Subject: [ipfix-req] RE: MUST or SHOULD be able to export ICMP codes? was:RE: [ipfix-r eq] list of issues

From: "Reinaldo Penno" <[email-masked]>
Date: Fri, 15 Nov 2002 07:40:30 -0800

Many platforms do not distinguish a lot of fields...Should we make them all
SHOULD?

Because today we have two requirements (on a quick glance) that go against
this reasoning

"4.4.  MPLS Label

   If the observation point is located at a device supporting
   Multiprotocol Label Switching (MPLS, see [RFC3031]) then the metering
   process MUST be able to separate flows by the MPLS label.

4.5.  DiffServ Code Point

   If the observation point is located at a device supporting
   Differentiated Services (DiffServ) then the metering process MUST be
   able to separate flows by the DiffServ Code Point (DSCP, see
   [RFC2474])."

So, if that's the reasoning I would propose (as before) dropping these two
requirements or making them a SHOULD. Otherwise I propose something like

"
   If the observation point is located at a device supporting
   ICMP ([XXXX]) then the metering  process MUST be able to separate flows
by ICMP Type and Code."

I'm just trying to be consistent, otherwise we are having double standards. 

regards,

Reinaldo 

ps: Detecting the ICMP type and code is Very important for security
purposes.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Friday, November 15, 2002 7:07 AM
> To: Juergen Quittek
> Cc: Tal Givoly; [email-masked]
> Subject: Re: MUST or SHOULD be able to export ICMP codes? was:RE:
> [ipfix-req] list of issues
> 
> 
> Juergen Quittek wrote:
> > 
> > Tal,
> > 
> > -- Tal Givoly wrote on 14 November 2002 13:31 -0800:
> > 
> > > Reinaldo-4: Add MUST requirement for exporting ICMP codes 
> in Section 6.1
> > >
> > >     There were not many responses on this suggestion. 
> Personally, I do
> > >     not consider it a MUST, but a nice-to-have.
> > >
> > > Tal> I believe this should be classified as a SHOULD.
> > 
> > I agree. In the current draft it is listed in section 6.1 as a MUST
> > attribute. We should move it to SHOULD. But I changed my opinion
> > on this issue already two times. Are there other people 
> having a more
> > firm opinion?
> > 
> 	SHOULD. Many platforms do not distinguish on this field and
> 	it does not make sense to report it if not part of the key.
> 
> >     Juergen
> > 
> > --
> > Help        mailto:[email-masked] and say 
> "help" in message body
> > Unsubscribe mailto:[email-masked] and say
> > "unsubscribe ipfix" in message body
> > Archive     http://ipfix.doit.wisc.edu/archive/
> 
> --
> Help        mailto:[email-masked] and say "help" 
> in message body
> Unsubscribe mailto:[email-masked] and say
> "unsubscribe ipfix" in message body
> Archive     http://ipfix.doit.wisc.edu/archive/
>

---

From: [email-masked]
Date: Fri, 15 Nov 2002 11:14:18 -0500

> Reinaldo Penno wrote:
> 
> Many platforms do not distinguish a lot of fields...Should we make
> them all SHOULD?

	Of course. Who is going to go change their hardware to
	meet this IPFIX requirement?
	
> 
> Because today we have two requirements (on a quick glance) that go
> against this reasoning
> 
> "4.4.  MPLS Label
> 

	This is reasonable because it says IF the device
	supports MPLS. If the device supports MPLS, it will 
	by definition, distinguish by label. What other attributes 
	(e.g. src ip, dst-ip) can be reported is less clear to me.

>    able to separate flows by the DiffServ Code Point (DSCP, see

	I didn't object to this one because I could not
	point to any devices that don't already distinguish
	based on this. Someone else is free to object on that
	basis.

> 
> So, if that's the reasoning I would propose (as before) dropping these
> two requirements or making them a SHOULD. Otherwise I propose
> something like
> 
> "
>    ICMP ([XXXX]) then the metering  process MUST be able to separate
> flows by ICMP Type and Code."
> 

	I would word it like this...

	If the observation point is located at a device which
	distinguishes flows by ICMP type code, then the metering  
	process MUST be able to export the type code.

	However, I thought we were trying to take the state
	of the industry in terms of distinguishing flows and
	make those MUSTs and the others SHOULD. 

> ps: Detecting the ICMP type and code is Very important for security

	I'm not questioning that aspect.

	Paul

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/