Subject: [ipfix] Re: MIDCOM first draft

From: [email-masked]
Date: Wed, 13 Feb 2002 08:34:01 -0500

Reinaldo Penno wrote:
> 
> >-----Original Message-----
> >From: [email-masked] [mailto:[email-masked]]
> >Sent: Tuesday, February 12, 2002 9:22 AM
> >To: Penno, Reinaldo [SC9:T327:EXCH]
> >Cc: [email-masked];
> >[email-masked]; K.C. Norseth
> >Subject: Re: MIDCOM first draft
> >
> >
> >> Do you agree?
> >
> >       Sorry for the delay. TOo many mails and not enough time :-)
> >
> >       Depends on how the 5-tuple is reported. If done the way
> >       I suggested then it looks like this... (as I modified above)
> >
> >               A <-> D
> >                  B as virtual SRC/DST
> >
> >       In that case the 5 touble would not change as a result of
> >       the translation assuming the actual address field is
> >       used in the 5-tuple.
> >
> >
> 
> Hello Paul,
> 
> I'll try to be more structured now.
> 
> the way it is reported is one thing, but a NAT is by all purposes (by
> definition) composed of two flows. You can export them in one record
> or two records, but that doesn't change how it should be faced.
> 
> would you agree with this?

	I would say no. Since a flow is defined by its key
	you cannot take that out of the picture. If the
	key is actual-src and actual-destination then
	there is only 1 flow and only 1 record.

	If the key is packet-src, packet-destination then
	it would be 2 flows as you suggest.

> regards,
> Reinaldo

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: "Reinaldo Penno"<[email-masked]>
Date: Thu, 14 Feb 2002 06:27:42 -0800

okay, last round before the beers..

>Sent: Thursday, February 14, 2002 6:14 AM
>[email-masked]; K.C. Norseth; ipfixx
>From reqs:
>==========
>      A flow is a set of packets passing an observation point in the
>      network during a certain time interval. All packets 
>belonging to a
>      particular flow have a set of common properties derived from the
>      data contained in the packet and from the packet treatment at the
>      observation point.
>
>From Arch (which matches Cisco doc):
>===================================
>
>"A flow is a set of packets passing an observation point in 
>the network 
>during a certain time interval. All packets belonging to a particular
>flow have a set of common properties derived from the data contained in
>the packet and from the packet treatment at the observation point."
>
>In this draft we define the flow more specifically.  A flow is defined
>as a set of packets passing an observation point in the 
>network during a
>certain time interval. All packets belonging to a particular 
>flow have a
>set of common properties.  Each property is defined as the result of
>applying a function to the values of:
>
>a. one or more of packet header fields (eg. destination IP address)
>b. one or more properties of the packet itself (eg. packet length)
>c. one or more of fields derived from packet treatment (eg. AS number)
>
>
>A packet is defined to belong to a flow if it matches all the defined
>properties of the flow. Flows can be defined in multiple ways. Some
>examples are:
>
>
>

In the case of twice NAT (and btw some OPES services or even some SLB
stuff), the packets will have nothing in common (except *maybe* same AS).
They do not have the same destination IP, source IP or port numbers.  The
packet length also change..So, they have nothing in common...

And on top of that after the NAT the treatment the "flow" might get inside
the same box a completely differ from before the NAT (different PHB,
firewall, etc, etc)

regards,

Reinaldo