Subject: Re: [ipfix-req] Requirements drafts, NATed flows and VPNs

From: Simon Leinen <[email-masked]>
Date: 05 Oct 2002 01:50:37 +0200

[ipfix-eval-team removed from list of recipients, since this seems
 purely a requirements issue.]

I am opposed to this proposal because it opens a can of worms if we
start to try to accomodate arbitrary services and middleboxes.

What about those cool rate shapers that fiddle with TCP window sizes?
If they support IPFIX, the window-fiddle-factor field ist a must!
What about "cookie-cutting" layer 4-7 switches? The cookie field is a
must! VoIP switches? etc. etc.

Please let's try to stick with the core goal of looking at IP (v4&v6)
packets and the "transport" protocol or next header.

Anything else should be optional and left to other documents.  The
IPFIX protocol just should support enough extensibility to allow this.

My counter-proposal would be to drop the MPLS label requirement from
the requirements draft.
-- 
Simon.

On Mon, 30 Sep 2002 10:26:36 -0700, "Reinaldo Penno" <[email-masked]> said:
> I think there are some important packet fields/scenarios that should
> be included in the requirements draft.

> 1 - We discussed a long time ago to include the VPN-ID as one of the
> parameters exported. If Ipfix will be used in VPN environments for
> accouting, QoS, monitoring, etc, this field is a must.

> 2 - There is mention to intrusion detection/security as one of the
> applications for IPfix, but there is no requirement to export NATed
> flows (before and after).

> In a device that supports NAT (traditional, layer 7 interception,
> whatever) and it's going to use IPfix for security/intrusion
> detection, dealing with NAT is must. There is no way a intrusion
> detection device will find attacker/attacked properly without both
> sides of a NAT flow. Not to mention accouting, billing, etc.

> I would propose to include both items on the requirements draft.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Randy Bush <[email-masked]>
Date: Fri, 04 Oct 2002 17:03:07 -0700

> packets and the "transport" protocol or next header.

i think that was the intent of this wg's charter.

randy, with ad hat on