Subject: [ipfix-arch] IPFIX devices

From: Juergen Quittek <[email-masked]>
Date: Fri, 29 Mar 2002 04:37:07 +0100

Hi KC,

below please find a suggestion for a new section (or subsection)
of the architecture document discussing IPFIX-related devices.

I call them 'IPFIX-related devices' because not all of them
match our definiton of 'IPFIX devices' in the terminology
section. Maybe we should discuss this definition again based on
the list of 'IPFIX-related devices'?

Cheers,

    Juergen
-- 
Juergen Quittek     [email-masked]     Tel: +49 6221 90511-15
NEC Europe Ltd.,    Network Laboratories     Fax: +49 6221 90511-55
Adenauerplatz 6, 69115 Heidelberg, Germany   http://www.ccrle.nec.de

IPFIX-related Devices

  This section discusses several IPFIX-related devices with different
  internal structures. They are all composed of one or more of the
  following elements: observation point (O), full or partial metering
  process (M), exporting process (E), collecting process (C).

         +---+     +-----+     +---------+       +---------+
         | E-+->   |  E--+->   |    E----+->   <-+--E   E--+->
         | | |     |  |  |     |   / \   |       |  |   |  |
         | M |     |  M  |     |  M   M  |       |  M   M  |
         | | |     | /|\ |     | /|\ /|\ |       | /|\ /|\ |
         | O |     | OOO |     | OOO OOO |       | OOO OOO |
         +---+     +-----+     +---------+       +---------+
         Probe      Basic        Complex          Multiple
                    Router       Router           Exporters

       +---+     +---+     +---+
       | E-+->   | E-+->   | E-+------------->---+
       | | |     | | |     | | | +---+         +-+-----+
       +-+-+     | M |     | M | | E-+------->-+-C-M-E-+->
         |       | | |     | | | | | | +---+   +-+-----+
       +-+-+     +-+-+     | O | | M | | E-+->---+
       | | |       |       +---+ | | | | | |
       | M |     +-+-+           | O | | M |
       | | |     | | |           +---+ | | |           +-----+
       | O |     | O |                 | O |        ->-+-C-E-+->
       +---+     +---+                 +---+           +-----+

      Protocol   Remote             Concentrator        Proxy
      Converter  Observation

                   Figure X: IPFIX-related Devices

  A very simple device is a probe. It contains on a single observation
  point, a single metering process, and a single exporting process.
  For this device the observation domain contains a single observation
  point only.

  A basic router extends this structure by multiple observation point.
  Here an exported flow record may still have an observation domain
  containing a single observation point. But also Observation domains
  containing all observation points of the routers are possible.

  A more complex router may host more than one metering process, for
  example one per line card. Please note that an observation domain
  is restricted to the observation points connected to a single
  metering process. An observation domain containing all observation
  points of this router is not possible with this structure.

  Alternatively, a complex router may use different exporting processes
  for flow records generated by different metering processes.

  A protocol converter makes use of a metering process that can be
  accessed only by another protocol than the one defined for IPFIX,
  for example the SNMP and the Meter MIB module [RFC2720]. Then
  the exporter receives flow record from a remote metering process
  and exports these records using the IPFIX protocol.

  Another choice is remote packet observation. Packet header captured
  at an observation point may be exported as raw data to a device
  hosting metering process and exproting process.

  An intermediate structure between protocol converter and remote
  observation (not shown in the Figure) would be a split metering
  process, for example performing timestaping and sampling at the
  device hosting the observation point and performing packet
  classification at another device hosting the exporting process.

  A concentrator receives flow records via the IPFIX protocol,
  merges them into higher aggregated flows and exports the resulting
  flows again using the IPFIX protocol. Please note that for the
  final flow records the observation domain potentially contains
  observation points at all first level devices. The metering process
  of the final flow records is composed by the (partial) metering
  processes at the first level devices and the partial metering
  process at the concentrator.

  Finally, a very simple IPFIX-related device is a proxy. It just
  receives flow records using the IPFIX protocol and sends them
  further using the same protocol. A proxy might be useful for
  traversing firewalls or other gateways.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/