Subject: Re: [IPFIX] NetFlow v9 to IPFIX conversion

From: Petr Velan <[email-masked]>
Date: Thu, 26 Mar 2015 08:14:03 +0100

Hi Andrew, all,

thank you for your explanation regarding nprobe.

However, we also need a fallback for unknown exporters with IEs > 2^15. The
generic requests for PENs need organization name, contact name and email
address. I can try to request the PEN for NetFlow v9 compatibility myself,
but I'd like it to be more public. Therefore, I suggest to complete the
request with something like:
*Organization Name*: NetFlow v9 to IPFIX
*Contact Name*: IPFIX WG
*Contact E-Mail: [email-masked]

This is just a first proposal to get things moving, please add your
thoughts. Once the PEN is granted, we can move forward and explain its
purpose in a short RFC.

Petr

On Tue, Jan 6, 2015 at 9:07 PM, Andrew Feren <[email-masked]> wrote:

>  Hi Petr,
>
> On 01/06/2015 07:03 AM, Petr Velan wrote:
>
>     Hello all,
>
>  I'm not sure whether this is the right place to ask, but we encountered
> following problem when converting NetFlow v9 messages to IPFIX.
>
>  Some vendors (I've heard of ntop) are using elements IDs large than 32767
> in NetFlow v9. When converting messages with these elements to IPFIX, they
> are considered to be Enterprise Numbers. To generate proper IPFIX message,
> we need to do one of the following:
>  a) Generate a list of the elements and map them to PEN of the correct
> vendor. However, this would result in an attempt to cover all possible
> elements that anybody used in NetFlow v9. Moreover, we would still have to
> somehow handle the cases where the element is unknown
>
> This should help with ntop/nprobe
>
> Recent versions of nprobe (since version 5.5.5 I think) all use the
> following mapping.
>
> PEN = 35632 and IPFIXID = (v9ID - 57472)
>
> For example, one v9 IE that nprobe exports is MYSQL_SERVER_VERSION 57667.
> The IPFIX equivalent would be
> MYSQL_SERVER_VERSION(35632/195).
>
> The nprobe docs have a complete list.
>
> Older versions of nprobe (pre ~2010) use IEs not in RFC 3954, but later
> allocated in IANA.  There is no good way to convert those v9 exports to
> IPFIX.
>
> -Andrew
>
>
>   b) Request a PEN for NetFlow compatibility and just add this PEN for
> every element that has ID larger than 32767.
>
>  Personally, I believe that the b) is more general and error-prone. Do you
> think, that it would be possible to dedicate whole PEN to this cause?
>
>  Thank you for any opinions,
>
> Petr Velan
>
>
>
> _______________________________________________
> IPFIX mailing [email-masked]://www.ietf.org/mailman/listinfo/ipfix
>
>
>

---

From: Paul Aitken <[email-masked]>
Date: Thu, 26 Mar 2015 08:43:55 +0000

Petr,

You should write an RFC (well, start with a draft) which explains the 
proposal and requests the PEN from IANA.

Since the IPFIX WG is now closed, such a draft must be AD sponsored by Joel.

P.

On 26/03/15 07:14, Petr Velan wrote:
> However, we also need a fallback for unknown exporters with IEs > 
> 2^15. The generic requests for PENs need organization name, contact 
> name and email address. I can try to request the PEN for NetFlow v9 
> compatibility myself, but I'd like it to be more public. Therefore, I 
> suggest to complete the request with something like:
> *Contact E-Mail: [email-masked] <mailto:[email-masked]>
>
> On Tue, Jan 6, 2015 at 9:07 PM, Andrew Feren <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     Hi Petr,
>
>>     I'm not sure whether this is the right place to ask, but we
>>     encountered following problem when converting NetFlow v9 messages
>>     to IPFIX.
>>
>>     Some vendors (I've heard of ntop) are using elements IDs large
>>     than 32767 in NetFlow v9. When converting messages with these
>>     elements to IPFIX, they are considered to be Enterprise Numbers.
>>     To generate proper IPFIX message, we need to do one of the following:
>>     a) Generate a list of the elements and map them to PEN of the
>>     correct vendor. However, this would result in an attempt to cover
>>     all possible elements that anybody used in NetFlow v9. Moreover,
>>     we would still have to somehow handle the cases where the element
>>     is unknown
>     Recent versions of nprobe (since version 5.5.5 I think) all use
>     the following mapping.
>
>     For example, one v9 IE that nprobe exports is MYSQL_SERVER_VERSION
>     57667.  The IPFIX equivalent would be
>     Older versions of nprobe (pre ~2010) use IEs not in RFC 3954, but
>     later allocated in IANA.  There is no good way to convert those v9
>     exports to IPFIX.
>
>     -Andrew
>
>
>>     b) Request a PEN for NetFlow compatibility and just add this PEN
>>     for every element that has ID larger than 32767.
>>
>>     Personally, I believe that the b) is more general and
>>     error-prone. Do you think, that it would be possible to dedicate
>>     whole PEN to this cause?
>>
>>     IPFIX mailing list
>>     [email-masked]  <mailto:[email-masked]>
>>     https://www.ietf.org/mailman/listinfo/ipfix
>
>