Subject: [ipfix-eval] Some comments on the evaluation team draft

From: Benoit Claise <[email-masked]>
Date: Thu, 14 Nov 2002 16:52:35 +0100

All,

I have 2 coments regarding the following draft

http://www2.auckland.ac.nz/net//ipfix/draft-ietf-ipfix-protocol-eval-00.txt

4.5 Time Synchronization  (5.5) 

LFAP: T     CRANE: T     IPDR: T     NetFlow: P     Diameter: T

In my draft http://www.ietf.org/internet-drafts/draft-claise-ipfix-eval-netflow-03.txt, I wrote

    3.4.5 Time Synchronization (5.5)

    _ Total Compliance. _
    The export packet header contains the UTC time of the export packet
    generation. This header also contains the router sysUpTime at the
    time of the export packet generation. The UTC time the router booted
    can therefore be deduced. The flow records contain the flow start
    and flow end sysUpTime, so that the NetFlow collector can deduce the
    flow start and flow end UTC time.

5.7 Anonymization  (6.7) 
    
LFAP: E     CRANE: E     IPDR: E     NetFlow: E     Diameter: E

In my draft http://www.ietf.org/internet-drafts/draft-claise-ipfix-eval-netflow-03.txt, I wrote

    3.5.7 Anonymization (6.6)
       
       "The exporting process MAY be capable of anonymizing source and
       destination IP addresses in flow data before exporting them."
       _Total Compliance. _

You can export the prefix is you want to and not the specific source and 
destination IP addresses.

I would appreciate if those two points above could be changed.

BTW, maybe I misunderstood the idea of the evaluation team, but from 
http://ipfix.doit.wisc.edu/archive/1000.html

3) Evaluation Team met by teleconference for an hour on Wed 26 June

   The team was strongly influenced by the MIDCOM WG's recent
   evaluation effort; the IPFIX process will be similar.

   a) The team will publish a 'Protocol Advocacy' draft, to be used
      by the Protocol Advocates in making their submissions to the
      Evaluation team.

   b) They will also publish a 'call for IPFIX protocol submissions,'
      most probably via the IPFIX list, referring to a web page on
      the IPFIX web site.  The call for submissions will set out
      preconditions (e.g. 'must be documented in an Internet Draft
      or RFC'), as discussed previously.

   c) Once all the submissions are in, the team will publish them,
      and call for comments about them on the IPFIX list.
      In addition, the team will read all the drafts and form their
      own opionions of them.

   d) The team will publish an 'Evaluation' draft, using the same
      outline as the Protocol Advocacy drafts; this will conclude
      with a recommendation on which protocol most nearly meets the
      IPFIX requirements.

   e) The Evaluation draft will be discussed on the IPFIX list, 
      until we reach WG consensus.

 From above, you can read "this will conclude with a recommendation on 
which protocol most nearly meets the IPFIX requirements."
And it seems that we miss that part in 
http://www2.auckland.ac.nz/net//ipfix/draft-ietf-ipfix-protocol-eval-00.txt.
The only exception was  in the initial draft from Simon Leinen. But the 
"conclusion" section was removed in the second version of his draft.

Regards, Benoit.

---

From: Simon Leinen <[email-masked]>
Date: 14 Nov 2002 23:47:53 +0100

On Thu, 14 Nov 2002 16:52:35 +0100, Benoit Claise <[email-masked]> said:
> 4.5 Time Synchronization  (5.5) LFAP: T     CRANE: T     IPDR: T
> NetFlow: P     Diameter: T

> In my draft
> http://www.ietf.org/internet-drafts/draft-claise-ipfix-eval-netflow-03.txt,
> I wrote

>     flow start and flow end UTC time.

Yes, but the problem is (Mark Fullmer pointed this out) that the UTC
time field in the header only has 1-second resolution, so a collector
cannot convert flow timestamps to UTC times with the required
precision (centiseconds or better).

It could be fixed by making the UTC time field in the header more
precise.  I think earlier versions of NetFlow had this.
-- 
Simon.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Simon Leinen <[email-masked]>
Date: 14 Nov 2002 23:54:33 +0100

On Thu, 14 Nov 2002 16:52:35 +0100, Benoit Claise <[email-masked]> said:
> 5.7 Anonymization  (6.7)   LFAP: E     CRANE: E     IPDR: E
> NetFlow: E     Diameter: E

> You can export the prefix is you want to and not the specific source
> and destination IP addresses.

I would call that "(router-based) aggregation" rather than
"anonymization".  With anonymization you somehow expect to maintain
granularity, but want some kind of (non-reversible?) scrambling to
cover up privacy-sensitive parts of the traffic data, such as IP
addresses.

Don't take this requirement too seriously.  None of the candidates has
addressed this, and I think as a requirement it hasn't been thought
through too well.  It doesn't really reflect current practice, and
personally I think this is better done on the collector side.
-- 
Simon.

---

From: Simon Leinen <[email-masked]>
Date: 14 Nov 2002 23:54:33 +0100

---

From: Vamsidhar Valluri <[email-masked]>
Date: Thu, 14 Nov 2002 15:30:00 -0800 (PST)

> precise.  I think earlier versions of NetFlow had this.

We are considering the suggestion made by Mark Fullmer to change this to
more precise value.

-vamsi

---

From: "Tal Givoly" <[email-masked]>
Date: Thu, 14 Nov 2002 15:36:01 -0800

Simon,

I fully support your conclusion.

Tal

-----Original Message-----
From: majordomo listserver [mailto:[email-masked]]On Behalf
Of Simon Leinen
Sent: Thursday, November 14, 2002 2:55 PM
To: Benoit Claise
Cc: [email-masked]; [email-masked]
Subject: Re: [ipfix-eval] Some comments on the evaluation team draft

--
Help        mailto:[email-masked] and say "help" in message
body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: "Tal Givoly" <[email-masked]>
Date: Thu, 14 Nov 2002 15:36:01 -0800

Simon,

Tal

---

From: Benoit Claise <[email-masked]>
Date: Fri, 15 Nov 2002 14:50:56 +0100

Simon,

>cover up privacy-sensitive parts of the traffic data, such as IP
So what's the point to export something that you can't use?

Benoit.

---

From: Benoit Claise <[email-masked]>
Date: Fri, 15 Nov 2002 14:50:56 +0100

Simon,

Benoit.