Subject: [ipfix-arch] protocol and architecture terminology nitpick

From: Brian Trammell <[email-masked]>
Date: Mon, 7 Mar 2005 18:43:31 -0600

I have one terminology nit to pick concerning 
draft-ietf-ipfix-protocol-08.txt:

In section 3, Terminology, "Metering Process", on page 7, I suggest 
changing:

"Input to the process are packet headers observed at an Observation 
Point and packet treatment at the Observation Point..."

to:

"Inputs to the process are packet headers and characteristics observed 
at an Observation Point and packet treatment at the Observation 
Point..."

as the current wording doesn't take into account "IP Traffic Flow" 
values part 2 on page 6:

"2. one or more characteristics of the packet itself"

if those characteristics are not, available in or derived from the 
network, transport, or application layer headers. (The specific 
application I'm thinking of for shipping more than headers to the 
Metering Process is first-N-octet payload hashing used in some 
darkspace sensors to classify worm propagation and scanning attempts.) 
In fact, Section 14, para 5, on Page 45, implies that payload 
information beyond the header may be passed forward to the Collecting 
Process by the Metering Process: "When an Information Element 
containing end-user payload information is exported, it SHOULD be 
transmitted to the Collecting Process using a means that secures its 
contents against eavesdropping."

I realize that the coupling between the Observation Point and the 
Metering Process is an implementation detail outside the scope of the 
protocol documents; nevertheless, for the sake of consistency, I'd 
suggest changing the relevant portion of the Terminology definition for 
Metering Process as above.

This suggested change also affects the terminology definition in 
draft-ietf-ipfix-architecture-06.txt, also in section 3, on page 7 of 
that document.

Regards,

Brian

--
Brian H. Trammell / MTS, CERT/NetSA / <[email-masked]> / 412.268.9748

---

From: Benoit Claise <[email-masked]>
Date: Thu, 17 Mar 2005 15:16:48 +0100

Brian,

As suggested, this is modified in IPFIX-PROTO.
The new definition is:

Metering Process

    The Metering Process generates Flow Records.  Inputs to the process
    are packet headers and characteristics observed at an Observation
    Point and packet treatment at the Observation Point (for example the
    selected output interface).

    The Metering Process consists of a set of functions that includes
    packet header capturing, timestamping, sampling, classifying, and
    maintaining Flow Records.

    The maintenance of Flow Records may include creating new records,
    updating existing ones, computing Flow statistics, deriving further
    Flow properties, detecting Flow expiration, passing Flow Records to
    the Exporting Process, and deleting Flow Records.

Nevil, for consistency purposes, you should copy this definition in 
IPFIX-ARCH.

Regards, Benoit.

> at an Observation Point and packet treatment at the Observation Point..."
>
> suggest changing the relevant portion of the Terminology definition 
> for Metering Process as above.
>

---

From: Benoit Claise <[email-masked]>
Date: Thu, 17 Mar 2005 15:16:48 +0100

Brian,

Metering Process

Regards, Benoit.