Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m6VGdH3u013963 for ; Thu, 31 Jul 2008 18:39:22 +0200 Received: from localhost (demetrius1.jacobs-university.de [212.201.44.46]) by hermes.jacobs-university.de (Postfix) with ESMTP id 65A26C003F; Thu, 31 Jul 2008 18:39:17 +0200 (CEST) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius1.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id m8y-pf++Sv-j; Thu, 31 Jul 2008 18:39:11 +0200 (CEST) Received: from elstar.local (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 036FDC0036; Thu, 31 Jul 2008 18:39:10 +0200 (CEST) Received: by elstar.local (Postfix, from userid 501) id C2DF867F80C; Thu, 31 Jul 2008 18:39:09 +0200 (CEST) Date: Thu, 31 Jul 2008 18:39:09 +0200 From: Juergen Schoenwaelder To: Ramin Sadre Subject: Re: [nmrg] Netflow/IPFIX workshop: information and request for feedback Message-ID: <20080731163909.GD24304@elstar.local> Mail-Followup-To: Ramin Sadre , nmrg@ibr.cs.tu-bs.de References: <4891DC28.5030908@ewi.utwente.nl> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4891DC28.5030908@ewi.utwente.nl> User-Agent: Mutt/1.5.18 (2008-05-17) X-IBRFilter-SpamReport: -2.599 () BAYES_00 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 Cc: nmrg@ibr.cs.tu-bs.de X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Jul 2008 16:39:24 -0000 On Thu, Jul 31, 2008 at 05:37:12PM +0200, Ramin Sadre wrote: > EMANICS Workshop on Netflow/IPFIX usage in network management > http://www.simpleweb.org/netflow/ > The workshop will take place October 30, at the LRZ Munich, Germany. > > We would highly appreciate your feedback and, of course, your > participation. In addition, we kindly ask you to express your opinion > on making the workshop a joint Emanics&IRTF-NMRG event. I like to get more feedback whether NMRG people support such a joint NMRG meeting plan and whether they plan to attend / contribute to such a meeting. Since there is a direct relationship to IETF work (IPFIX), this workshop might be an opportunity to get different groups of people to talk and exchange ideas. To the organizers: If this becomes an NMRG workshop, you have to make sure that the event is recorded in the form of minutes. In addition, it is desirable to report any significant outcomes in a form easily accessible to the IETF community (e.g. an Internet-Draft or a presentation at one of the upcoming IETF meetings). /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 Received: from rotterdam.ewi.utwente.nl (rotterdam.ewi.utwente.nl [130.89.10.5]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m6VFbHEG028467 for ; Thu, 31 Jul 2008 17:37:22 +0200 Received: from [127.0.0.1] (ewi1009.ewi.utwente.nl [130.89.11.34]) by rotterdam.ewi.utwente.nl (8.13.6/8.13.6) with ESMTP id m6VFbG12000052 for ; Thu, 31 Jul 2008 17:37:17 +0200 (MEST) Message-ID: <4891DC28.5030908@ewi.utwente.nl> Date: Thu, 31 Jul 2008 17:37:12 +0200 From: Ramin Sadre User-Agent: Thunderbird 2.0.0.16 (Windows/20080708) MIME-Version: 1.0 To: nmrg@ibr.cs.tu-bs.de Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0 () X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 X-Scanned-By: MIMEDefang 2.52 on 130.89.10.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0rc3 (rotterdam.ewi.utwente.nl [130.89.10.5]); Thu, 31 Jul 2008 17:37:17 +0200 (MEST) X-IBRFilter-SpamReport: -1.951 () BAYES_20 Subject: [nmrg] Netflow/IPFIX workshop: information and request for feedback X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Jul 2008 15:37:24 -0000 Dear list members, (we apologize for multiple postings) as already announced some days ago, the EMANICS network of excellence is currently preparing the EMANICS Workshop on Netflow/IPFIX usage in network management http://www.simpleweb.org/netflow/ The workshop will take place October 30, at the LRZ Munich, Germany. We would highly appreciate your feedback and, of course, your participation. In addition, we kindly ask you to express your opinion on making the workshop a joint Emanics&IRTF-NMRG event. We want the workshop to be an opportunity for people to exchange and discuss their experiences and ideas. To structure the discussions the workshop will be organized into several discussion topics. For each discussion topic, there will be short presentations (5-10 minutes) introducing the topic, followed by a discussion round. Currently, the following topics are planned: 1. "What technologies are available to analyze flow data?" Presentations: * Flow record query languages. * Using SQL databases for flow processing. 