Export of Source Address Validation (SAV) Information in IPFIX

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 8 March 2027.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

Source Address Validation (SAV) serves as a fundamental defense mechanism against IP source address spoofing. Despite its critical role in network security, current SAV implementations lack operational visibility, making it difficult to answer essential operational questions:¶

• How many packets are identified as spoofed and dropped by SAV?¶

• Which interfaces receive spoofed packets and which source prefixes are targeted?¶

• Which specific SAV rules trigger the enforcement actions?¶

• Are SAV rules functioning as intended or potentially misconfigured?¶

This document introduces a set of SAV-specific IP Flow Information Export (IPFIX) Information Elements (IEs) that enable detailed reporting of Source Address Validation enforcement actions. These elements align with the SAV concepts and operational models defined in [I-D.ietf-savnet-general-sav-capabilities], and provide traffic observations that can be operationally correlated with the SAV configuration and state information available via the YANG data model [I-D.li-savnet-sav-yang].¶

2. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

This document makes use of the terms defined in [RFC7011], and [I-D.ietf-savnet-general-sav-capabilities].¶

The following terms are used as defined in [RFC7011]:¶

• IPFIX¶

• IPFIX Information Elements¶

• Template¶

• Template Record¶

• Data Record¶

• Data Set¶

• Exporter¶

• Collector¶

The following terms are used as defined in [I-D.ietf-savnet-general-sav-capabilities].¶

• SAV rule¶

• Validation mode¶

3. SAV Overview and IPFIX Export Requirements

This section outlines the operational requirements for SAV telemetry export using IPFIX, based on the generalized SAV architectural framework defined in [I-D.ietf-savnet-general-sav-capabilities].¶

The SAV framework establishes four canonical validation modes that model validation policies:¶

• Interface-based prefix allowlist (Mode 1): Validates that a source prefix is explicitly permitted on the incoming interface.¶

• Interface-based prefix blocklist (Mode 2): Validates that a source prefix is not explicitly blocked on the incoming interface.¶

• Prefix-based interface allowlist (Mode 3): Validates that a packet is received on an interface explicitly permitted for its source prefix.¶

• Prefix-based interface blocklist (Mode 4): Validates that a packet is not received on an interface explicitly blocked for its source prefix.¶

These modes can be applied independently or in combination on a router, following a defined validation procedure (Section 2 of [I-D.ietf-savnet-general-sav-capabilities]). Furthermore, when identifying a packet as spoofed, a range of traffic handling policies (e.g. discard, rate-limit, redirect) can be applied.¶

However, the generalized SAV model requires corresponding operational visibility capabilities. Without integrated telemetry, operators face significant challenges in:¶

• Enforcement Visibility: Observing SAV enforcement actions and identifying which rules were triggered.¶

• Operational Analysis: Understanding the context of SAV decisions and troubleshooting unexpected enforcement behavior.¶

• Threat Intelligence: Analyzing traffic patterns identified as spoofed by SAV.¶

To address these limitations, IPFIX [RFC7011] and [RFC7012] provide a vendor-neutral protocol for SAV telemetry. The exported data must provide insight into:¶

• The validation outcome and specific reason for the decision¶

• The identity and type of SAV rule or rule set that influenced the decision¶

• The configured rule content that was evaluated during validation¶

• The enforcement action applied to spoofed packets¶

The following section defines the IPFIX IEs that meet these requirements.¶

4. IPFIX SAV Information Elements

This section defines the IEs used for SAV telemetry. These IEs have been specified in accordance with the guidelines in [RFC7013].¶

5. Use Cases

The SAV-specific IPFIX IEs defined in this document enable network operators to answer critical operational questions that are currently unaddressable without telemetry for SAV:¶

SAV Enforcement Monitoring: Use savRuleType (TBD1), savTargetType (TBD2), savPolicyAction (TBD4) and standard IPFIX counters, to quantify SAV enforcement actions, analyze their distribution across different validation modes, and identify applied SAV enforcement actions (discard, rate-limit, redirect) at the data plane level. This complements control-plane monitoring via YANG models, providing visibility into actual enforcement behavior rather than configured rules.¶

Rule-Level Attribution and Troubleshooting: Use savMatchedContentList (TBD3) to determine the specific SAV rule configuration that triggered enforcement decisions, including the exact rule parameters (interfaces, prefixes) evaluated during validation, whether for allowlist failures or blocklist matches.¶

Forensic Analysis and Compliance: SAV Data Records include both SAV-specific Information Elements and traditional packet-level details (source/destination addresses, ports, protocol), providing complete information for incident investigation and compliance reporting. Operators can use these records to investigate the source and nature of spoofing attacks, and gather evidence to support external trust initiatives and regulatory compliance reporting.¶

6. Operational Considerations

While this document defines new IPFIX IEs using standard IPFIX mechanisms, implementors should consider:¶

