Subject: Decopling Ruleset from Meter Reader

From: "Vidya Phalke" <[email-masked]>
Date: Mon, 10 Dec 2001 09:47:21 -0800

Folks, at Network Robots, CA we are implementing Rtfm in our
hardware as a mechanism for tracking flows. We seem to be looking
at the meter+reader in a slightly different way and would appreciate
your comments. 

In the current NetraMet implementation v4.3, the lifespan of a ruleset
is attached to a reader. I, on the other hand, see the meter (NetraMet)
and the reader (NeMaC) as two apps that fall under two totally different
mgmt and maintenance domains (us versus customer !)

The meter is part of the hardware element (snmp agent) and the reader
is typically part of a BSS/OSS platform or a mediation system. This
decoupling is important because as a hardware vendor we do not have the
resources to collect and write files and do backups etc on our box.

Once the decoupling is done, we get the following key requirement on
the Rtfm agent, namely:

The agent can not stop recording flow records simply because there
is no reader. This is critical since the flow records are potentially
meant for billing and the reader could be down for BSS/OSS upgrade.

So the possible solutions are:
1. Leave the state of the reader as part of the MIB (as done in the
   current implementation of NeMaC) but do not delete the ruleset
   and flow records upon exiting NeMaC.
2. Install the ruleset separately and then ask NeMaC to read from
   that ruleset, from a specific time.

#1 is not very elegant since it is keeping the state of a remote
reader in its repository.

#2 is clean because all the NeMaC user has to remember when shutting
down NeMaC is the last timestamp (which can be saved locally)

#2 makes the system more secure. The ruleset would need to be written
via the private community, but the reading (i.e. NeMaC) will be done
on the public community. (So only the ruleset savvy people on the
customer site can install rules :)

The only issue then remains is garbage collection, since we want to
rotate out old flows when the flow table fills up. That can be done
simply by fixing the way "old" flows are marked.

-Vidya Phalke, PhD
 Senior NMS Engineer
 Network Robots, Inc.
 Pleasanton, CA
 http://www.networkrobots.com