Subject: Re: [IPFIX] New Version Notification for draft-claise-export-application-info-in-ipfix-03.txt

From: Luca Deri <[email-masked]>
Date: Thu, 10 Nov 2011 23:59:21 +0100

Dear all,
IMHO it is important to standardize a way to export application information in IPFIX. This draft is a good starting point although I would like to see a way to export sub-protocol information. For instance today 'http' (as protocol) does not mean much, so I would like to be able to also add information about the sub-protocol (e.g. Facebook, Twitter, DropBox…). Not that IETF has to standardize such (extremely volatile) protocols, but perhaps add a sub-application tag I could use for that purpose.

In my open-source probe I already support export of application information, thus as soon as there is some consensus I would like to implement the draft.

Regards Luca

On Oct 31, 2011, at 12:35 AM, Benoit Claise wrote:

> Dear all, Dan
> 
> A new version of this draft has been posted.
> See http://tools.ietf.org/html/draft-claise-export-application-info-in-ipfix-03
> This is basically a clean up of the previous version.
> 
> Dan, 
> We would like to request an AD sponsored individual submission for this draft, if possible.
> 
> Regards, Paul, Nir, and Benoit.
> 
> -------- Original Message --------
> Subject:	New Version Notification for draft-claise-export-application-info-in-ipfix-03.txt
> Date:	Sun, 30 Oct 2011 16:29:36 -0700
> From:	[email-masked]
> To:	[email-masked]
> CC:	[email-masked], [email-masked], [email-masked]
> 
> A new version of I-D, draft-claise-export-application-info-in-ipfix-03.txt has been successfully submitted by Benoit Claise and posted to the IETF repository.
> 
> Filename:	 draft-claise-export-application-info-in-ipfix
> Revision:	 03
> Title:		 Export of Application Information in IPFIX
> Creation date:	 2011-10-30
> WG ID:		 Individual Submission
> Number of pages: 33
> 
> Abstract:
>         This document specifies an extension to the IPFIX information
>         model specified in [RFC5102] to export application information.
> 
> 
>      
>                                                                                   
> 
> 
> The IETF Secretariat
> 
> 
> 
> _______________________________________________
> IPFIX mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipfix

---

"Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it. - Brian W. Kernighan

---

From: Benoit Claise <[email-masked]>
Date: Sun, 13 Nov 2011 01:07:03 +0800

Hi Luca,
> IMHO it is important to standardize a way to export application information in IPFIX. This draft is a good starting point although I would like to see a way to export sub-protocol information. For…
Yes, you're right. The encoding should be done consistently in the 
industry. Note that the sub-application tag values can't be maintained 
by IANA since the application L7 can't be maintained by IANA.

> In my open-source probe I already support export of application information, thus as soon as there is some consensus I would like to implement the draft.
Actually, this draft is targeted for an Information RFC, so no real 
consensus is required. Hence the AD sponsored individual submission request.

Regards, Benoit.

---

From: Chris Inacio <[email-masked]>
Date: Sun, 13 Nov 2011 00:15:12 -0500

> In my open-source probe I already support export of application information, thus as soon as there is some consensus I would like to implement the draft.
Luca,

We also export application information in YAF.  I would love to coordinate with you and synchronize how we do it.

Software Engineering Institute is a sponsored research center at Carnegie Mellon University.  I would be more than happy to host a registry mechanism for the community.

For folks who have interest in requesting a registry element, but not publishing it, we can support that too, in order to avoid conflicts, but allow companies to innovate at their own pace.

If people are interested, I can put something together.

> Regards Luca

Regards,
Chris

---

From: Luca Deri <[email-masked]>
Date: Sun, 13 Nov 2011 09:19:20 +0100

Chris
If possible I would like to avoid fragmentation, thus I believe that given your offer it is important to synchronize us. Please send me more information about what you have in mind, and I will think about it. I have implemented application application detection in my probe, but not yet released, thus this is a good time for synching.

Cheers Luca 

Sent from my iPad