draft-ietf-psamp-protocol-01.txt   draft-ietf-psamp-protocol-02.txt 
PSAMP working group PSAMP working group
Internet Draft EDITOR: B. Claise Internet Draft EDITOR: B. Claise
draft-ietf-psamp-protocol-01.txt Cisco Systems draft-ietf-psamp-protocol-02.txt Cisco Systems
Expires: August 2004 February 2004 Expires: April 2006 October 2005
Packet Sampling (PSAMP) Protocol Specifications Packet Sampling (PSAMP) Protocol Specifications
Status of this Memo Status of this Memo
By submitting this Internet-Draft, each author represents that any
This document is an Internet-Draft and is in full conformance with applicable patent or other IPR claims of which he or she is aware
all provisions of Section 10 of RFC2026. have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet- other groups may also distribute working documents as Internet-
Drafts. Internet-Drafts are draft documents valid for a maximum of Drafts.
six months and may be updated, replaced, or obsolete by other
documents at any time. It is inappropriate to use Internet-Drafts as Internet-Drafts are draft documents valid for a maximum of six
reference material or to cite them other than as "work in progress." months and may be updated, replaced, or obsoleted by other documents
at any time. It is inappropriate to use Internet-Drafts as
reference material or to cite them other than as "work in progress".
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html. http://www.ietf.org/shadow.html
This Internet-Draft will expire on April 23, 2006.
Copyright Notice
Copyright (C) The Internet Society (2005).
Abstract Abstract
This document specifies the export of packet information from a This document specifies the export of packet information from a
PSAMP Exporting Process to a PSAMP Colleting Process. For export of PSAMP Exporting Process to a PSAMP Colleting Process. For export of
packet information the IP Flow Information eXport (IPFIX) protocol packet information the IP Flow Information eXport (IPFIX) protocol
is used. The IPFIX protocol is well suited for this purpose, because is used, as both the IPFIX and PSAMP architecture match very well
the IPFIX architecture matches the PSAMP architecture very well and and the means provided by the IPFIX protocol are sufficient. The
the means provided by the IPFIX protocol are sufficient. The
document specifies in detail how the IPFIX protocol is used for document specifies in detail how the IPFIX protocol is used for
PSAMP export of packet information. PSAMP export of packet information.
Conventions used in this document Conventions used in this document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119. document are to be interpreted as described in RFC 2119.
Table of Contents Table of Contents
1. Points of Discussion........................................3
1. Open Issues..................................................2 1.1 Open Issues................................................3
1.1 Open Issues................................................2 1.2 Action Items...............................................4
1.2 Action Items...............................................3 2. Introduction................................................5
2. Introduction.................................................3 3. PSAMP Documents Overview....................................5
3. Terminology..................................................4 4. Terminology.................................................6
4. Differences between PSAMP and IPFIX..........................4 4.1 IPFIX Terminology..........................................6
4.1 Architecture Point of View.................................4 4.2 PSAMP Terminology.........................................10
4.2 Protocol Point of View.....................................6 4.2.1 Observation Points, Packet Streams and Packet Content11
4.3 Information Model Point of View............................6 4.2.2 Selection Process....................................11
5. Using IPFIX for PSAMP........................................7 4.2.3 Reporting Process....................................13
5.1 High Level View of the Integration.........................7 4.2.4 Measurement Process..................................13
5.2 Partial or Entire IPFIX Protocol Specifications Support....7 4.2.5 Exporting Process....................................14
6. PSAMP Requirements versus the IPFIX Solution.................8 4.2.6 PSAMP Device.........................................14
6.1 IPFIX Solution for the PSAMP Requirements..................8 4.2.7 Selection Methods....................................14
7. Low Level View of the Integration...........................11 4.3 IPFIX and PSMAP Terminology Comparison....................16
7.1 Sampling Case, PSAMP Base Level of Functionality..........11 4.3.1 PSAMP and IPFIX Processes............................16
7.1.1 Example..............................................11 4.3.2 Packet Report, Packet Interpretation, and Data Record17
7.2 Sampling Case.............................................12 5. Differences between PSAMP and IPFIX........................17
7.2.1 Example..............................................13 5.1 Architecture Point of View................................17
7.3 Filtering Case............................................13 5.2 Protocol Point of View....................................19
7.3.1 Example..............................................13 5.3 Information Model Point of View...........................19
8. Security Considerations.....................................13 6. PSAMP Requirements versus the IPFIX Solution...............20
9. IANA Considerations.........................................13 6.1 IPFIX Solution for the PSAMP Requirements.................20
10. References.................................................13 6.2 High Level View of the Integration........................22
10.1 Normative References.....................................13 7. Using the IPFIX Protocol for PSAMP.........................23
10.2 Informative References...................................14 7.1 Selector ID...............................................23
11. Acknowledgments............................................14 7.2 The Associations..........................................23
7.3 Packet Reports............................................23
7.3.1 Basic Packet Reports.................................23
7.3.2 Extended Packet Reports..............................25
7.4 Report Interpretation.....................................26
7.4.1 Associations Report Interpretation...................26
7.4.2 Selector Report Interpretation.......................29
7.4.2.1 Systematic Count-Based Sampling......................29
7.4.2.2 Systematic Time-Based Sampling.......................30
7.4.2.3 Random n-out-of-N Sampling...........................31
7.4.2.4 Uniform Probabilistic Sampling.......................33
7.4.2.5 Non-uniform Probabilistic Sampling...................33
7.4.2.6 Non-uniform Flow State Sampling......................33
7.4.2.7 Match Based Filtering and Router State Filtering.....33
7.4.2.8 Hash Based Filtering.................................35
7.4.3 Associations Statistics Report Interpretation........35
7.4.4 Accuracy Report Interpretation.......................37
7.4.5 Observation Point Report Interpretation..............37
8. Security Considerations....................................37
9. IANA Considerations........................................38
10. References................................................38
10.1 Normative References.....................................38
10.2 Informative References...................................38
11. Acknowledgments...........................................38
1. 1.
Open Issues Points of Discussion
1.1 1.1
Open Issues Open Issues
This section covers the open issues, still to be resolved/updated in This section covers the open issues, still to be resolved/updated in
this draft: this draft:
PROTO-01 Do we want to distinguish an IPFIX Flow Record export with PROTO-01 [PSAMP-FMWK] mentions the optional Export Packets
one packet from a PSAMP export? compression (see section 8.5) Should we mention this in this
PROTO-02 Need to fill in the examples section 7.1.1, 7.1.2 and 7.1.3 document?
PROTO-03 in packet interpretation.
Options Template FlowSet (SELECTOR_ID, SAMPLING_ALGO, SAMPLING PROTO-02 From a protocol point of view, there a no differences
PARAM, TIMESTAMP, OBSERVATION POINT) between the Field Match Filtering and the Router State Filtering as
The packet reports MUST contain: defined in [PSAMP-TECH]. The only difference concerns the I.E. on
- the input sequence number(s), denoted the SEQUENCE-NUMBER in which we do the filtering... part of the packet in one case, not part
[PSAMP-INFO] of the packet in the other case. Proposal: merge the 2 methods in
- some number of contiguous bytes from the start of the [PSAMP-TECH]
packet, denoted the PACKET-SAMPLE in [PSAMP-INFO]
- the destination BGP AS , denoted destinationAS in [IPFIX- PROTO-03 The second open issue is concerned with reporting the
INFO] sequential order of sampling and filtering. => order of the scope.
- the input interface, denoted ingressPort in [IPFIX-INFO] We spot a new problem: we could export twice the hash value. How to
THIS IS NOT A GOOD EXAMPLE distinguish them? How to know that the hash value 1 corresponds to a
PROTO-04 Extend security considerations by a discussion on exported specific definition specified in an Option Template.
payload
PROTO-04 Should probably have a separate section for the examples?
PROTO-05 Transport protocol: SCTP and/or UDP and/or TCP. Nothing is
mentioned at this stage. [PSAMP-FMWK] and PSAMP charter specifically
mention UDP.
PROTO-06 Even if the notion of Associations ID is mentioned in
[PSAMP-TECH], maybe a term such as SelectionPath or PathID would be
more appropriate.
