Subject: [ipfix] RE: MIDCOM first draft

From: "Reinaldo Penno"<[email-masked]>
Date: Wed, 13 Feb 2002 12:38:59 -0800

Hello Paul,

comments inline.

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]
>Sent: Wednesday, February 13, 2002 5:34 AM
>To: Penno, Reinaldo [SC9:T327:EXCH]
>Cc: [email-masked];
>[email-masked]; K.C. Norseth; ipfixx
>Subject: Re: MIDCOM first draft
>
>
>> 
>> Hello Paul,
>> 
>> I'll try to be more structured now.
>> 
>> the way it is reported is one thing, but a NAT is by all purposes (by
>> definition) composed of two flows. You can export them in one record
>> or two records, but that doesn't change how it should be faced.
>> 
>> would you agree with this?
>
>	I would say no. Since a flow is defined by its key
>	you cannot take that out of the picture. If the
>	key is actual-src and actual-destination then
>	there is only 1 flow and only 1 record.

There is no actual src and actual dest. The flow can be NATed twice in the
same box. It's just how from an aimplementation standpoint you look at it
(see below)

>
>	If the key is packet-src, packet-destination then
>	it would be 2 flows as you suggest.

Paul, the "key" is something that we invented. It's an implementation thing
in the same sense that you might prefer to export NAT flows in one record.
But it doesn't change the basic definition. A flow is defined by a 5-tuple.
It's basic definition independent of IPfix.

regards,

Reinaldo

---

From: [email-masked]
Date: Wed, 13 Feb 2002 16:10:28 -0500

Reinaldo Penno wrote:
> There is no actual src and actual dest. The flow can be NATed twice in
> the same box. It's just how from an aimplementation standpoint you
> look at it (see below)
> 

	Doesn't matter how many times it gets NATed. The end result
	is some IP gets stuffed in the paceket to go out and that is the
	actual address in the NAT case. The addresses in the middle 
	are what I call the virtual addresses (for lack of a better term).
	There can be a list of virtual addresses if more than one
	translation takes place.

> Paul, the "key" is something that we invented. It's an implementation
> thing in the same sense that you might prefer to export NAT flows in
> one record. But it doesn't change the basic definition. A flow is
> defined by a 5-tuple. It's basic definition independent of IPfix.

	I don't think there is such a standard definition. Unless
	you mean a NAT flow and the NAT RFC defines such a thing
	(I'm not sure if it does or doesn't). ICMP for example does 
	not have src and dest port but I'm sure it can be NATed just
	the same.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/