Subject: [IPFIX] multiple export streams

From: Paul Aitken <[email-masked]>
Date: Mon, 26 Sep 2011 13:09:53 +0100

Benoit, All,

I just submitted a new errata for NFv9 (RFC 3954), to clarify that the 
source port should be used to differentiate between multiple export 
streams coming from a single device:

http://www.rfc-editor.org/errata_search.php?rfc=3954&eid=2979

While doing this, I noticed another subtle difference between NFv9 and 
IPFIX:

3954 says that these fields should be used to separate multiple streams 
from the same Exporter:

          NetFlow Collectors SHOULD use the combination of the source IP
          address and the Source ID field to separate different export
          streams originatingfrom the same Exporter.

(NB Exporter = "A device ... with the NetFlow services enabled".)

Whereas 5101 limits to multiple streams from the same Exporting Process:

       Collecting Processes SHOULD use the Transport Session and the
       Observation Domain ID field to separate different export streams
       originatingfrom the same Exporting Process.

- which fails to explain how to differentiate export streams from 
multiple EPs in a single device.

I think 5101 should also say, "from the same Exporter.", which in 5101 
is defined as:

       A device that hosts one or more Exporting Processes is termed an Exporter.

Can you take care of this in 5101bis? Shall I open another errata?

Thanks,
P.

---

From: Benoit Claise <[email-masked]>
Date: Mon, 26 Sep 2011 15:27:05 +0200

Paul,

As we discussed off line, that makes sense.
Inserted in my temp version of RFC5101bis.

Regards, Benoit.
> 3954 says that these fields should be used to separate multiple 
> streams from the same Exporter:
>