Subject: [IPFIX] Problems with Flow Collection in large-scale networks: feedback

From: Benoit Claise <[email-masked]>
Date: Sun, 09 Mar 2008 22:44:22 -0400

Kobayashi-san,

I think the draft improved compared to last time.

Here is my feedback.

- In the terminology section, you're missing a reference to the 
terminology from RFC5101, since you capitalized some of the terms.
-

         The
         second is changing the Template and record structure by adding/
         deleting specified Information Elements.  Example devices for
         this type are the IPFIX Masquerading Proxy and the IPFIX
         Concentrator.
NEW
	The
         second is changing the Template and record structure by adding/
         aggregating/deleting specified Information Elements.  Example devices for
         this type are the IPFIX Masquerading Proxy and the IPFIX
         Concentrator.

- Section 3.1. You mentioned sampling rate of 1/1000 to 1/1000. I've 
seen 1/100
- Section 3.1. You're missing an important application -> data retention.
- Section 4. twice the same idea in the following sentences

   It should be noted that the
   current sampling rate might become infeasible for Exporters within
   the next five years.  We expect to encounter this problem within the
   next five years in large-scale networks.

- I would develop further the section 4.2 to express that there is a 
different approach than exporting complete flow records to a mediation 
device, which in turn does some aggregation/filtering. I mean, the 
router have several different caches, each optimized for a specific 
application. So each cache has its own series of flow keys. And the 
content of each cache is sent to a specific collector. For example, a 
collector for security, another one for capacity planning, etc...
- Section 4.4 "In general, load balancing allows work of Collectors to 
be divided. Classifying Flow Records based on the value of specified 
Information Elements can prove to be very useful to achive scalability. 
" This is not load balancing, as the title says.
- I would add a new section 4.5 "Flow based sampling"
- section 5.1 "Implementing load balancing"

   "There currently is no description of a classification function in
   IPFIX."

This is normal as IPFIX is the export protocol. You speak about a 
specific feature of the Exporting Process that would use RFC5101

   "According to the current specification, Exporters send all
   Flow Records to multiple Collectors and Collectors drop uninteresting
   Flow Records to reduce their load."

This is wrong.
-

   "The Collector, however, needs to recognize the
   precise Observation Point whether Flow Records go through an IPFIX
   Mediator or not."

This is not always true. The answer is: it depends.
For example, for the core traffic matrix in capacity planning, having 
the router exporting the flow records is enough.
- section 5.6 "session management"
You want to talk about transport session, right? (to refer to RFC5101)
This session is confusing. After reading several times, I understand 
that you speak about the Collecting and Exporting Processes of the 
mediation device.
- section 5.6

   "If the session
   between a Router and a Mediator fails and the IPFIX Mediator shuts
   down the session between the Collector and the Mediator, the
   Collector would futilely continue to try to establish the session."

   "If
   one of these sessions between Routers and the Mediator fails and
   IPFIX Mediator shuts down the session between a Collector and the
   Mediator, other sessions between the Routers and the Mediator would
   not be relayed at all."

Not necessarily. It depends how we write the specifications.
- Section 5.6, last paragraph.

   "Even if one session is reset,
   the status of the other sessions is kept.  However, if Templates that
   reset the session of Collecting Processes would not be withdrawn,
   there is a possibility that assigned Template IDs overlap.  The
   Collector might then shut down IPFIX session, because it identifies
   the overlapping Template ID as part of an anomalous message.  In the
   case of resetting a session of the Collecting Process, the operation
   processed by IPFIX Mediator should be defined."

This is wrong IMHO. The mediation device should take care of the management of NEW templates. We can't rely on the template id received.

Regards, Benoit.

_______________________________________________
IPFIX mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipfix