Subject: Re: [ippm] WGLC on draft-ietf-ippm-active-passive-01

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Sat, 31 Oct 2015 22:09:07 -0400

Hi Mike, Greg,

The messages below leave out the “Class C” discussion
in the days/thread that followed. This is where we point out that
Hybrid methods can be considered equivalent to Passive when the
right circumstances are met. I proposed text that seemed to
meet everyone’s needs (most said so).

Where you are saying “active” below, the criteria says “hybrid”
because these are streams typically generated by users, which we
identified as an attribute of passive methods:

   o  dependent on the existence of one or more packet streams to supply
      the stream of interest

(I haven’t said “user” streams above; the streams could come from machines)
and not (from the active criteria):

   1.  Commonly, the packet stream of interest is generated as the basis

       of measurement.  Sometimes, the adjective "synthetic" is used to

       categorize Active measurement streams [Y.1731<https://tools.ietf.org/html/draft-ietf-ippm-active-passive-02#ref-Y.1731>].  Accompanying

       packet stream(s) may be generated to increase overall traffic

       load, though the loading stream(s) may not be measured.

with the active attribute of fields/values modified/added that are
dedicated to measurement:

   2.  The packets in the stream of interest have fields or field values

       (or are augmented or modified to include fields or field values)

       which are dedicated to measurement.  Since measurement usually

       requires determining the corresponding packets at multiple

       measurement points, a sequence number is the most common

       information dedicated to measurement, often combined with a

       timestamp.

When you have attributes from both
active and passive sets, it’s hybrid.
There’s no negative connotation associated
with that category (or any category).

regards,
Al

From: ippm [mailto:[email-masked]] On Behalf Of Ackermann, Michael
Sent: Tuesday, October 20, 2015 8:13 PM
To: Gregory Mirsky; Greg Mirsky; Joachim Fabini
Cc: [email-masked]
Subject: Re: [ippm] WGLC on draft-ietf-ippm-active-passive-01

Good answer Greg.

I too struggle with the Hybrid concept and method and most of all examples.
Our concept of PDM is that the operator could choose to run PDM all the time, in which case there would be no change or effect on the network traffic,  hence Passive.       The operator could alternately choose to turn PDM on an exception basis.  In that case the DO Extension Header would be additional bytes during the exception time and could hence be considered Active.
This would make PDM a Hybrid methodology, depending upon how you choose to use it?

Does that make sense?     If so THANKS!   Because it would be the first Hybrid example I can get my arms around!  ☺

Mike

From: Gregory Mirsky [mailto:[email-masked]]
Sent: Tuesday, October 20, 2015 7:56 PM
To: Ackermann, Michael <[email-masked]<mailto:[email-masked]>>; Greg Mirsky <[email-masked]<mailto:[email-masked]>>; Joachim Fabini <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: RE: [ippm] WGLC on draft-ietf-ippm-active-passive-01

Hi Mike,
very good questions, thank you.
Have to admit, I still don’t have good example of a hybrid measurement method if using the proposed criteria.
If IPv6 Destination Options Header inserted by the source of the flow, then use of it to perform PDM, in my view, would not change network behavior and thus be passive measurement. But if the header inserted only for the period of the measurement – active.
As you can see, impact on the network criteria makes some methods … hybrid. Perhaps that’s what hybrid methods are – active or passive, depending on how they’ve been performed?

                Regards,
                                Greg

From: ippm [mailto:[email-masked]] On Behalf Of Ackermann, Michael
Sent: Tuesday, October 20, 2015 4:43 PM
To: Greg Mirsky; Joachim Fabini
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [ippm] WGLC on draft-ietf-ippm-active-passive-01

Thanks Greg!

A couple questions popped to mind.

1.       Under what conditions would marking or any other method be considered HYBRID?

2.       Based on what you say below,  how would you classify PDM?

Thanks again!

Mike

From: ippm [mailto:[email-masked]] On Behalf Of Greg Mirsky
Sent: Tuesday, October 20, 2015 6:12 PM
To: Joachim Fabini <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [ippm] WGLC on draft-ietf-ippm-active-passive-01

Hi Joachim, et. al,
I believe that characterization of a measurement method as active, passive or hybrid must be based on its impact on the otherwise normal network behavior. If the method alters the network behavior or treatment of the data, then it is active measurement method. If the method does not change network behavior in any aspect, then it is passive. Why I believe that is important? Because from this point, marking method that does not affect treatment of the flow by the network is passive, not active measurement method since marked and unmarked packets are indistinguishable to the network except for observer(s). But it the marking method applied in the manner that would change how marked packets being processed comparing to unmarked, then it is active method.

