Subject: Re: [nmrg] Re: Netflow/IPFIX workshop: information and request for feedback
From: Juergen Schoenwaelder <[email-masked]>
To: [email-masked], Ramin Sadre <[email-masked]>
Date: Fri, 26 Sep 2008 10:37:45 +0200
List-Id: Network Management Research Group <nmrg.ibr.cs.tu-bs.de>

On Mon, Sep 15, 2008 at 10:08:19PM +0200, Juergen Schoenwaelder wrote:

> During the past few weeks, the program of this workshop has taken
> shape [1]. Next to a keynote by Benoit Claise, there will a number of
> talks concerning the following subjects:
> 
>   - Flow record query languages.
>   - Using SQL databases for flow processing.
>   - A distributed architecture for IP flow analysis.
>   - Open issues of hierarchical flow aggregation.
>   - Labeling flow traces for intrusion detection evaluation.
>   - Network anomaly characterization using flows.
>   - Application level dependency discovery with flows.
>   - Management of light paths in optical networks using flows.
> 
> There seems to be good potential for interaction with people active in
> IPFIX and some of the research community. I have received some
> supportive statements for making this an NMRG event and no negative
> comments.
> 
> So I propose to make this an NMRG workshop (the 25th). If you disagree,
> please let me/us know by September 25th.

Since I have not received any objections, we will make this event and
NMRG workshop. The current workshop plan is still here:

  http://www.simpleweb.org/netflow/

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

Date: Wed, 17 Sep 2008 22:59:23 +0200
From: Juergen Schoenwaelder <[email-masked]>
To: Benoit Claise <[email-masked]>
Subject: Re: [nmrg] draft-irtf-nmrg-snmp-measure-06.txt: your conclusions?
Mail-Followup-To: Benoit Claise <[email-masked]>, [email-masked]
Cc: [email-masked]
Reply-To: [email-masked]

On Wed, Sep 17, 2008 at 12:25:06PM -0700, Benoit Claise wrote:

> I understand that this future RFC covers an approach to carrying out  
> large scale SNMP traffic measurements, and not what you observed.  
> However, have you published your observations somewhere?
> I'm specifically interested in
>
>     3.2.  Periodic vs. Aperiodic Traffic . . . . . . . . . . . . . .  9
>     3.5.  Table Retrieval Approaches . . . . . . . . . . . . . . . . 10
>     3.6.  Trap-Directed Polling - Myths or Reality?  . . . . . . . . 10
>     3.7.  Popular MIB Definitions  . . . . . . . . . . . . . . . . . 10

Gijs van den Broek, a student at the University of Twente, has been
working on 3.2 [1] and as far as I know he is working on a paper
writeup. We at Jacobs have been working on 3.5 and when we talked to
the people from Twente, we found out that we need common definitions
for our conversation to be effective since we did similar things but
slightly different and under different terms.

So we joined forces to get common definitions in place and work on 3.5
somewhat stalled. The definitions are meanwhile somewhat stable [2]
and we are now working on updating our implementations to use them and
then hopefully we can continue on 3.5. I am not sure much work has
been done on 3.6 yet.

Some early results concerning 3.7 can be found in [3]. We now have
some additional traces but still like to get more and perhaps some of
the analysis reported in [3] needs to be redone on a larger data set.

For [2], there was a working Internet-Draft which Gijs presented at
the NMRG meeting next to the Philadelphia IETF. We turned the draft
<draft-schoenw-nmrg-snmp-trace-definitions> into the conference paper
[2] in order to get quickly a citable document in place.

/js

[1] J.G. van den Broek: Periodicity of SNMP Traffic, BSc Thesis,
    University of Twente, August 2007.

[2] J.G. van den Broek, J. Sch"onw"alder, A. Pras, M. Harvan: SNMP
    Trace Analysis Definitions, Proc. 2nd International Conference on
    Autonomous Infrastructure, Management and Security (AIMS 2008)",
    LNCS 5127, July 2008.

[3] J. Sch"onw"alder, A. Pras, M. Harvan, J. Schippers, R. van de
    Meent: SNMP Traffic Analysis: Approaches, Tools, and First
    Results, Proc. 10th IFIP/IEEE International Symposium on
    Integrated Network Management (IM 2007), May 2007.

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

Date: Wed, 17 Sep 2008 12:25:06 -0700
From: Benoit Claise <[email-masked]>
To: Juergen Schoenwaelder <[email-masked]>
Cc: [email-masked]
Subject: [nmrg] draft-irtf-nmrg-snmp-measure-06.txt: your conclusions?

