Subject: [ipfix-arch] Clarification on Arch document, section 7.2

From: "Reinaldo Penno"<[email-masked]>
Date: Tue, 19 Feb 2002 11:10:02 -0800

In the arch document it is said:

"7.2.  Selection Criteria Of Packets

The measurement device MAY define rules so that only certain packets within
a flow can be chosen for measurement at an observation point. This MAY be
done by one of the two types of methods defined below or a combination of
them.  A combination of each of these ways can be adopted to select the
packets .i.e. one can define a set of methods {F1, S1, F2, S2, S3} executed
in certain sequence at an observation point to collect flows of a particular
type.

7.2.1.  Function on properties that determines a flow type (Fi)

Packets that satisfy a function on the fields defined by the packet header
fields or fields obtained while doing the packet processing or the
properties of the packet itself.

Example:

Mask/Match of the fields that define a filter. The filter may be defined as
{Protocol == TCP, Destination Port between 80 and 120}. Multiple such
filters could be used in any sequence to select packets.

7.2.2.  Sampling packets on a flow type (Si)

Packets that satisfy the sampling criteria for this flow type.

Example:

Sample every 100th packet that was received at an observation point and
collect the flow information for a particular flow type. choosing all the
packets is a special case where sampling rate is 1:1."

Now, 7.2.2 seems to be a valid example, but I'm not sure about 7.2.1. It
seems to me that when you apply a function that further reduces the
properies that determines a flow you are by definition indirectly (or
directly) defining another flow. The flow based on the original definition
plus Fi. Then this would be just another flow and not a "selection criteria
of packets" within a flow. 

Maybe I should just rephrase mentioning that in the introduction of this
section is is said "to collect flows of a particular type". So, a special
type of a flow wouldn't be another flow? Yes, all the packets within a flow
can be a subset of another flow, but then, all packets are a subset of the
flow "src=any dest=any, proto=any, etc".

regards,

Reinaldo

---

From: [email-masked]
Date: Tue, 19 Feb 2002 14:36:51 -0500

Reinaldo Penno wrote:
> The measurement device MAY define rules so that only certain packets
> within a flow can be chosen for measurement at an observation point.
> This MAY be done by one of the two types of methods defined below or a
> combination of them.  A combination of each of these ways can be
> adopted to select the packets .i.e. one can define a set of methods
> {F1, S1, F2, S2, S3} executed in certain sequence at an observation
> point to collect flows of a particular type.
> 
> Packets that satisfy a function on the fields defined by the packet
> header fields or fields obtained while doing the packet processing or
> the properties of the packet itself.
> 
> Example:
> 
> Mask/Match of the fields that define a filter. The filter may be
> defined as {Protocol == TCP, Destination Port between 80 and 120}.
> Multiple such filters could be used in any sequence to select packets.
> 
> Sample every 100th packet that was received at an observation point
> and collect the flow information for a particular flow type. choosing
> all the packets is a special case where sampling rate is 1:1."
> 
> Now, 7.2.2 seems to be a valid example, but I'm not sure about 7.2.1.
> It seems to me that when you apply a function that further reduces the
> directly) defining another flow. The flow based on the original
> definition plus Fi. Then this would be just another flow and not a
> "selection criteria of packets" within a flow.
> 
> Maybe I should just rephrase mentioning that in the introduction of
> this section is is said "to collect flows of a particular type". So, a
> special type of a flow wouldn't be another flow? Yes, all the packets
> within a flow can be a subset of another flow, but then, all packets
> are a subset of the flow "src=any dest=any, proto=any, etc".
> 

	Here is my take on it...

	The selection process tells you which packets with
	be run through the Flow Definition rules to come up
	with unique flows to export. 

	I think you are correct in saying the the selection
	criteria is self defines a flow, but it does not
	define and flow for Export. So out of the more general
	"Selection Flow Definition" there are sub-flows defined 
	by the "Export Flow Definition".

	The other thing here that occurred to me is that
	you may need to know the selection criteria to make
	sense of the data. If I create a a graph by port number
	that info will help me understand why I only see
	ports in that range.

	My 2 cents.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/