Subject: [IPFIX] IPFIX / Netflow

From: Juarez Paulino <[email-masked]>
Date: Sun, 4 Oct 2009 18:07:51 -0300

Hello friends,

I have a simple question and maybe a stupid one. Anyway, I will do this:

Why do ipfix implementations such as vermont, maji, YAF(silk) just
export ipfix messages and not netflow v9 messages?

I mean I know that such implementations - for those which implements a
simple capable collector - can aparently read netflow v9 messages or
at least show it on stdout. This is also vermont's case. But is there
any specific reason for not exporting?

Is there some legal restrictions with cisco? Or is just a matter of
estabilishing and defining only what is written on the most promising
standard (RFC 5101)??

I know the requirements about netflow v9 (RFC 3954) and IPFIX (RFC
5101) and also that IPFIX was an improvement standadization of netflow
v9. I know also some differences as a 16-bit field on the headers and
some not compatible information elements's id. But it all seems to be
easy to implement...

My main concerns is about a great fraction of users/clients whose have
only paid closed netflow v9 collectors and expects receiving netflow
v9 messages. I think that it would be great if some of these ipfix
implementations could also be exporting these messages.

Sorry if this is a irrelevant or repeated discussion, but I would
apreciate if someone clarify it to me.

Thanks all,

--
Juarez Paulino

---

From: Gerhard Muenz <[email-masked]>
Date: Mon, 05 Oct 2009 00:18:37 +0200

Hi Juarez,

I can talk for vermont only. We do not use any netflow v9 collectors
(apart from vermont itself), therefore we do not have this problem. But
vermont is an open-source project. So, if you want to implement a
Netflow.v9 exporter for vermont, you are very welcome to join the
developer team :)

BTW, there are netflow.v9 exporters out there (e.g., ntop).

Regards,
Gerhard

Juarez Paulino wrote:
> _______________________________________________
> IPFIX mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipfix

-- 
Dipl.-Ing. Gerhard Münz
Chair for Network Architectures and Services (I8)
Technische Universität München - Department of Informatics
Boltzmannstr. 3, 85748 Garching bei München, Germany
Phone:  +49 89 289-18008       Fax: +49 89 289-18033
E-mail: [email-masked]    WWW: http://www.net.in.tum.de/~muenz

---

From: Paul Aitken <[email-masked]>
Date: Mon, 05 Oct 2009 08:55:55 +0100

Juarez,

> [...]
> Is there some legal restrictions with cisco?

No. While Cisco holds patents pertaining to NFv9 export, we allow that:

   "If any claims of any issued Cisco patents are necessary for
    implementing this specification, any party will have the right to use
    any such patent claims under reasonable, non-discriminatory terms,
    with reciprocity, to implement and fully comply with the
    specification."

IPR for RFC 3954 can be found here:

https://datatracker.ietf.org/ipr/search/?option=rfc_search&rfc_search=3954

Cheers,
P.

-- 
Paul Aitken
Cisco Systems Ltd, Edinburgh, Scotland.

---

From: Juarez Paulino <[email-masked]>
Date: Mon, 5 Oct 2009 12:05:52 -0300

Thanks Gerhard,

I was looking for some implementations to ipfix and vermont really seems to
be a complete and easy-to-use one. I really like the way vermont is being
developed and maybe I'll be developing something with your developer team.

I'll keep contact if our group decide to be upgrading vermont's capabilities
in this way... =)

--
Juarez Paulino

On Sun, Oct 4, 2009 at 7:18 PM, Gerhard Muenz <[email-masked]> wrote:

> E-mail: [email-masked]    WWW: http://www.net.in.tum.de/~muenz<http://www.net.in.tum.de/%7Emuenz>
>

---

From: Juarez Paulino <[email-masked]>
Date: Mon, 5 Oct 2009 12:14:05 -0300

Thanks Paul,

This really simplifies things here. Now we're certainly about what we can
develop or use on ways to maintain compatibility between IPFIX and NFv9
standards.

--
Juarez Paulino

---

From: Paul Aitken <[email-masked]>
Date: Mon, 05 Oct 2009 18:20:41 +0100

Juarez,

> This really simplifies things here. Now we're certainly about what we 
> can develop or use on ways to maintain compatibility between IPFIX and 
> NFv9 standards.

Great!

Re: "I know also some differences as [...] some not compatible 
information elements's id.", which information elements were you 
thinking of?

We try to keep the NFv9 and IPFIX information elements as unified as 
possible. There are some NFv9 fields which we chose not to standardise 
in IPFIX only because they're quite proprietary to cisco and not very 
useful to anyone else.

---

From: Juarez Paulino <[email-masked]>
Date: Mon, 5 Oct 2009 19:09:18 -0300

I review the standards here, you're right. It's just some of reserved cisco
information elements. The most relevant and useful were made unified...

--
Juarez Paulino

On Mon, Oct 5, 2009 at 2:20 PM, Paul Aitken <[email-masked]> wrote:

> Re: "I know also some differences as [...] some not compatible information
> elements's id.", which information elements were you thinking of?
>
> possible. There are some NFv9 fields which we chose not to standardise in
> IPFIX only because they're quite proprietary to cisco and not very useful to
> anyone else.
>
>
> --
> Paul Aitken