Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m8Q8bqJT025302 for ; Fri, 26 Sep 2008 10:37:57 +0200 Received: from localhost (demetrius3.jacobs-university.de [212.201.44.48]) by hermes.jacobs-university.de (Postfix) with ESMTP id 64254C006B; Fri, 26 Sep 2008 10:37:52 +0200 (CEST) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius3.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id RdSVP6ahSpuH; Fri, 26 Sep 2008 10:37:45 +0200 (CEST) Received: from elstar.local (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 66583C006A; Fri, 26 Sep 2008 10:37:45 +0200 (CEST) Received: by elstar.local (Postfix, from userid 501) id 37B9E7B9CEB; Fri, 26 Sep 2008 10:37:45 +0200 (CEST) Date: Fri, 26 Sep 2008 10:37:45 +0200 From: Juergen Schoenwaelder To: nmrg@ibr.cs.tu-bs.de, Ramin Sadre Subject: Re: [nmrg] Re: Netflow/IPFIX workshop: information and request for feedback Message-ID: <20080926083745.GA27802@elstar.local> Mail-Followup-To: nmrg@ibr.cs.tu-bs.de, Ramin Sadre References: <20080820071212.GC17541@elstar.local> <20080915200819.GA7564@elstar.local> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20080915200819.GA7564@elstar.local> User-Agent: Mutt/1.5.18 (2008-05-17) X-IBRFilter-SpamReport: -2.599 () BAYES_00 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Sep 2008 08:38:02 -0000 On Mon, Sep 15, 2008 at 10:08:19PM +0200, Juergen Schoenwaelder wrote: > During the past few weeks, the program of this workshop has taken > shape [1]. Next to a keynote by Benoit Claise, there will a number of > talks concerning the following subjects: > > - Flow record query languages. > - Using SQL databases for flow processing. > - A distributed architecture for IP flow analysis. > - Open issues of hierarchical flow aggregation. > - Labeling flow traces for intrusion detection evaluation. > - Network anomaly characterization using flows. > - Application level dependency discovery with flows. > - Management of light paths in optical networks using flows. > > There seems to be good potential for interaction with people active in > IPFIX and some of the research community. I have received some > supportive statements for making this an NMRG event and no negative > comments. > > So I propose to make this an NMRG workshop (the 25th). If you disagree, > please let me/us know by September 25th. Since I have not received any objections, we will make this event and NMRG workshop. The current workshop plan is still here: http://www.simpleweb.org/netflow/ /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m8HKxV5s011689 for ; Wed, 17 Sep 2008 22:59:36 +0200 Received: from localhost (demetrius3.jacobs-university.de [212.201.44.48]) by hermes.jacobs-university.de (Postfix) with ESMTP id 27AD2C004C; Wed, 17 Sep 2008 22:59:31 +0200 (CEST) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius3.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id fHPd7W9en-uI; Wed, 17 Sep 2008 22:59:24 +0200 (CEST) Received: from elstar.local (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 9C76EC0019; Wed, 17 Sep 2008 22:59:24 +0200 (CEST) Received: by elstar.local (Postfix, from userid 501) id 9C10F6D1206; Wed, 17 Sep 2008 22:59:23 +0200 (CEST) Date: Wed, 17 Sep 2008 22:59:23 +0200 From: Juergen Schoenwaelder To: Benoit Claise Subject: Re: [nmrg] draft-irtf-nmrg-snmp-measure-06.txt: your conclusions? Message-ID: <20080917205923.GA4615@elstar.local> Mail-Followup-To: Benoit Claise , nmrg@ibr.cs.tu-bs.de References: <48D15992.80201@cisco.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <48D15992.80201@cisco.com> User-Agent: Mutt/1.5.18 (2008-05-17) X-IBRFilter-SpamReport: -2.599 () BAYES_00 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 Cc: nmrg@ibr.cs.tu-bs.de X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Sep 2008 20:59:38 -0000 On Wed, Sep 17, 2008 at 12:25:06PM -0700, Benoit Claise wrote: > I understand that this future RFC covers an approach to carrying out > large scale SNMP traffic measurements, and not what you observed. > However, have you published your observations somewhere? > I'm specifically interested in > > 3.2. Periodic vs. Aperiodic Traffic . . . . . . . . . . . . . . 