Subject: [IPFIX] review: draft-sommer-ipfix-richtemplate-00.txt

From: Paul Aitken <[email-masked]>
Date: Thu, 10 Jul 2008 17:53:09 +0100

Chaps,

Interesting draft. Please find some feedback inline.

> Network Working Group                                          C. Sommer
> Internet-Draft                                               F. Dressler
> Intended status: Informational                            Univ. Erlangen
> Expires: January 8, 2009                                        G. Muenz
>                                                          Univ. Tuebingen
>                                                             July 7, 2008
> 
> 
>            Rich Template Set Extension to the IPFIX Protocol
>                 <draft-sommer-ipfix-richtemplate-00.txt>
> 
> Status of this Memo
> 
>    By submitting this Internet-Draft, each author represents that any
>    applicable patent or other IPR claims of which he or she is aware
>    have been or will be disclosed, and any of which he or she becomes
>    aware will be disclosed, in accordance with Section 6 of BCP 79.
> 
>    Internet-Drafts are working documents of the Internet Engineering
>    Task Force (IETF), its areas, and its working groups.  Note that
>    other groups may also distribute working documents as Internet-
>    Drafts.
> 
>    Internet-Drafts are draft documents valid for a maximum of six months
>    and may be updated, replaced, or obsoleted by other documents at any
>    time.  It is inappropriate to use Internet-Drafts as reference
>    material or to cite them other than as "work in progress."
> 
>    The list of current Internet-Drafts can be accessed at
>    http://www.ietf.org/ietf/1id-abstracts.txt.
> 
>    The list of Internet-Draft Shadow Directories can be accessed at
>    http://www.ietf.org/shadow.html.
> 
>    This Internet-Draft will expire on January 8, 2009.
> 
> Abstract
> 
>    This draft describes the Rich Template Set, a Template Set for the
>    IPFIX Protocol, as well as its respective Template Records.  One
>    possible application domain for this new Set is the transport of
>    IPFIX Flow Mediation selection criteria.  In comparison to the use of
>    Common Properties, the use of Rich Template Sets reduces the overhead
>    of repeated transmissions and makes data transmissions more robust
>    against failures.
> 
> 
> 
> 
> 
> 
> Sommer, et al.   draft-sommer-ipfix-richtemplate-00.txt         [Page 1]
> 
> Internet-Draft      Rich Template Set IPFIX Extension          July 2008
> 
> 
> Table of Contents
> 
>    1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
>    2.  Rich Template  . . . . . . . . . . . . . . . . . . . . . . . .  4
>    3.  Use of the Rich Template in Flow Aggregation . . . . . . . . .  7
>    4.  Security considerations  . . . . . . . . . . . . . . . . . . .  9
>    5.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . .  9
>    6.  Normative References . . . . . . . . . . . . . . . . . . . . .  9
>    Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 10
>    Intellectual Property and Copyright Statements . . . . . . . . . . 11
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> Sommer, et al.   draft-sommer-ipfix-richtemplate-00.txt         [Page 2]
> 
> Internet-Draft      Rich Template Set IPFIX Extension          July 2008
> 
> 
> 1.  Introduction
> 
>    IPFIX supports the concept of a Mediator, a device that receives,
>    transforms, and exports data streams using IPFIX.  A major
>    requirement of flow mediation is the reduction of the volume of IPFIX
>    traffic by discarding and aggregating received information.
>    [I-D.dressler-ipfix-aggregation] describes how pattern matching is
>    used for flow aggregation.  The draft also outlines how to select
>    flows and subsequently communicate the selection criteria to an IPFIX
>    Collector, using Common Properties of the resulting Compound Flows to
>    describe these attributes.  In order to avoid the overhead of the
>    repeated transmissions of all Common Properties (or their
>    identifiers) in all Flow Records, a new Template Set, the Rich
>    Template Set, is introduced.  This Template Set allows an Exporting
>    Process to simultaneously declare and transmit Common Properties to a
>    receiver.
> 
>    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
>    "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
>    document are to be interpreted as described in [RFC2119].
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> Sommer, et al.   draft-sommer-ipfix-richtemplate-00.txt         [Page 3]
> 
> Internet-Draft      Rich Template Set IPFIX Extension          July 2008
> 
> 
> 2.  Rich Template
> 
> 
>      0                   1                   2                   3
>      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |          Set ID = 4           |          Length               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      |                     Rich Template Record 1                    |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      |                              ...                              |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      |                     Rich Template Record N                    |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                          Padding (opt)                        |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> 
>                     Figure 1: Rich Template Set Format
> 
>    The basic format of a Rich Template Set is shown in Figure 1.  It is
>    the same as that of a Template Set defined in [RFC5101], except for a
>    different Set ID.