Juergen,

I understand that this future RFC covers an approach to carrying out 
large scale SNMP traffic measurements, and not what you observed. 
However, have you published your observations somewhere?
I'm specifically interested in

     3.2.  Periodic vs. Aperiodic Traffic . . . . . . . . . . . . . .  9
     3.5.  Table Retrieval Approaches . . . . . . . . . . . . . . . . 10
     3.6.  Trap-Directed Polling - Myths or Reality?  . . . . . . . . 10
     3.7.  Popular MIB Definitions  . . . . . . . . . . . . . . . . . 10

Regards, Benoit.

From: "Bert Wijnen \(IETF\)" <[email-masked]>
To: "NMRG" <[email-masked]>
Date: Wed, 17 Sep 2008 18:53:32 +0200
Organization: Consultant
Subject: [nmrg] draft-irtf-nmrg-snmp-measure-06.txt

NMRG, FYI....

The IESG has approved the document (as I reported a little while ago),
but there were some comments that we wanted to address. So Juergen
has posted a revision 6 to address those (as opposed to let the RFC-Editor
figure out the edits). This is in the RFC-Editor queue, so it is now being
processed to become RFC.

Just wanted to let you know the status and explain why there is a revision
06 in the I-D repository.

Bert Wijnen
document shepherd

below is the conversations Juergen and I had with the RFC-Editor.

----- Original Message ----- 
From: "RFC Editor" <[email-masked]>
To: "Bert Wijnen (IETF)" <[email-masked]>
Cc: <[email-masked]>; "Romascanu, Dan (Dan)" 
<[email-masked]>; "Aaron Falk" <[email-masked]>; "RFC Editor" 
<[email-masked]>
Sent: Wednesday, September 17, 2008 6:46 PM
Subject: Re: [[email-masked]: Re: Informational RFC to be: 
draft-irtf-nmrg-snmp-measure-05.txt]

> Hi Bert,
>
> Thanks for the update.  We'll retrieve version -06 and continue
> processing.
>
> Sandy
>
>
> On Wed, Sep 17, 2008 at 12:50:35PM +0200, Bert Wijnen (IETF) wrote:
>> Hi,
>>
>> Juergen has in the meanwhile posted a revision 06 of the
>> document (inlcuing .xml source). There we a few minor edits to addres
>> the IESG comments. Some comments also did not require an update.
>>
>> Below is Juergens check with me on his changes. I have indeed checked
>> this and I confirm that the changes made are appropriate and correct.
>> The comments that did not warrant changes have been responded to
>> and explained to the IESG members who made the comment.
>>
>> I have informed and explained to Tim polk why his comments did not
>> warrant an update (as Juergen also explains below).
>>
>> I think revision 6 (draft-irtf-nmrg-snmp-measure-06.txt) is now ready for
>> publication. Thank you all.
>>
>> Bert Wijnen
>> Document shepherd
>>
>> ----- Original Message ----- 
>> From: "Juergen Schoenwaelder" <[email-masked]>
>> To: "Bert Wijnen (IETF)" <[email-masked]>
>> Sent: Wednesday, September 17, 2008 8:12 AM
>> Subject: Re: [[email-masked]: Re: Informational RFC to
>> be:draft-irtf-nmrg-snmp-measure-05.txt]
>>
>> On Thu, Sep 11, 2008 at 08:57:14PM +0200, Bert Wijnen (IETF) wrote:
>>
>> >Juergen, were you going to make the changes or are we just assuming
>> >the RFC-Editor will do so based on the input from IESG comments?
>> >Probably it is better if you make the edits?
>>
>> I have posted <draft-irtf-nmrg-snmp-measure-06.txt> and here is a
>> short summary of the resolution of the IESG comments.
>>
>> - Pasi Eronen's comments have been addressed as explained in an
>>  email to Pasi.
>>
>> - I did respond to Jari Arkko's comment in an email and I do not think a
>> further
>>  clarification is needed.
>>
>> - Chris Newman asked how versioning of the XML format is handled. The
>>  XML namespace includes a version number. In case the SNMP protocol
>>  is extended and changes to the XML representation are needed, a new
>>  updated schema and a new XML namespace is needed. Additional text
>>  has been added just before the RelaxNG schema definition. Clarifying
>>  text has been added as described in the email to Chris.
>>
>> - Tim Polk's comment (A) concerns the different citation styles
>>  xml2rfc uses for normal references and references to URI. As far a I
>>  can tell, the references are consistent. Comment (B) concerns
>>  filtering, anonymization, encryption recommendations and I believe
>>  the text got this right as there is a difference between raw traces
>>  that likely are stored (if at all) by the network operator and
>>  converted/filtered/anonymized traces that might be given to other
>>  parties for analysis.
>>
>> Please check and inform the RFC editor if everything is fine.
>>
>> /js
>>
>>
>> ----- Original Message ----- 
>> From: "RFC Editor" <[email-masked]>
>> To: <mailto: [email-masked]>; 
>> <[email-masked]>
>> Cc: "RFC Editor" <[email-masked]>
>> Sent: Thursday, September 11, 2008 7:55 PM
>> Subject: Re: [[email-masked]: Re: Informational RFC to be:
>> draft-irtf-nmrg-snmp-measure-05.txt]
>>
>>
>> >FYI: Resending with Bert's corrected address...
>> >
>> >On Thu, Sep 11, 2008 at 10:19:14AM -0700, RFC Editor wrote:
>> >>Hi Juergen and Bert,
>> >>
>> >>The IESG provided us with the "no problem with publication" message
>> >>below for <draft-irtf-nmrg-snmp-measure-05.txt>.  However, they
>> >>have provided comments for review in the I-D tracker.  Can you
>> >>please review and address the comments (as necessary) and let us know
>> >>when/if a revised version has been posted as an ID.
>> >>
>> >>Bert, please note that as document shepherd, we will wait to hear from
>> >>you that the comments have been addressed, or provide us with a
>> >>statement that the comments do not need to be addressed.
>> >>
>> >>Thanks!
>> >>
>> >>Sandy
>> >>
>> >>
>> >>----- Forwarded message from The IESG <[email-masked]> -----
>> >>
>> >>From: The IESG <[email-masked]>
>> >>To: RFC Editor <[email-masked]>
>> >>Cc: The IESG <[email-masked]>, <[email-masked]>, [email-masked]
>> >>Date: Tue,  2 Sep 2008 11:22:08 -0700 (PDT)
>> >>Subject: Re: Informational RFC to be:
>> >>draft-irtf-nmrg-snmp-measure-05.txt
>> >>
>> >>The IESG has no problem with the publication of 'SNMP Traffic
>> >>Measurements and Trace Exchange Formats'
>> >><draft-irtf-nmrg-snmp-measure-05.txt> as an Informational RFC.
>> >>
>> >>The IESG would also like the RFC-Editor to review the comments in the
>> >>datatracker
>> >>(https://datatracker.ietf.org/public/pidtracker.cgi?command=view_id&dTag=14654&rfc_flag=0)
>> >>related to this document and determine whether or not they merit
>> >>incorporation into the document. Comments may exist in both the ballot
>> >>and the comment log.
>> >>
>> >>The IESG contact person is Dan Romascanu.
>> >>
>> >>A URL of this Internet-Draft is:
>> >>http://www.ietf.org/internet-drafts/draft-irtf-nmrg-snmp-measure-05.txt
>> >>
>> >>
>> >>The process for such documents is described at
>> >>http://www.rfc-editor.org/indsubs.html.
>> >>
>> >>Thank you,
>> >>
>> >>The IESG Secretary
>> >>
>> >>Technical Summary
>> >>
>> >>   The Simple Network Management Protocol (SNMP) is widely deployed to
>> >>   monitor, control and (sometimes also) configure network elements.
>> >>   Even though the SNMP technology is well documented, it remains
>> >>   relatively unclear how SNMP is used in practice and what typical 
>> >> SNMP
>> >>   usage patterns are.
>> >>
>> >>   This document proposes to carry out large scale SNMP traffic
>> >>   measurements in order to develop a better understanding how SNMP is
>> >>   used in real world production networks.  It describes the 
>> >> motivation,
>> >>   the measurement approach, and the tools and data formats needed to
>> >>   carry out such a study.
>> >>
>> >>
>> >>Working Group Summary
>> >>
>> >>   This document was produced within the IRTF's Network Management
>> >>   Research Group (NMRG) and represents the consensus of all of the
>> >>   active contributors to this group.
>> >>
>> >>Document Quality
>> >>
>> >>   SNMP is quite widely deployed. Measurements on SNMP traffic are 
>> >> being
>> >>   performed by various tools and different organizations.
>> >>
>> >>Personnel
>> >>
>> >>   Bert Wijnen shephereded the document in the NMRG. Dan Romascanu is
>> >>   the shepherding AD.
>> >>
>> >>IESG Note
>> >>
>> >>The IESG thinks that this work is related to IETF work done in the
>> >>Operations and Management Area related to SNMP, but this does not 
>> >>prevent
>> >>publishing. This RFC is not a candidate for any level of Internet
>> >>Standard.
>> >>
>> >>The IETF disclaims any knowledge of the fitness of this RFC for
>> >>any purpose and notes that the decision to publish is not based on
>> >>IETF review apart from the IETF Last Call on the allocation of an URI 
>> >>by
>> >>IANA and the IESG review for conflict with IETF work.
>> >>The RFC Editor has chosen to publish this document at its
>> >>discretion.  See RFC 3932 for more information.
>> >>
>> >>----- End forwarded message -----
>> >
>> >
>>
>
> 

Date: Tue, 16 Sep 2008 19:03:40 +0200
From: Juergen Schoenwaelder <[email-masked]>
To: David B Harrington <[email-masked]>
Subject: Re: [nmrg] Re: Netflow/IPFIX workshop: information and request forfeedback
Mail-Followup-To: David B Harrington <[email-masked]>, [email-masked]
Cc: [email-masked]
Reply-To: [email-masked]

On Tue, Sep 16, 2008 at 12:34:13PM -0400, David B Harrington wrote:
 
> My workgroup is interested in this topic, but for budget and planning
> reasons may not be able to attend the meeting. 
> 
> Will you have any audio or jabber support for the meeting?

I do not know. Jabber should be relatively easy to do but audio
streaming is usually much more difficult to organize for meetings of a
smaller scale where you do not have audio equipment in place.

> Will the presentations be made available on a website prior to the
> meeting?

Hopefully, but no promise; it depends on the discipline of the
presenters at the end (like in IETF meetings).

> Will the presentations not made available prior to the meeting be
> available after the meeting?

Yes. NMRG meetings always had presentation material and minutes online
after the meeting and this will be no different.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

From: "David B Harrington" <[email-masked]>
To: <[email-masked]>, <[email-masked]>
Subject: RE: [nmrg] Re: Netflow/IPFIX workshop: information and request forfeedback
Date: Tue, 16 Sep 2008 12:34:13 -0400

Hi,

My workgroup is interested in this topic, but for budget and planning
reasons may not be able to attend the meeting. 

Will you have any audio or jabber support for the meeting?
Will the presentations be made available on a website prior to the
meeting?
Will the presentations not made available prior to the meeting be
available after the meeting?

Thanks,
David Harrington
[email-masked]
[email-masked]
[email-masked]

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Juergen 
> Schoenwaelder
> Sent: Monday, September 15, 2008 4:08 PM
> To: [email-masked]
> Subject: [nmrg] Re: Netflow/IPFIX workshop: information and 
> request forfeedback
> 
> On Wed, Aug 20, 2008 at 09:12:12AM +0200, Juergen Schoenwaelder
wrote:
> > Hi,
> > 
> > the following Netflow/IPFIX workshop/meeting proposal was 
> sent to the
> > Network Management Research Group (NMRG) mailing list on 
> July 31st.  I
> > like to know whether there is support for such an event 
> form the IPFIX
> > community. Please drop a note if you plan to contribute so 
> that I can
> > gauge interest.
> 
> During the past few weeks, the program of this workshop has taken
> shape [1]. Next to a keynote by Benoit Claise, there will a number
of
> talks concerning the following subjects:
> 
>   - Flow record query languages.
>   - Using SQL databases for flow processing.
>   - A distributed architecture for IP flow analysis.
>   - Open issues of hierarchical flow aggregation.
>   - Labeling flow traces for intrusion detection evaluation.
>   - Network anomaly characterization using flows.
>   - Application level dependency discovery with flows.
>   - Management of light paths in optical networks using flows.
> 
> There seems to be good potential for interaction with people active
in
> IPFIX and some of the research community. I have received some
> supportive statements for making this an NMRG event and no negative
> comments.
> 
> So I propose to make this an NMRG workshop (the 25th). If you 
> disagree,
> please let me/us know by September 25th.
> 
> /js
> 
> [1] http://www.simpleweb.org/netflow/
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
> Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
> -- 
> !! This message is brought to you via the `nmrg' mailing list.
> !! Please do not reply to this message to unsubscribe. To 
> unsubscribe or adjust
> !! your settings, send a mail message to 
> <[email-masked]>
> !! or look at https://mail.ibr.cs.tu-bs.de/mailman/listinfo/nmrg.
> 

Date: Mon, 15 Sep 2008 22:08:19 +0200
From: Juergen Schoenwaelder <[email-masked]>
To: [email-masked]
Mail-Followup-To: [email-masked], Ramin Sadre <[email-masked]>
Subject: [nmrg] Re: Netflow/IPFIX workshop: information and request for feedback
Reply-To: [email-masked]

On Wed, Aug 20, 2008 at 09:12:12AM +0200, Juergen Schoenwaelder wrote:
> Hi,
> 
> the following Netflow/IPFIX workshop/meeting proposal was sent to the
> Network Management Research Group (NMRG) mailing list on July 31st.  I
> like to know whether there is support for such an event form the IPFIX
> community. Please drop a note if you plan to contribute so that I can
> gauge interest.

