From n.brownlee@auckland.ac.nz Thu Aug 1 00:07:06 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D805721F9CB3 for ; Thu, 1 Aug 2013 00:07:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.099 X-Spam-Level: X-Spam-Status: No, score=-103.099 tagged_above=-999 required=5 tests=[AWL=-0.500, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HhtObKyRG4ma for ; Thu, 1 Aug 2013 00:07:01 -0700 (PDT) Received: from mx2.auckland.ac.nz (mx2.auckland.ac.nz [130.216.125.245]) by ietfa.amsl.com (Postfix) with ESMTP id B5B9521F9BF7 for ; Thu, 1 Aug 2013 00:07:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=uoa; t=1375340821; x=1406876821; h=message-id:date:from:mime-version:to:subject: content-transfer-encoding; bh=9tP/0tUa2InrRN2vJ+5fxNJNWEUe1s3y5snXCuDsmEA=; b=IL/8I4TfbI5hwGrPL0umGTDXDf1SI+vZ1y5ub05j0MME6kbC+BNgcmKV 0KS98mUTqGHWT+RLHF20bnyRoMLsw3sXojHa6Cx/s3jKwepfxJ95M/mKo mbTIaiK4Vj8vKjgHJuYpFbdwGxEwoODR74YM3gQMJ5obzF4KAf+8EEt2U 4=; X-IronPort-AV: E=Sophos;i="4.89,792,1367928000"; d="scan'208";a="203113948" X-Ironport-HAT: None - $RELAY-AUTH X-Ironport-Source: 130.129.65.221 - Outgoing - Outgoing-SSL Received: from dhcp-41dd.meeting.ietf.org (HELO [130.129.65.221]) ([130.129.65.221]) by mx2-int.auckland.ac.nz with ESMTP; 01 Aug 2013 19:06:58 +1200 Message-ID: <51FA090D.80003@auckland.ac.nz> Date: Thu, 01 Aug 2013 19:06:53 +1200 From: Nevil Brownlee User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/20130623 Thunderbird/17.0.7 MIME-Version: 1.0 To: IPFIX Working Group , ipfix-ads@tools.ietf.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [IPFIX] DRAFT minutes for Monday's IPFIX meeting X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 07:07:06 -0000 Hi all: Here are my **DRAFT** minutes, please send me your comments/improvements /suggestions. Cheers, Nevil Brief summary: IPFIX WG meeting in Berlin Our Link Layer Attributes and IPFIX Mediation Protocol drafts will be submitted this month (August). Extended Field Specifiers look really useful, we could use them for exporting MIB Objects, We must choose between implementing EFSF (which would need a charter update) first, or using a mibFieldOption Template so as to finish the Exporting MIB Objects draft. Both, of course, will require changes to IPFIX collectors. There are several new drafts that could be WG items. These need to have objectives that could not be achieved by just registering new IEs via IANA/IE Doctors. Minutes of the IPFIX meeting at IETF 87 in Berlin About 36 people present, plus 6 on jabber Scribes: Paul Aitken (on Etherpad at http://tools.ietf.org/wg/ipfix/minutes) and Chris Innacio Meeting chairs: Nevil Brownlee, Juergen Quittek Juergen opened the meeting, and gave the IPFIX status update: - IPFIX Protocol, 5101bis approved as Internet Standard, 17 Jul 13 Nevil Brownlee presented the Link Layer IEs draft: - Kobayashi-san has made changes as suggested by Pat Thaler in Orlando. She has reviewed the new version, and reported that she will send Kobayashi-san a list detailing a few more needed changes. = After that the draft will be ready to submit. Brian Trammell presented the IPFIX Mediation Protocol draft: = -06 version to be published shortly, now ready for WGLC Paul Aitken presented the MIB Variable Export draft: - mibFieldOption proposed as alternative to Extended Field Specifiers (EFSF) - Brian Trammell: this is backwards compatible with current IPFIX - Juergen Quittek: but it adds an extra level of lookup in collectors - Benoit Claise: would like to compare EFSF vs option templates = This needs more discussion on the list Paul presented "IPFIX Extensions" - These must solve real problems, i.e. have real use cases - EFSF would support many use cases that would otherwise need many new IEs, e.g. Unobserved Fields, MIB OIDs. - Johan Kogel: likes it, but it may end up duplication some IEs - Agreement that using Option Templates to extend IEs is inelegant, but we already do it a lot, e.g. RFC 6313 (structured data) - Paul: it's orthogonal to the 'Option Templates' approach Abdelkader Lahmadi presented 'Metering Process Location' - A set of IEs for specifying host location - Could use EFSF, but need to know times when location changed - Peng Fan: doesn't want to install IPFIX on his mobile 'phone = Continue discussion on list Toerless Eckert presented 'Signaling Flow Characteristics' - Making a set of IEs that Applications can use to export information about their flows - How many IEs? ~20 to 30 = Discuss this idea with IE Doctors Ramki Krishnan presented 'Flow-Aware Packet Sampling' - The draft has been extensively revised since Orlando = Its aims could be achieved by registering this as a new sampling technique, i.e. value of the flowSelectorAlgorithm IE. There was no Other Business. The Chairs reminded the WG that - We need to consider IPFIX Extensions - i.e. EFSF - carefully, and reach consensus on a new charter item to work on it - Any other proposals for new work need to solve a real problem, and require something more than changes to the IE Registry The meeting finished at 1137 -- --------------------------------------------------------------------- Nevil Brownlee Computer Science Department | ITS Phone: +64 9 373 7599 x88941 The University of Auckland FAX: +64 9 373 7453 Private Bag 92019, Auckland 1142, New Zealand From ietf@meetecho.com Thu Aug 1 02:06:46 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6891C21F9D6F for ; Thu, 1 Aug 2013 02:06:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.122 X-Spam-Level: * X-Spam-Status: No, score=1.122 tagged_above=-999 required=5 tests=[AWL=0.352, BAYES_05=-1.11, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AHLA1E3OV0xT for ; Thu, 1 Aug 2013 02:06:41 -0700 (PDT) Received: from smtpdg6.aruba.it (smtpdg224.aruba.it [62.149.158.224]) by ietfa.amsl.com (Postfix) with ESMTP id 4AA6821F843F for ; Thu, 1 Aug 2013 02:06:25 -0700 (PDT) Received: from dell-tcastaldi ([130.129.65.11]) by smtpcmd02.ad.aruba.it with bizsmtp id 7M6N1m00t0EaGCq01M6Pdi; Thu, 01 Aug 2013 11:06:23 +0200 Date: Thu, 1 Aug 2013 11:06:20 +0200 (CEST) From: Meetecho Team To: ipfix@ietf.org Message-ID: <777409854.5.1375347980914.JavaMail.tcastaldi@dell-tcastaldi> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_4_495933923.1375347980910" Subject: [IPFIX] IPFIX session recording available X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 09:06:46 -0000 ------=_Part_4_495933923.1375347980910 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Dear all, the full recording (synchronized video, audio, slides and jabber room) of the IPFIX WG session at IETF 87 is available at the following URL: http://ietf87.conf.meetecho.com/index.php/Recorded_Sessions#IPFIX For the chair(s): please feel free to put the link to the recording in the minutes, if you think this might be useful. Cheers, the Meetecho Team This email has been automatically generated by The Meetecho Conferencing System ------=_Part_4_495933923.1375347980910-- From ssenthil@cisco.com Thu Aug 1 06:37:51 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 336D621E811A for ; Thu, 1 Aug 2013 06:37:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.299 X-Spam-Level: X-Spam-Status: No, score=-10.299 tagged_above=-999 required=5 tests=[AWL=0.301, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EMsxkG3hGudL for ; Thu, 1 Aug 2013 06:37:46 -0700 (PDT) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by ietfa.amsl.com (Postfix) with ESMTP id 3DC3C21E818E for ; Thu, 1 Aug 2013 06:37:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=251; q=dns/txt; s=iport; t=1375364266; x=1376573866; h=from:to:subject:date:message-id:in-reply-to:content-id: content-transfer-encoding:mime-version; bh=5S7rgyaRrBYVqywgQFgcmpd9+g0/kOZepro38cQkIxs=; b=d/YENth5lECm5BcgD3HnBKM7gUHraFo+Py9D62bkEPrVtUv2XHpmj+uI mlq9gRNlzIxMJ7ipuOmRhq2cBxncbK/+2OMgWgO9cT2Oj1D0+smhLNKHV 2nPzj0/RKUqwu6wHF/Zy5h7spp1ilkNUW9OziN3UCkr4iiBJglUYhLTJJ c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AjUKAJpj+lGtJV2a/2dsb2JhbABbgwY1UIJJu3kEAYEdFnSCJgEEOlEBKhRCJQIEG4gIDJkWoFGOZXE4gxlzA5kJkCSDFIIq X-IronPort-AV: E=Sophos;i="4.89,794,1367971200"; d="scan'208";a="242241378" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-2.cisco.com with ESMTP; 01 Aug 2013 13:37:45 +0000 Received: from xhc-aln-x06.cisco.com (xhc-aln-x06.cisco.com [173.36.12.80]) by rcdn-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id r71Dbj4Q019807 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Thu, 1 Aug 2013 13:37:45 GMT Received: from xmb-rcd-x15.cisco.com ([169.254.5.80]) by xhc-aln-x06.cisco.com ([173.36.12.80]) with mapi id 14.02.0318.004; Thu, 1 Aug 2013 08:37:45 -0500 From: "Senthil Sivakumar (ssenthil)" To: "ipfix@ietf.org Group" Thread-Topic: NAT logging using IPFIX - Requesting review Thread-Index: AQHOjrxNVDWF6yikWkuG+R3zhDdRHg== Date: Thu, 1 Aug 2013 13:37:44 +0000 Message-ID: In-Reply-To: <5CF0D719-2C84-4FD8-A565-0EBABBF30D9D@tik.ee.ethz.ch> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.6.130613 x-originating-ip: [10.117.198.132] Content-Type: text/plain; charset="us-ascii" Content-ID: <33128C415F2F5D418388C2062764968B@emea.cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [IPFIX] NAT logging using IPFIX - Requesting review X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 13:37:51 -0000 I would like the IPFIX WG to review this draft that uses IPFIX to log NAT events.=20 http://tools.ietf.org/html/draft-ietf-behave-ipfix-nat-logging This is a behave working group draft. Your feedback is greatly appreciated. Thanks Senthil From paitken@cisco.com Thu Aug 1 13:02:18 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 804FF21E8238; Thu, 1 Aug 2013 13:02:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.5 X-Spam-Level: X-Spam-Status: No, score=-10.5 tagged_above=-999 required=5 tests=[AWL=0.098, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0-YYG5bPXZgs; Thu, 1 Aug 2013 13:02:14 -0700 (PDT) Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by ietfa.amsl.com (Postfix) with ESMTP id 42D1821E8098; Thu, 1 Aug 2013 13:02:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=7601; q=dns/txt; s=iport; t=1375387333; x=1376596933; h=message-id:date:from:mime-version:to:cc:subject; bh=N+Nf2SwYEz+DSRDgJp8VGpFN9NfXcn+rEBifDY0NNtk=; b=l3P5b8xbbP9KZJP3Rhhn7JLNkv+UWnErRV2eixNXuOmLqRAr0mf6roCc a7lpZQckulamaAGa0wxOhE4bkwmrkgJycX3IskXKVjFhM9EJQd+wmvVqi rVj8LaCusjBF0BxQ4TfYLI1+GephOeo7WD069jwWpKwBcL35L5+WEMZv1 I=; X-IronPort-AV: E=Sophos;i="4.89,796,1367971200"; d="scan'208,217";a="157868856" Received: from ams-core-1.cisco.com ([144.254.72.81]) by ams-iport-1.cisco.com with ESMTP; 01 Aug 2013 20:02:11 +0000 Received: from cisco.com (mrwint.cisco.com [64.103.70.36]) by ams-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id r71K28k8014234 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 1 Aug 2013 20:02:09 GMT Received: from [10.61.98.64] (dhcp-10-61-98-64.cisco.com [10.61.98.64]) by cisco.com (8.14.4+Sun/8.8.8) with ESMTP id r71K27OW029099; Thu, 1 Aug 2013 21:02:08 +0100 (BST) Message-ID: <51FABEBF.1080507@cisco.com> Date: Thu, 01 Aug 2013 21:02:07 +0100 From: Paul Aitken User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/20130623 Thunderbird/17.0.7 MIME-Version: 1.0 To: "Senthil Sivakumar (ssenthil)" Content-Type: multipart/alternative; boundary="------------050802090601050604060309" Cc: behave@ietf.org, IETF IPFIX Working Group Subject: [IPFIX] review of draft-ietf-behave-ipfix-nat-logging-00 - IPFIX Information Elements for logging NAT Events X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 20:02:18 -0000 This is a multi-part message in MIME format. --------------050802090601050604060309 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Senthil, Here's a quick review of your draft from an IPFIX perspective: * The [NAT-EVENT-LOG-IANA] reference is not referenced in the text, and the URL doesn't exist. If it's not needed, then remove the reference. If it's needed, then fix the URL :-) * Where the tables include sizes of 1, 2, and 3 digits, the alignment is wrong (centralised?). Please right-align all the numbers. * Terminology: define "IE" / "IE's" before section 2. eg, reference the terminology from 5101bis. * Please be consistent about your usage of "IE" versus "Information Elements". * Briefly introduce IPFIX in the Introduction section. eg: The IPFIX Protocol [RFC5101bis] defines a generic push mechanism for exporting information and events. The IPFIX Information Model [IANA-IPFIX] defines a set of standard Information Elements (IEs) which can be carried by the IPFIX protocol. This document details the IPFIX Information Elements that are required for logging by a NAT device and all the optional fields. The fields specified in this document are gleaned from [RFC4787 ] and [RFC5382 ]. * Note that 5101 and 5102 are both being updated by -bis drafts which are soon to be RFCs - so your Informative References should be updated. * [IANA-IPFIX] == http://www.iana.org/assignments/ipfix/ipfix.xhtml This is now the definitive reference, rather than 5102 / 5102bis. * Please write "NetFlow v9" rather than "Netflow 9" (ie, with a capital 'F' and a 'v'). * IANA Considerations: if there are none, then say "there are no IANA considerations." P. --------------050802090601050604060309 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit
Senthil,