I'd prefer to see the pertinent fields specified at this point rather
than below figure 2.

> 
>    The format of individual Rich Template Records, however, differs from
>    that of Template Records and is shown in Figure 2.
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> Sommer, et al.   draft-sommer-ipfix-richtemplate-00.txt         [Page 4]
> 
> Internet-Draft      Rich Template Set IPFIX Extension          July 2008
> 
> 
>      0                   1                   2                   3
>      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |  Template ID (> 255)          |  Field Count                  |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |  Data Count                   |  Common Properties ID         |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      |                       Field 1 Specifier                       |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      |                              ...                              |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      |                       Field N Specifier                       |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      |                        Data 1 Specifier                       |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      |                              ...                              |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      |                        Data M Specifier                       |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      |                          Data 1 Value                         |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      |                              ...                              |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      |                          Data M Value                         |
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> 
>                    Figure 2: Rich Template Record Format

It might be more logical to put each "Data M Value" right after each
"Data M Specifier" to make a list of {T,L,V} tuples, rather than {T,L}, 
{T,L}, {T,L}, .... {V}, {V}, {V}.

> 
> 
> 
> 
> 
> 
> Sommer, et al.   draft-sommer-ipfix-richtemplate-00.txt         [Page 5]
> 
> Internet-Draft      Rich Template Set IPFIX Extension          July 2008
> 
> 
>    The Rich Template Set field definitions are as follows:
> 
>    Set ID
>       Type of this Template Set. A Set ID value of 4 is proposed for the
>       Rich Template Set.
> 
>    Length
>       Total length of this set in bytes, as defined in [RFC5101].
> 
>    Padding
>       OPTIONAL padding, as defined in [RFC5101].

I'd prefer to move the above field definitions to above figure 2.