PROTO-07 Even if [PSAMP-TECH] section 7.1 and 7.2 describes that "The
ASSOCIATIONS field describes the Observation Point and optionally the
IPFIX processes to which the packet Selector is associated. Values:
<STREAM ID, IPFIX Metering process ID, IPFIX Exporting process ID,
IDs of other associated processes>", we can't see an example where
the IPFIX process(es) ID would be required. Don't we have enough with
the list of Selector IDs?
PROTO-08 Instead of sending the input sequence number for each
selector ID, a counter64 value, associated with every packet, the
working group should discuss the possibility to send the information
on regular basis with an option template record. Specifically in the
case of Composite Selector, we would send multiple times a 64-bit
counter in each packet.
PROTO-09 "The algorithm specific Information Elements, defining
configuration parameters for match-based and router state filtering,
are taken from the full range of available IPFIX Information Elements
[IPFIX-INFO]". What about the ones from [PSAMP-INFO]? In other words,
are they I.E.s in [PSAMP-INFO] that we could use for the match-based
and router state filtering?
PROTO-10 We probably don't need the section 6.2 named "High Level
view of the integration", as this section was an intermediate step in
an interim version of the draft. To be discussed.
PROTO-11 Discuss how to implement the accuracy report interpretation
PROTO-12 Discuss how to implement the observation point report
interpretation (if we need one)
PROTO-13 The solution in this document is based on the fact that
https://psg.com/lists/psamp/psamp.2005/msg00050.html is taken into
account. That means: no range for the filtering
1.2 1.2
Action Items Action Items
This section covers the action items for this draft PROTO-101 See EDITOR'S NOTE
ACTION-01 For section 6 "PSAMP requirements versus the IPFIX PROTO-102 insert double spaces after the end of each sentence.
solution", check if there are any other requirements in the [PSAMP-
FRAMEWORK]. PROTO-103 Should briefly discuss the fact that PSAMP is OK with IPFIX
ACTION-02 Update the terminology section requirements in terms of time (uSec precision)
ACTION-03 A new section about the terminology comparison between
[PSAMP-PROTO] (hence [IPFIX-PROTO]) and [PSAMP-FRAMEWORK] PROTO-104 Fix the terminology sections, as a last step before
- Flow Data Records sent in Data FlowSet = packet report in publication
[PSAMP-FRAMEWORK] PROTO-105 Section 6 about "PSAMP requirements": check if any changes
- Options Data Record sent in Data FlowSet = packet interpretation with the version 5 of [PSAMP-FMWK]. This draft is based on ietf-
n [PSAMP-FRAMEWORK] psamp-framework-04.txt.
Exporting Process in IPFIX = Reporting Process in [PSAMP-
FRAMEWORK] PROTO-106 Extend security considerations by a discussion on exported
Note1: this is somehow explained in section 5.1 Payload. Consider whether [PSAMP-INFO] or [PSAMP-PROTO] or both
ACTION-04 Should briefly discuss the fact that PSAMP is OK with is/are the place(s).
IPFIX requirements in terms of time (uSec precision)
ACTION-05 Check for the existence of the Information Elements PROTO-107 All the examples in section 7 should contain the
defined here in [PSAMP-INFO] and modify if appropriate. Example: Information Element ID instead of the Information Element name.
Selector ID, packet-sample, sampling-algorithm, hash-value, etc… Example: Option 3 = samp.PacketSpace
For example, the section 7.1 Corrected Example: Option 3 = 305
ACTION-06 In section 6.1 ‘‘An Options Templates MUST be sent on
regular basis.’’ -> make the link with Metering Process Stats
currently discussed in the IPFIX mailing list and in [IPFIX-PROTO]
ACTION-07 Some text explanation the encoding of the new Information
Elements. For example, the ‘‘packet-fragment’’ will use the Variable
Length Data Type as described in [IPFIX-PROTO]
ACTION-08 Section 6 about ‘‘PSAMP requirements’’: check if any changes
with the version 5 of [PSAMP-FRAMEWORK]
2. 2.
Introduction Introduction
The name PSAMP is a contraction of the phrase Packet SAMPling. The
word "sampling" captures the idea that only a subset of all packets
passing a network element will be selected for reporting. PSAMP
selection operations include random selection, deterministic
selection (filtering), and deterministic approximations to random
selection (hash-based selection).
The IP Flow information export (IPFIX) protocol specified in [IPFIX- The IP Flow information export (IPFIX) protocol specified in [IPFIX-
PROTO] and [IPFIX-INFO] exports IP traffic information observed at PROTO] exports IP traffic information [IPFIX-INFO] observed at
network devices. This matches the general protocol requirements network devices. This matches the general protocol requirements
outlined in the Packet SAMPling (PSAMP) framework [PSAMP-FMWK]. outlined in the PSAMP framework [PSAMP-FMWK]. However, there are some
However, there are some architectural differences between IPFIX and architectural differences between IPFIX and PSAMP in the requirements
PSAMP and in the requirements for an export protocol. While in the for an export protocol. While the IPFIX architecture [IPFIX-ARCH] is
IPFIX architecture [IPFIX-ARCH] packet sampling is just one out of focused on gathering and exporting IP traffic flow information, the
many components considered, it is the focus of the PSAMP framework focus of the PSAMP framework [PSAMP-FMWK] is on exporting information
[PSAMP-FMWK]. This basic difference and a set of derived differences on individual packets. This basic difference and a set of derived
in protocol requirements are outlined in Section 4. Despite these differences in protocol requirements are outlined in Section 5.
differences, the IPFIX protocol is well suited as PSAMP protocol. Despite these differences, the IPFIX protocol is well suited as PSAMP
Section 5 specifies how the IPFIX protocol is used for the export of protocol. Section 5 specifies how the IPFIX protocol is used for the
packet samples. Required extensions of the IPFIX information model export of packet samples. Required extensions of the IPFIX
are specified in the PSAMP information model [PSAMP-INFO]. information model are specified in the PSAMP information model
[PSAMP-INFO].
3. 3.
Terminology PSAMP Documents Overview
EDITOR’S NOTE: [PSAMP-FMWK]: "A Framework for Packet Selection and Reporting",
- To be copied in from [PSAMP-FRAMEWORK]. describes the PSAMP framework for network elements to select subsets
- From [IPFIX-PROTO]: of packets by statistical and other methods, and to export a stream
- need Flow Record, Flow, Information Element, Metering Process, of reports on the selected packets to a collector.
Exporting Process, Collector, Scope
- need all terms from the table in section 5.2. That is: [PSAMP-TECH]: "Sampling and Filtering Techniques for IP Packet
FlowSet, Template Record, Data Record, Flow Data Record, Data Selection", describes the set of packet selection techniques
FlowSet, Options Data Record, Template FlowSet, Template supported by PSAMP.
Record(s), Options Template FlowSet, Options Template Record
- need PSAMP device [PSAMP-PROTO]: "Packet Sampling (PSAMP) Protocol Specifications"
- All the terms will have their initial letter in upper case (this document), specifies the export of packet information from a
PSAMP Exporting Process to a PSAMP Colleting Process
[PSAMP-INFO]: "Information Model for Packet Sampling Exports" defines
an information and data model for PSAMP.
[PSAMP-MIB]: "Definitions of Managed Objects for Packet Sampling"
describes the PSAMP Management Information Base
4. 4.
Terminology
As the IPFIX export protocol is used to export the PSAMP information,
the relevant IPFIX terminology from [IPFIX-PROTO] is copied over in
this document. The terminology summary table in section 4.1 gives a
quick overview of the relationships between the different IPFIX
terms. The PSAMP terminology defined here is fully consistent with
all terms listed in [PSAMP-TECH] and [PSAMP-FMWK] but only
definitions that are only relevant to the PSAMP protocol appear here.
The section 5.4 applies the PSAMP terminology to the IPFIX protocol
terminology.
4.1
IPFIX Terminology
EDITOR'S NOTE: The terminology has been entirely copied over from
[IPFIX-PROTO]. Before publication, we should evaluate which terms
should be kept, if not all. The ones required for sure so far are:
Flow Record, Flow, Information Element, Metering Process, Collector,
Scope, Set, Template Record, Data Record, Data Set, Template Set,
Template Record(s), Options Template Set, Options Template Record.
Note: the IPFIX Exporting Process was not used, as the PSAMP
Exporting Process is more specific.
Observation Point
An Observation Point is a location in the network where IP packets
can be observed. Examples include: a line to which a probe is
attached, a shared medium, such as an Ethernet-based LAN, a single
port of a router, or a set of interfaces (physical or logical) of a
router.
