Subject: [ipfix-data] RE: data doc section 5 [was "Re: [ipfix-arch] Clarification on Ar ch document, section 7.2"]

From: "Reinaldo Penno"<[email-masked]>
Date: Wed, 20 Feb 2002 19:09:13 -0800

Hello Ganesh,

comments inline..

>-----Original Message-----
>From: Ganesh Sadasivan [mailto:[email-masked]]
>Sent: Wednesday, February 20, 2002 6:33 PM
>To: Penno, Reinaldo [SC9:T327:EXCH]
>Cc: [email-masked]
>Subject: data doc section 5 [was "Re: [ipfix-arch] 
>Clarification on Arch
>document, section 7.2"]
>
>
>Hi Reinaldo,
>  For some reason I missed this e-mail...
>  The intention is to do some kind of pre-filtering
>  so that a narrower set of flows are generated.
>  The flow itself  could be different from what is
>  used for filtering.

right, but it must be a subset of the filtered one, right?

I think see what you mean...you have a pre-filtering rule, say PF that gives
you a set of flows S. You then apply independent methods (say M1 and M2) to
find results R1 and R2, which then you might possible export independetly.
Is this okay?

So, my question is: what's the difference from applying say, PF+M1 directly
on the original unfiltered flow and also PF+M2 on the original unfiltered
flow and get results R1 and R2? 

thanks,

Reinaldo

>  Just to expand this a little more: Create flows for
>  only those packets which are destined to an IP address
>  90.1.2.3 with destination L4 port=80. The flows
>  itself are defined by keys  say
> {src address, tos, input interface, src port}.
>
>Thanks
>Ganesh
>
>---------------------------------------------------------------
>-----------
>
>In the arch document it is said:
>
>"7.2.  Selection Criteria Of Packets
>
>The measurement device MAY define rules so that only certain packets
>within
>a flow can be chosen for measurement at an observation point. This MAY
>be
>done by one of the two types of methods defined below or a combination
>of
>them.  A combination of each of these ways can be adopted to select the
>packets .i.e. one can define a set of methods {F1, S1, F2, S2, S3}
>executed
>in certain sequence at an observation point to collect flows of a
>particular
>type.
>
>
>7.2.1.  Function on properties that determines a flow type (Fi)
>
>Packets that satisfy a function on the fields defined by the packet
>header
>fields or fields obtained while doing the packet processing or the
>properties of the packet itself.
>
>Example:
>
>Mask/Match of the fields that define a filter. The filter may 
>be defined
>as
>{Protocol == TCP, Destination Port between 80 and 120}. Multiple such
>filters could be used in any sequence to select packets.
>
>7.2.2.  Sampling packets on a flow type (Si)
>
>Packets that satisfy the sampling criteria for this flow type.
>
>Example:
>
>Sample every 100th packet that was received at an observation point and
>collect the flow information for a particular flow type. choosing all
>the
>packets is a special case where sampling rate is 1:1."
>
>Now, 7.2.2 seems to be a valid example, but I'm not sure about 
>7.2.1. It
>
>seems to me that when you apply a function that further reduces the
>properies that determines a flow you are by definition indirectly (or
>directly) defining another flow. The flow based on the original
>definition
>plus Fi. Then this would be just another flow and not a "selection
>criteria
>of packets" within a flow.
>
>Maybe I should just rephrase mentioning that in the 
>introduction of this
>
>section is is said "to collect flows of a particular type". So, a
>special
>type of a flow wouldn't be another flow? Yes, all the packets within a
>flow
>can be a subset of another flow, but then, all packets are a subset of
>the
>flow "src=any dest=any, proto=any, etc".
>
>regards,
>
>Reinaldo
>
>

---

From: Ganesh Sadasivan <[email-masked]>
Date: Wed, 20 Feb 2002 20:12:04 -0800

Hi Renaldo,

Reinaldo Penno wrote:

> I think see what you mean...you have a pre-filtering rule, say PF that
> gives you a set of flows S. You then apply independent methods (say M1
> and M2) to find results R1 and R2, which then you might possible
> export independetly. Is this okay?
>
> So, my question is: what's the difference from applying say, PF+M1
> directly on the original unfiltered flow and also PF+M2 on the
> original unfiltered flow and get results R1 and R2?

Probably you did not understand my explanation. But leave it.
As you said we can generate the same set of flows by other
means (eg. collect all flows and do postfiltering on flows).But
the idea here is to say that these are the options available.
One can use any combinaiton of section 5.2 & 5.3 to achieve
the desired results.

Thanks
Ganesh