Subject: [IPFIX] Re: [PSAMP] WG Last call for draft-ietf-psamp-info-07

From: Gerhard Muenz <[email-masked]>
Date: Wed, 24 Oct 2007 11:31:54 +0200

Dear all,

I reviewed the PSAMP information model draft.

I'll start with some small remarks before asking if anybody else shares
my interest in an additional *Section IE (see below).

-------

IPFIX information model does not have a terminology section, but the
PSAMP information does. How comes this difference?
On the other hand, you do not repeat the IE properties and the type
space from the IPFIX documents.

-------

In sections 1 and 5, you find occurrences of
"information element(s)" => Information Element(s)

-------

You find both writing:
"IPFIX Information Model" and "IPFIX information model"
but only
"PSAMP information model"
Try to be more consistent?

-------

Section 3:
IPFIX export protocol => IPFIX protocol

-------

Section 3.2:
small remark:
Selection Process is the only process name in PSAMP/IPFIX that does not
use the -ing form (ExportING Process etc.). Intended?

-------

This concerns all "*Section" IEs:
"If insufficient octets are available for the length specified in
 the Template, the Information Element MUST NOT be padded."
What is the consequence? The Template cannot be used. Maybe make a
clearer statement here?

-------

section 9:
"Specifically, the Information Elements pertaining to packet sections
MUST target no more than the packet header, some subsequent bytes of
the packet, and encapsulating headers if present.  Full packet
capture of arbitrary packet streams is explicitly out of scope, per
[RFC2804]."

What does "out of scope" mean? The PSAMP information model enables full
packet capture and export, although it may not be the intended usage.

Maybe formulation is based on a political decision. But if you compare
it to Cisco's presentation of Flexible NetFlow, you find the following
sentence:
"Flexible NetFlow adds capabilities such as packet section export for
deep packet inspection of security incidents."
http://www.cisco.com/en/US/products/ps6601/products_data_sheet0900aecd804b590b.html

Similarly, I assume that in practice, PSAMP will be used for deep packet
inspection as well.

-------

Now comes my question about an additional IE for the export of transport
layer payload section, which would complement the current set of
*Section IEs.

A technical argument against a transportPayloadSection IE is the PSAMP
device might not be able to decode any transport protocol. Yet, in
practice, only three transport protocols are used: TCP, UDP, SCTP. And
IPFIX/PSAMP devices are able to decode these transport protocols anyway
in order to extract transport header fields. So, the usage of the IE
could be restricted to these transport protocols.

I raised this question already in February 2006 on the mailing list:
http://www1.ietf.org/mail-archive/web/psamp/current/msg00221.html
At that time, nobody else seemed to be interested in this additional IE.
Maybe the situation has changed in the meantime.

Best regards,
Gerhard

Juergen Quittek wrote:
> Dear all,
> 
> The WGLC on this document lasts until the end of this week.
> 
> However, I will not close the call without knowing of at least
> three solid reviews from non-authors.
> 
> Please have a look at it and tell us what you think.
> 
> Thanks,
> 
>     Juergen
> 
> 
> On 12.10.2007 12:56 Uhr  "Juergen Quittek" <[email-masked]> wrote:
> 

_______________________________________________
IPFIX mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipfix

---

From: Gerhard Muenz <[email-masked]>
Date: Wed, 24 Oct 2007 11:31:54 +0200

Dear all,

-------

-------

-------

You find both writing:

-------

Section 3:

-------

Section 3.2:
small remark:

-------

-------

section 9:

-------

Best regards,
Gerhard