• Exporter Implementation: Exporters MUST properly encode the subTemplateList structure for savMatchedContentList and ensure semantic consistency between savRuleType and list contents. Exporters MUST also define the sub-templates (e.g., 901-904) used in savMatchedContentList prior to exporting Data Records that use them.¶

• Collector Processing: Collectors MUST be capable of parsing subTemplateList structure and understanding the context-dependent semantics of standard IEs within savMatchedContentList. Collectors MUST associate the sub-templates with the main template for correct interpretation.¶

• Export Volume and Aggregation: When savMatchedContentList is used for allowlist non-matches, the exported record carries the full consulted allowlist, which may generate excessive IPFIX traffic. To bound export load, exporters SHOULD consider rate limiting, sampling [RFC5475], or aggregation [RFC7015]. Exporters MAY aggregate packets sharing the same Flow Key and SAV context into a single Data Record, including over a reporting interval. For allowlist non-match events, aggregation is more constrained because the consulted allowlist may change between packets. Exporters SHOULD avoid combining packets validated against different allowlist contents into the same Data Record.¶

7. YANG-IPFIX Mapping

The mappings between the SAV YANG data model and IPFIX IEs are considered based on the common foundation of the general SAV capabilities document [I-D.ietf-savnet-general-sav-capabilities]. The operational correlation is demonstrated in Table 1, which defines the values for the designed IEs mapped from the corresponding [I-D.li-savnet-sav-yang] SAV Management YANG Module.¶

+---------------------+---------------------------------------+
| YANG Elements       | IPFIX IEs                             |
+---------------------+---------------------------------------+
| sav-check-type      | savRuleType                           |
|   sav:sav-allow-list|     1 (allowlist)                     |
|   sav:sav-block-list|     2 (blocklist)                     |
+---------------------+---------------------------------------+
| sav-mode            | savTargetType                         |
|   sav:sav-im        |     1 (interface-based)               |
|   sav:sav-cm        |     2 (prefix-based)                  |
+---------------------+---------------------------------------+
| SAV Rules attributes| savMatchedContentList                 |
|   source-prefix     |     sourceIPv4Prefix/sourceIPv6Prefix |
|   incoming-interface|     ingressInterface                  |
+---------------------+---------------------------------------+

Table 1: Mappings between SAV YANG Data Model and IPFIX Information Elements¶

The savPolicyAction element carries real-time SAV decisions applied to spoofed packets. It does not directly map to YANG configuration node.¶

The code points for these IEs are maintained by IANA in the corresponding subregistries of the IPFIX registry. Future additions or changes are managed via Expert Review as described in IANA Considerations (Section 9).¶

8. Security Considerations

The SAV-specific Information Elements defined in this document export data that reveals the security posture of a network's source address validation deployment. This data is sensitive and warrants additional considerations beyond those in [RFC7012].¶

• Rule Configuration Disclosure: The savMatchedContentList element, when used with the allOf semantic for allowlist non-matches, exports the complete set of source prefixes permitted on an interface. An adversary with access to these IPFIX exports, for example via a compromised collector, could learn which source prefixes are allowed on each interface. This information could then be used to forge packets with spoofed source addresses drawn from those permitted prefixes, thereby increasing the adversary's ability to evade source address validation.¶

• Enforcement State Disclosure: The savPolicyAction element with the value permit (monitoring only) reveals that SAV is not actively enforcing on a given path. This information could be exploited by an adversary to identify interfaces or prefixes where spoofed traffic would not be dropped.¶

• IPFIX Export Amplification: A sustained spoofing attack can trigger a large volume of IPFIX exports and may overload the collector or the management plane, causing a secondary denial-of-service effect. This risk is especially relevant when allowlist non-match records carry the full consulted allowlist. The guidance in Operational Considerations (Section 6) can help mitigate this risk.¶

• Transport Security: Given the sensitivity of SAV enforcement data, exporters and collectors SHOULD use encrypted transport such as TLS or DTLS as described in [RFC7011] to protect SAV Data Records from eavesdropping and tampering.¶

• Access Control: Collectors that store SAV enforcement data SHOULD restrict access to authorized operators, as the data reveals both the SAV configuration and its enforcement outcomes.¶

Other security considerations described in [I-D.ietf-savnet-general-sav-capabilities] apply to this document.¶

9. IANA Considerations

This document requests IANA actions for the IPFIX registry [IANA-IPFIX]. Specifically, it requests the creation of new subregistries for the value spaces of selected SAV-specific Information Elements, and the allocation of four new IPFIX Information Elements.¶

+-------+------------+-------------------------------------------------+
| Value |   Name     |                 Description                     |
+-------+------------+-------------------------------------------------+
|   0   | unassigned |  Reserved; no value is available                |
|   1   | allowlist  |  The packet was validated against an allowlist  |
|   2   | blocklist  |  The packet was validated against a blocklist   |
| 3-255 | unassigned |  Reserved for future assignment                 |
+-------+------------+-------------------------------------------------+