9 > 3.5. Table Retrieval Approaches . . . . . . . . . . . . . . . . 10 > 3.6. Trap-Directed Polling - Myths or Reality? . . . . . . . . 10 > 3.7. Popular MIB Definitions . . . . . . . . . . . . . . . . . 10 Gijs van den Broek, a student at the University of Twente, has been working on 3.2 [1] and as far as I know he is working on a paper writeup. We at Jacobs have been working on 3.5 and when we talked to the people from Twente, we found out that we need common definitions for our conversation to be effective since we did similar things but slightly different and under different terms. So we joined forces to get common definitions in place and work on 3.5 somewhat stalled. The definitions are meanwhile somewhat stable [2] and we are now working on updating our implementations to use them and then hopefully we can continue on 3.5. I am not sure much work has been done on 3.6 yet. Some early results concerning 3.7 can be found in [3]. We now have some additional traces but still like to get more and perhaps some of the analysis reported in [3] needs to be redone on a larger data set. For [2], there was a working Internet-Draft which Gijs presented at the NMRG meeting next to the Philadelphia IETF. We turned the draft into the conference paper [2] in order to get quickly a citable document in place. /js [1] J.G. van den Broek: Periodicity of SNMP Traffic, BSc Thesis, University of Twente, August 2007. [2] J.G. van den Broek, J. Sch"onw"alder, A. Pras, M. Harvan: SNMP Trace Analysis Definitions, Proc. 2nd International Conference on Autonomous Infrastructure, Management and Security (AIMS 2008)", LNCS 5127, July 2008. [3] J. Sch"onw"alder, A. Pras, M. Harvan, J. Schippers, R. van de Meent: SNMP Traffic Analysis: Approaches, Tools, and First Results, Proc. 10th IFIP/IEEE International Symposium on Integrated Network Management (IM 2007), May 2007. -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 Received: from av-tac-bru.cisco.com (odd-brew.cisco.com [144.254.15.119]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m8HJPInt024874 for ; Wed, 17 Sep 2008 21:25:23 +0200 X-TACSUNS: Virus Scanned Received: from strange-brew.cisco.com (localhost [127.0.0.1]) by av-tac-bru.cisco.com (8.11.7p3+Sun/8.11.7) with ESMTP id m8HJPCC23835; Wed, 17 Sep 2008 21:25:12 +0200 (CEST) Received: from [128.107.115.134] ([128.107.115.134]) by strange-brew.cisco.com (8.11.7p3+Sun/8.11.7) with ESMTP id m8HJP6A11674; Wed, 17 Sep 2008 21:25:07 +0200 (CEST) Message-ID: <48D15992.80201@cisco.com> Date: Wed, 17 Sep 2008 12:25:06 -0700 From: Benoit Claise User-Agent: Thunderbird 2.0.0.16 (Windows/20080708) MIME-Version: 1.0 To: Juergen Schoenwaelder Content-Type: text/plain; charset=iso-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-IBRFilter-SpamReport: 0.001 () BAYES_50 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 Cc: nmrg@ibr.cs.tu-bs.de Subject: [nmrg] draft-irtf-nmrg-snmp-measure-06.txt: your conclusions? X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Sep 2008 19:25:28 -0000 Juergen, I understand that this future RFC covers an approach to carrying out large scale SNMP traffic measurements, and not what you observed. However, have you published your observations somewhere? I'm specifically interested in 3.2. Periodic vs. Aperiodic Traffic . . . . . . . . . . . . . . 9 3.5. Table Retrieval Approaches . . . . . . . . . . . . . . . . 10 3.6. Trap-Directed Polling - Myths or Reality? . . . . . . . . 10 3.7. Popular MIB Definitions . . . . . . . . . . . . . . . . . 