Subject: [PSAMP] WG Last call for draft-ietf-psamp-info-07

From: Juergen Quittek <[email-masked]>
Date: Fri, 12 Oct 2007 12:56:05 +0200

Dear all,

A new revision of the PSAMP information model has been posted today.
Already the previous version was pretty stable.  For the new version
the authors have applied only minor fixes.

Now it's time for working group last call on this document.

Please read the draft and send us your comments to this list.
Please also send a message if you have read the draft and are fine
with it.

WG last call starts today and will end on Friday, October 26.

Thanks,

    Juergen

--On 12.10.07 05:00 -0400 [email-masked] wrote:

> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Packet Sampling Working Group of the IETF.
>
>
> 	Title           : Information Model for Packet Sampling Exports
> 	Author(s)       : T. Dietz, et al.
> 	Filename        : draft-ietf-psamp-info-07.txt
> 	Pages           : 48
> 	Date            : 2007-10-12
>
> This memo defines an information model for the Packet Sampling
> (PSAMP) protocol.  It is used by the PSAMP protocol for encoding
> sampled packet data and information related to the sampling process.
> As the PSAMP protocol is based on the IPFIX protocol, this
> information model is an extension to the IPFIX information
> model.Conventions used in this document
>
> The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
> "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
> document are to be interpreted as described in RFC 2119 [RFC2119].
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-psamp-info-07.txt
>
> To remove yourself from the I-D Announcement list, send a message to
> [email-masked] with the word unsubscribe in the body of
> the message.
> You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
> to change your subscription settings.
>
> Internet-Drafts are also available by anonymous FTP. Login with the
> username "anonymous" and a password of your e-mail address. After
> logging in, type "cd internet-drafts" and then
> 	"get draft-ietf-psamp-info-07.txt".
>
> A list of Internet-Drafts directories can be found in
> http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
> Internet-Drafts can also be obtained by e-mail.
>
> Send a message to:
> 	[email-masked].
> In the body type:
> 	"FILE /internet-drafts/draft-ietf-psamp-info-07.txt".
>
> NOTE:   The mail server at ietf.org can return the document in
> 	MIME-encoded form by using the "mpack" utility.  To use this
> 	feature, insert the command "ENCODING mime" before the "FILE"
> 	command.  To decode the response(s), you will need "munpack" or
> 	a MIME-compliant mail reader.  Different MIME-compliant mail readers
> 	exhibit different behavior, especially when dealing with
> 	"multipart" MIME messages (i.e. documents which have been split
> 	up into multiple messages), so check your local documentation on
> 	how to manipulate these messages.
>
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.

-- 
Juergen Quittek        [email-masked]       Tel: +49 6221 4342-115
NEC Europe Limited,    Network Laboratories        Fax: +49 6221 4342-155
Kurfuersten-Anlage 36, 69115 Heidelberg, Germany   http://www.netlab.nec.de
Registered Office: NEC House, 1 Victoria Road, London W3 6BL, UK
Registered in England 2832014

_______________________________________________
PSAMP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/psamp

---

From: Juergen Quittek <[email-masked]>
Date: Mon, 22 Oct 2007 17:14:44 +0900

Dear all,

The WGLC on this document lasts until the end of this week.

However, I will not close the call without knowing of at least
three solid reviews from non-authors.

Please have a look at it and tell us what you think.

Thanks,

    Juergen

---

From: Gerhard Muenz <[email-masked]>
Date: Wed, 24 Oct 2007 11:31:54 +0200

Dear all,

I reviewed the PSAMP information model draft.

I'll start with some small remarks before asking if anybody else shares
my interest in an additional *Section IE (see below).

-------

IPFIX information model does not have a terminology section, but the
PSAMP information does. How comes this difference?
On the other hand, you do not repeat the IE properties and the type
space from the IPFIX documents.

-------

In sections 1 and 5, you find occurrences of
"information element(s)" => Information Element(s)

-------

You find both writing:
"IPFIX Information Model" and "IPFIX information model"
but only
"PSAMP information model"
Try to be more consistent?

-------

Section 3:
IPFIX export protocol => IPFIX protocol

-------

Section 3.2:
small remark:
Selection Process is the only process name in PSAMP/IPFIX that does not
use the -ing form (ExportING Process etc.). Intended?

-------

This concerns all "*Section" IEs:
"If insufficient octets are available for the length specified in
 the Template, the Information Element MUST NOT be padded."
What is the consequence? The Template cannot be used. Maybe make a
clearer statement here?

-------

section 9:
"Specifically, the Information Elements pertaining to packet sections
MUST target no more than the packet header, some subsequent bytes of
the packet, and encapsulating headers if present.  Full packet
capture of arbitrary packet streams is explicitly out of scope, per
[RFC2804]."

What does "out of scope" mean? The PSAMP information model enables full
packet capture and export, although it may not be the intended usage.

Maybe formulation is based on a political decision. But if you compare
it to Cisco's presentation of Flexible NetFlow, you find the following
sentence:
"Flexible NetFlow adds capabilities such as packet section export for
deep packet inspection of security incidents."
http://www.cisco.com/en/US/products/ps6601/products_data_sheet0900aecd804b590b.html

Similarly, I assume that in practice, PSAMP will be used for deep packet
inspection as well.

-------

Now comes my question about an additional IE for the export of transport
layer payload section, which would complement the current set of
*Section IEs.

A technical argument against a transportPayloadSection IE is the PSAMP
device might not be able to decode any transport protocol. Yet, in
practice, only three transport protocols are used: TCP, UDP, SCTP. And
IPFIX/PSAMP devices are able to decode these transport protocols anyway
in order to extract transport header fields. So, the usage of the IE
could be restricted to these transport protocols.

I raised this question already in February 2006 on the mailing list:
http://www1.ietf.org/mail-archive/web/psamp/current/msg00221.html
At that time, nobody else seemed to be interested in this additional IE.
Maybe the situation has changed in the meantime.

Best regards,
Gerhard