Subject: [ipfix] DRAFT IPFIX meeting minutes, 63rd IETF, Paris

From: Dave Plonka <[email-masked]>
Date: Tue, 2 Aug 2005 11:20:12 -0500

IPFIXers,

Please review the attached DRAFT minutes of the IPFIX meeting yesterday
afternoon.  You are welcome to send any follow-up comments/suggestions/
corrections to the list.

The minutes can also be found here:

   http://ipfix.doit.wisc.edu/IETF63/minutes.txt

Thanks to those that participated, and especially the interoperability
folks.  Thanks also to Matt Zekauskas and Ralf Wolter for their notes.

Dave

-- 
[email-masked]  http://net.doit.wisc.edu/~plonka  ARS:N9HZF  Madison, WI

---

From: Nevil Brownlee <[email-masked]>
Date: Wed, 3 Aug 2005 23:05:15 +1200

Hi Dave:

Thanks for the IPFIX minutes, they look fine.

I agree with the notion that an observvation point should not be
able to see packets "before thay reach the observation point."
That is, I think that we should not allow pre- preixes, but post-
prefixes do seem OK and useful.  

I like Juergen's 'External Flow Information' proposal, to me that
seems much the same as something like the next-hop address in a router.

Clearly the draft editors will have to work through the set of changes
discussed at the meeting; once that's done we'd better run another
WG Last Call.  Then, all being well, we can get them submitted to
IESG by the and of August - so we'd better ask our ADs to change
our milestones to say that.

As for the new drafts, clearly there's strong interest in pursuing
these IPFIX-related activities.  I like your proposal to review
the IPFIX charter to include them *after* we've submitted the current
four drafts.  Agan, you'd better discuss that with our ADs.

Thanks again, Nevil

-----------------------------------------------------------------------
   Nevil Brownlee                 Computer Science Department | ITSS
   Phone: +64 9 373 7599 x88941           The University of Auckland
   FAX: +64 9 373 7021      Private Bag 92019, Auckland, New Zealand

-------------------------------------------------
This mail sent through University of Auckland
http://www.auckland.ac.nz/

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Sven Anderson <[email-masked]>
Date: Wed, 03 Aug 2005 19:06:33 +0200

Hi all,

Dave Plonka schrieb:
> IPFIX open issue regarding pre-/post- prefixed info elements (Juergen Quittek)
> a.k.a. "IFPIX observations at middleboxes"
[...]
>    a) atomic flow observation (Sven Anderson posted on mailing list)
> 
>       In this method, the IPFIX device reports only from one observation
>       point.  This has the advantage that there is no need for "pre" or
>       "post" prefixes, since there is only one observation point for a
>       given packet, that the implementation must make clear to the user
>       so that the value can be interpreted appropriately.  It is
>       restrictive however if the device has the potential to observe the
>       flows before and after packet treatment.  If exported seperately,
>       they would be very hard to correlate flow records afterwards.

I'm happy to see my proposal here. But unfortunately there is an important 
part missing. (The possibility to define Flows by attributes from 
_different_ OPs in an OD.) Without it, it would be indeed really 
restrictive. So the sentence "the IPFIX device reports only from one 
observation point" is not true for my proposal. Is this changed 
intentionally or is it an misunderstanding, and I should explain my 
proposal in more detail on the ipfix-info list again?

The real disadvantage is, that it maybe implies changes in IPFIX-PROTO 
too, as the template scheme has to be expanded, and that costs time. But I 
offer my help here if you want to go that way, and I also have an idea to 
realize it without changing IPFIX-PROTO. I think it's worth it, as the 
"post" solutions blow up the list of IEs and restrict the flows to derive 
from only two observation points (post and not-post), but there is no need 
to do such a restriction.

Cheers,

Sven

-- 
Sven Anderson
Institute for Informatics - http://www.ifi.informatik.uni-goettingen.de
Georg-August-Universitaet Goettingen
Lotzestr. 16-18, 37083 Goettingen, Germany

---

From: Jeroen Massar <[email-masked]>
Date: Thu, 04 Aug 2005 14:30:55 +0200

> Dave Plonka schrieb:
<SNIP>
> too, as the template scheme has to be expanded, and that costs time. But
> I offer my help here if you want to go that way, and I also have an idea
> to realize it without changing IPFIX-PROTO. I think it's worth it, as
> the "post" solutions blow up the list of IEs and restrict the flows to
> derive from only two observation points (post and not-post), but there
> is no need to do such a restriction.

A possible "solution" we could use for making items post is having a IE
which specifies 'post' eg, a template like:

+-------------+-----------+
| TmpID 40042 |    len    |
+-------------+-----------+
| Src IPv4    |     4     |
+-------------+-----------+
| Dst IPv4    |     4     |
+-------------+-----------+
| Octets      |     8     |
+-------------+-----------+
| Packets     |     8     |
+-------------+-----------+
| Post        |     0     |   <-- indicates that the IE's
+-------------+-----------+       following this one are 'post'
| Src IPv4    |     4     |
+-------------+-----------+
| Dst IPv4    |     4     |
+-------------+-----------+

A such we can have multiple of these special IE's which simply 'flip'
the meaning. People supporting this 'flip' do it correctly, others will
have a small meaning problem in which we might want to define with
respect to double entries. Then again semantics could also be said to be
specified by collector and meter. My take is in case of double entries,
and not knowing what to do with it to ignore the second field. Of course
when you know what to do with it, take it in. Always warn the user when
unknown of course.

my two cents ;)

Greets,
 Jeroen

---

From: Sven Anderson <[email-masked]>
Date: Thu, 04 Aug 2005 15:06:16 +0200

Hi Jeroen,

> which specifies 'post' eg, a template like:

this is exactly the idea I was talking about above saying "to realize it 
without changing IPFIX-PROTO". ;-)

My whole proposal mail will be finished and sent to ipfix-info today.

Cheers,

Sven