10 Regards, Benoit. Received: from relay.versatel.net (relay.versatel.net [62.250.3.110]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with SMTP id m8HGriFo022401 for ; Wed, 17 Sep 2008 18:53:49 +0200 Received: (qmail 4752 invoked from network); 17 Sep 2008 16:53:43 -0000 Received: from unknown (HELO BertLaptop) (87.215.199.34) by relay.versatel.net with SMTP; 17 Sep 2008 16:53:43 -0000 Message-ID: <235E1B94BC2441CBA02626F4343AA537@BertLaptop> From: "Bert Wijnen \(IETF\)" To: "NMRG" Date: Wed, 17 Sep 2008 18:53:32 +0200 Organization: Consultant MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6001.18000 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049 X-IBRFilter-SpamReport: 0.001 () BAYES_50 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 Subject: [nmrg] draft-irtf-nmrg-snmp-measure-06.txt X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Sep 2008 16:53:53 -0000 NMRG, FYI.... The IESG has approved the document (as I reported a little while ago), but there were some comments that we wanted to address. So Juergen has posted a revision 6 to address those (as opposed to let the RFC-Editor figure out the edits). This is in the RFC-Editor queue, so it is now being processed to become RFC. Just wanted to let you know the status and explain why there is a revision 06 in the I-D repository. Bert Wijnen document shepherd below is the conversations Juergen and I had with the RFC-Editor. ----- Original Message ----- From: "RFC Editor" To: "Bert Wijnen (IETF)" Cc: ; "Romascanu, Dan (Dan)" ; "Aaron Falk" ; "RFC Editor" Sent: Wednesday, September 17, 2008 6:46 PM Subject: Re: [iesg-secretary@ietf.org: Re: Informational RFC to be: draft-irtf-nmrg-snmp-measure-05.txt] > Hi Bert, > > Thanks for the update. We'll retrieve version -06 and continue > processing. > > Sandy > > > On Wed, Sep 17, 2008 at 12:50:35PM +0200, Bert Wijnen (IETF) wrote: >> Hi, >> >> Juergen has in the meanwhile posted a revision 06 of the >> document (inlcuing .xml source). There we a few minor edits to addres >> the IESG comments. Some comments also did not require an update. >> >> Below is Juergens check with me on his changes. I have indeed checked >> this and I confirm that the changes made are appropriate and correct. >> The comments that did not warrant changes have been responded to >> and explained to the IESG members who made the comment. >> >> I have informed and explained to Tim polk why his comments did not >> warrant an update (as Juergen also explains below). >> >> I think revision 6 (draft-irtf-nmrg-snmp-measure-06.txt) is now ready for >> publication. Thank you all. >> >> Bert Wijnen >> Document shepherd >> >> ----- Original Message ----- >> From: "Juergen Schoenwaelder" >> To: "Bert Wijnen (IETF)" >> Sent: Wednesday, September 17, 2008 8:12 AM >> Subject: Re: [iesg-secretary@ietf.org: Re: Informational RFC to >> be:draft-irtf-nmrg-snmp-measure-05.txt] >> >> On Thu, Sep 11, 2008 at 08:57:14PM +0200, Bert Wijnen (IETF) wrote: >> >> >Juergen, were you going to make the changes or are we just assuming >> >the RFC-Editor will do so based on the input from IESG comments? >> >Probably it is better if you make the edits? >> >> I have posted and here is a >> short summary of the resolution of the IESG comments. >> >> - Pasi Eronen's comments have been addressed as explained in an >> email to Pasi. >> >> - I did respond to Jari Arkko's comment in an email and I do not think a >> further >> clarification is needed. >> >> - Chris Newman asked how versioning of the XML format is handled. The >> XML namespace includes a version number. In case the SNMP protocol >> is extended and changes to the XML representation are needed, a new >> updated schema and a new XML namespace is needed. Additional text >> has been added just before the RelaxNG