2. "What can be expected from distributed analysis techniques?" Presentations: * A distributed architecture for IP flow analysis. 3. "Should we have a standard format for the annotation of Netflow/IPFIX traces?" Presentations: * Labeling flow traces for intrusion detection evaluation. 4. "For what kind of applications can Netflow/IPFIX be used?" Presentations: * Network anomaly characterization using flows. * Application level dependency discovery with flows. * Management of light paths in optical networks using flows. The above list is still preliminary and we welcome your contributions and suggestions. Regards, Ramin Sadre Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m6VDZDdq030746 for ; Thu, 31 Jul 2008 15:35:18 +0200 Received: from localhost (demetrius3.jacobs-university.de [212.201.44.48]) by hermes.jacobs-university.de (Postfix) with ESMTP id C51CEC0036 for ; Thu, 31 Jul 2008 15:35:13 +0200 (CEST) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius3.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id DrFi-DwVxerk; Thu, 31 Jul 2008 15:35:05 +0200 (CEST) Received: from elstar.local (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id E3F81C001D; Thu, 31 Jul 2008 15:35:05 +0200 (CEST) Received: by elstar.local (Postfix, from userid 501) id B999A67F2DA; Thu, 31 Jul 2008 15:35:04 +0200 (CEST) Date: Thu, 31 Jul 2008 15:35:04 +0200 From: Juergen Schoenwaelder To: nmrg@ibr.cs.tu-bs.de Message-ID: <20080731133504.GB24152@elstar.local> Mail-Followup-To: nmrg@ibr.cs.tu-bs.de MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) X-IBRFilter-SpamReport: -2.599 () BAYES_00 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 Subject: [nmrg] trace meta data and anonymization / pseudonymization X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Jul 2008 13:35:20 -0000 Hi, during the review of , two items popped up several times: a) trace meta-data The question is what meta-data should be recoded, what should it include, are there specific formats to record meta-data etc. b) trace anonymization/pseudonymization Which anonymization/pseudonymization transforms are out there and how strong are they or which pitfalls should be known/avoided while doing trace anonymization. I believe both subjects are important and especially b) is also relevant for work in the IETF (the IPFIX WG is starting to work on anonymization mediators for IPFIX). I am just bringing this up here so that people are aware of this outcome of the review process and if there are people who are actually interested to work on some of this, please speak up and we can see whether there is sufficient interest and critical mass. /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 Received: from relay.versatel.net (relay.versatel.net [62.250.3.110]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with SMTP id m6VDZ85p030740 for ; Thu, 31 Jul 2008 15:35:14 +0200 Received: (qmail 77633 invoked from network); 31 Jul 2008 13:35:08 -0000 Received: from unknown (HELO BertLaptop) (87.215.199.34) by relay.versatel.net with SMTP; 31 Jul 2008 13:35:08 -0000 Message-ID: <41C6ABEBAD3E41DD9F545FCFAF6191C4@BertLaptop> From: To: "NMRG" Date: Thu, 31 Jul 2008 15:35:04 +0200 Organization: prive MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6001.18000 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18000 X-IBRFilter-SpamReport: 0.008 () BAYES_50,NO_REAL_NAME X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 X-Mailman-Approved-At: Thu, 31 Jul 2008 19:55:21 +0200 Subject: [nmrg] Fw: Request to publish draft-irtf-nmrg-snmp-measure-05 as Informational RFC X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Jul 2008 13:35:15 -0000 FYI Bert Wijnen Document Shepherd ----- Original Message ----- From: "Bert Wijnen (IETF)" To: "Aaron Falk" Cc: "IRSG" Sent: Thursday, July 31, 2008 3:33 PM Subject: Request to publish draft-irtf-nmrg-snmp-measure-05 as Informational RFC > Aaron, this is a request to publish this document as an Informational RFC. > > The NMRG has gone through a number of review stages. Also individuals > who are know to be active in this space have been