Here's a quick review of your draft from an IPFIX perspective:

* The [NAT-EVENT-LOG-IANA] reference is not referenced in the text, and the URL doesn't exist.
    If it's not needed, then remove the reference. If it's needed, then fix the URL :-)

* Where the tables include sizes of 1, 2, and 3 digits, the alignment is wrong (centralised?). Please right-align all the numbers.

* Terminology: define "IE" / "IE's" before section 2. eg, reference the terminology from 5101bis.

* Please be consistent about your usage of "IE" versus "Information Elements".

* Briefly introduce IPFIX in the Introduction section. eg:
   The IPFIX Protocol [RFC5101bis] defines a generic push mechanism for exporting information and events.
   The IPFIX Information Model [IANA-IPFIX] defines a set of standard Information Elements (IEs) which can be carried by the IPFIX protocol.
   This document details the IPFIX Information Elements that are required for logging by a NAT device and all the optional fields.
   The fields specified in this document are gleaned from [RFC4787] and [RFC5382].

* Note that 5101 and 5102 are both being updated by -bis drafts which are soon to be RFCs - so your Informative References should be updated.

* [IANA-IPFIX] == http://www.iana.org/assignments/ipfix/ipfix.xhtml
    This is now the definitive reference, rather than 5102 / 5102bis.

* Please write "NetFlow v9" rather than "Netflow 9" (ie, with a capital 'F' and a 'v').

* IANA Considerations: if there are none, then say "there are no IANA considerations."

P.
--------------050802090601050604060309-- From paitken@cisco.com Thu Aug 1 13:19:49 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0516121F9E94 for ; Thu, 1 Aug 2013 13:19:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.503 X-Spam-Level: X-Spam-Status: No, score=-10.503 tagged_above=-999 required=5 tests=[AWL=0.096, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3mYHIUr60vtz for ; Thu, 1 Aug 2013 13:19:43 -0700 (PDT) Received: from ams-iport-4.cisco.com (ams-iport-4.cisco.com [144.254.224.147]) by ietfa.amsl.com (Postfix) with ESMTP id 91A9B21E8098 for ; Thu, 1 Aug 2013 13:19:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2; q=dns/txt; s=iport; t=1375388354; x=1376597954; h=message-id:date:from:mime-version:to:subject: content-transfer-encoding; bh=frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=; b=l+4stdcP2PCXHVyhuBklFcO1KpymlprfM2mMIywMkdxBqLAXWf4kKEXS NmGyHJXgrO/7rGq7zkMCAfhvykP/0YPmisoPGMPKGMWJeTUhz8rWkNfgY RzYcjARnGNuw06decLzO7V78poT4t68DDQruv/IfrvdkFh5UHE+qluIAM 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AlYRAF/B+lGQ/khL/2dsb2JhbABbgwY2hhWGPLNnFnSCRB99NAJMDQgBAYgMmWCUFIwflBoDl1+GJIsqgxU X-IronPort-AV: E=Sophos;i="4.89,796,1367971200"; d="scan'208";a="16711949" Received: from ams-core-2.cisco.com ([144.254.72.75]) by ams-iport-4.cisco.com with ESMTP; 01 Aug 2013 20:19:13 +0000 Received: from cisco.com (mrwint.cisco.com [64.103.70.36]) by ams-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id r71KJBLh019418 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 1 Aug 2013 20:19:11 GMT Received: from [10.61.98.64] (dhcp-10-61-98-64.cisco.com [10.61.98.64]) by cisco.com (8.14.4+Sun/8.8.8) with ESMTP id r71KJA7M029880 for ; Thu, 1 Aug 2013 21:19:10 +0100 (BST) Message-ID: <51FAC2BE.70206@cisco.com> Date: Thu, 01 Aug 2013 21:19:10 +0100 From: Paul Aitken User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/20130623 Thunderbird/17.0.7 MIME-Version: 1.0 To: IETF IPFIX Working Group Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [IPFIX] test - please ignore X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 20:19:49 -0000 From paitken@cisco.com Fri Aug 2 02:08:06 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD8EE11E831C; Fri, 2 Aug 2013 02:07:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.506 X-Spam-Level: X-Spam-Status: No, score=-10.506 tagged_above=-999 required=5 tests=[AWL=0.092, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s20ccWLGaGNK; Fri, 2 Aug 2013 02:07:47 -0700 (PDT) Received: from ams-iport-2.cisco.com (ams-iport-2.cisco.com [144.254.224.141]) by ietfa.amsl.com (Postfix) with ESMTP id AB55B11E8320; Fri, 2 Aug 2013 02:02:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=7749; q=dns/txt; s=iport; t=1375434122; x=1376643722; h=message-id:date:from:mime-version:to:cc:subject; bh=yj5SMFr80wZhoWFLEFj9AM/TkOZCY3FXuXgqgHuLnIo=; b=aIPE3y8rseXxU5x7nWoxPKu+fYmzydO1LAMUVic5RgqePbmbQsSZHK8f D6vJo4FsWCJoOaosfVtjZOE8NEzQJ+G1aBtDHsB84j6ZaYjyORRLeUoy2 QNbisKd7emkG5vscjtib0zq/I/BaQRMEgXKeIBBIrgppyntTvUyMKq4p0 g=; X-IronPort-AV: E=Sophos;i="4.89,800,1367971200"; d="scan'208,217";a="85379333" Received: from ams-core-3.cisco.com ([144.254.72.76]) by ams-iport-2.cisco.com with ESMTP; 02 Aug 2013 09:01:22 +0000 Received: from cisco.com (mrwint.cisco.com [64.103.70.36]) by ams-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id r7291KfW026513 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 2 Aug 2013 09:01:20 GMT Received: from [10.61.98.64] (dhcp-10-61-98-64.cisco.com [10.61.98.64]) by cisco.com (8.14.4+Sun/8.8.8) with ESMTP id r7291Jd7001373; Fri, 2 Aug 2013 10:01:19 +0100 (BST) Message-ID: <51FB7560.1010605@cisco.com> Date: Fri, 02 Aug 2013 10:01:20 +0100 From: Paul Aitken User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/20130623 Thunderbird/17.0.7 MIME-Version: 1.0 To: "Senthil Sivakumar (ssenthil)" Content-Type: multipart/alternative; boundary="------------060309010008060007090802" Cc: behave@ietf.org, IETF IPFIX Working Group Subject: [IPFIX] review of draft-ietf-behave-ipfix-nat-logging-00 - IPFIX Information Elements for logging NAT Events X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2013 09:08:06 -0000 This is a multi-part message in MIME format. --------------060309010008060007090802 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit [resending due to an apparent IETF email outage?] Senthil, Here's a quick review of your draft from an IPFIX perspective: * The [NAT-EVENT-LOG-IANA] reference is not referenced in the text, and the URL doesn't exist. If it's not needed, then remove the reference. If it's needed, then fix the URL :-) * Where the tables include sizes of 1, 2, and 3 digits, the alignment is wrong (centralised?). Please right-align all the numbers. * Terminology: define "IE" / "IE's" before section 2. eg, reference the terminology from 5101bis. * Please be consistent about your usage of "IE" versus "Information Elements". * Briefly introduce IPFIX in the Introduction section. eg: The IPFIX Protocol [RFC5101bis] defines a generic push mechanism for exporting information and events. The IPFIX Information Model [IANA-IPFIX] defines a set of standard Information Elements (IEs) which can be carried by the IPFIX protocol. This document details the IPFIX Information Elements that are required for logging by a NAT device and all the optional fields. The fields specified in this document are gleaned from [RFC4787 ] and [RFC5382 ]. * Note that 5101 and 5102 are both being updated by -bis drafts which are soon to be RFCs - so your Informative References should be updated. * [IANA-IPFIX] == http://www.iana.org/assignments/ipfix/ipfix.xhtml This is now the definitive reference, rather than 5102 / 5102bis. * Please write "NetFlow v9" rather than "Netflow 9" (ie, with a capital 'F' and a 'v'). * IANA Considerations: if there are none, then say "there are no IANA considerations." P. --------------060309010008060007090802 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit
[resending due to an apparent IETF email outage?]