schema definition. Clarifying >> text has been added as described in the email to Chris. >> >> - Tim Polk's comment (A) concerns the different citation styles >> xml2rfc uses for normal references and references to URI. As far a I >> can tell, the references are consistent. Comment (B) concerns >> filtering, anonymization, encryption recommendations and I believe >> the text got this right as there is a difference between raw traces >> that likely are stored (if at all) by the network operator and >> converted/filtered/anonymized traces that might be given to other >> parties for analysis. >> >> Please check and inform the RFC editor if everything is fine. >> >> /js >> >> >> ----- Original Message ----- >> From: "RFC Editor" >> To: ; >> >> Cc: "RFC Editor" >> Sent: Thursday, September 11, 2008 7:55 PM >> Subject: Re: [iesg-secretary@ietf.org: Re: Informational RFC to be: >> draft-irtf-nmrg-snmp-measure-05.txt] >> >> >> >FYI: Resending with Bert's corrected address... >> > >> >On Thu, Sep 11, 2008 at 10:19:14AM -0700, RFC Editor wrote: >> >>Hi Juergen and Bert, >> >> >> >>The IESG provided us with the "no problem with publication" message >> >>below for . However, they >> >>have provided comments for review in the I-D tracker. Can you >> >>please review and address the comments (as necessary) and let us know >> >>when/if a revised version has been posted as an ID. >> >> >> >>Bert, please note that as document shepherd, we will wait to hear from >> >>you that the comments have been addressed, or provide us with a >> >>statement that the comments do not need to be addressed. >> >> >> >>Thanks! >> >> >> >>Sandy >> >> >> >> >> >>----- Forwarded message from The IESG ----- >> >> >> >>From: The IESG >> >>To: RFC Editor >> >>Cc: The IESG , , ietf-announce@ietf.org >> >>Date: Tue, 2 Sep 2008 11:22:08 -0700 (PDT) >> >>Subject: Re: Informational RFC to be: >> >>draft-irtf-nmrg-snmp-measure-05.txt >> >> >> >>The IESG has no problem with the publication of 'SNMP Traffic >> >>Measurements and Trace Exchange Formats' >> >> as an Informational RFC. >> >> >> >>The IESG would also like the RFC-Editor to review the comments in the >> >>datatracker >> >>(https://datatracker.ietf.org/public/pidtracker.cgi?command=view_id&dTag=14654&rfc_flag=0) >> >>related to this document and determine whether or not they merit >> >>incorporation into the document. Comments may exist in both the ballot >> >>and the comment log. >> >> >> >>The IESG contact person is Dan Romascanu. >> >> >> >>A URL of this Internet-Draft is: >> >>http://www.ietf.org/internet-drafts/draft-irtf-nmrg-snmp-measure-05.txt >> >> >> >> >> >>The process for such documents is described at >> >>http://www.rfc-editor.org/indsubs.html. >> >> >> >>Thank you, >> >> >> >>The IESG Secretary >> >> >> >>Technical Summary >> >> >> >> The Simple Network Management Protocol (SNMP) is widely deployed to >> >> monitor, control and (sometimes also) configure network elements. >> >> Even though the SNMP technology is well documented, it remains >> >> relatively unclear how SNMP is used in practice and what typical >> >> SNMP >> >> usage patterns are. >> >> >> >> This document proposes to carry out large scale SNMP traffic >> >> measurements in order to develop a better understanding how SNMP is >> >> used in real world production networks. It describes the >> >> motivation, >> >> the measurement approach, and the tools and data formats needed to >> >> carry out such a study. >> >> >> >> >> >>Working Group Summary >> >> >> >> This document was produced within the IRTF's Network Management >> >> Research Group (NMRG) and represents the consensus of all of the >> >> active contributors to this group. >> >> >> >>Document Quality >> >> >> >> SNMP is quite widely deployed. Measurements on SNMP traffic are >> >> being >> >> performed by