Internet-Draft BGP Flowspec for Statistics December 2023
Bao Expires 10 June 2024 [Page]
IDR Working Group
Intended Status:
Standards Track
L. Bao
Huawei Technologies

BGP Flow Specification Extensions for Traffic Statistics


RFC8955 defines a Border Gateway Protocol Network Layer Reachability Information (BGP NLRI) encoding format that can be used to distribute (intra-domain and inter-domain) traffic Flow Specifications for IPv4 unicast and IPv4 BGP/MPLS VPN services. This allows the routing system to propagate information regarding more specific components of the traffic aggregate defined by an IP destination prefix. It also specifies BGP Extended Community encoding formats, which can be used to propagate Traffic Filtering Actions along with the Flow Specification NLRI. Those Traffic Filtering Actions encode actions a routing system can take if the packet matches the Flow Specification.

This document extends RFC 8955 with New traffic Filtering Actions. statistic for bytes rate per second and statistic for packets rate per second are useful in specified Flow processing scenario.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on 10 June 2024.

Table of Contents

1. Introduction

[RFC8955] obsoletes "Dissemination of Flow Specification Rules" [RFC5575] (see Appendix B for the differences). This document also obsoletes "Clarification of the Flowspec Redirect Extended Community" [RFC7674], since it incorporates the encoding of the BGP Flow Specification Redirect Extended Community in Section 7.4.

When performing an action on a flow, you need to continuously observe the flow status, whether packets are continuously sent, and the statistic bytes rate and packets rate for the Flow Specification. This allows you to perform the next step on the flow. Therefore, the Action field in section 7.3 of [RFC8955] needs to be extended to add an action for flow statistics.

1.1. Requirements Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

2. Traffic Filtering Actions

Traffic-Action (traffic-action) Sub-Type 0x07 is defined in [RFC8955] (see Section 7.2). The traffic-action Extended Community consists of 6 octets of which only the 2 least significant bits of the 6th octet (from left to right) are defined by this document, as shown in Figure 1.

      0                   1                   2                   3
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
     | Traffic Action Field                                          |
     | Tr. Action Field (cont.)  |S|T|

            Figure 1: Traffic-Action Extended Community Encoding

The S and T bit are defined as:

Other 2 significant bits of the 6th octet of traffic-action is required to identify and indicate the action of statistics. One bit is statistic-rate-bytes on a flow at an interval of per second. Another bit is statistic-rate-packets on a flow at an interval of per second.

3. Security Considerations


4. IANA Considerations

The "traffic-action" Extended Community (Section 7.3) defined in [RFC8955] has 46 unused bits, which can be used to convey additional meaning. IANA created and maintains a registry entitled "Traffic Action Fields". IANA has updated the reference for this registry to RFC 8955. as shown in Figure 2.

Two new bits in the Traffic Action Field field are required for statistic-rate-bytes and statistic-rate-packets. The Bit Field and Reference are TBD.

  | Bit | Name                  | Reference |
  | 47  | Terminal Action       | RFC 8955  |
  | 46  | Sample                | RFC 8955  |
  | TBD | statistic-rate-bytes  |    TBD    |
  | TBD | statistic-rate-packets|    TBD    |
 Figure 2: Registry: Traffic Action Fields

5. Acknowledgments

The authors would like to thank Guoqi Xu, Lei Bao, Haibo Wang and Shunwan Zhuang for their review and discussion of this document.

6. References

6.1. Normative References

Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, , <>.
Marques, P., Sheth, N., Raszuk, R., Greene, B., Mauch, J., and D. McPherson, "Dissemination of Flow Specification Rules", RFC 5575, DOI 10.17487/RFC5575, , <>.
Haas, J., Ed., "Clarification of the Flowspec Redirect Extended Community", RFC 7674, DOI 10.17487/RFC7674, , <>.
Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, , <>.
Loibl, C., Hares, S., Raszuk, R., McPherson, D., and M. Bacher, "Dissemination of Flow Specification Rules", RFC 8955, DOI 10.17487/RFC8955, , <>.

6.2. Informative References

Author's Address

Lei Bao
Huawei Technologies