Note that every Observation Point is associated with an Observation
Domain (defined below), and that one Observation Point may be a
superset of several other Observation Points. For example one
Observation Point can be an entire line card. That would be the
superset of the individual Observation Points at the line card's
interfaces.
Observation Domain
An Observation Domain is the largest set of Observation Points for
which Flow information can be aggregated by a Metering Process.
Each Observation Domain presents itself using a unique ID to the
Collecting Process to identify the IPFIX Messages it generates. For
example, a router line card may be an observation domain if it is
composed of several interfaces, each of which is an Observation
Point. Every Observation Point is associated with an Observation
Domain.
IP Traffic Flow or Flow
There are several definitions of the term 'flow' being used by the
Internet community. Within the context of IPFIX we use the following
definition:
A Flow is defined as a set of IP packets passing an Observation Point
in the network during a certain time interval. All packets belonging
to a particular Flow have a set of common properties. Each property
is defined as the result of applying a function to the values of:
1. one or more packet header field (e.g. destination IP address),
transport header field (e.g. destination port number), or
application header field (e.g. RTP header fields [RFC1889])
2. one or more characteristics of the packet itself (e.g. number
of MPLS labels, etc...)
3. one or more of fields derived from packet treatment (e.g. next
hop IP address, the output interface, etc...)
A packet is defined to belong to a Flow if it completely satisfies
all the defined properties of the Flow.
This definition covers the range from a Flow containing all packets
observed at a network interface to a Flow consisting of just a single
packet between two applications. It includes packets selected by a
sampling mechanism.
Flow Key
Each of the fields which
1. Belong to the packet header (e.g. destination IP address)
2. Are a property of the packet itself (e.g. packet length)
3. Are derived from packet treatment (e.g. AS number)
and which are used to define a Flow are termed Flow Keys.
Flow Record
A Flow Record contains information about a specific Flow that was
observed at an Observation Point. A Flow Record contains measured
properties of the Flow (e.g. the total number of bytes for all the
Flow's packets) and usually characteristic properties of the Flow
(e.g. source IP address).
Metering Process
The Metering Process generates Flow Records. Inputs to the process
are packet headers and characteristics observed at an Observation
Point, and packet treatment at the Observation Point (for example the
selected output interface).
The Metering Process consists of a set of functions that includes
packet header capturing, timestamping, sampling, classifying, and
maintaining Flow Records.
The maintenance of Flow Records may include creating new records,
updating existing ones, computing Flow statistics, deriving further
Flow properties, detecting Flow expiration, passing Flow Records to
the Exporting Process, and deleting Flow Records.
Exporter
A device which hosts one or more Exporting Processes is termed an
Exporter.
IPFIX Device
An IPFIX Device hosts at least one Observation Point, a Metering
Process and an Exporting Process.
Collecting Process
A Collecting Process receives Flow Records from one or more
Exporting Processes. The Collecting Process might process or store
received Flow Records, but such actions are out of scope for this
document.
Collector
A device which hosts one or more Collecting Processes is termed a
Collector.
Template
Template is an ordered sequence of <type, length> pairs, used to
completely specify the structure and semantics of a particular set of
information that needs to be communicated from an IPFIX Device to a
Collector. Each Template is uniquely identifiable by means of a
Template ID.
IPFIX Message
An IPFIX Message is a message originating at the Exporting Process
that carries the IPFIX records of this Exporting Process and whose
destination is a Collecting Process. An IPFIX Message is
encapsulated at the transport layer.
Message Header
The Message Header is the first part of an IPFIX Message, which
provides basic information about the message such as the IPFIX
version, length of the message, message sequence number, etc.
Template Record
A Template Record defines the structure and interpretation of fields
in a Data Record.
Data Record
A Data Record is a record that contains values of the parameters
corresponding to a Template Record.
Options Template Record
An Options Template Record is a Template Record that defines the
structure and interpretation of fields in a Data Record, including
defining how to scope the applicability of the Data Record.
Set
Set is a generic term for a collection of records that have a similar
structure. In an IPFIX Message, one or more Sets follow the Message
Header.
There are three different types of Sets: Template Set, Options
Template Set, and Data Set.
Template Set
A Template Set is a collection of one or more Template Records that
have been grouped together in an IPFIX Message.
Options Template Set
An Options Template Set is a collection of one or more Options
Template Records that have been grouped together in an IPFIX Message.
Data Set
A Data Set is one or more Data Records, of the same type, that are
grouped together in an IPFIX Message. Each Data Record is previously
defined by a Template Record or an Options Template Record.
Information Element
An Information Element is a protocol and encoding independent
description of an attribute which may appear in an IPFIX Record. The
IPFIX information model [IPFIX-INFO] defines the base set of
Information Elements for IPFIX. The type associated with an
Information Element indicates constraints on what it may contain and
also determines the valid encoding mechanisms for use in IPFIX.
+------------------+---------------------------------------------+
| | Contents |
| +--------------------+------------------------+
| Set | Template | Record |
+------------------+--------------------+------------------------+
| Data Set | / | Data Record(s) |
+------------------+--------------------+------------------------+
| Template Set | Template Record(s) | / |
+------------------+--------------------+------------------------+
| Options Template | Options Template | / |
| Set | Record(s) | |
+------------------+--------------------+------------------------+
Figure A: Terminology Summary Table
4.2
PSAMP Terminology
EDITOR'S NOTE: The terminology has been entirely copied over from
[PSAMP-TECH], except for some (almost) similar terms where only the
IPFIX terms were kept (for example, observation point). Before
publication, we should evaluate which terms should be kept. The ones
required for sure so far are: Selector, Composite Selector, Packet
Reports, Packet Interpretation, PSAMP device, Collector, Filtering,
Sampling. Note that the terms Selector ID and Association ID, coming
from [PSAMP-FMWK], has been added in the Selection Process section.
4.2.1 Observation Points, Packet Streams and Packet Content
Observed Packet Stream
The Observed Packet Stream is the set of all packets observed at the
Observation Point.
Packet Stream
A packet stream denotes a subset of the Observed Packet Stream that
flows past some specified point within the measurement process. An
example of a Packet Stream is the output of the selection process.
Packet Content
The packet content denotes the union of the packet header (which
includes link layer, network layer and other encapsulation headers)
and the packet payload.
4.2.2 Selection Process
Selection Process
A Selection Process takes the Observed Packet Stream as its input and
selects a subset of that stream as its output.
Selection State
A Selection Process may maintain state information for use by the
Selection Process and/or the reporting process. At a given time, the
Selection State may depend on packets observed at and before that
time, and other variables. Examples include:
(i) sequence numbers of packets at the input of Selectors;
(ii) a timestamp of observation of the packet at the
Observation Point;
(iii) iterators for pseudorandom number generators;
(iv) hash values calculated during selection;
(v) indicators of whether the packet was selected by a
given Selector;
Selection Processes may change portions of the Selection State as a
result of processing a packet. Selection state for a packet is to
reflect the state after processing the packet.
Selector
A Selector defines the action of a Selection Process on a single
packet of its input. If selected, the packet becomes an element of
the output Packet Stream.
The Selector can make use of the following information in determining
whether a packet is selected:
(i) the packet's content;
(ii) information derived from the packet's treatment at the
Observation Point;
(iii) any selection state that may be maintained by the
Selection Process.
Composite Selector
A Composite Selector is an ordered composition of Selectors, in which
the output Packet Stream issuing from one Selector forms the input
Packet Stream to the succeeding Selector.
Primitive Selector
A Selector is primitive if it is not a Composite Selector.
Selector ID
The Selector ID is the unique ID identifying a Primitive Selector.
Associations ID
From all the packets observed at an Observation Point, only a few
packets are selected by one or more Selectors. The Associations ID is
a unique value describing the Observation Point and the Selector IDs
through which the packets are selected. The Associations ID is
represented by the associationsID Information Element [PSAMP-INFO].
4.2.3 Reporting Process
Reporting Process
A Reporting Process creates a Report Stream on packets selected by a
Selection Process, in preparation for export. The input to the
Reporting Process comprises that information available to the
Selection Process per selected packet, specifically:
(i) the selected packet's content;
(ii) information derived from the selected packet's
treatment at the Observation Point;
(iii) any Selection State maintained by the inputting
Selection Process, reflecting any modifications to the
Selection State made during selection of the packet.
Packet Reports
Packet Reports comprise a configurable subset of a packet's input to
the reporting process, including the packet's content, information
relating to its treatment (for example, the output interface), and
its associated selection state (for example, a hash of the packet's
content)
Report Interpretation:
Report Interpretation comprises subsidiary information, relating to
one or more packets, that is used for interpretation of their packet
reports. Examples include configuration parameters of the Selection
Process and of the Reporting Process.
Report Stream:
The Report Stream is the output of a Reporting Process, comprising
two distinguished types of information: Packet Reports, and Report
Interpretation.
4.2.4 Measurement Process
Measurement Process
A Measurement Process is the composition of a Selection Process that
takes the Observed Packet Stream as its input, followed by a
Reporting Process.
4.2.5 Exporting Process
Exporting Process:
An Exporting Process sends, in the form of Export Packet, the output
of one or more Measurement Processes to one or more Collectors.
Export Packet:
An Export Packet is a combination of Report Interpretation and/or one
or more Packet Reports are bundled by the Exporting Process into a
Export Packet for exporting to a Collector.
4.2.6 PSAMP Device
PSAMP Device
A PSAMP Device is a device hosting at least an Observation Point, a
Measurement Process and an Exporting Process. Typically,
corresponding Observation Point(s), Measurement Process(es) and
Exporting Process(es) are co-located at this device, for example at a
router.
4.2.7 Selection Methods
Filtering
A filter is a Selector that selects a packet deterministically based
on the Packet Content, or its treatment, or functions of these
occurring in the Selection State. Examples include field match
Filtering, and Hash-based Selection.
Sampling
A Selector that is not a filter is called a Sampling operation. This
reflects the intuitive notion that if the selection of a packet
cannot be determined from its content alone, there must be some type
of Sampling taking place.
Content-independent Sampling
A Sampling operation that does not use Packet Content (or quantities
derived from it) as the basis for selection is called a Content-
independent Sampling operation. Examples include systematic
Sampling, and uniform pseudorandom Sampling driven by a pseudorandom
number whose generation is independent of Packet Content. Note that
in Content-independent Sampling it is not necessary to access the
Packet Content in order to make the selection decision.
Content-dependent Sampling
A Sampling operation where selection is dependent on Packet Content
is called a Content-dependent Sampling operation. Examples include
pseudorandom selection according to a probability that depends on the
contents of a packet field. Note that this is not a filter, because
the selection is not deterministic.
Hash Domain
A subset of the Packet Content and the packet treatment, viewed as an
N-bit string for some positive integer N.
Hash Range
A set of M-bit strings for some positive integer M that define the
range of values the result of the hash operation can take.
Hash Function
A deterministic map from the Hash Domain into the Hash Range.
Hash Selection Range
A subset of the Hash Range. The packet is selected if the action of
the Hash Function on the Hash Domain for the packet yields a result
in the Hash Selection Range.
Hash-based Selection
Filtering specified by a Hash Domain, a Hash Function, and Hash Range
and a Hash Selection Range.
Approximative Selection
Selectors in any of the above categories may be approximated by
operations in the same or another category for the purposes of
implementation. For example, uniform pseudorandom Sampling may be
approximated by Hash-based Selection, using a suitable Hash Function
and Hash Domain. In this case, the closeness of the approximation
depends on the choice of Hash Function and Hash Domain.
Population
A Population is a Packet Stream, or a subset of a Packet Stream. A
Population can be considered as a base set from which packets are
selected. An example is all packets in the Observed Packet Stream
that are observed within some specified time interval.
Population Size
The Population Size is the number of all packets in the Population.
Sample Size
The number of packets selected from the Population by a Selector.
Configured Selection Fraction
The Configured Selection Fraction is the ratio of the number of
packets selected by a Selector from an input Population, to the
Population Size, as based on the configured selection parameters.
Attained Selection Fraction
The Attained Selection Fraction is the actual ratio of the
number of packets selected by a Selector from an input
Population, to the Population Size.
For some sampling methods the Attained Selection Fraction can differ
from the Configured Selection Fraction due to, for example, the
inherent statistical variability in sampling decisions of
probabilistic Sampling and Hash-based Selection. Nevertheless, for
large Population Sizes and properly configured Selectors, the
Attained Selection Fraction usually approaches the Configured
Selection Fraction.
4.3
IPFIX and PSMAP Terminology Comparison
EDITOR'S NOTE:
Some terms between IPFIX and PSAMP were almost similar but not
quite:
- observation point. I kept the one from IPFIX. However, if the
PSAMP/IPFIX definitons would be aligned, it would better.
- exporting process. I kept the one from PSAMP
- Collector: I kept the one from IPFIX, which implies that I used
the Collecting Process defined in IPFIX (it speaks about flows, but
there is no PSAMP Collecting Process definition)
The PSAMP terminology has been specified with an IPFIX background, as
PSAMP and IPFIX have similar terms. However, this section explains a
couple of non compatible terms between IPFIX and PSAMP.
4.3.1 PSAMP and IPFIX Processes
The figure B indicates the sequence of the three processes
(selection, reporting, and exporting) within the PSAMP Device. The
composition of the Selection Process followed by the Reporting
Process is known as the Measurement Process.
+---------+ +---------+ +---------+
Observed |Selection| |Reporting| |Exporting|
Packet--->|Process |--->|Process |--->|Process |--->Collector
Stream +---------+ +---------+ +---------+
\----Measurement Process-----/
Figure B: PSAMP Processes
The PSAMP Measurement Process can be viewed as analogous to the IPFIX
Metering Process. The PSAMP Measurement Process takes an Observed
Packet Stream as its input, and produces Packet Reports as its
output. The IPFIX Metering Process produces Flow Records as its
output. The distinct name "Measurement Process" has been retained in
PSAMP in order to avoid potential confusion in settings where IPFIX
and PSAMP coexist, and in order to avoid the implicit requirement
that the PSAMP version satisfy the requirements of an IPFIX Metering
Process.
4.3.2 Packet Report, Packet Interpretation, and Data Record
The PSAMP terminology speaks of Packet Report and Packet
Interpretation, while the IPFIX terminology speaks of Data Record and
(Option) Template Record. The Packet Report, which comprises
information about the observed packet, can be viewed as analogous to
the Data Record defined by a Template Record. The Packet
Interpretation, which comprises subsidiary information used for the
interpretation of the packet reports, can be viewed as analogous to
the Data Record defined by an Option Template Record.
5.
Differences between PSAMP and IPFIX Differences between PSAMP and IPFIX
The output of the IPFIX working group relevant for this draft, is The output of the IPFIX working group relevant for this draft is
structured into three documents: structured into three documents:
- IP Flow information architecture [IPFIX-ARCH] - IP Flow information architecture [IPFIX-ARCH]
- IPFIX Protocol Specifications [IPFIX-PROTO] - IPFIX Protocol Specifications [IPFIX-PROTO]
- IP Flow information export information model [IPFIX-INFO] - IP Flow information export information model [IPFIX-INFO]
4.1 5.1
Architecture Point of View Architecture Point of View
Traffic Flow measurement as described in the IPFIX requirements Traffic Flow measurement as described in the IPFIX requirements
[IPFIX-REQ] and the IPFIX architecture [IPFIX-ARCH] can be separated [RFC3917] and the IPFIX architecture [IPFIX-ARCH] can be separated
into two stages: packet processing and Flow processing. into two stages: packet processing and Flow processing.
The figure below illustrates these stages. The figure C illustrates these stages.
On stage 1, all processing steps act on packets. Packets are On stage 1, all processing steps act on packets. Packets are
captured, time stamped, selected by one or more selection steps and captured, time stamped, selected by one or more selection steps and
finally forwarded to packet classification that maps packets to finally forwarded to packet classification that maps packets to
Flows. The packets selection steps may include filtering and Flows. The packets selection steps may include filtering and sampling
sampling functions. functions.
On stage 2, all processing steps act on Flows. After packets are On stage 2, all processing steps act on Flows. After packets are
classified (mapped to Flows), Flows are generated or updated if they classified (mapped to Flows), Flows are generated, or updated if they
exist already. Flow generation and update steps may be performed exist already. Flow generation and update steps may be performed
repeatedly for aggregating Flows. Finally, Flows are exported. repeatedly for aggregating Flows. Finally, Flows are exported.
Packet sampling as described in the PSAMP framework [PSAMP-FMWK] Packet sampling as described in the PSAMP framework [PSAMP-FMWK]
covers only stage 1 of the IPFIX architecture with the packet covers only stage 1 of the IPFIX architecture with the packet
classification replaced by packet record export. classification replaced by packet record export.
IPFIX architecture PSAMP framework IPFIX architecture PSAMP framework
packet header packet header packet header packet header
skipping to change at page 6, line 4 skipping to change at page 19, line 6
| | > Flow | | > Flow
| v | processing | v | processing
| Flow | | Flow |
| selection | | selection |
| | | | | |
+-------+ | +-------+ |
| | | |
v | v |
Flow Record / Flow Record /
export export
Comparison of IPFIX architecture and PSAMP framework
4.2 Figure C: Comparison of IPFIX architecture and PSAMP framework
5.2
Protocol Point of View Protocol Point of View
Concerning the protocol, the major difference between IPFIX and Concerning the protocol, the major difference between IPFIX and PSAMP
PSAMP is that the IPFIX protocol exports Flow Records while the is that the IPFIX protocol exports Flow Records while the PSAMP
PSAMP protocol exports packet records. From a pure export point of protocol exports packet records. From a pure export point of view,
view, IPFIX will not distinguish a Flow Record composed of several IPFIX will not distinguish a Flow Record composed of several packets
packets aggregated together, from a Flow Record composed of a single aggregated together, from a Flow Record composed of a single packet.
packet. So the PSAMP export can be seen as special IPFIX Flow Record So the PSAMP export can be seen as special IPFIX Flow Record
containing information about a single packet. containing information about a single packet.
EDITOR’S NOTE: maybe we want to distinguish an IPFIX Flow Record
export with one packet from a PSAMP export?
Extensions of the IPFIX protocol needed by PSAMP are rather limited. All extensions of the IPFIX protocol that are required to satisfy the
A basic one is the need of a data type for protocol fields that has PSAMP requirements, have already been incorporated in the IPFIX
flexible length, such as an octet array. This is needed by the PSAMP protocol [IPFIX-PROTO], which was developed in parallel with the
protocol for reporting content of captured packets, for example the PSAMP protocol. An example is the need of a data type for protocol
first 40 octets of a packet. fields that have flexible length, such as an octet array. This was
added to the IPFIX protocol specification in order to meet the
requirement of the PSAMP protocol to report content of captured
packets, for example the first octets of a packet.
4.3 5.3
Information Model Point of View Information Model Point of View
However, the overlap between both protocols is still quite large. From the information model point of view, the overlap between both
Most of the data fields in the IPFIX protocol also apply to PSAMP, the IPFIX and PSAMP protocols is quite large. Most of the data fields
for example all fields reporting packet header fields. Only a few in the IPFIX protocol are also relevant for exporting packet
fields, such as flowCount, packetCount (whose value will always be information, for example all fields reporting packet header
one) etc., cannot be used in a meaningful way by the PSAMP protocol. properties. Only a few fields, such as flowCount, packetCount (whose
Also, IPFIX protocol requirements concerning stage 2 do not apply to value will always be 1 for PSAMP) etc., cannot be used in a
the PSAMP protocol. meaningful way by the PSAMP protocol. Also, IPFIX protocol
requirements concerning stage 2 of figure C do not apply to the PSAMP
metering process.
Further required extensions apply to the information model. The Further required extensions apply to the information model. Even if
IPFIX information model is rather poor concerning sampling. Just two the IPFIX charter speaks of sampling, no sampling related Information
fields, one for the sampling method and one for the sampling rate, Elements are specified in [IPFIX-INFO]. The task of specifying them
are not sufficient, as shown in [PSAMP-SLCT]. A set of several was intentionally left for the PSAMP information model. A set of
additional fields is required for satisfying the requirements for a several additional fields is required for satisfying the requirements
PSAMP information model. Additional required extensions of the for the PSAMP information model [PSAMP-TECH].
information model concern packet filtering, and the a field
reporting content of a packet using the flexible length data type Additional required extensions of the information model concern
mentioned above. packet filtering, and the field reporting content of a packet using
the flexible length data type mentioned above.
Exploiting the extensibility of the IPFIX information model, the Exploiting the extensibility of the IPFIX information model, the
required extension is covered by the PSAMP information model required extension is covered by the PSAMP information model
specified in [PSAMP-INFO]. specified in [PSAMP-INFO].
5.
Using IPFIX for PSAMP
5.1
High Level View of the Integration
The Template Record in the Template FlowSet is used to describe the
different PSAMP Information Elements that will be exported to the
Collector. The Collector decodes the Template FlowSet and knows
which Information Elements to expect when it receives the Flow Data
Records in the Data FlowSet, i.e. the PSAMP Packet Reports.
Typically, in the base level of the PSAMP functionality, the
Template FlowSet will contain the input sequence number, the packet
fragment (some number of contiguous bytes from the start of the
packet) and the selector ID.
The Options Template Record in the Options Template FlowSet is used
to describe the different PSAMP Information Elements that concern
the Metering Process itself: sampling and/or filtering functions,
plus the associated parameters. The Collector decodes the Options
Template FlowSet and knows which Information Elements to expect when
it receives the Options Data Records in the Data FlowSet, i.e. the
PSAMP Report Interpretation. Typically, the Options Template would
contain the Selector ID, the sampling or filtering functions, and
the sampling or filtering associated parameters.
5.2
Partial or Entire IPFIX Protocol Specifications Support
The "High level view of the integration" section 5.1 concludes that
PSAMP requires all the different possibilities of the IPFIX protocol
specifications [IPFIX-PROTO]. That is the 3 types of FlowSet (Data
FlowSet, Template FlowSet and Options Templates FlowSet), the 2
types of Templates Records (Template Record and Options Template
Record), and the 2 types of Data Record (Flow Data Record, Options
Data Record), as described again in the table below.
+------------------+---------------------------------------------+
| | Contents |
| +--------------------+------------------------+
| FlowSet | Template Record | Data Record |
+------------------+--------------------+------------------------+
| | | Flow Data Record(s) |
| Data FlowSet | / | or |
| | | Options Data Record(s) |
+------------------+--------------------+------------------------+
| Template FlowSet | Template Record(s) | / |
+------------------+--------------------+------------------------+
| Options Template | Options Template | / |
| FlowSet | Record(s) | |
+------------------+--------------------+------------------------+
As a consequence, PSAMP can't rely on a subset of the IPFIX protocol
specifications are described in [IPFIX-PROTO]. The entire IPFIX
protocol specifications MUST be implemented for the PSAMP export.
6. 6.
PSAMP Requirements versus the IPFIX Solution PSAMP Requirements versus the IPFIX Solution
[PSAMP-FRAMEWORK] describes some requirements that affect directly [PSAMP-FMWK] describes some requirements that affect directly the
the export protocol. Refer to the following sections: export protocol. Refer to the following sections:
section 3.2 "Reporting Process Requirements" . section 3.2 "Reporting Process Requirements"
section 3.3 "Exporting Process Requirements" . section 3.3 "Exporting Process Requirements"
section 5 "Reporting Process" . section 5 "Reporting Process"
[PSAMP-FRAMEWORK] also describes in the section 3.1 one requirement [PSAMP-FMWK] also describes in the section 3.1 one requirement that,
that, if not directly related to the export protocol, will put some if not directly related to the export protocol, will put some
constraints on it: constraints on it:
Selection Process Requirements: Selection Process Requirements:
- Parallel Measurements: multiple independent measurement - Parallel Measurements: multiple independent measurement
processes at the same entity." processes at the same entity."
[PSAMP-FRAMEWORK] finally describes in the section 5 some [PSAMP-FMWK] finally describes in the section 5 some requirements
requirements regarding the reporting process. This series of regarding the reporting process. This series of requirements
requirements specifies the different Information Elements that MUST specifies the different Information Elements that MUST and SHOULD
and SHOULD reported to the collector. Nevertheless IPFIX, being a reported to the Collector. Nevertheless IPFIX, being a generic export
generic export protocol, can export any Information Elements as long protocol, can export any Information Elements as long as there are
as there are described in the information model. So these described in the information model. So these requirements are mainly
requirements are mainly targeted for the [PSAMP-INFO] document. targeted for the [PSAMP-INFO] document.