various tools and different organizations. >> >> >> >>Personnel >> >> >> >> Bert Wijnen shephereded the document in the NMRG. Dan Romascanu is >> >> the shepherding AD. >> >> >> >>IESG Note >> >> >> >>The IESG thinks that this work is related to IETF work done in the >> >>Operations and Management Area related to SNMP, but this does not >> >>prevent >> >>publishing. This RFC is not a candidate for any level of Internet >> >>Standard. >> >> >> >>The IETF disclaims any knowledge of the fitness of this RFC for >> >>any purpose and notes that the decision to publish is not based on >> >>IETF review apart from the IETF Last Call on the allocation of an URI >> >>by >> >>IANA and the IESG review for conflict with IETF work. >> >>The RFC Editor has chosen to publish this document at its >> >>discretion. See RFC 3932 for more information. >> >> >> >>----- End forwarded message ----- >> > >> > >> > > Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m8GH3m26013332 for ; Tue, 16 Sep 2008 19:03:53 +0200 Received: from localhost (demetrius2.jacobs-university.de [212.201.44.47]) by hermes.jacobs-university.de (Postfix) with ESMTP id 5BED2C001D; Tue, 16 Sep 2008 19:03:48 +0200 (CEST) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius2.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id fO+GHSLZTmEm; Tue, 16 Sep 2008 19:03:41 +0200 (CEST) Received: from elstar.iuhb02.iu-bremen.de (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id E095EC0019; Tue, 16 Sep 2008 19:03:41 +0200 (CEST) Received: by elstar.iuhb02.iu-bremen.de (Postfix, from userid 501) id ADB986CF404; Tue, 16 Sep 2008 19:03:40 +0200 (CEST) Date: Tue, 16 Sep 2008 19:03:40 +0200 From: Juergen Schoenwaelder To: David B Harrington Subject: Re: [nmrg] Re: Netflow/IPFIX workshop: information and request forfeedback Message-ID: <20080916170340.GA1886@elstar.iuhb02.iu-bremen.de> Mail-Followup-To: David B Harrington , nmrg@ibr.cs.tu-bs.de References: <20080820071212.GC17541@elstar.local> <20080915200819.GA7564@elstar.local> <04b001c9181a$0e2a2870$0600a8c0@china.huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <04b001c9181a$0e2a2870$0600a8c0@china.huawei.com> User-Agent: Mutt/1.5.18 (2008-05-17) X-IBRFilter-SpamReport: -2.599 () BAYES_00 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 Cc: nmrg@ibr.cs.tu-bs.de X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Sep 2008 17:03:55 -0000 On Tue, Sep 16, 2008 at 12:34:13PM -0400, David B Harrington wrote: > My workgroup is interested in this topic, but for budget and planning > reasons may not be able to attend the meeting. > > Will you have any audio or jabber support for the meeting? I do not know. Jabber should be relatively easy to do but audio streaming is usually much more difficult to organize for meetings of a smaller scale where you do not have audio equipment in place. > Will the presentations be made available on a website prior to the > meeting? Hopefully, but no promise; it depends on the discipline of the presenters at the end (like in IETF meetings). > Will the presentations not made available prior to the meeting be > available after the meeting? Yes. NMRG meetings always had presentation material and minutes online after the meeting and this will be no different. /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 Received: from QMTA03.westchester.pa.mail.comcast.net (qmta03.westchester.pa.mail.comcast.net [76.96.62.32]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m8GGYLrS004881 for ; Tue, 16 Sep 2008 18:34:27 +0200 Received: from OMTA07.westchester.pa.mail.comcast.net ([76.96.62.59]) by QMTA03.westchester.pa.mail.comcast.net with comcast id FRKd1a01N1GhbT853UaG9k; Tue, 16 Sep 2008 16:34:16 +0000 Received: from Harrington73653 ([24.128.66.199]) by OMTA07.westchester.pa.mail.comcast.net with comcast id FUaD1a00W4HwxpC3TUaD4s; Tue, 