Kemp Support, how can we help?

The latest application delivery knowledge and expertise at your fingertips.

TOS (Type of Service) flow field in Flowmon OS

 

Information

 

Summary:

TOS (Type of Service) field in the Monitoring Center - Analysis can be found in three objects:

  • TOS
  • Source TOS
  • Destination TOS
Environment:

Product: Flowmon Collector

Version: Any

Platform: Any

Question/Problem Description:

 

Steps to Reproduce:  
Error Message:  
Defect Number:  
Enhancement Number:  
Cause:  
Resolution: There is always only one TOS value in the packet. If Flowmon Probe exports the flow, then TOS is exported in the field with ID 5 (ipClassOfService), which is defined as:

For IPv4 packets, this is the value of the TOS field in the IPv4 packet header. For IPv6 packets, this is the value of the Traffic Class field in the IPv6 packet header

But there is also a destination TOS field, ID 55 (postIpClassOfService), defined as:

The definition of this Information Element is identical to the definition of Information Element 'ipClassOfService', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

 If an L3 switch or router exports the flow, it might change the TOS value and export both source TOS (before the change) and destination TOS (after the change).
When the Flowmon Probe exports the flow, there is always only one TOS because the Probe does not modify the TOS value. The probe uses a field with ID 5 that can also be considered a source TOS. 
Workaround:  
Notes: IANA IPFIX field definition
https://www.iana.org/assignments/ipfix/ipfix.xhtml

Was this article helpful?
0 out of 0 found this helpful

Comments