Subject: [ipfix] Relationship between Metering Process and Observation Point

From: Motonori Shindo <[email-masked]>
Date: Mon, 15 May 2006 11:52:06 +0900 (JST)

Hi,

I'm relatively new to this mailing list, so if the following has
already been brought up and discussed in this mailing list in the
past, please accept my apology.

I don't clearly understand the relationship between Observation Point
and Metering Process. Looking at Figure 4 in
draft-ietf-ipfix-architecture-10.txt, it is obviously not a 1:1
relationship because Observation Point has an index M whereas Metering
Process has an index N. 

I think it is quite possible for a given Metering Process to meter
more than one Observation Points under single Observation Domain, but
how about the other way around? That is, is it OK for a given
Observation Point to be metered by more than one Metering Processes?
If it is allowed, it will then introduce so called a "double counting"
(or "multiple counting" in general) issue inside the IPFIX device,
which is not a desired behavior in most cases.

It looks to me that having multiple Metering Processes associated with
a given Observation Domain has a legitimate usage, for example, for
the case where each Metering Process has a distinct sampling rate, but
I don't see any practical use of having multiple Metering Processes
for a given Observation Point.

Will anybody here kindly clarify this point? Thanks.

---
Motonori Shindo
Chief Technology Officer
Fivefront Corporation
http://www.fivefront.com

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Juergen Quittek <[email-masked]>
Date: Mon, 15 May 2006 08:49:01 +0200

> which is not a desired behavior in most cases.

Yes, you are right.  IPFIX supports this.
But as you reasoned well, applications using this should be aware
of the implications.  One of them is the potential of double counting.
There are cases where double counting can is intended and useful.
Still it is a potential source of misinterpretation of measured data.
But this is something that the IPFIX standard cannot and does not intend
to completely exclude.  Most standard protocols can be used in a way
that is not recommendable.

> for a given Observation Point.

If you go back to the RTFM architecture (RFC 2722), then you will find
the idea that different users of the same device want to apply different
metering rules for the same source of traffic, for example, by with
different applications that want to measure the same flow with different
sampling rates.  You can discuss if this problem would be solved better
with a single or multiple metering processes for the same observation
point, but this is an implementation issue that IPFIX should not limit
in one way or the other.

If we restrict an observation point to be observed by one metering
process only, we would unnecessarily rule out a PC runing more than
one IPFIX-compatible application on the same interface.

> Will anybody here kindly clarify this point? Thanks.

Hope the text above helps.

Thanks,

    Juergen

---

From: Motonori Shindo <[email-masked]>
Date: Tue, 16 May 2006 11:22:21 +0900 (JST)

Juergen,

From: Juergen Quittek <[email-masked]>
Subject: Re: [ipfix] Relationship between Metering Process and Observation Point
Date: Mon, 15 May 2006 08:49:01 +0200

> that is not recommendable.

I agree.

> point, but this is an implementation issue that IPFIX should not limit

OK.

> one IPFIX-compatible application on the same interface.

In such a case, those metering processes are not likely to share the
export process, are they? 

Anyway, I understand that, as seen in many other protocols, IPFIX is
designed as much flexible as it can be and will not exclude any
scenario unless it has an inherent drawback.

> Hope the text above helps.

It really did. Thanks!

---
Motonori Shindo
Chief Technology Officer
Fivefront Corporation
http://www.fivefront.com

---

From: Juergen Quittek <[email-masked]>
Date: Tue, 16 May 2006 09:29:13 +0200

Shindo-san,

> export process, are they?

Right.

    Juergen
-- 
Juergen Quittek        [email-masked]       Tel: +49 6221 4342-115
NEC Europe Ltd.,       Network Laboratories        Fax: +49 6221 4342-155
Kurfuersten-Anlage 36, 69115 Heidelberg, Germany   http://www.netlab.nec.de

---

From: Carter Bullard <[email-masked]>
Date: Tue, 16 May 2006 03:35:16 -0400

Gentle people,

>> export process, are they?

Actually they are highly likely to use the same export process.

>    Juergen

Carter Bullard
CEO/President
QoSient, LLC
150 E. 57th Street Suite 12D
New York, New York 10022

+1 212 588-9133 Phone
+1 212 588-9134 Fax

---

From: Motonori Shindo <[email-masked]>
Date: Tue, 16 May 2006 15:49:59 +0900 (JST)

Folks,

From: Carter Bullard <[email-masked]>
Subject: Re: [ipfix] Relationship between Metering Process and Observation Point
Date: Tue, 16 May 2006 03:35:16 -0400

> Actually they are highly likely to use the same export process.