16 Sep 2008 16:34:14 +0000 X-Authority-Analysis: v=1.0 c=1 a=X4OghBnVmIUA:10 a=IgPSJgSV_dcA:10 a=c8CjfOg0AAAA:8 a=j3Z76cjpAAAA:8 a=Jiz0tsSxAAAA:8 a=1GMS524Q7S0jMs0q2XAA:9 a=pxOQtK7-c4wjEMA5SRAA:7 a=8w14K-thIx4HPDQ-vgnWXNaegeoA:4 a=si9q_4b84H0A:10 a=hPjdaMEvmhQA:10 a=50e4U0PicR4A:10 From: "David B Harrington" To: , References: <20080820071212.GC17541@elstar.local> <20080915200819.GA7564@elstar.local> Subject: RE: [nmrg] Re: Netflow/IPFIX workshop: information and request forfeedback Date: Tue, 16 Sep 2008 12:34:13 -0400 Message-ID: <04b001c9181a$0e2a2870$0600a8c0@china.huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 11 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 In-Reply-To: <20080915200819.GA7564@elstar.local> Thread-Index: AckXbuyYSmEvFwUqTrG/MfiNEZefLAAqow7A X-IBRFilter-SpamReport: 1.65 (*) BAYES_20,DNS_FROM_RFC_POST,RCVD_IN_SORBS_DUL X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Sep 2008 16:34:33 -0000 Hi, My workgroup is interested in this topic, but for budget and planning reasons may not be able to attend the meeting. Will you have any audio or jabber support for the meeting? Will the presentations be made available on a website prior to the meeting? Will the presentations not made available prior to the meeting be available after the meeting? Thanks, David Harrington dbharrington@comcast.net ietfdbh@comcast.net dharrington@huawei.com > -----Original Message----- > From: nmrg-bounces@ibr.cs.tu-bs.de > [mailto:nmrg-bounces@ibr.cs.tu-bs.de] On Behalf Of Juergen > Schoenwaelder > Sent: Monday, September 15, 2008 4:08 PM > To: nmrg@ibr.cs.tu-bs.de > Subject: [nmrg] Re: Netflow/IPFIX workshop: information and > request forfeedback > > On Wed, Aug 20, 2008 at 09:12:12AM +0200, Juergen Schoenwaelder wrote: > > Hi, > > > > the following Netflow/IPFIX workshop/meeting proposal was > sent to the > > Network Management Research Group (NMRG) mailing list on > July 31st. I > > like to know whether there is support for such an event > form the IPFIX > > community. Please drop a note if you plan to contribute so > that I can > > gauge interest. > > During the past few weeks, the program of this workshop has taken > shape [1]. Next to a keynote by Benoit Claise, there will a number of > talks concerning the following subjects: > > - Flow record query languages. > - Using SQL databases for flow processing. > - A distributed architecture for IP flow analysis. > - Open issues of hierarchical flow aggregation. > - Labeling flow traces for intrusion detection evaluation. > - Network anomaly characterization using flows. > - Application level dependency discovery with flows. > - Management of light paths in optical networks using flows. > > There seems to be good potential for interaction with people active in > IPFIX and some of the research community. I have received some > supportive statements for making this an NMRG event and no negative > comments. > > So I propose to make this an NMRG workshop (the 25th). If you > disagree, > please let me/us know by September 25th. > > /js > > [1] http://www.simpleweb.org/netflow/ > > -- > Juergen Schoenwaelder Jacobs University Bremen gGmbH > Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany > Fax: +49 421 200 3103 > -- > !! This message is brought to you via the `nmrg' mailing list. > !! Please do not reply to this message to unsubscribe. To > unsubscribe or adjust > !! your settings, send a mail message to > > !! or look at https://mail.ibr.cs.tu-bs.de/mailman/listinfo/nmrg. > Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m8FK8Q9I011899 for ; Mon, 15 Sep 2008 22:08:31 +0200 Received: from localhost (demetrius1.jacobs-university.de [212.201.44.46]) by hermes.jacobs-university.de (Postfix) with ESMTP id A6FBEC002C; Mon, 15 Sep 2008 22:08:26 +0200 (CEST) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius1.