Subject: [IPFIX] Internal WG Review: Recharter of IP Flow Information Export WG (ipfix)

From: IESG Secretary <[email-masked]>
Date: Wed, 24 Oct 2007 15:15:01 -0400

A new charter for the IP Flow Information Export (ipfix) working group
in the Operations and ManagementArea of the IETF is being considered.
The draft charter is provided below for your review and comment.

Review time is one week.

The IETF Secretariat

+++

IP Flow Information Export (ipfix)
===================================

Last Modified: 2007-10-17

Current Status: Active Working Group

Additional information is available at tools.ietf.org/wg/ipfix

Chair(s):
Nevil Brownlee <[email-masked]> 
Juergen Quittek <[email-masked]>

Operations and Management Area Director(s):
Dan Romascanu <[email-masked]>
Ronald Bonica <[email-masked]>

Operations and Management Area Advisor:
Dan Romascanu <[email-masked]>

Mailing Lists:
General Discussion: [email-masked]
To Subscribe: http://www1.ietf.org/mailman/listinfo/ipfix
Archive: http://www1.ietf.org/mail-archive/web/ipfix/current/index.html

Description of Working Group:

The IPFIX working group has specified the Information Model (to describe
IP flows) and the IPFIX protocol (to transfer IP flow data from IPFIX
exporters to collectors). Several implementers have already built
applications using the IPFIX protocol. As a result of a series of IPFIX
interoperability testing events the WG has produced guidelines for IPFIX
implementation and testing as well as recommendations for handling
special cases such as bidirectional flow reporting and reducing
redundancy in flow records.

Practical experiences with IPFIX implementations exposed new
requirements for the IPFIX protocol that so far have not been addressed
by the WG. The major current goal of the WG is developing solutions
that meet the new requirements without modifying the core IPFIX protocol
specifications.

1. The IPFIX WG has developed a MIB module for monitoring IPFIX
implementations. Means for configuring these devices have not been
standardized yet. The WG will develop an XML-based configuration data
model that can be used for configuring IPFIX devices and for storing,
modifying and managing IPFIX configurations parameter sets. This work
will be performed in close collaboration with the NETCONF WG.

2. There is a need for storing measured flow information and for
exchanging this information between different systems and organizations.
The WG develop a common IPFIX file format for storing flow data in
order to facilitating interoperability and reusability among a wide
variety of flow storage, processing, and analysis tools. It will be a
flat-file format using binary encodings that are based on the IPFIX
message format.

3. When dealing with enterprise-specific information elements in IPFIX
flow records, it often occurs that the receiver of the record does not
know the definition of the information element. For processing such
information elements it would be desirable for the receiver to know at
least the data types of the enterprise-specific information elements.
The WG will develop an extension to IPFIX that provides means for the
encoding of IPFIX data type information within an IPFIX Message stream.

4. Another requirement resulting from practical use of IPFIX is
reporting IPFIX template records and corresponding data records within
the same SCTP stream. The IPFIX WG will develop guidelines for this use
case.

5. First applications of IPFIX at large operator networks showed the
need for mediation of flow information, for example, for aggregating
huge amounts of flow data and for anomymization of flow information.
The IPFIX WG will investigate this issue and produce a problem statement
and a framework for IPFIX flow mediation.

Goals and Milestones:
Done Publish Internet Draft on IPFIX Testing
Done Publish Internet Draft on IPFIX MIB
Nov 2007 Submit IPFIX Testing draft to IESG for publication
as Informational RFC
Nov 2007 Submit IPFIX MIB draft to IESG for publication
as Standards track RFC

Dec 2007 Publish Internet draft on IPFIX Configuration Data Model
Dec 2007 Publish Internet draft on IPFIX File Format
Dec 2007 Publish Internet draft on IPFIX Type Information Export
Dec 2007 Publish Internet draft on Single SCTP Stream Reporting
Jan 2008 Publish Internet draft on IPFIX Mediation Problem Statement
Jun 2008 Submit File Format draft to IESG for publication
as Standards track RFC
Jun 2008 Submit Type Export draft to IESG for publication
as Standards track RFC
Jun 2008 Submit Single SCTP Stream draft to IESG for publication
as Informational RFC
Oct 2008 Submit Configuration Data Model draft to IESG for
publication
as Standards track RFC
Oct 2008 Submit Mediation Problem draft to IESG for publication
as Informational RFC

_______________________________________________
IPFIX mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipfix

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Sun, 28 Oct 2007 11:53:58 +0100

In order to help the IESG members with the reading of the updated
charter proposal, here are the major changes relative to the previous
version: 

1) changes in the description of the Working Group, and specifically in
the wording of the scope: 

OLD: 

The IPFIX working group has specified the Information Model (to 
describe IP flows) and the IPFIX protocol (to transfer IP flow data 
from IPFIX exporters to collectors). The PSAMP working group has 
specified the usage of the IPFIX protocol for exporting packet 
records. With both specifications available, several implementers have 
started building applications using the IPFIX protocol.