>    The Rich Template Record field definitions are as follows:
> 
>    Template ID
>       Template ID of this Rich Template Record.  As defined in
>       [RFC5101], this value MUST be greater than 255.
> 
>    Field Count
>       Number of regular fields that will be sent in subsequent Data
>       Records using this Template, as defined in [RFC5101].
> 
>    Data Count
>       Number of fixed-value fields that will be sent in this Template.
> 
>    Common Properties ID
>       Contains an identifier that can be referred to by
>       commonPropertiesId Information Elements, as introduced in
>       [I-D.ietf-ipfix-reducing-redundancy].
> 
>    Field N Specifier
>       Information Element identifier, Field length and an Enterprise
>       Number (if applicable) of field N. Refer to [RFC5101] for more
>       information on Field Specifiers.
> 
>    Data M Specifier
>       Same as "Field N Specifier", but used for Common Properties of all
>       Data Records of this Template.  Together with Data M Value, a
>       similar encoding like TLV (type-length-value) is achieved.
> 
>    Data M Value
>       Bit representation of a Common Property as would be transmitted in
>       a Data Record.
> 
> 
> 
> 
> 
> 
> 
> 
> Sommer, et al.   draft-sommer-ipfix-richtemplate-00.txt         [Page 6]
> 
> Internet-Draft      Rich Template Set IPFIX Extension          July 2008
> 
> 
> 3.  Use of the Rich Template in Flow Aggregation
> 
>    The Rich Template is well-suited for use in flow aggregation, as
>    introduced in [I-D.dressler-ipfix-aggregation].  Table 1 illustrates
>    the relationship between a flow aggregator's field modifiers and
>    patterns on the one hand, and the resulting regular and fixed-value
>    fields in the Rich Template on the other hand.  It can be seen that
>    the analyzer is able to deduce all instructions of the Aggregation
>    Rule considering the structure of the Rich Template, except the
>    combination "discard without pattern" that does not result in any
>    field.
> 
>    +----------+---------+------------------------+---------------------+
>    | field    | pattern | field in Flow Record   | fixed-value field   |
>    | modifier |         |                        | in Rich Template    |
>    +----------+---------+------------------------+---------------------+
>    | discard  | no      | N/A                    | N/A                 |
>    | discard  | yes     | N/A                    | yes, contains       |
>    |          |         |                        | pattern             |
>    | keep     | no      | yes                    | N/A                 |
>    | keep     | yes     | yes, if pattern        | yes, contains       |
>    |          |         | specifies a range of   | pattern             |
>    |          |         | values                 |                     |
>    | mask     | no      | yes, IP network        | N/A                 |
>    |          |         | address                |                     |
>    | mask     | yes     | yes, IP network        | yes, contains       |
>    |          |         | address                | pattern             |
>    +----------+---------+------------------------+---------------------+
> 
>      Table 1: Relation between field modifiers, Flow Records, and Rich
>                                  Templates
> 
>    Assume, for example, the concentrator was given the Aggregation Rule
>    shown in Table 2.
> 
>          +-------------------------+--------------+-------------+
>          | IPFIX Field             | Filtering    | Aggregation |
>          +-------------------------+--------------+-------------+
>          | sourceIPv4Address       | 192.0.2.0/28 | discard     |
>          | destinatonTransportPort |              | keep        |
>          | packetDeltaCount        |              | aggregate   |
>          +-------------------------+--------------+-------------+
> 
>                            Table 2: Example Rule
> 
> 
> 
> 
> 
> 
> 
> Sommer, et al.   draft-sommer-ipfix-richtemplate-00.txt         [Page 7]
> 
> Internet-Draft      Rich Template Set IPFIX Extension          July 2008
> 
> 
>    Based on the Aggregation Rule, the concentrator would now first send
>    a corresponding Rich Template Record as shown in Table 3.
> 
>                 +----------------------+------------------+
>                 | Field                | Value            |
>                 +----------------------+------------------+
>                 | Template ID          | 10001            |
>                 | Field Count          | 2                |
>                 | Data Count           | 2                |
>                 | Common Properties ID | 0                |
>                 | Field 1 Type         | Destination Port |
>                 | Field 2 Type         | Packets          |
>                 | Data 1 Type          | Source IP Prefix |
>                 | Data 2 Type          | Source IP Mask   |
>                 | Data 1 Value         | 192.0.2.0        |
>                 | Data 2 Value         | 28               |
>                 +----------------------+------------------+
> 
>                         Table 3: Rich Template used
> 
>    Assume further that the concentrator receives the Flow Records shown
>    in Table 4.
> 
>    +-------------+-----------+--------------+----------------+---------+
>    | Source IP   | Source    | Destination  | Destination    | Packets |
>    |             | Port      | IP           | Port           |         |
>    +-------------+-----------+--------------+----------------+---------+
>    | 192.0.2.1   | 64235     | 192.0.2.101  | 80             | 10      |
>    | 192.0.2.2   | 64236     | 192.0.2.102  | 110            | 10      |
>    | 192.0.2.3   | 64237     | 192.0.2.103  | 80             | 10      |
>    | 192.0.2.101 | 64238     | 192.0.2.1    | 80             | 10      |
>    | 192.0.2.102 | 64239     | 192.0.2.2    | 80             | 10      |
>    +-------------+-----------+--------------+----------------+---------+
> 
>                           Table 4: Incoming Flows
> 
>    The concentrator would then export Data Records of this type, which
>    contain the Compound Flows resulting from aggregation.  Note that the
>    Flows' Common Property, having a source IP address in 192.0.2.0/28,
>    was already transmitted in the Rich Template Record and is thus not
>    included in Data Records.
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> Sommer, et al.   draft-sommer-ipfix-richtemplate-00.txt         [Page 8]
> 
> Internet-Draft      Rich Template Set IPFIX Extension          July 2008
> 
> 
>    The exported Data Records, shown in Table 5, only contain the
>    aggregated packet counts and the destination port, the latter being
>    the only discriminating Flow Key property.
> 
>                       +------------------+---------+
>                       | Destination Port | Packets |
>                       +------------------+---------+
>                       | 80               | 20      |
>                       | 110              | 10      |
>                       +------------------+---------+
> 
>                          Table 5: Aggregated Flows
> 
> 

Some example Rich Template Records would be perfect!

P.