6.1 6.1
IPFIX Solution for the PSAMP Requirements IPFIX Solution for the PSAMP Requirements
Let's address the PSAMP requirements one by one. Let's address the PSAMP requirements one by one.
* Parallel Measurements: multiple independent measurement processes * Parallel Measurements: multiple independent measurement processes
at the same entity. Refer to [PSAMP-FRAMEWORK] section 3.1 "Selection at the same entity. Refer to [PSAMP-FMWK] section 3.1 "Selection
Process Requirements". Process Requirements".
This requirement is addressed by exporting the Selector ID This requirement is addressed by exporting the Associations ID
Information Element in every packet report, so part of every Flow Information Element in every packet report. Note that without this
Data Records. Note that without this requirement, exporting the Scope requirement, exporting the Selector ID in a Scope part of every
part of every single packet report could have been sufficient. single packet report could have been sufficient.
* Transparency: allow transparent interpretation of measurements as * Transparency: allow transparent interpretation of measurements as
communicated by PSAMP reporting, without any need to obtain communicated by PSAMP reporting, without any need to obtain
additional information concerning the observed packet stream. Refer additional information concerning the observed packet stream. Refer
to [PSAMP-FRAMEWORK] section 3.2 "Reporting Process Requirements". to [PSAMP-FMWK] section 3.2 "Reporting Process Requirements".
This requirement is addressed by exporting the Selector ID This requirement is addressed by exporting the Associations ID
Information Element in every Flow Data Records (packet report) and Information Element in every Packet Report (a Data Record specified
exporting the associated SAMPLING_ALGORITHM and SAMPLING PARAMETERS in Template Record) and exporting the associated selection algorithm
Information Elements in the Options Data Record (packet and selection parameters Information Elements in the Packet
interpretation). So the all the Metering Process parameters are Interpretation (a Data Record specified in Options Template Record).
linked to the Flow Data Records.
* Robustness to Information Loss: allow robust interpretation of * Robustness to Information Loss: allow robust interpretation of
measurements with respect to reports missing due to data loss, e.g. measurements with respect to reports missing due to data loss, e.g.
in transport, or within the measurement, reporting or Exporting in transport, or within the measurement, reporting or Exporting
Processes. Inclusion in reporting of information that enables the Processes. Inclusion in reporting of information that enables the
accuracy of measurements to be determined. Refer to [PSAMP-FRAMEWORK] accuracy of measurements to be determined. Refer to [PSAMP-FMWK]
section 3.2 "Reporting Process Requirements". section 3.2 "Reporting Process Requirements".
An Options Templates MUST be sent on regular basis. This Options An Options Template, with updated statistics, MUST be sent on regular
Template contains for example the total number of packet report basis. This Options Template contains for example the total number of
exported from the PSAMP device, the total number of packet observed, packet report exported from the PSAMP device, the total number of
etc... Thus the Collector can compare the number of packet report packet observed, etc... Thus the Collector can compare the number of
received per selector ID with the number actually metered and/or packet report received per selector ID with the number actually
sent. In case of discrepancy, a new sampling rate could be computed. metered and/or sent. In case of discrepancy, a new sampling rate
could be computed.
* Faithfulness: all reported quantities that relate to the packet * Faithfulness: all reported quantities that relate to the packet
treatment MUST reflect the router state and configuration encountered treatment MUST reflect the router state and configuration encountered
by the packet at the time it is received by the measurement process. by the packet at the time it is received by the measurement process.
Refer to [PSAMP-FRAMEWORK] section 3.2 "Reporting Process Refer to [PSAMP-FMWK] section 3.2 "Reporting Process Requirements".
Requirements".
This requirement doesn't concern the export protocol itself but the This requirement doesn't concern the export protocol itself but the
Metering Process, even if described in the "Reporting Process Metering Process, even if described in the "Reporting Process
Requirements" section. Requirements" section.
* Privacy: selection of the content of packet reports will be * Privacy: selection of the content of packet reports will be
cognizant of privacy and anonymity issues while being responsive to cognizant of privacy and anonymity issues while being responsive to
the needs of measurement applications, and in accordance with RFC the needs of measurement applications, and in accordance with RFC
2804. Full packet capture of arbitrary packet streams is explicitly 2804. Full packet capture of arbitrary packet streams is explicitly
out of scope. Refer to [PSAMP-FRAMEWORK] section 3.2 "Reporting out of scope. Refer to [PSAMP-FMWK] section 3.2 "Reporting Process
Process Requirements". Requirements".
This requirement doesn't concern the export protocol itself, even if This requirement doesn't concern the export protocol itself, even if
described in the "Reporting Process Requirements" section. described in the "Reporting Process Requirements" section.
* Timeliness: reports on selected packets MUST be made available to * Timeliness: reports on selected packets MUST be made available to
the collector quickly enough to support near real time applications. the Collector quickly enough to support near real time applications.
Specifically, any report on a packet MUST be dispatched within 1 Specifically, any report on a packet MUST be dispatched within 1
second of the time of receipt of the packet by the measurement second of the time of receipt of the packet by the measurement
process. Refer to [PSAMP-FRAMEWORK] section 3.3 "Export Process process. Refer to [PSAMP-FMWK] section 3.3 "Export Process
Requirements". Requirements".
EDITOR'S NOTE: the term "dispatched" is not clear. Does it mean sent
from the Metering Processing to the Exporting Process? Or put into a
packet by the Exporting Process? Or written on the wire?
The IPFIX protocol specifications [IPFIX-PROTO] describe an The IPFIX protocol specifications [IPFIX-PROTO] describe an
inactivity timeout for the Flow expiration. This inactivity timeout inactivity timeout for the Flow expiration. This inactivity timeout
is configurable, with a minimum value of 0 for immediate expiration. is configurable, with a minimum value of 0 for immediate expiration.
Note that this minimum value of 0 will force every single Flow Data Note that this minimum value of 0 will force every single Data Record
Record to contain information about a single packet and not an to contain information about a single packet and not an aggregation
aggregation of packets. of packets.
* Congestion Avoidance: export of a report stream across a network * Congestion Avoidance: export of a report stream across a network
MUST be congestion avoiding in compliance with RFC 2914. Refer to MUST be congestion avoiding in compliance with RFC 2914. Refer to
[PSAMP-FRAMEWORK] section 3.3 "Export Process Requirements". [PSAMP-FMWK] section 3.3 "Export Process Requirements".
IPFIX, by its charter, MUST also respect this requirement. IPFIX, by its charter, MUST also respect this requirement.
* Secure Export: * Secure Export:
- confidentiality: the option to encrypt exported data MUST be - confidentiality: the option to encrypt exported data MUST be
provided. provided.
- integrity: alterations in transit to exported data MUST be - integrity: alterations in transit to exported data MUST be
detectable at the collector detectable at the Collector
- authenticity: authenticity of exported data MUST be verifiable - authenticity: authenticity of exported data MUST be verifiable by
by the collector in order to detect forged data. the Collector in order to detect forged data.
The motivation here is the same as for security in IPFIX export. The motivation here is the same as for security in IPFIX export.
Refer to [PSAMP-FRAMEWORK] section 3.3 "Export Process Refer to [PSAMP-FMWK] section 3.3 "Export Process Requirements".
Requirements".
6.2
High Level View of the Integration
The Template Record in the Template Set is used to describe the
different PSAMP Information Elements that will be exported to the
Collector. The Collector decodes the Template Record in the Template
Set and knows which Information Elements to expect when it receives
the Data Records in the Data Set, i.e. the PSAMP Packet Reports.
Typically, in the base level of the PSAMP functionality, the Template
Set will contain the input sequence number, the packet fragment (some
number of contiguous bytes from the start of the packet) and the
Associations ID.
The Options Template Record in the Options Template Set is used to
describe the different PSAMP Information Elements that concern the
Metering Process itself: sampling and/or filtering functions, plus
the associated parameters. The Collector decodes the Options Template
Records in the Option Template Set and knows which Information
Elements to expect when it receives the Data Records in the Data Set,
i.e. the PSAMP Report Interpretation. Typically, the Options Template
would contain the Associations ID, the sampling or filtering
functions, and the sampling or filtering associated parameters.
PSAMP requires all the different possibilities of the IPFIX protocol
specifications [IPFIX-PROTO]. That is the 3 types of Set (Data Set,
Template Set and Options Templates Set) with the 2 types of Templates
Records (Template Record and Options Template Record), as described
in the figure A. As a consequence, PSAMP can't rely on a subset of
the IPFIX protocol specifications are described in [IPFIX-PROTO]. The
entire IPFIX protocol specifications [IPFIX-PROTO] MUST be
implemented for the PSAMP export.
7. 7.
Low Level View of the Integration Using the IPFIX Protocol for PSAMP
7.1 7.1
Sampling Case, PSAMP Base Level of Functionality Selector ID
EDITOR’S NOTE: LET'S ASSUME THAT THE [PSAMP-INFO] DEFINES THE The Selector ID is the unique ID identifying a Primitive Selector.
FOLLOWING DATA TYPES Each Primitive Selector MUST have a unique ID within the Observation
SEQUENCE-NUMBER: the input sequence number, Domain.
PACKET-SAMPLE: some number of contiguous bytes from the start
of the packet
SELECTOR-ID:
SAMPLING-ALGORITHM:
SAMPLING-PARAMETER1, SAMPLING-PARAMETERS2, ETC...
As described in the section 5.1 "Mandatory Contents of Packet 7.2
Reports" of [PSAMP-FRAMEWORK], the packet reports must contain: The Associations
- the input sequence number(s), denoted the SEQUENCE-NUMBER in
[PSAMP-INFO]
- some number of contiguous bytes from the start of the packet,
denoted the PACKET-SAMPLE in [PSAMP-INFO].
Thus the Template FlowSet defines a Template Record composed of
SEQUENCE-NUMBER, PACKET-SAMPLE and SELECTOR-ID.
The report interpretation must contain: From all the packets observed at an Observation Point, a subset of
- the sampling algorithm, denoted SAMPLING-ALGORITHM in [PSAMP-INFO] packets is selected by one or more Selectors. The Associations ID is
- the sampling parameters denoted SAMPLING-PARAMETER1, SAMPLING- a unique value describing the Observation Point and the Selector IDs
PARAMETER2, etc... in [PSAMP-INFO] through which the packets are selected. The Associations ID is
The Options Template FlowSet defines a Options Template Record represented by the associationsId Information Element [PSAMP-INFO].
composed of SELECTOR-ID, SAMPLING-ALGORITHM, SAMPLING-PARAMETERS.
Finally the Data FlowSet is used to export the Flow Data Record(s) Optionally, the IPFIX processes to which the packets are MAY be added
containing the real values of SEQUENCE-NUMBER, PACKET-SAMPLE and to the Associations ID. Example of IPFIX processes are IPFIX Metering
SELECTOR-ID. The Data FlowSet is also used to export the Options Process ID and IPFIX Exporting Process ID.
Data Record(s) containing the real values of SELECTOR-ID, SAMPLING-
ALGORITHM, SAMPLING-PARAMETERS.
By means of the SELECTOR-ID, the Collector can link any Flow Data EDITOR'S NOTE: Even if [PSAMP-TECH] section 7.1 and 7.2 describes
Record to the corresponding Options Data Record. That is, any Flow that "The ASSOCIATIONS field describes the Observation Point and
Data Record to the Metering Process function and parameters. optionally the IPFIX processes to which the packet Selector is
associated. Values: <STREAM ID, IPFIX Metering process ID, IPFIX
Exporting process ID, IDs of other associated processes>", we can't
see an example where the IPFIX process(es) ID would be required.
Don't we have enough with the list of Selector IDs?
7.1.1 Example 7.3
Packet Reports
EDITOR’S THIS MUST BE A FULL EXAMPLE LIKE IN SECTION 13 OF [IPFIX- For each Assocations, for each select packet, a Packet Report MUST be
PROTO]. created. The format of the Packet Report is specified in a Template
THE [PSAMP-INFO] MUST BE FIRST PUBLISHED. Record contained in a Template Set.
7.2 There are two types of Packet Report, as described in [PSAMP-FWMK]:
Sampling Case the basic Packet Report and the extended Packet Report.
The PSAMP reporting process SHOULD also report fields relating to 7.3.1 Basic Packet Reports
the protocols used in the packets, to the packet treatment and to
the selection state associated with the packet, as specified in
[PSAMP-FRAMEWORK] section 5.2 "Recommended Contents for Packet
Reports".
Let's take the same example as in the section 7.1, but let's add the For each selected packet, the Packet Report MUST contain the
export of the destination BGP Autonomous System (AS) [1771] and of following information:
the input interface - The associationsId Information Element
- Some number of contiguous bytes from the start of the packet,
including the packet header (which includes link layer, network layer
and other encapsulation headers) and some subsequent bytes of the
packet payload. The Layer2PacketSection and ipPacketSection PSAMP
elements are available for this use. The Information Element can be
provided either with a fixed length field or with a variable sized
field
- the input sequence number(s) of any Selectors that acted on the
packet
The packet reports MUST contain: EDITOR'S NOTE: We should probably list all the possible Information
- the input sequence number(s), denoted the SEQUENCE-NUMBER in Elements from [PSAMP-INFO]: Layer2PacketSection, ipPacketSection,
[PSAMP-INFO] etc...
- some number of contiguous bytes from the start of the packet,
denoted the PACKET-SAMPLE in [PSAMP-INFO]
- the destination BGP AS , denoted destinationAS in [IPFIX-INFO]
- the input interface, denoted ingressPort in [IPFIX-INFO]
Thus the Template FlowSet defines a Template Record composed of
SEQUENCE-NUMBER, PACKET-SAMPLE and SELECTOR-ID, destinationAS and
ingressPort.
The report interpretation will remain unchanged and must contain: EDITOR'S NOTE: instead of sending the input sequence number for each
- the sampling algorithm, denoted SAMPLING-ALGORITHM in [PSAMP-INFO] selector ID, a counter64 value, associated with every packet, the
- the sampling parameters denoted SAMPLING-PARAMETER1, SAMPLING- working group should discuss the possibility to send the information
PARAMETER2, etc... in [PSAMP-INFO] on regular basis with an option template record. Specifically in the
The Options Template FlowSet is used to define this template case of Composite Selector, we would send multiple times a 64-bit
composed of SELECTOR-ID, SAMPLING-ALGORITHM, SAMPLING-PARAMETERS. counter in each packet. The example below doesn't contain the input
sequence number.
Finally Data FlowSet is used to export the Flow Data Record(s) Here is an example of a basic Packet Report, with an AssociationsId
containing the real values of SEQUENCE-NUMBER, PACKET-SAMPLE and value of 9 (will be explained later on) and a fixed ipPacketSection
SELECTOR-ID, destinationAS and ingressPort. The Data FlowSet is also field of 12 bytes:
used to export the Options Data Record(s) containing the real values
of SELECTOR-ID, SAMPLING-ALGORITHM, SAMPLING-PARAMETERS.
As a consequence, the collector can link any Flow Data Record to the IPFIX Template Record:
sampling algorithm and sampling parameters, by means of the
SELECTOR-ID value.
7.2.1 Example 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 2 | Length = 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 260 | Field Count = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = AssociationsId | IE Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = ipPacketSection | IE Length = 12 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
EDITOR’S NOTE: THIS MUST BE A FULL EXAMPLE LIKE IN SECTION 13 OF The associated IPFIX Data Record:
[IPFIX-PROTO]. THE [PSAMP-INFO] MUST BE FIRST PUBLISHED.
7.3 0 1 2 3
Filtering Case 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 260 | Length = 20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: AssociationsId = 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: ipPacketSection = 0x4500 005B |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ...continued = 0xA174 0000 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ...continued = 0xFF11 832E |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
EDITOR’S NOTE: ACTUALLY THE EXAMPLE WILL BE QUITE SIMILAR TO 7.1 AND Figure D: Example of a Basic Packet Report
7.2 BUT WILL DEPEND A LOT ON HOW WE WILL DEFINE THE FILTERING IN
[IPFIX-INFO].