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id RLXbSWJUTggv; Mon, 15 Sep 2008 22:08:20 +0200 (CEST) Received: from elstar.local (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 3F508C0027; Mon, 15 Sep 2008 22:08:20 +0200 (CEST) Received: by elstar.local (Postfix, from userid 501) id F33686CADB4; Mon, 15 Sep 2008 22:08:19 +0200 (CEST) Date: Mon, 15 Sep 2008 22:08:19 +0200 From: Juergen Schoenwaelder To: nmrg@ibr.cs.tu-bs.de Message-ID: <20080915200819.GA7564@elstar.local> Mail-Followup-To: nmrg@ibr.cs.tu-bs.de, Ramin Sadre References: <20080820071212.GC17541@elstar.local> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20080820071212.GC17541@elstar.local> User-Agent: Mutt/1.5.18 (2008-05-17) X-IBRFilter-SpamReport: -2.599 () BAYES_00 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 Subject: [nmrg] Re: Netflow/IPFIX workshop: information and request for feedback X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Sep 2008 20:08:39 -0000 On Wed, Aug 20, 2008 at 09:12:12AM +0200, Juergen Schoenwaelder wrote: > Hi, > > the following Netflow/IPFIX workshop/meeting proposal was sent to the > Network Management Research Group (NMRG) mailing list on July 31st. I > like to know whether there is support for such an event form the IPFIX > community. Please drop a note if you plan to contribute so that I can > gauge interest. During the past few weeks, the program of this workshop has taken shape [1]. Next to a keynote by Benoit Claise, there will a number of talks concerning the following subjects: - Flow record query languages. - Using SQL databases for flow processing. - A distributed architecture for IP flow analysis. - Open issues of hierarchical flow aggregation. - Labeling flow traces for intrusion detection evaluation. - Network anomaly characterization using flows. - Application level dependency discovery with flows. - Management of light paths in optical networks using flows. There seems to be good potential for interaction with people active in IPFIX and some of the research community. I have received some supportive statements for making this an NMRG event and no negative comments. So I propose to make this an NMRG workshop (the 25th). If you disagree, please let me/us know by September 25th. /js [1] http://www.simpleweb.org/netflow/ -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 Received: from relay.versatel.net (relay.versatel.net [62.250.3.110]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with SMTP id m82KVjGh027707 for ; Tue, 2 Sep 2008 22:31:51 +0200 Received: (qmail 25176 invoked from network); 2 Sep 2008 20:31:45 -0000 Received: from unknown (HELO BertLaptop) (87.215.199.34) by relay.versatel.net with SMTP; 2 Sep 2008 20:31:45 -0000 Message-ID: From: "Bert Wijnen \(IETF\)" To: "NMRG" Date: Tue, 2 Sep 2008 22:31:03 +0200 Organization: Consultant MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6001.18000 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049 X-IBRFilter-SpamReport: 0.001 () BAYES_50 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 Subject: [nmrg] Fw: Informational RFC to be: draft-irtf-nmrg-snmp-measure-05.txt X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Sep 2008 20:31:55 -0000 FYI Bert Wijnen document shepherd ----- Original Message ----- From: "The IESG" To: "RFC Editor" Cc: ; "The IESG" ; Sent: Tuesday, September 02, 2008 8:22 PM Subject: Re: Informational RFC to be: draft-irtf-nmrg-snmp-measure-05.txt > The IESG has no problem with the publication of 'SNMP Traffic > Measurements and Trace Exchange Formats' > as an Informational RFC. > > The IESG would also like the RFC-Editor to review the comments in the > datatracker > (https://datatracker.ietf.org/public/pidtracker.cgi?command=view_id&dTag=14654&rfc_flag=0) > related to this document