Senthil,

Here's a quick review of your draft from an IPFIX perspective:

* The [NAT-EVENT-LOG-IANA] reference is not referenced in the text, and the URL doesn't exist.
    If it's not needed, then remove the reference. If it's needed, then fix the URL :-)

* Where the tables include sizes of 1, 2, and 3 digits, the alignment is wrong (centralised?). Please right-align all the numbers.

* Terminology: define "IE" / "IE's" before section 2. eg, reference the terminology from 5101bis.

* Please be consistent about your usage of "IE" versus "Information Elements".

* Briefly introduce IPFIX in the Introduction section. eg:
   The IPFIX Protocol [RFC5101bis] defines a generic push mechanism for exporting information and events.
   The IPFIX Information Model [IANA-IPFIX] defines a set of standard Information Elements (IEs) which can be carried by the IPFIX protocol.
   This document details the IPFIX Information Elements that are required for logging by a NAT device and all the optional fields.
   The fields specified in this document are gleaned from [RFC4787] and [RFC5382].

* Note that 5101 and 5102 are both being updated by -bis drafts which are soon to be RFCs - so your Informative References should be updated.

* [IANA-IPFIX] == http://www.iana.org/assignments/ipfix/ipfix.xhtml
    This is now the definitive reference, rather than 5102 / 5102bis.

* Please write "NetFlow v9" rather than "Netflow 9" (ie, with a capital 'F' and a 'v').

* IANA Considerations: if there are none, then say "there are no IANA considerations."

P.
--------------060309010008060007090802-- From andrewf@plixer.com Fri Aug 2 05:12:40 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CEAE211E833F; Fri, 2 Aug 2013 05:12:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=-0.001, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N4PDIhhnASaV; Fri, 2 Aug 2013 05:12:33 -0700 (PDT) Received: from mx1.plixer.com (mx1.plixer.com [64.140.243.154]) by ietfa.amsl.com (Postfix) with ESMTP id 688BF11E8325; Fri, 2 Aug 2013 05:12:31 -0700 (PDT) Received: from [10.11.1.15] (64.140.243.154) by mx1.plixer.com (10.1.5.1) with Microsoft SMTP Server (TLS) id 14.3.123.3; Fri, 2 Aug 2013 08:12:30 -0400 Message-ID: <51FBA231.6020802@plixer.com> Date: Fri, 2 Aug 2013 08:12:33 -0400 From: Andrew Feren User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130623 Thunderbird/17.0.7 MIME-Version: 1.0 To: Paul Aitken References: <51FABEBF.1080507@cisco.com> In-Reply-To: <51FABEBF.1080507@cisco.com> Content-Type: multipart/alternative; boundary="------------030606000106080304020002" Cc: behave@ietf.org, IETF IPFIX Working Group Subject: Re: [IPFIX] review of draft-ietf-behave-ipfix-nat-logging-00 - IPFIX Information Elements for logging NAT Events X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2013 12:12:40 -0000 --------------030606000106080304020002 Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit Hi Paul, On 08/01/2013 04:02 PM, Paul Aitken wrote: > Senthil, [ snip ] > * [IANA-IPFIX] == http://www.iana.org/assignments/ipfix/ipfix.xhtml > This is now the definitive reference, rather than 5102 / 5102bis. Given recent discussion of the ietf list I think the correct link to use is actually http://www.iana.org/assignments/ipfix [ snip ] -Andrew --------------030606000106080304020002 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit
Hi Paul,

On 08/01/2013 04:02 PM, Paul Aitken wrote:
Senthil,

 [ snip ]
* [IANA-IPFIX] == http://www.iana.org/assignments/ipfix/ipfix.xhtml
    This is now the definitive reference, rather than 5102 / 5102bis.

