Subject: [IPFIX] I-D ACTION:draft-ietf-ipfix-protocol-23.txt

From: [email-masked]
Date: Fri, 13 Oct 2006 15:50:02 -0400

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.
This draft is a work item of the IP Flow Information Export Working Group of the IETF.

	Title		: Specification of the IPFIX Protocol for the Exchange of IP Traffic Flow Information
	Author(s)	: B. Claise
	Filename	: draft-ietf-ipfix-protocol-23.txt
	Pages		: 63
	Date		: 2006-10-13
	
This document specifies the IPFIX protocol that serves for 
   transmitting IP traffic flow information over the network.  In order 
   to transmit IP traffic flow information from an exporting process to 
   an information collecting process, a common representation of flow 
   data and a standard means of communicating them is required. This 
   document describes how the IPFIX data and templates records are 
   carried over a number of transport protocols from an IPFIX exporting 
   process to an IPFIX collecting process.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-ipfix-protocol-23.txt

To remove yourself from the I-D Announcement list, send a message to 
[email-masked] with the word unsubscribe in the body of 
the message. 
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the 
username "anonymous" and a password of your e-mail address. After 
logging in, type "cd internet-drafts" and then 
"get draft-ietf-ipfix-protocol-23.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-ipfix-protocol-23.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
IPFIX mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipfix

---

From: Ma Yuzhi <[email-masked]>
Date: Fri, 20 Oct 2006 15:00:03 +0800

Hi,

Section 11.1 Applicability of TLS and DTLS
   Though TLS bindings to SCTP are defined in [RFC3436], they 
   require all communication to be over reliable streams, and require 
   one session per stream.  This arrangement is not compatible with the 
   rationale behind the choice of SCTP as an IPFIX transport protocol. 

RFC3436 Section 5 Connections and Bi-directional Streams
  TLS makes use of a bi-directional stream by establishing a connection
   over it.  This means that the number of connections for an
   association is limited by the number of bi-directional streams.

Does "one session per stream" mean  "one TLS session per SCTP stream"?
If so, I think the description are unsuitable.

Yuzhi

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> Sent: Saturday, October 14, 2006 3:50 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: I-D ACTION:draft-ietf-ipfix-protocol-23.txt
> 
> A New Internet-Draft is available from the on-line 
> Internet-Drafts directories.
> 	Title		: Specification of the IPFIX Protocol 
> for the Exchange of IP Traffic Flow Information
> 	Author(s)	: B. Claise
> To remove yourself from the I-D Announcement list, send a 
> message to [email-masked] with the word 
> unsubscribe in the body of the message. 
> Internet-Drafts are also available by anonymous FTP. Login 
> with the username "anonymous" and a password of your e-mail 
> address. After logging in, type "cd internet-drafts" and then 
> http://www.ietf.org/shadow.html or 
> ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> 
> Below is the data which will enable a MIME compliant mail 
> reader implementation to automatically retrieve the ASCII 
> version of the Internet-Draft.
>

---

From: Ma Yuzhi <[email-masked]>
Date: Fri, 20 Oct 2006 15:00:03 +0800

Hi,

Yuzhi

---

From: Brian Trammell <[email-masked]>
Date: Fri, 20 Oct 2006 11:57:43 -0400

Yuzhi,

Ah, yes... after reviewing RFC 3436 section 5, especially on TLS  
session resumption, the language here confuses TLS Sessions and  
Connections; it should read:

    Though TLS bindings to SCTP are defined in [RFC3436], they
    require all communication to be over reliable, bi-directional  
streams,
    and require one TLS Connection per stream.  This arrangement is not
    compatible with the rationale behind the choice of SCTP as an IPFIX
    transport protocol.

Thanks,

Brian

>> version of the Internet-Draft.

Brian H. Trammell <[email-masked]>                           +1 412 268  
9748
Technical Lead, Engineering       CERT Network Situational Awareness  
Group
Software Engineering Institute, Carnegie Mellon University,  
Pittsburgh, PA

---

From: Brian Trammell <[email-masked]>
Date: Fri, 20 Oct 2006 11:57:43 -0400

Yuzhi,

Thanks,

Brian

---

From: Ma Yuzhi <[email-masked]>
Date: Mon, 23 Oct 2006 15:57:09 +0800

Hi, Brain

Due to the reasons below, can we conclude that TLS is improper for IPFIX
while the transport protocol is SCTP?
Maybe it need more WG discussion. 

