Subject: [OPSAWG] A proposal on draft-aitken-ipfix-unobserved-fields

From: "Wayne Tackabury" <[email-masked]>
Date: Mon, 5 Oct 2015 20:00:51 +0000

Hi all:

In work we are doing here, we have found rather compelling value, to put it mildly, in the scope and techniques which are covered in a draft which was submitted to the now-closed IPFIX working group,  draft-aitken-ipfix-unobserved-fields.  Its latest manifestation (as a -.03 rev) is to be found at https://datatracker.ietf.org/doc/draft-aitken-ipfix-unobserved-fields/.

This was submitting when the wg was in its closing throes.  HIstory from the list was unearthed by Paul Aitken indicating that the draft has value, but had not yet received sufficient list commentary to move forward, at the exact moment that wg closure was sought.

I have reached out to that original author and the wg chair, Benoit Claise, who is an active member of this area wg as well of course.  Benoit recommended that in the current state of the IPFIX wg, that I approach this area wg with an interest in revival and refinement of this draft (which I am willing to particpate in), with an eye towards its eventual elevation to be a companion to the other Proposed Standard RFCs produced by the IPFIX WG.

It is in that spirit I submit this post, I hope my protocol of approach is in order.  If there is another viable strategy for elevation of this draft than wg reactivation, please let me know.

Thanks in advance,

Wayne Tackabury

IBM Security Systems

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 5 Oct 2015 22:17:45 +0200

Wayne,

I agree that having a well-defined low-complexity mechanism to
indicate that certain values are missing would be valuable. I know
that some exporters simple report 0 for fields they have no value for
and this is really bad (unless 0 has been specifically reserved for
this purpose). So I support work in this space but I won't have much
time to be involved.

PS: We had a similar problem in SNMP land where agents reported 0 for
    counters they did not support and it has been effort to convince
    people to not report values for object instances that do not have
    a value; part of the problem were poorly written SNMP managers
    that could not deal with missing values. A good solution will be
    incrementally deployable, allowing those who care to do the right
    thing and those who prefer to not care to stay simple minded about
    null values (until they start to care).

On Mon, Oct 05, 2015 at 08:00:51PM +0000, Wayne Tackabury wrote:
>    Hi all:
> 
>    In work we are doing here, we have found rather compelling value, to put
>    it mildly, in the scope and techniques which are covered in a draft which
>    was submitted to the now-closed IPFIX working group,
>     draft-aitken-ipfix-unobserved-fields.  Its latest manifestation (as a
>    -.03 rev) is to be found at
>    [1]https://datatracker.ietf.org/doc/draft-aitken-ipfix-unobserved-fields/.
> 
>    This was submitting when the wg was in its closing throes.  HIstory from
>    the list was unearthed by Paul Aitken indicating that the draft has value,
>    but had not yet received sufficient list commentary to move forward, at
>    the exact moment that wg closure was sought.
> 
>    I have reached out to that original author and the wg chair, Benoit
>    Claise, who is an active member of this area wg as well of course.  Benoit
>    recommended that in the current state of the IPFIX wg, that I approach
>    this area wg with an interest in revival and refinement of this draft
>    (which I am willing to particpate in), with an eye towards its eventual
>    elevation to be a companion to the other Proposed Standard RFCs produced
>    by the IPFIX WG.
> 
>    It is in that spirit I submit this post, I hope my protocol of approach is
>    in order.  If there is another viable strategy for elevation of this draft
>    than wg reactivation, please let me know.
> 
>    Thanks in advance,
> 
>    Wayne Tackabury
>    IBM Security Systems
> 
> 
> References
> 
>    Visible links
>    1. https://datatracker.ietf.org/doc/draft-aitken-ipfix-unobserved-fields/

> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>