and determine whether or not they merit > incorporation into the document. Comments may exist in both the ballot > and the comment log. > > The IESG contact person is Dan Romascanu. > > A URL of this Internet-Draft is: > http://www.ietf.org/internet-drafts/draft-irtf-nmrg-snmp-measure-05.txt > > > The process for such documents is described at > http://www.rfc-editor.org/indsubs.html. > > Thank you, > > The IESG Secretary > > Technical Summary > > The Simple Network Management Protocol (SNMP) is widely deployed to > monitor, control and (sometimes also) configure network elements. > Even though the SNMP technology is well documented, it remains > relatively unclear how SNMP is used in practice and what typical SNMP > usage patterns are. > > This document proposes to carry out large scale SNMP traffic > measurements in order to develop a better understanding how SNMP is > used in real world production networks. It describes the motivation, > the measurement approach, and the tools and data formats needed to > carry out such a study. > > > Working Group Summary > > This document was produced within the IRTF's Network Management > Research Group (NMRG) and represents the consensus of all of the > active contributors to this group. > > Document Quality > > SNMP is quite widely deployed. Measurements on SNMP traffic are being > performed by various tools and different organizations. > > Personnel > > Bert Wijnen shephereded the document in the NMRG. Dan Romascanu is > the shepherding AD. > > IESG Note > > The IESG thinks that this work is related to IETF work done in the > Operations and Management Area related to SNMP, but this does not prevent > publishing. This RFC is not a candidate for any level of Internet > Standard. > > The IETF disclaims any knowledge of the fitness of this RFC for > any purpose and notes that the decision to publish is not based on > IETF review apart from the IETF Last Call on the allocation of an URI by > IANA and the IESG review for conflict with IETF work. > The RFC Editor has chosen to publish this document at its > discretion. See RFC 3932 for more information. > > _______________________________________________ > IETF-Announce mailing list > IETF-Announce@ietf.org > https://www.ietf.org/mailman/listinfo/ietf-announce > > Received: from de307622-de-outbound.net.avaya.com (de307622-de-outbound.net.avaya.com [198.152.71.100]) by bierator.ibr.cs.tu-bs.de (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id m81EL2Kt024105 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for ; Mon, 1 Sep 2008 16:21:07 +0200 X-IronPort-AV: E=Sophos;i="4.32,307,1217822400"; d="scan'208";a="120207249" Received: from unknown (HELO nj300815-nj-erheast.avaya.com) ([198.152.6.5]) by de307622-de-outbound.net.avaya.com with ESMTP; 01 Sep 2008 10:20:56 -0400 X-IronPort-AV: E=Sophos;i="4.32,307,1217822400"; d="scan'208";a="263697746" Received: from unknown (HELO 307622ANEX5.global.avaya.com) ([135.64.140.13]) by nj300815-nj-erheast-out.avaya.com with ESMTP; 01 Sep 2008 10:20:56 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Mon, 1 Sep 2008 16:20:59 +0200 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: approval of draft-irtf-nmrg-snmp-measure Thread-Index: AckMPfSMGFTnNMWVRiWQNGtX3NcR3A== From: "Romascanu, Dan (Dan)" To: X-IBRFilter-SpamReport: 0.001 () BAYES_50 X-Scanned-By: MIMEDefang 2.51 on 134.169.34.9 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by bierator.ibr.cs.tu-bs.de id m81EL2Kt024105 Subject: [nmrg] approval of draft-irtf-nmrg-snmp-measure X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.5 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Sep 2008 14:21:10 -0000 The IESG discussed in the 8/28 telechat the nmrg I-D draft-irtf-nmrg-snmp-measure and found no problem with its publication as Informational RFC. Dan