> 4.  Security considerations
> 
>    This document introduces a new IPFIX Template Set, a variation on the
>    Template Set and data types introduced in [RFC5101] and
>    [I-D.ietf-ipfix-reducing-redundancy].  No additional security
>    considerations apply.
> 
> 
> 5.  IANA Considerations
> 
>    Use of the Rich Template Set requires one new IPFIX Set ID to be
>    assigned.
> 
> 
> 6.  Normative References
> 
>    [I-D.dressler-ipfix-aggregation]
>               Dressler, F., "IPFIX Aggregation",
>               draft-dressler-ipfix-aggregation-05 (work in progress),
>               July 2008.
> 
>    [I-D.ietf-ipfix-reducing-redundancy]
>               Boschi, E., "Reducing Redundancy in IP Flow Information
>               Export (IPFIX) and Packet  Sampling (PSAMP) Reports",
>               draft-ietf-ipfix-reducing-redundancy-04 (work in
>               progress), May 2007.
> 
>    [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
>               Requirement Levels", BCP 14, RFC 2119, March 1997.
> 
>    [RFC5101]  Claise, B., "Specification of the IP Flow Information
>               Export (IPFIX) Protocol for the Exchange of IP Traffic
>               Flow Information", RFC 5101, January 2008.
> 
> 
> 
> 
> Sommer, et al.   draft-sommer-ipfix-richtemplate-00.txt         [Page 9]
> 
> Internet-Draft      Rich Template Set IPFIX Extension          July 2008
> 
> 
> Authors' Addresses
> 
>    Christoph Sommer
>    University of Erlangen-Nuremberg
>    Department of Computer Science 7
>    Martensstr. 3
>    Erlangen  91058
>    Germany
> 
>    Phone: +49 9131 85-27993
>    Email: [email-masked]
>    URI:   http://www7.informatik.uni-erlangen.de/~sommer/
> 
> 
>    Falko Dressler
>    University of Erlangen-Nuremberg
>    Department of Computer Science 7
>    Martensstr. 3
>    Erlangen  91058
>    Germany
> 
>    Phone: +49 9131 85-27914
>    Email: [email-masked]
>    URI:   http://www7.informatik.uni-erlangen.de/
> 
> 
>    Gerhard Muenz
>    University of Tuebingen
>    Computer Networks and Internet
>    Sand 13
>    Tuebingen  72076
>    Germany
> 
>    Phone: +49 7071 29-70534
>    Email: [email-masked]
>    URI:   http://net.informatik.uni-tuebingen.de/
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> Sommer, et al.   draft-sommer-ipfix-richtemplate-00.txt        [Page 10]
> 
> Internet-Draft      Rich Template Set IPFIX Extension          July 2008
> 
> 
> Full Copyright Statement
> 
>    Copyright (C) The IETF Trust (2008).
> 
>    This document is subject to the rights, licenses and restrictions
>    contained in BCP 78, and except as set forth therein, the authors
>    retain all their rights.
> 
>    This document and the information contained herein are provided on an
>    "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
>    OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
>    THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
>    OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
>    THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
>    WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
> 
> 
> Intellectual Property
> 
>    The IETF takes no position regarding the validity or scope of any
>    Intellectual Property Rights or other rights that might be claimed to
>    pertain to the implementation or use of the technology described in
>    this document or the extent to which any license under such rights
>    might or might not be available; nor does it represent that it has
>    made any independent effort to identify any such rights.  Information
>    on the procedures with respect to rights in RFC documents can be
>    found in BCP 78 and BCP 79.
> 
>    Copies of IPR disclosures made to the IETF Secretariat and any
>    assurances of licenses to be made available, or the result of an
>    attempt made to obtain a general license or permission for the use of
>    such proprietary rights by implementers or users of this
>    specification can be obtained from the IETF on-line IPR repository at
>    http://www.ietf.org/ipr.
> 
>    The IETF invites any interested party to bring to its attention any
>    copyrights, patents or patent applications, or other proprietary
>    rights that may cover technology that may be required to implement
>    this standard.  Please address the information to the IETF at
>    [email-masked].
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> Sommer, et al.   draft-sommer-ipfix-richtemplate-00.txt        [Page 11]
> 

-- 
Paul Aitken
Cisco Systems Ltd, Edinburgh, Scotland.

_______________________________________________
IPFIX mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipfix