

IPFIX prefers the Stream Control Transmission Protocol (SCTP) as the transport layer protocol, but also allows the use of the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). SCTP provides some of the same service features of both TCP and UDP. SCTP is message-oriented like UDP and ensures reliable, in-sequence transport of messages with congestion control like TCP. It differs from the two protocols when providing multi-homing and redundant paths to increase resilience and reliability.