If they are implemented as a user land process, metering processes
that meters the same observation point are not likely to sahre the
export process. If they are implemented as part of the kernel on the
other hand, they may be likely to share the export process. Just my
two cents.

Regards,

---
Motonori Shindo
Chief Technology Officer
Fivefront Corporation
http://www.fivefront.com

---

From: Paul Aitken <[email-masked]>
Date: Tue, 16 May 2006 10:23:39 +0100

Shindo-san,

> other hand, they may be likely to share the export process.

So it's an implimentation issue. The IPFIX protocol doesn't place any 
restrictions here.

-- 
Paul Aitken
Cisco Systems Ltd, Edinburgh, Scotland.

---

From: Paul Aitken <[email-masked]>
Date: Tue, 16 May 2006 10:23:24 +0100

I agree.

See Figure 4 in draft-ietf-ipfix-architecture-10.txt for an example.

---

From: Juergen Quittek <[email-masked]>
Date: Tue, 16 May 2006 18:17:19 +0200

Hi Carter,

> Actually they are highly likely to use the same export process.

We were talking about two applications running on the same PC.

For sharing one exporter we would need something like an IPFIX exporter
library (or other interface).  Do you expect such a library to be
available soon?

Thanks,

    Juergen

---

From: kobayashi atsushi <[email-masked]>
Date: Fri, 26 May 2006 18:04:52 +0900

Dear all,

I'm sorry for late reply.

I confused a little about this discussion. 
With regard to PSAMP, I think that each measurement processes are allowed 
to select each exporting processes, if one observation point shares  two
measurement processes. Of course, we can select one exporting processes,
too.
If one observation point shares two measurement process, two measurement
processes are likely to be created by different purpose.  There are QoS
measurement or anomaly detection. In that case, different exporting
processes are likely to be selected. In PSAMP-MIB, we can configure
above conditions. 

In IPFIX, it is not configurable architecture. Is such reletionship
implementation matter?

Thank you,
Atsushi KOBAYASHI

On Tue, 16 May 2006 18:17:19 +0200

> > 150 E. 57th Street Suite 12D

--- 
Atsushi KOBAYASHI  <[email-masked]>
NTT Information Sharing Platform Lab.
tel:+81-(0)422-59-3978 fax:+81-(0)422-59-5652

---

From: Motonori Shindo <[email-masked]>
Date: Sun, 28 May 2006 21:17:46 +0900 (JST)

Kobayashi-san,

From: kobayashi atsushi <[email-masked]>
Subject: Re[2]: [ipfix] Relationship between Metering Process and Observation Point
Date: Fri, 26 May 2006 18:04:52 +0900

> In IPFIX, it is not configurable architecture. Is such reletionship

I'm not sure about PSAMP case, but my understanding about IPFIX model
is as follows:

In IPFIX, as depicted in draft-ietf-ipfix-architecture-10.txt,
Observation Point and Metering Process forms "M : N" relationship, and
Metering Process and Exporting Process forms "N : 1" relationship. In
case where there are more than one Exporting Processes, then it is
viewed as multiple IPFIX devices. How one entity selects the
counterpart is up to the implementation.

Please correct me if I'm wrong. Thanks.

Regards,

---
Motonori Shindo
Chief Technology Officer
Fivefront Corporation
http://www.fivefront.com

---

From: Paul Aitken <[email-masked]>
Date: Sun, 28 May 2006 15:47:31 +0100

Motonori-san,

> Metering Process and Exporting Process forms "N : 1" relationship.

IPFIX-ARCH doesn't make it clear, but I believe it should be possible 
for each Metering Process to be associated with multiple Exporting 
Processes - eg, to provide redundancy, for export over different 
transports, to convey the MP output to multiple collectors, or even to 
impliment different export protocols.

Certainly the text doesn't say that's not possible.

> In case where there are more than one Exporting Processes, then it is
> viewed as multiple IPFIX devices.

Figure 3 in IPFIX-ARCH shows a single IPFIX device with multiple EPs:

    +------------------------+
    |IPFIX Device(i)         |
    |[Observation Point(s)]  |
    |[Metering Process(es)]  |
    |[Exporting Process(es)] |
    +------------------------+

Thanks.