Subject: Re: [IPFIX] IPFIX Mediator - Term Definition

From: Atsushi Kobayashi <[email-masked]>
Date: Thu, 05 Feb 2009 17:47:34 +0900

Gerhard and Benoit,

I submitted new version problem statement draft just now. It took more
long time than I have expected.

I tried to merge Benoit's idea and Gerhard's idea regarding terminology
section. I propose that IPFIX Mediation indicates the generic term of
some capabilities, and IPFIX Concentrator, Proxy and Masquerading Proxy
indicate specific capability of IPFIX Mediation.

Please see section 2, and let me know your comments.

http://tools.ietf.org/html/draft-ietf-ipfix-mediators-problem-statement-02#section-2

Thanks,
Atsushi Kobayashi

On Fri, 21 Nov 2008 12:29:15 +0100
Gerhard Muenz <[email-masked]> wrote:

> 
> Benoit,
> 
> Benoit Claise wrote:
> >  Christoph, All,
> > 
> > I agree there is some confusion with regards to the terminology.
> > Here is a proposal
> > 
> > IPFIX Mediation
> > 
> > IPFIX Mediation is a function that offers one or multiple of the
> > following capabilities:
> >          *  rerouting input Flow Records/Packet Reports to a appropriate
> > Collecting Process
> >          *  replicating input Flow Records/Packet Reports
> >          *  filtering and selecting Flow Records/Packet Report
> >          *  aggregating input Flow Records/Packet Reports based on a new
> > set of Flow Key field
> >          *  correlating a set of Flow Records/Packet Reports for
> > creating new Flow Records/Packet Reports with new metrics
> >          *  changing the transport protocol which carries IPFIX Message
> >          *  modifying Flow Records/Packet Reports
> >              The modification of Flow Records/Packet Reports includes
> > these functions
> >                     *  changing the value of specified Information Elements
> >                     *  adding new Information Elements by deriving
> > further Flow or
> >                         packet properties from existing fields or
> > calculating new metrics
> >                     *  deleting specified Information Elements.
> > IPFIX Mediation can be included in any IPFIX Devices, such as routers,
> >       switches, NMS(Network Management Systems),. In an IPFIX Device,
> > the IPFIX Mediation is located between Exporting Processes and
> > Collecting Processes.
> 
> "IPFIX Mediation is a function that offers one or multiple capabilities"
> sounds a bit strange to me.
> 
> Instead, we could define:
> 
> IPFIX Mediation Function = Any functions that can be applied to entire
> messages or individual records of IPFIX and related protocols. Examples
> are: ...
> 
> Intermediate Process (or: Mediation Process) = Process that implements
> one or more IPFIX Mediation Functions.
> 
> > IPFIX Mediator
> > 
> > The IPFIX Mediator is an IPFIX Device that contains one or more IPFIX
> > Mediations capabilities.
> 
> As far as I understood, IPFIX Mediator was previously defined as a
> device that contains at least one Collecting Process and one Exporting
> Process:
> 
> CP --> some mediation function --> EP
> 
> So, if a Mediation Function is applied at an Exporter that does not have
> any Collecting Process, it is _not_ an IPFIX Mediator:
> 
> CP --> MP --> some mediation function --> EP
> 
> Of course, we can remove the restriction and say any device capable of
> doing any mediation is an IPFIX Mediator.
> 
> Yet, I would prefer to say: An IPFIX Mediator is an IPFIX Device that
> contains one or more Mediation/Intermediate Processes.
> 
> > IPFIX Proxy
> > 
> >       An IPFIX Proxy is an IPFIX Mediation that receives IPFIX Messages
> >     from Original Exporter(s), and sends new IPFIX Messages to one or
> >     more Collector(s).  For example, it may change the transport
> >     protocol, such as UDP, TCP, SCTP and PR-SCTP. A specific type of
> >     IPFIX Proxy is a IPFIX Mediation that converts legacy protocol
> >     messages into an IPFIX Message.
> 
> This definition does not work because "that receives IPFIX Messages from
> Original Exporter(s)" prevents the reception of legacy protocols.
> See also my proposed definition in another mail.
> 
> Regards,
> Gerhard
> 
> > 
> > IPFIX Concentrator      
> > 
> >     An IPFIX Concentrator is an IPFIX Mediation that ...
> > 
> > Regards, Benoit.
> > 
> >> Dear all,
> >>
> >> Atsushi Kobayashi wrote:
> >>   
> >>> Gerhard Muenz wrote:
> >>>     
> >>>> IPFIX Mediator Problem statement wrote:
> >>>>       
> >>>>> IPFIX Mediation is an additional function to suit the needs of some
> >>>>> measurement system.
> >>>>>         
> >>>> Isn't IPFIX Mediation supposed to be an umbrella term which includes
> >>>> IPFIX concentrators and IPFIX proxies?
> >>>>       
> >>> I mean that IPFIX Mediator is umbrella term which includes IPFIX
> >>> concentrators and IPFIX proxies. But, IPFIX Mediation is not.
> >>>     
> >> I think there is still some confusion on what a number of terms that
> >> came up during IPFIX Mediator discussions mean. Some of them are not
> >> clearly defined and some are used interchangeably. From the top of my
> >> head, these are:
> >>
> >> * IPFIX Mediator
> >> * IPFIX Mediation
> >> * IPFIX Mediation device
> >> * Mediation Function
> >> * Intermediate Function
> >> * Intermediate Process
> >> * Exporter with Mediation Function
> >> * Exporter with Mediation
> >>
> >> How about we settle on a subset and give a clear(er) definition of these
> >> terms?
> >>
> >>
> >> I propose the following two definitions:
> >>
> >> * Intermediate Process:
> >>   a black box that processes Flow Records, i.e. that takes
> >>   Flow Records as its input and has Flow Records as its output.
> >>
> >> * IPFIX Mediator:
> >>   a device that can host zero or more Intermediate Processes
> >>   along with other Processes defined in IPFIX.
> >>
> >>
> >> I think these two definitions can be used to describe all
> >> currently-thought-of IPFIX Mediators by using zero or more Intermediate
> >> Processes (IMPs), like so:
> >>
> >> * IPFIX Proxy:
> >>   Collector---Exporter
> >>
> >> * IPFIX Concentrator:
> >>   Collector---"IMP Aggregator"---Exporter
> >>
> >> * IPFIX Distributor:
> >>   Collector---"IMP Distributor"---Exporter(s)
> >>
> >> * IPFIX Masquerading Proxy:
> >>   Collector---"IMP Masquerade"---Exporter
> >>
> >>
> >> I would like to hear as many comments/suggestions as possible, so we can
> >> arrive at a clear definition of what an IPFIX Mediator is and what an
> >> Intermediate Process can do!
> >>
> >>
> >> Regards,
> >>
> >>   Christoph
> >>
> >>   
> >