Subject: RE: [ipfix] Re: AD review for: draft-ietf-ipfix-architecture-09.txt

From: "Schmoll, Carsten" <[email-masked]>
Date: Fri, 7 Apr 2006 11:18:58 +0200

Brian,

I fear that the number of lost packets which an IPFIX entity
is able to report might only ever be a *lower limit* for 
the number of losses, since e.g. at a time of network downtime
some flows might have been exported using UDP whose
export ended before the network comes up again. In that
case estimating the number of lost packets from skipped
counters in IPFIX messages is not possible. 

In any case wouldn't it make sense to talk about number
of lost messages instead of packets - or is this synonymous?

Regards,
Carsten.

> -----Original Message-----
> From: majordomo listserver 
> [mailto:[email-masked]] On Behalf Of Brian Trammell
> Sent: Thursday, April 06, 2006 7:17 PM
> To: Paul Aitken
> Cc: Nevil Brownlee; [email-masked]; Bert; 
> [email-masked]; [email-masked]; [email-masked]
> Subject: Re: [ipfix] Re: AD review for: 
> draft-ietf-ipfix-architecture-09.txt
> 
> Paul,
> 
> Agreed. This paragraph raises a few of additional questions:
> 
> Is it _ever_ possible to assume that a Device's estimation of packet  
> loss is accurate? What is the minimum standard of "accuracy" below  
> which a Device should not give such an estimate? Should the  
> information loss message (which, I assume, maps to a scoped data  
> record in the protocol) also include some information about how  
> accurate the Device thinks the estimate, if any, may be?
> 
> - Brian
> 
> On Apr 6, 2006, at 4:29 AM, Paul Aitken wrote:
> 
> > Nevil,
> >
> >> - sect 6.4 2nd para.
> >>  How can a IPfix device count the p[ackets losts in all
> >>  the possible problem scenarios?
> >>  Maybe the solution is to say that it should try to count
> >>  them and if it can, then it should report. Of it cannot count
> >>  them, then maybe give a indication of the time period that
> >>  packets could not be handled/seen?
> >>  * Reowrked para to:
> >>  In such situations, the IPFIX Device should attempt to count the
> >>  number of packet losses that have occurred, and report them to its
> >>  Collector(s).  If it is not possible to count losses accurately,
> >>  e.g. when transport layer errors are detected, the IPFIX device  
> >> should
> >>  report this fact, and perhaps indicate the time period 
> during which
> >>  some packets might not have been observed.
> >
> > That sounds a bit wooly :-(
> >
> > Which Information Elements will indicate this? Obviously a start  
> > and / or end time (if known), but also something indicating where  
> > the packet loss occurred, in terms that the collector can 
> understand.
> >
> > So it'd be better to define an information loss message and say  
> > "the IPFIX device should report this fact using an 
> information loss  
> > message."
> >
> > Cheers.
> > -- 
> > Paul Aitken
> > Cisco Systems Ltd, Edinburgh, Scotland.
> >
> > --
> > Help        mailto:[email-masked] and say "help" in  
> > message body
> > Unsubscribe mailto:[email-masked] and say
> > "unsubscribe ipfix" in message body
> > Archive     http://ipfix.doit.wisc.edu/archive/
> 
> 

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Paul Aitken <[email-masked]>
Date: Fri, 07 Apr 2006 10:54:22 +0100

Carsten,

> counters in IPFIX messages is not possible. 

As long as those packets consumed Sequence Numbers, the collector can 
work out how many packets were lost from the difference between the 
Sequence Numbers.

> of lost messages instead of packets - or is this synonymous?

I agree: our terminology should be "lost messages".