Subject: [Dots] A couple of comments on draft-fu-ipfix-network-security-00

From: Dave Dolson <[email-masked]>
Date: Tue, 24 Mar 2015 19:41:08 +0000

I haven't read the entire document, but I noticed a few things, some editorial.

Section 3.1.

-          Why no mention of ipv6 addresses or prefixes? Consider providing *only* ipv6, with IPv4-mapped IPv6 address (from RFC 2373) for IPv4.

-          There is an inconsistent use of 32-bit and 64-bit counters. If tcpSynTotalCount is 64 bits, probably octetUpstreamCount and octetDownstreamCount should also be 64 bits.

-          I don't understand how absolute timestamps flowStartMilliseconds and flowEndMilliseconds can be only 32-bit numbers.

-          Are fragmentIncomplete and fragmentFirstTooShort, etc. intended to be counters? They are 32-bits, but do not have "count" in their names.

-          fragmentOffestError is spelled wrong. Should be fragmentOffsetError. (or fragmentOffsetErrorCount).

David Dolson
Senior Software Architect
Sandvine

---

From: "Hedanping (Ana)" <[email-masked]>
Date: Wed, 25 Mar 2015 20:07:24 +0000

Hi Dave,

Thank you very much for the comments, please see my reply inline.

> -----Original Message-----

  > From: Dots [mailto:[email-masked]] On Behalf Of Dave Dolson

  > Sent: Wednesday, March 25, 2015 3:41 AM

  > To: [email-masked]<mailto:[email-masked]>

  > Subject: [Dots] A couple of comments on draft-fu-ipfix-network-security-00

  > I haven't read the entire document, but I noticed a few things, some

  > editorial.

  > - Why no mention of ipv6 addresses or prefixes? Consider providing *only*

  > ipv6, with IPv4-mapped IPv6 address (from RFC 2373) for IPv4.

Yes, IPv6 should be considered, IPFIX has ipv4 and ipv6 IEs defined separately. But *only* considering IPv6 and mapping IPv4 with IPv6 does not add to much value, except it can avoid using redundant data models,

  > - There is an inconsistent use of 32-bit and 64-bit counters. If

  > tcpSynTotalCount is 64 bits, probably octetUpstreamCount and

  > octetDownstreamCount should also be 64 bits.

  > - I don't understand how absolute timestamps flowStartMilliseconds and

  > flowEndMilliseconds can be only 32-bit numbers.

  > - Are fragmentIncomplete and fragmentFirstTooShort, etc. intended to be

  > counters? They are 32-bits, but do not have "count" in their names.

  > - fragmentOffestError is spelled wrong. Should be fragmentOffsetError. (or

  > fragmentOffsetErrorCount).

Yes, up/down stream counters should be 64 bits.

flowStartMilliseconds/ flowEndMilliseconds should belong to dateTimeMilliseconds.

Fragment parameters are counters with 32 bits, their names should be :

fragmentIncompleteCount

fragmentFirstTooShortCount

fragmentOffsetErrorCount

fragmentFlagErrorCount

The typos will be corrected in the next version.

Regards,

Ana