Given recent discussion of the ietf list I think the correct link to use is actually

http://www.iana.org/assignments/ipfix

 [ snip ]

-Andrew
--------------030606000106080304020002-- From ssenthil@cisco.com Fri Aug 2 07:19:16 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5862421E8087; Fri, 2 Aug 2013 07:19:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.448 X-Spam-Level: X-Spam-Status: No, score=-10.448 tagged_above=-999 required=5 tests=[AWL=0.150, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FzBo3ih6Eqt2; Fri, 2 Aug 2013 07:19:11 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by ietfa.amsl.com (Postfix) with ESMTP id 96FBB21E8083; Fri, 2 Aug 2013 07:19:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=9831; q=dns/txt; s=iport; t=1375453151; x=1376662751; h=from:to:cc:subject:date:message-id:in-reply-to: mime-version; bh=hvA7mtceuuJT/VP6tDvVogmFa6yfuc99ubsQObKDwl4=; b=b9wMzN3ix8LMY7B7K9IQpocWobVekZzgEQfi2ui+dbEKNLDZScHcnLTt myGyowM87G1jhQo4bpPO8qP3Ig++i36+Gbcw4Mdx0xG8BqQpIUNd4IULZ /eqoFj96WiMOnpq2xPZt37mgj9xVOz9JUbMEhbYcL8vjHEhYt1iNPvNrE Y=; X-IronPort-AV: E=Sophos;i="4.89,801,1367971200"; d="scan'208,217";a="242749888" Received: from rcdn-core2-6.cisco.com ([173.37.113.193]) by rcdn-iport-7.cisco.com with ESMTP; 02 Aug 2013 14:19:11 +0000 Received: from xhc-aln-x08.cisco.com (xhc-aln-x08.cisco.com [173.36.12.82]) by rcdn-core2-6.cisco.com (8.14.5/8.14.5) with ESMTP id r72EJBvo000575 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Fri, 2 Aug 2013 14:19:11 GMT Received: from xmb-rcd-x15.cisco.com ([169.254.5.80]) by xhc-aln-x08.cisco.com ([173.36.12.82]) with mapi id 14.02.0318.004; Fri, 2 Aug 2013 09:19:10 -0500 From: "Senthil Sivakumar (ssenthil)" To: "Paul Aitken (paitken)" Thread-Topic: review of draft-ietf-behave-ipfix-nat-logging-00 - IPFIX Information Elements for logging NAT Events Thread-Index: AQHOj17eZrQ3EsxpSEynslYVUhXvw5mCCIeA Date: Fri, 2 Aug 2013 14:19:10 +0000 Message-ID: In-Reply-To: <51FB7560.1010605@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.6.130613 x-originating-ip: [10.117.198.132] Content-Type: multipart/alternative; boundary="_000_CB1B483277FEC94E9B58357040EE5D023267DBB2xmbrcdx15ciscoc_" MIME-Version: 1.0 Cc: "behave@ietf.org" , IETF IPFIX Working Group Subject: Re: [IPFIX] review of draft-ietf-behave-ipfix-nat-logging-00 - IPFIX Information Elements for logging NAT Events X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2013 14:19:16 -0000 --_000_CB1B483277FEC94E9B58357040EE5D023267DBB2xmbrcdx15ciscoc_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Paul, Thanks for the review, I will incorporate the comments in the next revision= . Thanks Senthil From: "Paul Aitken (paitken)" > Date: Friday, August 2, 2013 5:01 AM To: Senthil Sivakumar > Cc: IETF IPFIX Working Group >, "beha= ve@ietf.org" > Subject: review of draft-ietf-behave-ipfix-nat-logging-00 - IPFIX Informati= on Elements for logging NAT Events [resending due to an apparent IETF email outage?] Senthil, Here's a quick review of your draft from an IPFIX perspective: * The [NAT-EVENT-LOG-IANA] reference is not referenced in the text, and the= URL doesn't exist. If it's not needed, then remove the reference. If it's needed, then fix= the URL :-) * Where the tables include sizes of 1, 2, and 3 digits, the alignment is wr= ong (centralised?). Please right-align all the numbers. * Terminology: define "IE" / "IE's" before section 2. eg, reference the ter= minology from 5101bis. * Please be consistent about your usage of "IE" versus "Information Element= s". * Briefly introduce IPFIX in the Introduction section. eg: The IPFIX Protocol [RFC5101bis] defines a generic push mechanism for exp= orting information and events. The IPFIX Information Model [IANA-IPFIX] defines a set of standard Infor= mation Elements (IEs) which can be carried by the IPFIX protocol. This document details the IPFIX Information Elements that are required f= or logging by a NAT device and all the optional fields. The fields specified in this document are gleaned from [RFC4787] and [RFC5382]. * Note that 5101 and 5102 are both being updated by -bis drafts which are s= oon to be RFCs - so your Informative References should be updated. * [IANA-IPFIX] =3D=3D http://www.iana.org/assignments/ipfix/ipfix.xhtml This is now the definitive reference, rather than 5102 / 5102bis. * Please write "NetFlow v9" rather than "Netflow 9" (ie, with a capital 'F'= and a 'v'). * IANA Considerations: if there are none, then say "there are no IANA consi= derations." P. --_000_CB1B483277FEC94E9B58357040EE5D023267DBB2xmbrcdx15ciscoc_ Content-Type: text/html; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable
Paul,
Thanks for the review, I will incorporate the comments in the next rev= ision.

Thanks
Senthil

From: "Paul Aitken (paitken)&q= uot; <paitken@cisco.com>
Date: Friday, August 2, 2013 5:01 A= M
To: Senthil Sivakumar <ssenthil@cisco.com>
Cc: IETF IPFIX Working Group <ipfix@ietf.org>, "behave@ietf.org" <behave@ietf.org>
Subject: review of draft-ietf-behav= e-ipfix-nat-logging-00 - IPFIX Information Elements for logging NAT Events<= br>

[resending due to a= n apparent IETF email outage?]