At two interoperability testing events, several IPFIX protocol
implementations were tested. The experiences made at these events were
fed back to IPFIX protocol specification, particularly for removing
ambiguities. In addition, several lessons were learned about how to
implement and use IPFIX correctly and efficiently. The exchange among
different implementers further led to new ideas for advanced usage of
IPFIX. Many of these ideas are currently documented in individual
Internet drafts.

The goal of the IPFIX working group is now to produce 'best current
practice' and 'guideline' documents concerning implementation,
application and usage of the IPFIX protocol.

Modifications to the core IPFIX and PSAMP protocol specifications is 
out of scope for this charter. However, the definition of new IPFIX 
and PSAMP information elements is within the scope of this charter.

NEW: 

Practical experiences with IPFIX implementations exposed new
requirements for the IPFIX protocol that so far have not been addressed
by the WG. The major current goal of the WG is developing solutions that
meet the new requirements without modifying the core IPFIX protocol
specifications.

Specific Goals: 

OLD: 

o Develop guidelines for implementers based on experiences
gained individually by implementers and jointly at interoperability
testing events. The guidelines will give recommendations for
integrating IPFIX observation points, metering processes,
exporting processes and collecting processes into the packet flow
at different kinds of IPFIX devices. They will make suggestions for
efficient implementation of the IPFIX protocol features and identify
parts of the IPFIX specification that have already been misunderstood
by several implementors. For some implementation choices that the
protocol specification leaves to the implementer, the guidelines will
discuss advantages and disadvantages of the different choices.
Several recent individual drafts call for new Information Elements;
The implementation guidelines will explain procedures for requesting,
reviewing and approving new IEs.
Deliverables:
1. IPFIX Implementation Guidelines draft, to be an Informational RFC
(6 months)
2. IPFIX Testing draft, to be an Informational RFC (6 months)

o Develop methods and means for an efficient use of the IPFIX
protocol by reducing redundancy in flow reports. The basic idea
to be followed is very simple. For multiple flow records that all
report the same value in one or more of the contained IPFIX
information elements, those values are removed from the flow
records and instead reported once for all in a separate record.
Such an approach integrates very well with the IPFIX protocol and
only needs a few simple methods for expressing the relationship
between flow records and corresponding separate records.
Deliverable:
3. IPFIX Reducing Redundancy, to be an Informational RFC (6 months)

o Create an IPFIX MIB, for reporting information and statistics
of IPFIX metering, exporting and collecing processes. Much of this
work has already been done by the PSAMP working group, and by
individuals working on IPFIX collectors. Deliverable:
4. IPFIX MIB, to be a Standards Track RFC (12 months)

o Develop an effective method for exporting information about
bidirectional flows ('biflows'). The IP security community has
expressed a strong need to collect data on bidrectional flows.
A recent individual draft discusses several different ways to
support biflows in IPFIX - this work will produce a single,
best-practice method for handling them, without requiring changes
to the IPFIX protocol.
Deliverable:
5. IPFIX Biflow draft, to be an Informational RFC (12 months) 

NEW: 

2. There is a need for storing measured flow information and for
exchanging this information between different systems and organizations.
The WG develop a common IPFIX file format for storing flow data in order
to facilitating interoperability and reusability among a wide variety of
flow storage, processing, and analysis tools. It will be a flat-file
format using binary encodings that are based on the IPFIX message
format.

3) Milestones were updated to reflect completion of previous charter
milestones, and new milestones were added: 

NEW: 

Jun 2008 Submit File Format draft to IESG for publication as Standards
track RFC 

Jun 2008 Submit Type Export draft to IESG for publication as Standards
track RFC 

Jun 2008 Submit Single SCTP Stream draft to IESG for publication as
Informational RFC 

Oct 2008 Submit Configuration Data Model draft to IESG for publication
as Standards track RFC 

Oct 2008 Submit Mediation Problem draft to IESG for publication as
Informational RFC

> -----Original Message-----
> From: IESG Secretary [mailto:[email-masked]] 
> Sent: Wednesday, October 24, 2007 9:15 PM
> To: [email-masked]; [email-masked]; [email-masked]; 
> [email-masked]; [email-masked]
> Subject: Internal WG Review: Recharter of IP Flow Information 
> Export WG (ipfix) 
> 
> A new charter for the IP Flow Information Export (ipfix) 
> working group in the Operations and ManagementArea of the 
> IETF is being considered.
> Nevil Brownlee <[email-masked]> Juergen Quittek 
> <[email-masked]>
> 
> Archive: 
> http://www1.ietf.org/mail-archive/web/ipfix/current/index.html
> 
> 
> The IPFIX working group has specified the Information Model 
> (to describe IP flows) and the IPFIX protocol (to transfer IP 
> flow data from IPFIX exporters to collectors). Several 
> implementers have already built applications using the IPFIX 
> protocol. As a result of a series of IPFIX interoperability 
> testing events the WG has produced guidelines for IPFIX 
> implementation and testing as well as recommendations for 
> handling special cases such as bidirectional flow reporting 
> and reducing redundancy in flow records.
> 
> requirements for the IPFIX protocol that so far have not been 
> addressed by the WG. The major current goal of the WG is 
> developing solutions that meet the new requirements without 
> modifying the core IPFIX protocol specifications.
> 
> 1. The IPFIX WG has developed a MIB module for monitoring 
> IPFIX implementations. Means for configuring these devices 
> have not been standardized yet. The WG will develop an 
> XML-based configuration data model that can be used for 
> configuring IPFIX devices and for storing, modifying and 
> managing IPFIX configurations parameter sets. This work will 
> be performed in close collaboration with the NETCONF WG.
> 
> 2. There is a need for storing measured flow information and 
> for exchanging this information between different systems and 
> organizations.
> The WG develop a common IPFIX file format for storing flow 
> data in order to facilitating interoperability and 
> reusability among a wide variety of flow storage, processing, 
> and analysis tools. It will be a flat-file format using 
> binary encodings that are based on the IPFIX message format.
> 
> 3. When dealing with enterprise-specific information elements 
> in IPFIX flow records, it often occurs that the receiver of 
> the record does not know the definition of the information 
> element. For processing such information elements it would be 
> desirable for the receiver to know at least the data types of 
> the enterprise-specific information elements.
> The WG will develop an extension to IPFIX that provides means 
> for the encoding of IPFIX data type information within an 
> IPFIX Message stream.
> 
> 4. Another requirement resulting from practical use of IPFIX 
> is reporting IPFIX template records and corresponding data 
> records within the same SCTP stream. The IPFIX WG will 
> develop guidelines for this use case.
> 
> 5. First applications of IPFIX at large operator networks 
> showed the need for mediation of flow information, for 
> example, for aggregating huge amounts of flow data and for 
> anomymization of flow information.
> The IPFIX WG will investigate this issue and produce a 
> problem statement and a framework for IPFIX flow mediation.
> 
> Goals and Milestones:
> Done Publish Internet Draft on IPFIX Testing Done Publish 
> Internet Draft on IPFIX MIB Nov 2007 Submit IPFIX Testing 
> draft to IESG for publication as Informational RFC Nov 2007 
> Submit IPFIX MIB draft to IESG for publication as Standards track RFC
> 
> 
> Dec 2007 Publish Internet draft on IPFIX Configuration Data 
> Model Dec 2007 Publish Internet draft on IPFIX File Format 
> Dec 2007 Publish Internet draft on IPFIX Type Information 
> Export Dec 2007 Publish Internet draft on Single SCTP Stream 
> Reporting Jan 2008 Publish Internet draft on IPFIX Mediation 
> Problem Statement Jun 2008 Submit File Format draft to IESG 
> for publication as Standards track RFC Jun 2008 Submit Type 
> Export draft to IESG for publication as Standards track RFC 
> Jun 2008 Submit Single SCTP Stream draft to IESG for 
> publication as Informational RFC Oct 2008 Submit 
> Configuration Data Model draft to IESG for publication as 
> Standards track RFC Oct 2008 Submit Mediation Problem draft 
> to IESG for publication as Informational RFC
>

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Sun, 28 Oct 2007 11:53:58 +0100

OLD: 

NEW: 

Specific Goals: 

OLD: 

NEW: 

NEW: