Subject: [IPFIX] clarification questions

From: ramki Krishnan <[email-masked]>
Date: Wed, 27 Mar 2013 10:40:19 -0700

Dear IPFIX experts,

>From RFC 6728,

1.       Section 4.3.2

o   Is there a way to periodically export the flows if we are using a TimeoutCache or NaturalCache ?

2.       Suppose we want to populate the cache only with long-lived large flows (see Note1  below for data model definitions)

o   One way to achieve this would be to have a selection process, using a unique observation domain, which filters the long-lived large flows. Are any other better ways ?

3.       Continuing from 3) - suppose we want to sample the other flows (not the long-lived large flows)

o   Is there a way to not include the long-lived large flows in the selection process ?

Note 1:

-          observationInterval: The minimum time interval to observe a flow for performing further processing of the flow. Unit is in seconds.

-          bandwidthThreshold: The minimum bandwidth of the flow during the observation interval for declaring the flow a long-lived large flow. Unit is in Mbps.
For example, a flow which is at or above 10 Mbps (bandwidthThreshold )for a time period of at least 30 seconds (observationInterval) could be declared a long-lived large flow.

--
Thanks,
Ram (aka Ramki)

---

From: Andrew Feren <[email-masked]>
Date: Wed, 27 Mar 2013 14:10:35 -0400

Hi Ram,

On 03/27/2013 01:40 PM, ramki Krishnan wrote:
>
> Dear IPFIX experts,
>
> From RFC 6728,
>
> 1.Section 4.3.2
>
> oIs there a way to periodically export the flows if we are using a 
> TimeoutCache or NaturalCache ?
>

Maybe I'm not understanding your question, but periodic export of flows 
is exactly what I would expect with with a TimeoutCache or 
NaturalCache.  After an activeTimeout, for example, flows are exported 
with the observed values for that inteverval (using IEs with 
deltaCounter semantics for any counters).

> 2.Suppose we want to populate the cache only with long-lived large 
> flows (see Note1  below for data model definitions)
>
> oOne way to achieve this would be to have a selection process, using a 
> unique observation domain, which filters the long-lived large flows. 
> Are any other better ways ?
>
> 3.Continuing from 3) - suppose we want to sample the other flows (not 
> the long-lived large flows)
>
> oIs there a way to not include the long-lived large flows in the 
> selection process ?
>

What are you trying to accomplish?  This feels like a catch-22 to me.  
Do you intend to sample all flows until they cross some threshold?  
Based on your description I'm not sure how you would know a flow was 
long lived until after observationInterval and/or bandwidthThreshold.

-Andrew

> Note 1:
>
> -observationInterval: The minimum time interval to observe a flow for 
> performing further processing of the flow. Unit is in seconds.
>
> -bandwidthThreshold: The minimum bandwidth of the flow during the 
> observation interval for declaring the flow a long-lived large flow. 
> Unit is in Mbps.
>
> For example, a flow which is at or above 10 Mbps (bandwidthThreshold 
> )for a time period of at least 30 seconds (observationInterval) could 
> be declared a long-lived large flow.
>
> --
>
> Thanks,
>
> Ram (aka Ramki)
>
>
>
> _______________________________________________
> IPFIX mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipfix

---

From: Gerhard Muenz <[email-masked]>
Date: Wed, 27 Mar 2013 22:21:43 +0100

Hi Ram,

The configuration model of RFC 6728 does not cover flow selection. If 
you want to configure something like flow selection, you need to extend 
the model.

It seems that your actual question is how flow selection fits into the 
IPFIX device architecture which has been taken as a basis for RFC 6728. 
Concretely, you seem to wonder  whether your flow selection is a kind of 
Selection Process or a new kind of Cache (or maybe both?).

I cannot answer this question because I do not know how it would be 
implemented.

Regarding your question:
- With TimeoutCache and NaturalCache, the Flow is only exported when it 
is expired. At expiration, the Flow is immediately removed from the 
Cache. A longlasting flow will result in a new Flow being created in the 
Cache.
- It's different with PermanentCache. Here, the Flow remains in the 
Cache, and the status is periodically exported.

Regards,
Gerhard

---

From: ramki Krishnan <[email-masked]>
Date: Thu, 28 Mar 2013 14:06:04 -0700

Hi Gerhard,

Thanks a lot. More below.

>>- With TimeoutCache and NaturalCache, the Flow is only exported when it is expired. At expiration, the Flow is immediately removed from the Cache. A longlasting flow will result in a new Flow being created in the Cache.
For applications, especially security, it would be worthwhile to periodically export the flow for monitoring purposes. We could add an optional "exportInterval" parameter similar to PermanentCache for this. Your comments/thoughts would be appreciated.

Hi Gerhard/All,

>>It seems that your actual question is how flow selection fits into the IPFIX device architecture which has been taken as a basis for RFC 6728. Concretely, you seem to wonder  whether your flow selection is a kind of Selection Process or a new kind of Cache (or maybe both?).

The new data models I am trying to specify are based on the following draft and presentation at the IETF Orlando meeting.  It seems to me that a good starting point is specifying a new flow selection process. Your comments/thoughts would be appreciated.

http://www.ietf.org/proceedings/86/slides/slides-86-ipfix-1.pptx
http://datatracker.ietf.org/doc/draft-krishnan-ipfix-flow-aware-packet-sampling/

Thanks,
Ramki

From: Gerhard Muenz [mailto:[email-masked]]
Sent: Wednesday, March 27, 2013 2:22 PM
To: ramki Krishnan
Cc: IPFIX Working Group; Ning So
Subject: Re: [IPFIX] clarification questions

Hi Ram,

The configuration model of RFC 6728 does not cover flow selection. If you want to configure something like flow selection, you need to extend the model.

It seems that your actual question is how flow selection fits into the IPFIX device architecture which has been taken as a basis for RFC 6728. Concretely, you seem to wonder  whether your flow selection is a kind of Selection Process or a new kind of Cache (or maybe both?).

I cannot answer this question because I do not know how it would be implemented.

Regarding your question:
- With TimeoutCache and NaturalCache, the Flow is only exported when it is expired. At expiration, the Flow is immediately removed from the Cache. A longlasting flow will result in a new Flow being created in the Cache.
- It's different with PermanentCache. Here, the Flow remains in the Cache, and the status is periodically exported.

Regards,
Gerhard

1.      Section 4.3.2

Note 1:

--
Thanks,
Ram (aka Ramki)

IPFIX mailing list

[email-masked]<mailto:[email-masked]>