Subject: [IPFIX] What kind of flow record does LSN export?

From: Atsushi Kobayashi <[email-masked]>
Date: Sun, 21 Mar 2010 15:10:32 +0900

Hi all,

I am considering what kind of Flow Records LSN(Large Scale NAT) exports.
We had called it CGN(Carrier Grade NAT) at beginning.
http://tools.ietf.org/html/draft-nishitani-cgn-04

Section 7 in RFC5153 mentions the guideline for middlebox. In conclusion,
it recommends that we take side external or internal as Observation
Point, and then each field is distinguished to be changed or not to be
changed by prefix "post".

Generally, a NAT box has been located in a network periphery, in that
case, it is better to monitor internal or external side only.
However, LSN will be located in access side or in core side in carrier
network, the network operators should monitor both sides of network, and
also they needs to keep track Flows on both sides, and there are flows
without passing CGN box. It make more complicated situation.

I consider several Flow Records as follows.

         +----------------+
         |                |
-------->|    LSN Box     |--------->
     OP#1|                |OP#2
         +----------------+ 
     SrcIP#a               SrcIP#b 
     DstIP#d               DstIP#d 

To simplify my question, I omit src/dst port numbers on both side. 

a) Export two Flow Records 
- Flow#A {SrcIP#a, DstIP#d} from OP#1
- Flow#B {SrcIP#b, DstIP#d} from OP#2 
However, operator can not identify that both flows are identical. How to
correlate both Flow Records is not considered yet?

b) Export two Flow Records with flowId
- Flow#A {SrcIP#a, DstIP#d, flowId#b} from OP#1
- Flow#B {SrcIP#b, DstIP#d, flowId#b} from OP#2

We can correlate both Flow Records with flowId. 
However, "flowId" seem be assumed related Flow Records have same Flow
Key. Is it correct to use flowId? And if each entity on cache in
Metering Process is individual, it seem difficult to extract flowId
value.

c) Single Flow Record with "post" IEs
A CGN box originally has a cache for NAT. Thus, it becomes quite simple
to export its entity on cache directly. Several IEs have prefix "post"
IEs, and then we can use them.

- Flow { SrcIP#a, postSrcIP#b, DstIP#d }

But, actually, I can not find "postSourceIPvXAddress" and
"postDestinationIPvXAddress" in RFC5103.  

d) Single Flow Record by using structure data format
Can structured format be applited to it?

- Flow {(basicList, ORDERED, SrcIP#a, SrcIP#b), DstIP#d }

Let me know your thought. Do you have better solution?

Regards,
Atsushi

-- 
Atsushi Kobayashi <[email-masked]>