Regards,
Greg

On Tue, Oct 13, 2015 at 3:10 AM, Joachim Fabini <[email-masked]<mailto:[email-masked]>> wrote:
Hi Brian, Al, IPPM,

I've read it and it's good... ;) The active-passive-hybrid definition
and categorization helps enormously and should have been started years
ago - many thanks to Al for taking the initiative. I consider this work
to be relevant also for the scientific community. In particular the term
hybrid is used with many diverging meanings (commonly as a buzzword when
applying for new project funding), so I spent some time on reviewing and
reasoning about. Disclaimer: I've not been involved into earlier
discussions on this draft and it's the first time I read it. Consider it
to be an unbiased first-time-reader opinion.

Comments (sequential reading, _no_ priority ordering):

Sec. 3.4 (1) s/"a packet stream..."/"Additional packet streams..."/ to
be more generic? Any stream can be an aggregate of other streams, but
the second variant seems to be more accurate and flexible (thinking of
several streams with distinct sources and destinations for impairing
distinct sub-paths of the measurement path).

Sec. 3.4 (2) "The packets in the stream(s) of interest have fields (or
are augmented or modified to include fields) which are dedicated to
measurements"
Proposed (relaxing) addition: Instead of dedicated measurement fields an
aggregated set of packet header _values_ can be sufficient to identify
packets as being part of the active measurement stream.
Considering the hypothetical case of UDP BTC measurements, the traffic
is actively generated, so the method is active. But packets are not
marked, nor are there any specific fields like sequence numbers that can
be used to identify packets. And for a UDP BTC metric there is no need
for such. One could argue that packets of a UDP measurement stream can
be identified by SRC/DST IP addresses and port numbers, which is why
these fields are dedicated to measurement - but that's not intuitive.
Alternatively the two occurrences of "fields" could be replaced by
"fields or field values". The key is that these specific measurement
stream packets are selected/evaluated/measured in at least one
measurement location. Possibly nitpicking?

Sec. 3.4 (3) possible typo (known a' priori)

Sec. 3.4: not sure: does it make sense to mention in a note  possible
changes of packet type (Type-P) along the measurement path (e.g.
IPv4->IPv6, tunneling, addition of headers) and possible resulting
measurement issues? We address this issue in the IPv6 draft but my
feeling is that it can help to raise reader's awareness in this draft,
too. Type-P at the source does not necessarily mean same Type-P at the
destination (same observation is valid for passively observing
intermediate nodes)

Sec. 3.6: What about Passive Measurements and generating background
load? Consider the case of passive monitoring of a cellular link that
does on-demand capacity allocation. The measurement process observes the
measurement stream at ingress and egress. One might be tempted to
generated some background load that triggers allocation of additional
capacity on the link. Where does this method fit into: passive or
hybrid? I'm not sure. As a matter of consistency with the section on
active methods (where you mention background load traffic explicitly) it
might be appropriate to discuss this special case for passive methods, too.

Sec. 3.7: Last paragraph (sentence) is very long and difficult to
understand, including possible typos. Should "basis of reference events
as packet pass reference point" read "basis of reference events that are
generated as packet_s_ pass reference points"? Rephrasing can help here.

Sec. 3.8: The differentiation between hybride-active-passive is not
clear to me from the definition in 3.8. I believe that the definition of
"hybrid" {sh|c}ould be sharpened to delimit "hybrid" more accurately
from active and passive.