Senthil,

Here's a quick review of yo= ur draft from an IPFIX perspective:

* The [N= AT-EVENT-LOG-IANA] reference is not referenced in the text, and the URL doesn't exist.
    If it's not needed, then remove the reference. If it's n= eeded, then fix the URL :-)

* Where the tables = include sizes of 1, 2, and 3 digits, the alignment is wrong (centralised?).= Please right-align all the numbers.

* Terminology: define= "IE" / "IE's" before section 2. eg, reference the term= inology from 5101bis.

* Please be consisten= t about your usage of "IE" versus "Information Elements"= ;.

* Briefl= y introduce IPFIX in the Introduction section. eg:
   The IPFIX Protocol [RFC5101bis] defines a=
 generic push mechanism for exporting information and events.
   The IPFIX Information Model [IANA-IPFIX] defines a set of standard =
Information Elements (IEs) which can be carried by the IPFIX protocol.
   This document details the IPFIX Information Elements that are required f=
or logging by a NAT device and all the optional fields.
   The fields specified in this document are gleaned from [RFC4787] and [RFC5382].

* Note that 5101 and 5102 are both being updated by -bis drafts which are so= on to be RFCs - so your Informative References should be updated.

* [IANA-IPFIX] =3D=3D http://www.iana.org/assignments/ipfix/ipfix.xhtml
    This is now the definitive reference, rather than 5102 /= 5102bis.

* Please write "NetFlow v9" rather than "Netflow 9" (ie= , with a capital 'F' and a 'v').

* IANA Considerations: if there are none, then say "there are no IANA = considerations."

