Subject: [ipfix-arch] revised terminology

From: Juergen Quittek <[email-masked]>
Date: Fri, 29 Mar 2002 03:08:00 +0100

Hi KC,

Here is a revised version of the terminology for the
architecture document (as promised in Minneapolis).
Most of the changes result from discussions with Tanja.

The definitions of IPFIX device, template, control
stream and data stream are unchanged, although I am
not yet completely satisfied with them.
Further discussion on all terms seems to be ahead.

Cheers,

    Juergen
-- 
Juergen Quittek     [email-masked]     Tel: +49 6221 90511-15
NEC Europe Ltd.,    Network Laboratories     Fax: +49 6221 90511-55
Adenauerplatz 6, 69115 Heidelberg, Germany   http://www.ccrle.nec.de

Terminology

 * IP Traffic Flows
   A flow is defined as a set of packets passing an observation
   domain in the network during a certain time interval. All packets
   belonging to a particular flow have a set of common properties.
   Each property is defined as the result of applying a function to
   the values of:

      1. one or more of packet header fields (eg. destination IP
         address)
      2. one or more properties of the packet itself (eg. packet length)
      3. one or more of fields derived from packet treatment (eg. AS
         number)

   A packet is defined to belong to a flow if it completely
   satisfies all the defined properties of the flow.

   This definition covers the range from a flow containing all
   packets observed at a network interface to a flow consisting of
   just a single packet between two applications with a specific
   sequence number. Please note that the flow definition does not
   match a general application-level end-to-end stream. However,
   an application may derive properties of application-level
   streams by processing measured flow data.

 * Observation Point
   The observation point is a location in the network where IP
   packets can be observed. Examples are a line to which a probe
   is attached, a shared medium, such as an Ethernet-based LAN,
   a single port of a router, or the routing engine of a router.

 * Observation Domain
   A single IP traffic flow may contain packets observed at several
   different observation points, for example at several ports of a
   line card or at different probes. The observation domain of a
   flow is the set of observation points at which the packets of
   this flow have been or might have been observed. The minimal
   observation domain contains just a single observation point.

 * Metering Process
   The metering process generates flow records. Input to the
   process are IP packets observed in an observation domain. The
   metering process consists of a set of functions that includes
   packet header capturing, timestamping, sampling, classifying,
   and maintaining flow records.

   Sampling and classifying may be performed repeatedly (with
   different parameters). The sampling function selects a subset
   of the received set of items (packet headers with timestamps or
   flow records) to be passed further to the classifying function.
   The sampling function may be trivial by passing all items,
   which is equivalent to applying no sampling at all. The
   classifying function maps its input to flows. There are two
   extreme classifying functions: one mapping each packet to
   different flows and one mapping all packets to the same flow.

   Maintenance of flow records may include creating new records,
   updating existing ones, computing flow statistics, deriving further
   flow properties, detecting flow expiration, passing flows record to
   the exporting process, and deleting flow records.

   The figure below shows the sequence in which the functions are applied.

                        packet header capturing
                                  |
                             timestamping
                                  |
                                  v
                           +----->+
                           |      |
                           |   sampling
                           |      |
                           | classifying
                           |      |
                           +------+
                                  |
                       maintaining flow records
                                  |
                                  v

              Figure 1: Functions of the metering process

 * Flow Record
   A flow record contains information about a specific flow that was
   metered in an observation domain. A flow record contains measured
   properties of the flow (e.g. the total number of bytes of all packets
   of the flow) and usually characteristic properties of the flow (e.g.
   source IP address).

 * Exporting Process
   The exporting process sends flow records to one or more collectors.
   The flow records are generated by one or more metering processes.

 * Collecting Process
   The collecting process receives flow records from one or more exporting
   processes. The collecting process might store received flow record
   or further process them, but these actions are out of the scope of
   this document.

 * IPFIX Device:
   A device hosting at least an observation point, a metering
   process and a flow information export process. Typically,
   corresponding observation point(s), metering process(es), and
   exporter process(es) are co-located at this device, for example,
   at a router.

 * Template:
   Templates is a set of {type, length} ordered pairs, used to
   completely identify the structure and semantics of a particular
   information that needs to be communicated from the IPFIX Device
   to the collector. Each template is uniquely identified by a
   Template ID.

 * Control Stream, Data Stream:
   The information that needs to be exported from the IPFIX device
   can be classified into the following categories:

     - Control Information :
       This includes the flow type definition, selection criteria
       for packets within the flow. This is also called as Control
       Stream.
     - Flow record :
       This includes data records corresponding to the various
       observed flows at each of the observation point. This is also
       called as Data Stream.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/