approached for review. > This is all recorded in the issue tracker under ticket #9, see: > > http://www3.tools.ietf.org/group/irtf/trac/ticket/9 > > Summary of review: > - 15 reviews were recieved on this document during NMRG review period. > this led to explanation from the author and to a few revisions to > include the required changes/clarifications. > - Each revision was posted and the NMRG has had time to review and > further comment. > - OPS AREA Director Dan Romascanu did issue an IETF Last Call on > revision 3 of this document because it DOES ask for a URI registration > by IANA. No objections/comments were received. > - revision 4 was also reviewed by Karin R. Sollins which led to one more > revision, the final revision (05) > - The final revision (05) was reviewed by the IRSG members > Karin R. Sollins and Stephen Farrell; They both voted YES on the IRSG > Poll for this revision. No objections were received. > > I have updated the status to: IRSG review concluded. > > Let me know if I need to do anything else. > > Bert Wijnen > Document Shepherd > > > Received: from relay.versatel.net (relay.versatel.net [62.250.3.110]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with SMTP id m6VDBeUQ022978 for ; Thu, 31 Jul 2008 15:11:45 +0200 Received: (qmail 54972 invoked from network); 31 Jul 2008 13:11:39 -0000 Received: from unknown (HELO BertLaptop) (87.215.199.34) by relay.versatel.net with SMTP; 31 Jul 2008 13:11:39 -0000 Message-ID: <98593D9987DC4C9E8ADD92BEAEAF7664@BertLaptop> From: "Bert Wijnen \(IETF\)" To: "NMRG" Date: Thu, 31 Jul 2008 15:11:22 +0200 Organization: Consultant MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6001.18000 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18000 X-IBRFilter-SpamReport: 0.001 () BAYES_50 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 Subject: [nmrg] Fw: [IRTF] #9: IRSG Poll completed and document OKed by IRSG X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Jul 2008 13:11:46 -0000 FYI Bert Wijnen Document shepherd ----- Original Message ----- From: "IRTF" Sent: Thursday, July 31, 2008 3:04 PM Subject: Re: [IRTF] #9: IRSG Poll completed and document OKed by IRSG > Ticket #9: IRSG Poll completed and document OKed by IRSG > >>From bertietf@bwijnen.net): > > * summary: draft-irtf-nmrg-snmp-measure review => IRSG Poll completed > and document OKed by IRSG > * milestone: 2. IRSG review received => 3. IRSG review concluded > > > > IRSG Poll has completed. Both Karin S. Rollins and Stephen Farrell > votes YES. No objections were recieved (as far as I know, if any were > posted to the IRSG list, then I have not seen them, because I am > not on that list; But Aaron informed me the document has been OKed, > so I assume there were no objections). > > Now working on the request to publish (to be expected soon). > > Bert > > > --------------------------------------------------+------------------------- > Reporter: bertietf@bwijnen.net | Owner: > bertietf@bwijnen.net > Type: doc review | Status: reopened > Priority: routine | Milestone: 3. IRSG > review concluded > Component: nmrg | Version: -05 > Severity: | Resolution: > Keywords: NMRG review of snmp-measure document | > --------------------------------------------------+------------------------- > -- > Ticket URL: > > IRTF > IRTF Tracker > > Received: from smtp.utwente.nl ([IPv6:2001:610:1908:1000:204:23ff:feb7:ef56]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m6S8XIa1025178 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Mon, 28 Jul 2008 10:33:23 +0200 Received: from ewi899.ewi.utwente.nl (ewi899.ewi.utwente.nl [130.89.11.144]) by smtp.utwente.nl (8.12.10/SuSE Linux 0.7) with ESMTP id m6S8WlII030906; Mon, 28 Jul 2008 10:32:47 +0200 Message-Id: <05F19952-486B-40AF-829E-D6A7CD9F9C90@utwente.nl> From: Aiko Pras To: "Romascanu, Dan (Dan)" , Ramin Sadre In-Reply-To: Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v926) Subject: Re: [nmrg] Workshop on Netflow usage Date: Mon, 28 Jul 2008 10:32:46 +0200 References: <4885E9D0.8020107@ewi.utwente.nl> X-Mailer: Apple Mail (2.926) X-UTwente-MailScanner-Information: Scanned by MailScanner. Contact servicedesk@icts.utwente.nl for more information. X-UTwente-MailScanner: Found to be clean X-UTwente-MailScanner-From: a.pras@utwente.nl X-Spam-Status: No X-IBRFilter-SpamReport: -1.951 () BAYES_20 X-Scanned-By: MIMEDefang 2.51 on IPv6:2001:638:602:2200:20d:60ff:fe9a:2b5c Cc: Aiko Pras , nmrg@ibr.cs.tu-bs.de X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Jul 2008 08:33:26 -0000 1) I will attend such workshop 2) I propose to use "Netflow/IPFIX", instead of "Netflow" Reason for using both terms: - Since we are an IRTF WG, it would be good to promote "IPFIX" - Since the term "Netflow" is better known than "IPFIX", we should also use the term "Netflow" Bye Aiko On 25 jul 2008, at 20:13, Romascanu, Dan (Dan) wrote: > May I ask why is the goal of the workshop defined in terms of Netflow > rather than IPFIX, which is an IETF standard? > > Dan > > >> -----Original Message----- >> From: nmrg-bounces@ibr.cs.tu-bs.de >> [mailto:nmrg-bounces@ibr.cs.tu-bs.de] On Behalf Of Ramin Sadre >> Sent: Tuesday, July 22, 2008 5:08 PM >> To: nmrg@ibr.cs.tu-bs.de >> Subject: [nmrg] Workshop on Netflow usage >> >> Dear all, >> >> the Emanics Network of Excellence is currently planning a >> workshop on Netflow usage, tentatively scheduled for October >> 30th in Munich, Germany. >> >> Topic of the workshop is the usage of Netflow in network >> management, in particular for (but not restricted >> to) intrusion detection. It also comprises related topics >> such as flow storage, querying, etc. >> >> Are you interested in such a workshop? What do you think to >> organize it as a joint Emanics&IRTF-NMRG event? >> Your comments are appreciated. >> >> Best regards, >> >> Ramin Sadre >> University of Twente >> >> -- >> !! This message is brought to you via the `nmrg' mailing list. >> !! Please do not reply to this message to unsubscribe. To >> unsubscribe or adjust !! your settings, send a mail message >> to !! or look at >> https://mail.ibr.cs.tu-bs.de/mailman/listinfo/nmrg. >> > > -- > !! This message is brought to you via the `nmrg' mailing list. > !! Please do not reply to this message to unsubscribe. To > unsubscribe or adjust > !! your settings, send a mail message to bs.de> > !! or look at https://mail.ibr.cs.tu-bs.de/mailman/listinfo/nmrg. Received: from de307622-de-outbound.net.avaya.com (de307622-de-outbound.net.avaya.com [198.152.71.100]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m6PIDFFU010168 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for ; Fri, 25 Jul 2008 20:13:20 +0200 X-IronPort-AV: E=Sophos;i="4.31,253,1215403200"; d="scan'208";a="115999167" Received: from unknown (HELO nj300815-nj-erheast.avaya.com) ([198.152.6.5]) by de307622-de-outbound.net.avaya.com with ESMTP; 25 Jul 2008 14:13:09 -0400 X-IronPort-AV: E=Sophos;i="4.31,253,1215403200"; d="scan'208";a="235878461" Received: from unknown (HELO 307622ANEX5.global.avaya.com) ([135.64.140.14]) by nj300815-nj-erheast-out.avaya.com with ESMTP; 25 Jul 2008 14:13:08 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Subject: RE: [nmrg] Workshop on Netflow usage Date: Fri, 25 Jul 2008 20:13:05 +0200 Message-ID: In-Reply-To: <4885E9D0.8020107@ewi.utwente.nl> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [nmrg] Workshop on Netflow usage Thread-Index: Acjtzd5qDtX5AdjPQee06NJt2asuJQAtA4og References: <4885E9D0.8020107@ewi.utwente.nl> From: "Romascanu, Dan (Dan)" To: "Ramin Sadre" , X-IBRFilter-SpamReport: 0.001 () BAYES_50 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by bierator.ibr.cs.tu-bs.de id m6PIDFFU010168 X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Jul 2008 18:13:23 -0000 May I ask why is the goal of the workshop defined in terms of Netflow rather than IPFIX, which is an IETF standard? Dan > -----Original Message----- > From: nmrg-bounces@ibr.cs.tu-bs.de > [mailto:nmrg-bounces@ibr.cs.tu-bs.de] On Behalf Of Ramin Sadre > Sent: Tuesday, July 22, 2008 5:08 PM > To: nmrg@ibr.cs.tu-bs.de > Subject: [nmrg] Workshop on Netflow usage > > Dear all, > > the Emanics Network of Excellence is currently planning a > workshop on Netflow usage, tentatively scheduled for October > 30th in Munich, Germany. > > Topic of the workshop is the usage of Netflow in network > management, in particular for (but not restricted > to) intrusion detection. It also comprises related topics > such as flow storage, querying, etc. > > Are you interested in such a workshop? What do you think to > organize it as a joint Emanics&IRTF-NMRG event? > Your comments are