P.
 --_000_CB1B483277FEC94E9B58357040EE5D023267DBB2xmbrcdx15ciscoc_-- From n.brownlee@auckland.ac.nz Mon Aug 5 17:39:42 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55AD921F99DD for ; Mon, 5 Aug 2013 17:39:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.26 X-Spam-Level: X-Spam-Status: No, score=-100.26 tagged_above=-999 required=5 tests=[AWL=-2.338, BAYES_50=0.001, SUBJ_ALL_CAPS=2.077, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KFBrDHNhZr8U for ; Mon, 5 Aug 2013 17:39:38 -0700 (PDT) Received: from mx2.auckland.ac.nz (mx2.auckland.ac.nz [130.216.125.245]) by ietfa.amsl.com (Postfix) with ESMTP id 1BF7C21F89A6 for ; Mon, 5 Aug 2013 17:39:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=uoa; t=1375749577; x=1407285577; h=message-id:date:from:mime-version:to:subject: content-transfer-encoding; bh=/4Es4emshAI/8DP+xhBcLV0dKr00/StQtAn5XjCRLWM=; b=Y4APctq9ud/IOZvMslf/IKayRD4hK/m3UUaemT79tF609DVbXIP13VR3 yQykm3yvXnqURecGuw7v1tIjWNqLVuEcnzSIZi8tNB83ao0gTmrXOwiwd ySXwblsSNAl1R0l6AT2HcYi9hlzQ5nifUQJF/IrLRiXYf9hTdV9EescgJ E=; X-IronPort-AV: E=Sophos;i="4.89,822,1367928000"; d="scan'208";a="203934586" X-Ironport-HAT: UNIVERSITY - $RELAY-THROTTLE X-Ironport-Source: 130.216.38.131 - Outgoing - Outgoing-SSL Received: from nevil-laptop1.sfac.auckland.ac.nz (HELO [130.216.38.131]) ([130.216.38.131]) by mx2-int.auckland.ac.nz with ESMTP; 06 Aug 2013 12:39:34 +1200 Message-ID: <520045C5.3020500@auckland.ac.nz> Date: Tue, 06 Aug 2013 12:39:33 +1200 From: Nevil Brownlee User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 MIME-Version: 1.0 To: IPFIX Working Group Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [IPFIX] PAM 2014 CFP X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2013 00:39:42 -0000 Hi all: The CFP for PAM 2014 (to be held in Los Angeles) is available now, at http://www.wikicfp.com/cfp/servlet/event.showcfp?eventid=31949©ownerid=53505 Cheers, Nevil -- --------------------------------------------------------------------- Nevil Brownlee Computer Science Department Phone: +64 9 373 7599 x88941 The University of Auckland FAX: +64 9 373 7453 Private Bag 92019, Auckland 1142, New Zealand From n.brownlee@auckland.ac.nz Wed Aug 7 15:12:35 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2A2511E8161 for ; Wed, 7 Aug 2013 15:12:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.13 X-Spam-Level: X-Spam-Status: No, score=-100.13 tagged_above=-999 required=5 tests=[AWL=-0.131, BAYES_50=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nR1+BC2Zhm5m for ; Wed, 7 Aug 2013 15:12:30 -0700 (PDT) Received: from mx2.auckland.ac.nz (mx2.auckland.ac.nz [130.216.125.245]) by ietfa.amsl.com (Postfix) with ESMTP id A59AC11E814D for ; Wed, 7 Aug 2013 15:12:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=uoa; t=1375913550; x=1407449550; h=message-id:date:from:mime-version:to:subject: content-transfer-encoding; bh=RhC7A4poGDNW9eKPMoqq2wU/1eJQhgjaPKHRaeHAr/w=; b=uaW+b0OW1aRyFwBzzDG7CjCWUAJjFMqBxleX2rcGLKOUJuRolG1oGg1A l96utPPI9MHZ/TNIllj4MIvaKCz/Dgs41hNeLYyCN2D/JXBbdr/qLdsoD 1siQj89MytmFRdGruzlz9hEjmX0wQVdZoRByaXTV4zn6GEVomsFkuc/zV Q=; X-IronPort-AV: E=Sophos;i="4.89,835,1367928000"; d="scan'208";a="204175676" X-Ironport-HAT: UNIVERSITY - $RELAY-THROTTLE X-Ironport-Source: 130.216.38.131 - Outgoing - Outgoing-SSL Received: from nevil-laptop1.sfac.auckland.ac.nz (HELO [130.216.38.131]) ([130.216.38.131]) by mx2-int.auckland.ac.nz with ESMTP; 08 Aug 2013 10:12:24 +1200 Message-ID: <5202C647.5030204@auckland.ac.nz> Date: Thu, 08 Aug 2013 10:12:23 +1200 From: Nevil Brownlee User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: IPFIX Working Group Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [IPFIX] WG Last call for draft-ietf-ipfix-mediation-protocol-06.txt X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2013 22:12:35 -0000 Hi all: The -06 version of IPFIX Mediation Protocol was published last week, now it's time for its WG Last Call. The WGLC starts now, and will run until Friday, 23 August. Please read the draft and send your comments/suggestions to the list. Actual reviews of the draft would be much appreciated, but a brief comment saying "I read it, it's fine" is useful too! Cheers, Nevil -- --------------------------------------------------------------------- Nevil Brownlee Computer Science Department Phone: +64 9 373 7599 x88941 The University of Auckland FAX: +64 9 373 7453 Private Bag 92019, Auckland 1142, New Zealand From n.brownlee@auckland.ac.nz Mon Aug 26 20:31:14 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31BA621F9E77 for ; Mon, 26 Aug 2013 20:31:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qrR7GEIdRnIt for ; Mon, 26 Aug 2013 20:31:09 -0700 (PDT) Received: from mx2.auckland.ac.nz (mx2.auckland.ac.nz [130.216.125.245]) by ietfa.amsl.com (Postfix) with ESMTP id 5C34D21F9E6B for ; Mon, 26 Aug 2013 20:31:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=uoa; t=1377574269; x=1409110269; h=message-id:date:from:mime-version:to:subject:references: in-reply-to:content-transfer-encoding; bh=3HjE9sYsIdnjG+ESV69zYP7sF7ogwf1QCamYod6gkTw=; b=eJnXsbry/PwAhZRDdU34n28Gm5aRaBKoqgD9USRGx1ZdYl8COk4iAIZL 85HWd58jLeCw6wtNlRZWPIIoFNwmSs4uSSkBfofiYefgF1kxl4XjP/pqd d9zC/Da43u4yG1uUAuwPD+2V8N3zBp/SzQiOwijtTDaI/V76LJpTI0A9F o=; X-IronPort-AV: E=Sophos;i="4.89,965,1367928000"; d="scan'208";a="207771768" X-Ironport-HAT: UNIVERSITY - $RELAY-THROTTLE X-Ironport-Source: 130.216.38.131 - Outgoing - Outgoing-SSL Received: from nevil-laptop1.sfac.auckland.ac.nz (HELO [130.216.38.131]) ([130.216.38.131]) by mx2-int.auckland.ac.nz with ESMTP; 27 Aug 2013 15:31:01 +1200 Message-ID: <521C1D74.6070103@auckland.ac.nz> Date: Tue, 27 Aug 2013 15:31:00 +1200 From: Nevil Brownlee User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: IPFIX Working Group References: <20130826114207.24953.70085.idtracker@ietfa.amsl.com> In-Reply-To: <20130826114207.24953.70085.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: [IPFIX] MIB Variable Export: mibFieldOption vs EFSF X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Aug 2013 03:31:14 -0000 Hi all: The note below reminds me that we need to make some progress on MIB Variable Export. The minutes from Berlin (now on the IETF Proceedings page) say: - mibFieldOption proposed as alternative to Extended Field Specifiers (EFSF) - Brian Trammell: this is backwards compatible with current IPFIX - Juergen Quittek: but it adds an extra level of lookup in collectors - Benoit Claise: would like to compare EFSF vs option templates = This needs more discussion on the list So far I haven't seen any discussion on this list. My own view is that: i) the mibFieldOption follows what we've done for things like structured data. We know it will work. ii) EFSF seems a nice, general, mechanism but it's definitely an IPFIX extension, i.e. a new way of doing things. If we're to use EFSF, we'll need to develop it as a new WG item and publish it before we can use it for MIB Variables. We _need_ some more discussion. Also it would be good to have a draft proposing EFSF. Paul, could you do that sometime soon, please? Meantime, let's see some real discussion of mibOption and EFSF! Cheers, Nevil On 26/08/13 11:42 PM, IETF Secretariat wrote: > The following draft will expire soon: > > Name: draft-ietf-ipfix-mib-variable-export > Title: Exporting MIB Variables using the IPFIX Protocol > State: I-D Exists > Expires: 2013-08-29 (in 2 days, 19 hours) -- --------------------------------------------------------------------- Nevil Brownlee Computer Science Department Phone: +64 9 373 7599 x88941 The University of Auckland FAX: +64 9 373 7453 Private Bag 92019, Auckland 1142, New Zealand From n.brownlee@auckland.ac.nz Mon Aug 26 20:32:31 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C1F121E8087 for ; Mon, 26 Aug 2013 20:32:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 91LTUpp2ej9F for ; Mon, 26 Aug 2013 20:32:26 -0700 (PDT) Received: from mx2.auckland.ac.nz (mx2.auckland.ac.nz [130.216.125.245]) by ietfa.amsl.com (Postfix) with ESMTP id F378321E804E for ; Mon, 26 Aug 2013 20:32:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=uoa; t=1377574346; x=1409110346; h=message-id:date:from:mime-version:to:subject:references: in-reply-to:content-transfer-encoding; bh=S/IE3/lL5wpFc5/Tu+4xgAHBLjL7UNtG8GtIlGt4DW8=; b=VBuOGAfHpPbsItYje3mrYSFBiZkmFtEYm3CFxK59seajTxPbsFszuSs+ xF8vVE7o2YpjCEtZumEvvRDv/3cdtITLP1e/++Gsbl2RYqEcAe3l8Hz5F sD2OL0I+1tOElOdQkmrqXVCrsxcqoQcYfHwRU0VrWDQAujjOkKZ6uKUPO 4=; X-IronPort-AV: E=Sophos;i="4.89,965,1367928000"; d="scan'208";a="207772650" X-Ironport-HAT: UNIVERSITY - $RELAY-THROTTLE X-Ironport-Source: 130.216.38.131 - Outgoing - Outgoing-SSL Received: from nevil-laptop1.sfac.auckland.ac.nz (HELO [130.216.38.131]) ([130.216.38.131]) by mx2-int.auckland.ac.nz with ESMTP; 27 Aug 2013 15:32:25 +1200 Message-ID: <521C1DC8.2070102@auckland.ac.nz> Date: Tue, 27 Aug 2013 15:32:24 +1200 From: Nevil Brownlee User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: IPFIX Working Group References: <5202C647.5030204@auckland.ac.nz> In-Reply-To: <5202C647.5030204@auckland.ac.nz> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [IPFIX] WG Last call for draft-ietf-ipfix-mediation-protocol-06.txt X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Aug 2013 03:32:31 -0000 Hi all: This WGLC has finished, with no comments at all on the list. I need at least a few "looks OK to me" or "I can live with that" responses before I can put together its Shepherd writeup! Cheers, Nevil On 8/08/13 10:12 AM, Nevil Brownlee wrote: > > Hi all: > > The -06 version of IPFIX Mediation Protocol was published last week, > now it's time for its WG Last Call. > > The WGLC starts now, and will run until Friday, 23 August. > > Please read the draft and send your comments/suggestions to the list. > Actual reviews of the draft would be much appreciated, but a brief > comment saying "I read it, it's fine" is useful too! > > Cheers, Nevil -- --------------------------------------------------------------------- Nevil Brownlee Computer Science Department Phone: +64 9 373 7599 x88941 The University of Auckland FAX: +64 9 373 7453 Private Bag 92019, Auckland 1142, New Zealand From andrewf@plixer.com Fri Aug 30 07:52:19 2013 Return-Path: X-Original-To: ipfix@ietfa.amsl.com Delivered-To: ipfix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B03D11E80F5 for ; Fri, 30 Aug 2013 07:52:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jHGwVUbHCoCb for ; Fri, 30 Aug 2013 07:52:14 -0700 (PDT) Received: from mx1.plixer.com (mx1.plixer.com [64.140.243.154]) by ietfa.amsl.com (Postfix) with ESMTP id 0D3CD11E81A9 for ; Fri, 30 Aug 2013 07:52:12 -0700 (PDT) Received: from [10.11.1.15] (64.140.243.154) by mx1.plixer.com (10.1.5.1) with Microsoft SMTP Server (TLS) id 14.3.158.1; Fri, 30 Aug 2013 10:52:11 -0400 Message-ID: <5220B1A5.5090001@plixer.com> Date: Fri, 30 Aug 2013 10:52:21 -0400 From: Andrew Feren User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130803 Thunderbird/17.0.8 MIME-Version: 1.0 To: IPFIX Working Group References: <5202C647.5030204@auckland.ac.nz> <521C1DC8.2070102@auckland.ac.nz> In-Reply-To: <521C1DC8.2070102@auckland.ac.nz> Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [IPFIX] WG Last call for draft-ietf-ipfix-mediation-protocol-06.txt X-BeenThere: ipfix@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IPFIX WG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2013 14:52:19 -0000 Hi Nevil, all, I missed last call, but as no one else has posted anything here are my comments. First, I think something like this document is needed, but I'd prefer the language to be a bit more general in a number of places. I also have a number of specific issues. An IPFIX Mediator converts a record stream to IPFIX and a record stream can be "IPFIX Data Records or any other format", but other than those points in the Terminology section this document seems to assume IPFIX input. For example: Original Exporter: An Original Exporter is an IPFIX Device that hosts the Observation Points where the metered IP packets are observed. I have a need for something very much like originalExporterIPv4Address except that my data source(s) fall under that "any other format" umbrella and are not IPFIX devices. I'd prefer to see originalSenderIPv4Address (or some such) rather than an IE for each non-IPFIX source. If there is a need to know that the original source was IPFIX or something else I'd prefer an additional IE for originalSenderFormat. Probably with a registry of known formats. I don't have a use case for this IE at the moment, but perhaps there is a need. In section 3 "Note that the format is compatible with the IPFIX Message Header defined in [I-D.ietf-ipfix-protocol-rfc5101bis], with some field definitions (for the example, the Export Time) updated in the context of the IPFIX Mediator." I don't like this at all. Does an exporter send IPFIX or something compatible with IPFIX? For example Export Time "MAY use the export time received from the incoming Transport Session". I think I understand the motivation behind this, but at the collector I have no way to know which export time is being used. How do I know if the time applies to the original or mediator? I'd rather not see this exception unless someone can explain how it is useful. The text for sequence number doesn't match 5101bis. More generally I think it is confusing to include all that copy paste text in this document. I'd rather see a reference to 5101bis followed by a list of special circumstances. Something like The format of the IPFIX Message Header as exported by an IPFIX Mediator is the same as [RFC5102bis]. See Section 4.1 for special considerations for Observation Domain management while passing unmodified templates through an IPFIX Mediator, and Section 5 for guidelines for preservation of original Observation Domain information at an IPFIX Mediator. That makes it obvious what is special or different(*shudder*) relative to IPFIX. Section 4.1 and 4.3 discuss two situations when a Mediator MUST NOT reorder and fields in a record. Additionally, if an IE occurs more than once in a template that order also MUST NOT be modified. I would think that this situation should also be treated similarly to unknown IEs either resend all or none. 4.2 starts with "The second case". I'm not entirely sure what was first. In section 4.3 " Depending on application requirements, Mediators which do not generate new Records SHOULD re-export values for unknown Information Elements, whether enterprise-specific Information Elements or Information Elements in the IPFIX Information Element registry [iana-ipfix-assignments]. added since the Mediator was implemented or updated." That sentence seems a bit long and complicated. At the very least I think the '.' before added needs to be removed. Although I'd prefer to simplify it. I think it is enough to state that "An IE is considered unknown if its data type and semantics are not known to the Mediator." Trying to list the reasons it might not be known just complicates things IMO. I didn't fully grok Section 5, but "[RFC6313] MUST be used" bothers me. Mostly because from a collector perspective I really don't like 6313 at all and subTemplateMultiList in particular. Is 6313 really the only way to export this data? Why? Section 7 timing constraints refers to relative timestamps as "difficult to manage". I think "impossible to manage" is closer to the mark. A collector can get sysUpTime from a v9 header. For IPFIX I'm no sure where I get sysUpTime from. Perhaps there needs to be a requirement for Mediators converting v9 to IPFIX to translate relative times to absolute times. Better late than never I guess, -Andrew On 08/26/2013 11:32 PM, Nevil Brownlee wrote: > > Hi all: > > This WGLC has finished, with no comments at all on the list. > I need at least a few "looks OK to me" or "I can live with that" > responses before I can put together its Shepherd writeup! > > Cheers, Nevil > > > On 8/08/13 10:12 AM, Nevil Brownlee wrote: >> >> Hi all: >> >> The -06 version of IPFIX Mediation Protocol was published last week, >> now it's time for its WG Last Call. >> >> The WGLC starts now, and will run until Friday, 23 August. >> >> Please read the draft and send your comments/suggestions to the list. >> Actual reviews of the draft would be much appreciated, but a brief >> comment saying "I read it, it's fine" is useful too! >> >> Cheers, Nevil >