Subject: [ipfix-data] data doc section 5 [was "Re: [ipfix-arch] Clarification on Arch document, section 7.2"]

From: Ganesh Sadasivan <[email-masked]>
Date: Wed, 20 Feb 2002 18:33:24 -0800

Hi Reinaldo,
  For some reason I missed this e-mail...
  The intention is to do some kind of pre-filtering
  so that a narrower set of flows are generated.
  The flow itself  could be different from what is
  used for filtering.
  Just to expand this a little more: Create flows for
  only those packets which are destined to an IP address
  90.1.2.3 with destination L4 port=80. The flows
  itself are defined by keys  say
 {src address, tos, input interface, src port}.

Thanks
Ganesh

--------------------------------------------------------------------------

In the arch document it is said:

"7.2.  Selection Criteria Of Packets

The measurement device MAY define rules so that only certain packets
within
a flow can be chosen for measurement at an observation point. This MAY
be
done by one of the two types of methods defined below or a combination
of
them.  A combination of each of these ways can be adopted to select the
packets .i.e. one can define a set of methods {F1, S1, F2, S2, S3}
executed
in certain sequence at an observation point to collect flows of a
particular
type.

7.2.1.  Function on properties that determines a flow type (Fi)

Packets that satisfy a function on the fields defined by the packet
header
fields or fields obtained while doing the packet processing or the
properties of the packet itself.

Example:

Mask/Match of the fields that define a filter. The filter may be defined
as
{Protocol == TCP, Destination Port between 80 and 120}. Multiple such
filters could be used in any sequence to select packets.

7.2.2.  Sampling packets on a flow type (Si)

Packets that satisfy the sampling criteria for this flow type.

Example:

Sample every 100th packet that was received at an observation point and
collect the flow information for a particular flow type. choosing all
the
packets is a special case where sampling rate is 1:1."

Now, 7.2.2 seems to be a valid example, but I'm not sure about 7.2.1. It

seems to me that when you apply a function that further reduces the
properies that determines a flow you are by definition indirectly (or
directly) defining another flow. The flow based on the original
definition
plus Fi. Then this would be just another flow and not a "selection
criteria
of packets" within a flow.

Maybe I should just rephrase mentioning that in the introduction of this

section is is said "to collect flows of a particular type". So, a
special
type of a flow wouldn't be another flow? Yes, all the packets within a
flow
can be a subset of another flow, but then, all packets are a subset of
the
flow "src=any dest=any, proto=any, etc".

regards,

Reinaldo

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/