Subject: [IPFIX] Unit of flowActiveTimeout

From: Shingo KASHIMA <[email-masked]>
Date: Wed, 08 Sep 2010 03:45:56 +0900

Dear all,

I have one question about unit of flowActiveTimeout.

According to RFC 5102, unit of flowActiveTimeout is second.
Why IPFIX doesn't support a timer with a unit smaller than second, e.g.
millisecond or microsecond ? I want to know a history of discussion.

----
5.11.1.  flowActiveTimeout

   Description:
      The number of seconds after which an active Flow is timed out
      anyway, even if there is still a continuous flow of packets.
   Abstract Data Type: unsigned16
   ElementId: 36
   Status: current
   Units: seconds
---

On the other hand, IEs about flow timestamps and packet timestamps have
various units e.g. second, millisecond, microsecond and nanosecond.
---
flowStartSeconds
flowEndSeconds
flowStartMilliseconds
flowEndMilliseconds
flowStartMicroseconds
flowEndMicroseconds
flowStartNanoseconds
flowEndNanoseconds
flowStartDeltaMicroseconds
flowEndDeltaMicroseconds
systemInitTimeMilliseconds
flowStartSysUpTime
flowEndSysUpTime
observationTimeSeconds
observationTimeMilliseconds
observationTimeMicroseconds
observationTimeNanoseconds
---

Also PSAMP IEs about time-based sampling parameter support a unit of
microsecond. 
---
samplingTimeInterval
samplingTimeSpace
---

Best regards.

-- 
Shingo KASHIMA <[email-masked]>
NTT Information Sharing Platform Lab.

---

From: Gerhard Muenz <[email-masked]>
Date: Wed, 08 Sep 2010 09:16:07 +0200

Dear Shingo,

The IE ID is <128, which indicates that this IE has been adopted from
NetFlow.v9. So, "second" seems to be historical.

At a moment, active/inactive timeout parameters in IPFIX-CONFIG have
unit "milliseconds":
http://tools.ietf.org/html/draft-ietf-ipfix-configuration-model-07#page-26

Probably, this should be changed to "seconds" for consistency with the
IPFIX-MIB?

Regards,
Gerhard

---

From: Shingo KASHIMA <[email-masked]>
Date: Sun, 12 Sep 2010 03:37:31 +0900

Dear Gerhard and all,

Thank you for reply.

I have understood why timeout parameter is "second".

I propose to add new IE of active timeout with a unit smaller than
a second e.g. flowActiveTimeoutMilliseconds and
flowActiveTimeoutMicroseconds
bacause I want to mesure traffic change for a short time with
IPFIX and PSAMP. I want to detect a bursty traffic in our network.
How do you think about my proposal ?

At the current moment, active/inactive timeout parameters in
IPFIX-CONFIG may be change to "seconds" for consistency with IPFIX-MIB.
When my proposal is accepted, the short timeout parameter should be
added to IPFIX-MIB and IPFIX-CONFG.

Best Regards,
Shingo.

On Wed, 08 Sep 2010 09:16:07 +0200