appreciated. > > Best regards, > > Ramin Sadre > University of Twente > > -- > !! This message is brought to you via the `nmrg' mailing list. > !! Please do not reply to this message to unsubscribe. To > unsubscribe or adjust !! your settings, send a mail message > to !! or look at > https://mail.ibr.cs.tu-bs.de/mailman/listinfo/nmrg. > Received: from rotterdam.ewi.utwente.nl (rotterdam.ewi.utwente.nl [130.89.10.5]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m6PAlCGY005073 for ; Fri, 25 Jul 2008 12:47:17 +0200 Received: from [127.0.0.1] (ewi429.ewi.utwente.nl [130.89.13.39]) by rotterdam.ewi.utwente.nl (8.13.6/8.13.6) with ESMTP id m6PAl9TD012667; Fri, 25 Jul 2008 12:47:10 +0200 (MEST) Message-ID: <4889AF28.3040902@ewi.utwente.nl> Date: Fri, 25 Jul 2008 12:47:04 +0200 From: Ramin Sadre User-Agent: Thunderbird 1.5.0.2 (Windows/20060308) MIME-Version: 1.0 To: Benoit Claise Subject: Re: [nmrg] Workshop on Netflow usage References: <4885E9D0.8020107@ewi.utwente.nl> <4888F424.6060607@cisco.com> In-Reply-To: <4888F424.6060607@cisco.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0 () X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 X-Scanned-By: MIMEDefang 2.52 on 130.89.10.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0rc3 (rotterdam.ewi.utwente.nl [130.89.10.5]); Fri, 25 Jul 2008 12:47:10 +0200 (MEST) X-IBRFilter-SpamReport: -2.599 () BAYES_00 Cc: nmrg@ibr.cs.tu-bs.de X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Jul 2008 10:47:18 -0000 Benoit Claise wrote: > Do you have a goal in mind for the workshop? Or simply the > exchange of ideas? > Any idea on what you want to cover? The goal of the workshop is to exchange experiences and ideas in the usage of Netflow in network management. We are open to all kind of usages, as well as to related topics such as flow collection and storage, querying,.. The program will include presentations from several EMANICS members who have done work in this area. Currently, presentations with the following topics are planned: - flow query languages - network anomaly characterization using flows - distributed architecture for IP flow analysis - application level dependency discovery with flows The workshop will take place on October 30, 2008 at the LRZ in Munich, Germany. A web site with further information will soon be announced. Regards, Ramin Received: from av-tac-bru.cisco.com (odd-brew.cisco.com [144.254.15.119]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m6OLTH25018508 for ; Thu, 24 Jul 2008 23:29:22 +0200 X-TACSUNS: Virus Scanned Received: from strange-brew.cisco.com (localhost [127.0.0.1]) by av-tac-bru.cisco.com (8.11.7p3+Sun/8.11.7) with ESMTP id m6OLTBH20337; Thu, 24 Jul 2008 23:29:11 +0200 (CEST) Received: from [10.61.80.46] (ams3-vpn-dhcp4143.cisco.com [10.61.80.46]) by strange-brew.cisco.com (8.11.7p3+Sun/8.11.7) with ESMTP id m6OLT8A26332; Thu, 24 Jul 2008 23:29:08 +0200 (CEST) Message-ID: <4888F424.6060607@cisco.com> Date: Thu, 24 Jul 2008 23:29:08 +0200 From: Benoit Claise User-Agent: Thunderbird 1.5.0.12 (Windows/20070509) MIME-Version: 1.0 To: Ramin Sadre Subject: Re: [nmrg] Workshop on Netflow usage References: <4885E9D0.8020107@ewi.utwente.nl> In-Reply-To: <4885E9D0.8020107@ewi.utwente.nl> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-IBRFilter-SpamReport: -1.096 () BAYES_40 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 X-Mailman-Approved-At: Fri, 25 Jul 2008 08:30:57 +0200 Cc: nmrg@ibr.cs.tu-bs.de X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Jul 2008 21:29:23 -0000 Ramin, Do you have a goal in mind for the workshop? Or simply the exchange of ideas? Any idea on what you want to cover? Regards, Benoit. > Dear all, > > the Emanics Network of Excellence is currently planning > a workshop on Netflow usage, tentatively scheduled for > October 30th in Munich, Germany. > > Topic of the workshop is the usage of Netflow in > network management, in particular for (but not restricted > to) intrusion detection. It also comprises related topics > such as flow storage, querying, etc. > > Are you interested in such a workshop? What do you think > to organize it as a joint Emanics&IRTF-NMRG event? > Your comments are appreciated. > > Best regards, > > Ramin Sadre > University of Twente > Received: from rotterdam.ewi.utwente.nl (rotterdam.ewi.utwente.nl [130.89.10.5]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m6ME8MIZ006656 for ; Tue, 22 Jul 2008 16:08:27 +0200 Received: from [127.0.0.1] (ewi429.ewi.utwente.nl [130.89.13.39]) by rotterdam.ewi.utwente.nl (8.13.6/8.13.6) with ESMTP id m6ME8LRi018459 for ; Tue, 22 Jul 2008 16:08:22 +0200 (MEST) Message-ID: <4885E9D0.8020107@ewi.utwente.nl> Date: Tue, 22 Jul 2008 16:08:16 +0200 From: Ramin Sadre User-Agent: Thunderbird 1.5.0.2 (Windows/20060308) MIME-Version: 1.0 To: nmrg@ibr.cs.tu-bs.de Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0 () X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 X-Scanned-By: MIMEDefang 2.52 on 130.89.10.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0rc3 (rotterdam.ewi.utwente.nl [130.89.10.5]); Tue, 22 Jul 2008 16:08:22 +0200 (MEST) X-IBRFilter-SpamReport: -2.599 () BAYES_00 X-Mailman-Approved-At: Thu, 24 Jul 2008 22:42:17 +0200 Subject: [nmrg] Workshop on Netflow usage X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jul 2008 14:08:29 -0000 Dear all, the Emanics Network of Excellence is currently planning a workshop on Netflow usage, tentatively scheduled for October 30th in Munich, Germany. Topic of the workshop is the usage of Netflow in network management, in particular for (but not restricted to) intrusion detection. It also comprises related topics such as flow storage, querying, etc. Are you interested in such a workshop? What do you think to organize it as a joint Emanics&IRTF-NMRG event? Your comments are appreciated. Best regards, Ramin Sadre University of Twente Received: from relay.versatel.net (relay.versatel.net [62.250.3.110]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with SMTP id m64A0qaQ032622 for ; Fri, 4 Jul 2008 12:00:57 +0200 Received: (qmail 54137 invoked from network); 4 Jul 2008 10:00:51 -0000 Received: from unknown (HELO bwMedion) (87.215.199.34) by relay.versatel.net with SMTP; 4 Jul 2008 10:00:51 -0000 From: "Bert Wijnen - IETF" To: "Nmrg" Date: Fri, 4 Jul 2008 12:00:57 +0200 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Importance: Normal X-IBRFilter-SpamReport: 0.001 () BAYES_50 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 Subject: [nmrg] FW: draft-irtf-nmrg-snmp-measure-05 IRSG poll X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Jul 2008 10:00:58 -0000 NMRG, this is FYI. Unfortunately I was not aware that I needed to start the poll, and only learned this after returning from my vacation. Anyway, let us hope that the IRSG approves this document within the next couple of weeks. Bert Wijnen document shepherd -----Oorspronkelijk bericht----- Van: Bert Wijnen - IETF [mailto:bertietf@bwijnen.net] Verzonden: vrijdag 4 juli 2008 11:54 Aan: IRSG Onderwerp: draft-irtf-nmrg-snmp-measure-05 IRSG poll The IRSG review for draft-irtf-nmrg-snmp-measure-04.txt was completed late May, by Karen R. Sollins, and the draft has been revised as into a new version draft-irtf-nmrg-snmp-measure-05.txt on which Karen and the NMRG have given their OK. The draft-irtf-nmrg-snmp-measure-05.txt is available at: http://www.ietf.org/internet-drafts/draft-irtf-nmrg-snmp-measure-05.txt The IRSG review is available form the IRTF Tracker web page at: http://www3.tools.ietf.org/group/irtf/trac/ticket/9 This is a two-week IRSG poll. Please use one of the poll responses defined in http://tools.ietf.org/id/draft-irtf-rfcs-01.txt (the draft has unfortunately expired, but is still there). Those possible poll responses are: o 'Ready to publish' -- requires a thorough read and reasonably detailed review o 'Not ready to publish' -- requires a thorough read, reasonably detailed review, and actionable comments. o 'No objection' -- I don't object if this document goes forward; I've read the document (perhaps quickly); I have some small comments which are not show stoppers; I don't have great expertise in the area. o 'Request more time to review' -- a commitment to provide a thorough review in a specified period of time. And the most relevant rule is that "At least two other IRSG members (besides the one sponsoring the document) need to vote 'ready to publish' for the document to move forward." So please read and vote, Many thanks, Bert Wijnen (Document Shepherd). p.s. I assume that Juergen Schienwaelder sponsors the document, but he is also author, so that is why I am shepherding.