During the past few weeks, the program of this workshop has taken
shape [1]. Next to a keynote by Benoit Claise, there will a number of
talks concerning the following subjects:

  - Flow record query languages.
  - Using SQL databases for flow processing.
  - A distributed architecture for IP flow analysis.
  - Open issues of hierarchical flow aggregation.
  - Labeling flow traces for intrusion detection evaluation.
  - Network anomaly characterization using flows.
  - Application level dependency discovery with flows.
  - Management of light paths in optical networks using flows.

There seems to be good potential for interaction with people active in
IPFIX and some of the research community. I have received some
supportive statements for making this an NMRG event and no negative
comments.

So I propose to make this an NMRG workshop (the 25th). If you disagree,
please let me/us know by September 25th.

/js

[1] http://www.simpleweb.org/netflow/

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

From: "Bert Wijnen \(IETF\)" <[email-masked]>
To: "NMRG" <[email-masked]>
Date: Tue, 2 Sep 2008 22:31:03 +0200
Organization: Consultant
Subject: [nmrg] Fw: Informational RFC to be: draft-irtf-nmrg-snmp-measure-05.txt 

FYI

Bert Wijnen
document shepherd

----- Original Message ----- 
From: "The IESG" <[email-masked]>
To: "RFC Editor" <[email-masked]>
Cc: <[email-masked]>; "The IESG" <[email-masked]>; <[email-masked]>
Sent: Tuesday, September 02, 2008 8:22 PM
Subject: Re: Informational RFC to be: draft-irtf-nmrg-snmp-measure-05.txt

> The IESG has no problem with the publication of 'SNMP Traffic
> Measurements and Trace Exchange Formats'
> <draft-irtf-nmrg-snmp-measure-05.txt> as an Informational RFC.
>
> The IESG would also like the RFC-Editor to review the comments in the
> datatracker
> (https://datatracker.ietf.org/public/pidtracker.cgi?command=view_id&dTag=14654&rfc_flag=0)
> related to this document and determine whether or not they merit
> incorporation into the document. Comments may exist in both the ballot
> and the comment log.
>
> The IESG contact person is Dan Romascanu.
>
> A URL of this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-irtf-nmrg-snmp-measure-05.txt
>
>
> The process for such documents is described at 
> http://www.rfc-editor.org/indsubs.html.
>
> Thank you,
>
> The IESG Secretary
>
> Technical Summary
>
>   The Simple Network Management Protocol (SNMP) is widely deployed to
>   monitor, control and (sometimes also) configure network elements.
>   Even though the SNMP technology is well documented, it remains
>   relatively unclear how SNMP is used in practice and what typical SNMP
>   usage patterns are.
>
>   This document proposes to carry out large scale SNMP traffic
>   measurements in order to develop a better understanding how SNMP is
>   used in real world production networks.  It describes the motivation,
>   the measurement approach, and the tools and data formats needed to
>   carry out such a study.
>
>
> Working Group Summary
>
>   This document was produced within the IRTF's Network Management
>   Research Group (NMRG) and represents the consensus of all of the
>   active contributors to this group.
>
> Document Quality
>
>   SNMP is quite widely deployed. Measurements on SNMP traffic are being
>   performed by various tools and different organizations.
>
> Personnel
>
>   Bert Wijnen shephereded the document in the NMRG. Dan Romascanu is
>   the shepherding AD.
>
> IESG Note
>
> The IESG thinks that this work is related to IETF work done in the
> Operations and Management Area related to SNMP, but this does not prevent
> publishing. This RFC is not a candidate for any level of Internet
> Standard.
>
> The IETF disclaims any knowledge of the fitness of this RFC for
> any purpose and notes that the decision to publish is not based on
> IETF review apart from the IETF Last Call on the allocation of an URI by
> IANA and the IESG review for conflict with IETF work.
> The RFC Editor has chosen to publish this document at its
> discretion.  See RFC 3932 for more information.
>
> _______________________________________________
> IETF-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-announce
>
> 

Content-class: urn:content-classes:message
Date: Mon, 1 Sep 2008 16:20:59 +0200
From: "Romascanu, Dan (Dan)" <[email-masked]>
To: <[email-masked]>
Subject: [nmrg] approval of  draft-irtf-nmrg-snmp-measure

The IESG discussed in the 8/28 telechat the nmrg I-D
draft-irtf-nmrg-snmp-measure and found no problem with its publication
as Informational RFC. 

Dan