Subject: [IPFIX] IPFIX for Layer4/layer7 proxie

From: Mahesh M <[email-masked]>
Date: Wed, 22 Sep 2010 01:06:52 +0530

Hi,

I am a new member to this group(just joined). I am going through the IPFIX RFCs to find out how the layer4 and layer7 proxy flow information could be exported. Also, i went through some of the commercial and freely available collectors and report generating tools which consume IPFIX flow records. Looks like just collectors got changed to interpret and process IPFIX templates and data records and report generating is mostly like layer3 flows.

As per my understanding most of the flow information report generators, still work based on the assumption that the exporter is layer3 or layer2 device.  For example for list report top 10 conversations based on 4tuples of a TCP connection,  it needs to aggregate two flow records i.e. one in each direction. This will work since in layer3 and layer4 devices IP address will not change and we can follow both ingress and egress numbers of each TCP connection.

Coming to layer4 proxies and layer7 proxies where there will be two different TCP connections (most of the time IP address will be different),  reporting tools will not be able to find out the egress flows for a TCP connection.
I have seen RFCs for biflow and post* IEs which can be used. But, i believe most of the current report  generating tools will not be able generate any reports correctly.

Any thoughts on this?

Regards,
Mahesh