One particular case of hybrid measurement - imho the most compelling one
- is the one where passive measurements are combined with additions of
fields or changes of field values in intermediate
(observation/measurement) nodes. This includes all kinds of packet
markings, addition of header fields or changes in header field values in
intermediate nodes. However, to make the measurement hybrid, these
changes must be a _consequence_ or _result_ of actions undertaken by the
(otherwise passive) _measurement_ process.
My personal opinion on this:
a) Active: whenever the measurement process generates a dedicated stream
of measurement packets, where packets are identifiable either by
dedicated measurement fields (either in payload or header), and/or by
(possibly aggregated, i.e., set of) field values, the method/metric can
be categorized as active
b) Passive: whenever the measurement process observes an existing stream
of packets without changing/adding/removing any packet fields or field
values. The passive monitoring _must_not_ add/change/remove header
fields or header field values. Although passive monitoring might bias
the timing of the observed traffic to some extent (be it by setting
interfaces into promiscous mode or by inserting splitters into the path)
it does not do this _intentionally_. Open question: into which category
does the generation of background load for passive measurements fit?
c) Hybrid: the measurement acts exclusively on existing traffic, that
is, anything that is categorized as passive (b). However, the
_measurement_ process adds/changes/removes fields or changes packet
field values in (intermediate) nodes as part of the measurement (may be
header or payload). Obviously, IPv4 header updates that result from
forwarding rules (checksum, TTL) are NOT part of the measurement
process. Question: does "passive + background load" fit into hybrid?

Sec. 3.8: Possible Typo: Y.1540 define_s_ -> _d_?

Sec. 4: 1. Possible typo "effects" -> "biases"?

Sec. 4: "To keep simple, we consider the stream effect only when it is
present".
This statement imho conflicts with the main findings of RFC7312. Today's
networks store flow/stream state at layers below IP, so networks have a
"historic view". I doubt that this bias can be ignored - infact the bias
of past periods is visible during the current measurement period. A
mention of possible consequences in stateful networks with reference to
7312 could be a cheap solution (not sure if this is sufficient).

Sec. 4: ASCII diagram: it might improve readability to add axis labels
(don't know how this can be done easily, maybe split/break descriptions
of reference points onto several lines): y axis label: "Measurement
stream capacity", x axis label: "Stream characteristics known".
In this context its's also not clear to me whether stream
characteristics must be just "known" or if they must be
controled/generated/changed.

Sec. 4, 4.1, 4.2: Page 7: The examples (and detailed reasoning) are
excellent here to support and illustrate the categories defined before.
Still, I believe that an earlier clear categorization
active/passive/hybrid in sec. 3.8 can ease the reading.

Sec. 4.1., 4.2: I fully agree with the categorization. However, is the
"small effect" essential for these examples/statement? One could find
several cases when the bias onto measurements is substantial - anything
between a) "packets become too large when adding the PDM header and
results in <IPv6-fragementation-required> to the sending host", b) "Size
increase with PDM header makes stream to exceed a network threshold and
trigger channel capacity re-allocation" and c) "subsequent nodes on the
path drop these packets because of the measurement node modifications".
All of these actions should result in substantial bias of measurement
results. And even the change of field values could result in
intermediate nodes to apply distinct forwarding policies to the packets.

The point is that the measurement process _intends_ to introduce a
minimum bias but it's quite difficult to estimate the consequences onto
measurement results. If this _intention_ is key, then I'm fine with the
wording. Otherwise one could think about a possible rephrase.

Summarizing: I consider this draft and its definitions to be essential
for the work and discussions of IPPM and related working groups. It
tackles the definitions it is supposed to and treats them in adequate
depth. As a first-time reader I had the impression that some few
sentences and clarifications can substantially improve the
categorization and delimiting of active/passive/hybrid methods in sec.
3.4-3.8 - I consider this to be the key part of the draft.

regards
Joachim

On 07.10.2015 12:47, Brian Trammell wrote:
> Greetings, all,
>
> WG last call on draft-ietf-ippm-active-passive-01 begins today, and will end Wednesday 21 October 2015. Please send any comments (including "I've read it and it's good" :) ) to the [email-masked]<mailto:[email-masked]> list.
>
> Thanks, cheers,
>
> Brian (chair hat)
>
>
>
> _______________________________________________
> ippm mailing list
> [email-masked]<mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/ippm
>

_______________________________________________
ippm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ippm

The information contained in this communication is highly confidential and is intended solely for the use of the individual(s) to whom this communication is directed. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information is prohibited. Please notify the sender, by electronic mail or telephone, of any unintended receipt and delete the original message without making any copies.

Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are nonprofit corporations and independent licensees of the Blue Cross and Blue Shield Association.

The information contained in this communication is highly confidential and is intended solely for the use of the individual(s) to whom this communication is directed. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information is prohibited. Please notify the sender, by electronic mail or telephone, of any unintended receipt and delete the original message without making any copies.

Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are nonprofit corporations and independent licensees of the Blue Cross and Blue Shield Association.