Subject: RE: [ipfix-req] RE: MUST or SHOULD be able to export ICMP codes? was:RE: [ipfix-req] list of issues

From: "Carter Bullard" <[email-masked]>
Date: Fri, 15 Nov 2002 11:07:57 -0500

Hey Reinaldo,
  I agree that a MUST is too strong for any data element
in the flow model. It pre-supposes that all IPFIX devices
will generate the same type of flow information.  ICMP
packets can be viewed as belonging to its own flow, in
the case of ICMP request/response types, or they can be
viewed as belonging to Type-P1-P2 flows, in the case
of unreachables.

  I do not want IPFIX to dictate how a flow monitor will
count these packets, since it doesn't have a well defined
flow model that explains the methodology.

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street
Suite 18K
New York, New York 10022

+1 212 588-9133 Phone
+1 212 588-9134 Fax
   
-----Original Message-----
From: majordomo listserver [mailto:[email-masked]] On
Behalf Of Reinaldo Penno
Sent: Friday, November 15, 2002 10:41 AM
To: [email-masked]; Juergen Quittek
Cc: Tal Givoly; [email-masked]
Subject: [ipfix-req] RE: MUST or SHOULD be able to export ICMP codes?
was:RE: [ipfix-req] list of issues

Many platforms do not distinguish a lot of fields...Should we make them
all SHOULD? 
Because today we have two requirements (on a quick glance) that go
against this reasoning 
"4.4.  MPLS Label 
   If the observation point is located at a device supporting 
   Multiprotocol Label Switching (MPLS, see [RFC3031]) then the metering

   process MUST be able to separate flows by the MPLS label. 
4.5.  DiffServ Code Point 
   If the observation point is located at a device supporting 
   Differentiated Services (DiffServ) then the metering process MUST be 
   able to separate flows by the DiffServ Code Point (DSCP, see 
   [RFC2474])." 
So, if that's the reasoning I would propose (as before) dropping these
two requirements or making them a SHOULD. Otherwise I propose something
like
" 
   If the observation point is located at a device supporting 
   ICMP ([XXXX]) then the metering  process MUST be able to separate
flows by ICMP Type and Code." 
I'm just trying to be consistent, otherwise we are having double
standards. 
regards, 
Reinaldo 

ps: Detecting the ICMP type and code is Very important for security
purposes. 

> -----Original Message----- 
> From: [email-masked] [mailto:[email-masked]] 
> Sent: Friday, November 15, 2002 7:07 AM 
> To: Juergen Quittek 
> Cc: Tal Givoly; [email-masked] 
> Subject: Re: MUST or SHOULD be able to export ICMP codes? was:RE: 
> [ipfix-req] list of issues 
> 
> 
> Juergen Quittek wrote: 
> > 
> > Tal, 
> > 
> > -- Tal Givoly wrote on 14 November 2002 13:31 -0800: 
> > 
> > > Reinaldo-4: Add MUST requirement for exporting ICMP codes 
> in Section 6.1 
> > > 
> > >     There were not many responses on this suggestion. 
> Personally, I do 
> > >     not consider it a MUST, but a nice-to-have. 
> > > 
> > > Tal> I believe this should be classified as a SHOULD. 
> > 
> > I agree. In the current draft it is listed in section 6.1 as a MUST 
> > attribute. We should move it to SHOULD. But I changed my opinion 
> > on this issue already two times. Are there other people 
> having a more 
> > firm opinion? 
> > 
>       SHOULD. Many platforms do not distinguish on this field and 
>       it does not make sense to report it if not part of the key. 
> 
> >     Juergen 
> > 
> > -- 
> > Help        mailto:[email-masked] and say 
> "help" in message body 
> > Unsubscribe mailto:[email-masked] and say 
> > "unsubscribe ipfix" in message body 
> > Archive     http://ipfix.doit.wisc.edu/archive/ 
> 
> -- 
> Help        mailto:[email-masked] and say "help" 
> in message body 
> Unsubscribe mailto:[email-masked] and say 
> "unsubscribe ipfix" in message body 
> Archive     http://ipfix.doit.wisc.edu/archive/ 
> 

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/