+-------+-----------------+----------------------------------------+
| Value |       Name      |              Description               |
+-------+-----------------+----------------------------------------+
|   0   |    unassigned   |   Reserved; no value is available      |
|   1   | interface-based |   The rule is indexed by an interface  |
|   2   |   prefix-based  |   The rule is indexed by a prefix      |
| 3-255 |    unassigned   |   Reserved for future assignment       |
+-------+-----------------+----------------------------------------+

+-------+----------+---------------------------------------------------+
| Value |   Name   |                  Description                      |
+-------+----------+---------------------------------------------------+
|   0   |unassigned| Reserved; no value is available                   |
|   1   |  permit  |The packet was allowed to proceed (monitoring only)|
|   2   |  discard | Packet was discarded or dropped                   |
|   3   |rate-limit| Traffic was subjected to rate limiting            |
|   4   | redirect | Packet was redirected to alternative destination  |
| 5-255 |unassigned| Reserved for future assignment                    |
+-------+----------+---------------------------------------------------+

+------------+-----------------------+
| Element ID | Name                  |
+------------+-----------------------+
| TBD1       | savRuleType           |
| TBD2       | savTargetType         |
| TBD3       | savMatchedContentList |
| TBD4       | savPolicyAction       |
+------------+-----------------------+

10. References

Appendix A. IPFIX Encoding Examples

This appendix provides encoding examples for the SAV-specific IPFIX IEs defined in this document.¶

+-----+--------------+---------+---------+-----------+-------------+
|Event|Source Address|Interface|Rule Type|Target Type|Policy Action|
+-----+--------------+---------+---------+-----------+-------------+
|  1  | 192.0.2.100  |  5001   |Allowlist| Interface | Rate-limit  |
|  2  | 2001:db8::1  |  5002   |Blocklist| Prefix    | Discard     |
+-----+--------------+---------+---------+-----------+-------------+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Set ID = 2           |          Length = 20          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|       Template ID = 901       |        Field Count = 3        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|   ingressInterface = 10     |        Field Length = 4       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|   sourceIPv4Prefix = 44     |        Field Length = 4       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| sourceIPv4PrefixLength = 9  |        Field Length = 1       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Set ID = 2           |          Length = 20          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|       Template ID = 902       |        Field Count = 3        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|   ingressInterface = 10     |        Field Length = 4       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|   sourceIPv6Prefix = 170    |        Field Length = 16      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| sourceIPv6PrefixLength = 29 |        Field Length = 1       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Set ID = 2           |          Length = 20          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|       Template ID = 903       |        Field Count = 3        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|   sourceIPv4Prefix = 44     |        Field Length = 4       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| sourceIPv4PrefixLength = 9  |        Field Length = 1       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|   ingressInterface = 10     |        Field Length = 4       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Set ID = 2           |          Length = 20          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|       Template ID = 904       |        Field Count = 3        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|   sourceIPv6Prefix = 170    |        Field Length = 16      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| sourceIPv6PrefixLength = 29 |        Field Length = 1       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|   ingressInterface = 10     |        Field Length = 4       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Set ID = 2           |          Length = 28          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|        Template ID = 400      |        Field Count = 5        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|  observationTimeMicrosec=324|        Field Length = 8       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|      savRuleType = TBD1     |        Field Length = 1       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|     savTargetType = TBD2    |        Field Length = 1       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| savMatchedContentList=TBD3  |      Field Length = 0xFFFF    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|   savPolicyAction = TBD4    |        Field Length = 1       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Set ID = 400         |          Length = 88          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|              observationTimeMicrosec =                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                      0x5D2F0A0000000000                       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   savRT =1    |   savTT=1     |     255       |   List Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     = 30      | semantic=0x03 |    Template ID = 901          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                ingressInterface[0] = 5001                     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|              sourceIPv4Prefix[0] = 198.51.100.0               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|sPrf4Len[0]=24 |         ingressInterface[1] =                 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|      5001     |         sourceIPv4Prefix[1] =                 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  203.0.113.0  | sPrf4Len[1]=24|      ingressInterface[2] =    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|               5001            |       sourceIPv4Prefix[2] =   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         192.0.2.128           |sPrf4Len[2]=25 |    savAct=3   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|              observationTimeMicrosec =                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                      0x5D2F0A0000000001                       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   savRT =2    |   savTT=2     |     255       |  List Length  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     = 24      | semantic=0x01 |     Template ID = 904         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                     sourceIPv6Prefix[0]                       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|sPrf6Len[0]=32 |          ingressInterface[0] =                |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|       5002    |    savAct=2   |              padding          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Authors' Addresses