Yuzhi

> From: Brian Trammell [mailto:[email-masked]] 
> Sent: Friday, October 20, 2006 11:58 PM
> To: Ma Yuzhi
> Cc: [email-masked]
> Subject: Re: [IPFIX] RE: I-D ACTION:draft-ietf-ipfix-protocol-23.txt
> 
> Yuzhi,
> 
> Ah, yes... after reviewing RFC 3436 section 5, especially on 
> TLS session resumption, the language here confuses TLS 
> Sessions and Connections; it should read:
> 
>     require all communication to be over reliable, 
> bi-directional streams,
> >> This draft is a work item of the IP Flow Information 
> Export Working 
> >> Group of the IETF.
> >>
> >>    to transmit IP traffic flow information from an 
> exporting process 
> >> to
> message to 
> >> [email-masked] with the word unsubscribe in 
> the body 
> >> of the message.
> with the 
> >> logging in, type "cd internet-drafts" and then "get 
> >> draft-ietf-ipfix-protocol-23.txt".
> >>

---

From: Ma Yuzhi <[email-masked]>
Date: Mon, 23 Oct 2006 15:57:09 +0800

Hi, Brain

Yuzhi

---

From: Nevil Brownlee <[email-masked]>
Date: Tue, 24 Oct 2006 11:16:17 +1300

Hi Yuzhi:

I think this points to a need for better understanding of TLS.

If you use SCTP, *without* the SCTP-PR extension, then you have all
streams running through a reliable connection, and you can use TLS to
protect the connection.  No problems there.

However, if you want to use SCTP-PR, then at least some of the streams
will be unreliable, that's why protocol-23 says you must use DTLS with SCTP.
The phrase "not compatible with the rationale behind the choice of SCTP
as an IPFIX transport protocol" reminds you that IPFIX data may be lost
during peaks of network activity.

To answer your question (below), it's inappropriate to use TLS with IPFIX
over SCTP.

Cheers, Nevil

>> Software Engineering Institute, Carnegie Mellon University,

-----------------------------------------------------------------------
   Nevil Brownlee                 Computer Science Department | ITSS
   Phone: +64 9 373 7599 x88941           The University of Auckland
   FAX: +64 9 373 7453      Private Bag 92019, Auckland, New Zealand

-----------------------------------------------------------------------
This mail sent through University of Auckland http://www.auckland.ac.nz

---

From: Nevil Brownlee <[email-masked]>
Date: Tue, 24 Oct 2006 11:16:17 +1300

Hi Yuzhi:

Cheers, Nevil

---

From: Ma Yuzhi <[email-masked]>
Date: Tue, 24 Oct 2006 11:10:05 +0800

Hi, Nevil

Please find my inline response.

Thanks, Yuzhi

> From: Nevil Brownlee [mailto:[email-masked]] 
> Sent: Tuesday, October 24, 2006 6:16 AM
> To: Ma Yuzhi
> Cc: [email-masked]
> Subject: RE: [IPFIX] RE: I-D ACTION:draft-ietf-ipfix-protocol-23.txt
> 
> 
> Hi Yuzhi:
> 
> If you use SCTP, *without* the SCTP-PR extension, then you 
> have all streams running through a reliable connection, and 
> you can use TLS to protect the connection.  No problems there.
> 
In this scenario, It may not be inappropriate to use TLS with IPFIX over
SCTP.

> However, if you want to use SCTP-PR, then at least some of 
> the streams will be unreliable, that's why protocol-23 says 
> you must use DTLS with SCTP.
> The phrase "not compatible with the rationale behind the 
> choice of SCTP as an IPFIX transport protocol" reminds you 
> that IPFIX data may be lost during peaks of network activity.
> 
If IPFIX Template Set and Options Template Set can be sent on reliable
stream, I think it is acceptable for some application even though some IPFIX
data may be lost.
I agree on using DTLS with SCTP in protocol-23, but  may not  MUST use it. 

> To answer your question (below), it's inappropriate to use 
> TLS with IPFIX over SCTP.
> 
> Cheers, Nevil
> 
> > Due to the reasons below, can we conclude that TLS is improper for 
> > IPFIX while the transport protocol is SCTP?
> >>     and require one TLS Connection per stream.  This 
> arrangement is 
> >> not
> >> >    one session per stream.  This arrangement is not 
> compatible with 
> >> > the
> >> >> 	"FILE 
> /internet-drafts/draft-ietf-ipfix-protocol-23.txt".
> >> >>

---

From: Ma Yuzhi <[email-masked]>
Date: Tue, 24 Oct 2006 11:10:05 +0800

Hi, Nevil

Thanks, Yuzhi