7.3.1 Example 7.3.2 Extended Packet Reports
EDITOR’S NOTE: THIS MUST BE A FULL EXAMPLE LIKE IN SECTION 13 OF Alternatively to the basic Packet Report, the extended Packet Report
[IPFIX-PROTO]. THE [PSAMP-INFO] MUST BE FIRST PUBLISHED. MAY contain extra information related to the protocols used in the
packet (such as source and destination IP addresses), related to the
packet treatment (such as output interface, destination BGP
autonomous system), related to the Selection State associated with
the packet (such as timestamps, hash values). Using the IPFIX
Information Elements [IPFIX-INFO], the extra information is added to
the Template Record.
It is envisaged that selection of fields for Extended Packet
Reporting may be used to reduce reporting bandwidth, in which case
the option to report some number of contiguous bytes from the start
of the packet, mandatory in the basic Packet Report, may not be
exercised.
Example of a detailed Extended Packet Report:
IPFIX Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 2 | Length = 32 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 261 | Field Count = 6 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = associationsId | IE Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = sourceIPv4Address | IE Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = destinationIPv4Address| IE Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = totalLengthIPv4 | IE Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = tcpSourcePort | IE Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = tcpDestinationPort | IE Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 261 | Length = 20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: AssociationsId = 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: sourceIPv4Address = 10.0.0.1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: destinationIPv4Address = 10.0.1.106 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Rec. 1: totalLengthIPv4 = 72 | Rec. 1: tcpSourcePort = 1372 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Rec. 1: tcpDestinationPort=80|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure E: Example of an Extended Packet Report
7.4
Report Interpretation
To make full sense of the Packet Reports there are a number of
additional pieces of information that must be communicated to the
Collector:
- The details about which Selectors and Observation Points are being
used within an Associations MUST be provided using the Associations
Report Interpretation.
- The configuration details of each Selector MUST be provided using
the Selector Report Interpretation.
- The Selector ID statistics MUST be provided using the
AssociationsStatistics Report Interpretation.
- The accuracies of the reported fields MUST be provided using the
Accuracy Report Interpretation.
- Further information about each Observation Point MAY be provided
using the Observation Point Report Interpretation.
7.4.1 Associations Report Interpretation
Each Packet Report contains an associationsId Information Element
that identifies the particular combination of Observation Point and
Selectors used for its selection. For every associationsId
Information Element in use, the PSAMP Device MUST export an
Associations Report Interpretation using an Options Template with the
following Information Element:
Scope: associationsId
Non-Scope: observationPointId
selectorId (one or more)
If the packets are selected by a Composite Selector, the Associations
ID field is composed of several Primitive Selectors. In such a case,
the Associations Report Interpretation MUST contain the list of all
the Primitive Selector IDs in the Associations ID. If multiple
Selectors are contained in the Associations Report Interpretation,
the Selectors ID MUST be identified in the order they are used.
Optionally, the Associations Report Interpretation MAY contain the
following Information
Non-Scope: meteringProcessId
exportingProcessId
The observationPointID SHOULD be first Information Element and the
optional processes SHOULD be last ones so that the path of the
selected Packet is provided in the logical order.
EDITOR'S NOTE: Even if [PSAMP-TECH] section 7.1 and 7.2 describes
that "The ASSOCIATIONS field describes the Observation Point and
optionally the IPFIX processes to which the packet Selector is
associated. Values: <STREAM ID, IPFIX Metering process ID, IPFIX
Exporting process ID, IDs of other associated processes>", we can't
see an example where the IPFIX process(es) ID would be required.
Don't we have enough with the list of Selector IDs? If we don't need
the IPFIX Process ID, the following examples must be updated.
Example of a Two Associations ID:
Selection Path 7 (Filter->Sampling):
observationPointID 1 (Interface 5),
selectorId 5 (Filter, match IPV4SourceAddress 10.0.0.1),
selectorId 10 (Sampler, Random 1 out-of ten),
meteringProcessID 15 (IPFIX Metering Process)
Selection Path 9 (Sampling->Filtering):
observationPointID 1 (Interface 5),
selectorId 10 (Sampler, Random 1 out-of ten),
selectorId 5 (Filter, match IPV4SourceAddress 10.0.0.1),
meteringProcessID 15 (IPFIX Metering Process)
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 30 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 262 | Field Count = 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 4 | Scope 1 = AssociationsId |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 | Option 1 = ObservationPointId |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Length = 4 | Option 2 = selectorId |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 2 Length = 4 | Option 4 = selectorId |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 3 Length = 4 | Option 5 = MeteringProcessId |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 4 Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 262 | Length = 44 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: AssociationsId = 7 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: ObservationPointId = 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: selectorId = 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: selectorId = 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: MeteringProcessId = 15 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: AssociationsId = 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: Obs.PointId = 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: selectorId = 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: selectorId = 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: MeteringProcessId = 15 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure F: Example of an Associations Report Interpretation
Notes:
* There are two Records here in the same Data Set. Each record
defines a different Selection Path.
* If a different Selection Path used three Selectors then a different
Options Template would have to be used.
7.4.2 Selector Report Interpretation
An IPFIX Data Record, defined by an Option Template Record, MUST be
used to send the configuration details of every Selector in use. The
Option Template Record MUST contain the selectorId as the Scope field
and the SelectorAlgorithm followed by some type specific
configuration fields as the data:
Scope: selectorId
Non-scope: selectorAlgorithm
algorithm specific Information Elements
The algorithm specific Information Elements are specified in the
following subsections, depending on the selection method represented
by the value of the selectorAlgorithm.
The Associations statistics MUST be exported periodically.
7.4.2.1 Systematic Count-Based Sampling
In systematic count-based Sampling, the start and stop triggers for
the Sampling interval are defined in accordance to the spatial packet
position (packet count) [PSAMP-TECH].
The algorithm specific Information Elements in case of systematic
count-based Sampling are:
samplingPacketInterval: number of packets selected in a row
samplingPacketSpace: number of packets between selections
Example of a simple 1 out-of 10 systematic count-based Selector
definition, where the samplingPacketInterval is 1 and the
samplingPacketSpace is 9.
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 263 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 | Scope 1 = selectorId |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 | Option 1 = selectorAlgorithm |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Length = 1 | Option 2 = samp.Pack.Interval |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 2 Length = 1 | Option 3 = samp.PacketSpace |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 3 Length = 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 263 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| selectorId (scope) = 15 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| .Algorithm= 1 | .Interval= 1 | .Space = 09 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure G: Example of the Selector Report Interpretation,
For Systematic Count-Based Sampling
Notes:
* A samplingAlgorithm value of 1 represents systematic count-based
Sampling.
* samplingPacketInterval and samplingPacketSpace are of type
unsigned32 but are compressed down to one octet here.
7.4.2.2 Systematic Time-Based Sampling
In systematic time-based Sampling, the start and stop triggers are
used to define the Sampling intervals [PSAMP-TECH]. The algorithm
specific Information Elements in case of systematic time-based
Sampling are:
samplingTimeInterval: time (in ms) when packets are selected
samplingTimeSpace: time (in ms) between selections
Example of a 100 ms out-of 1000 ms systematic time-based Selector
definition, where the samplingTimeInterval is 100 and the
samplingTimeSpace is 900
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 264 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 | Scope 1 = selectorId |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 | Option 1 = selectorAlgorithm |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Length = 1 | Option 2 = samp.TimeInterval |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 2 Length = 1 | Option 3 = samp.TimeSpace |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 3 Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 264 | Length = 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| selectorId (scope) = 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| .Algorithm= 2 | .Interval=100 | samplingTimeSpace = 900 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure H: Example of the Selector Report Interpretation,
For Systematic Time-Based Sampling
Notes:
* A samplingAlgorithm value of 2 represents systematic time-based
Sampling.
* samplingTimeInterval and samplingTimeSpace are of type unsigned32
but are compressed down here.
7.4.2.3 Random n-out-of-N Sampling
In random n-out-of-N Sampling, n elements are selected out of the
parent population that consists of N elements [PSAMP-TECH]. The
algorithm specific Information Elements in case of random n-out-of-N
Sampling are:
samplingSize: number of packets selected
samplingPopulation: number of packets in selection population
Example of a 1 out-of 10 random n-out-of-N sampling Selector:
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 265 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 | Scope 1 = selectorId |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 | Option 1 = selectorAlgorithm |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Length = 1 | Option 2 = samplingSize |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 2 Length = 1 | Option 3 = samplingPopulation |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 3 Length = 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 265 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| selectorId (scope) = 17 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| .Algorithm= 1 | .samp.Size= 1 | samp.Pop = 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure I: Example of the Selector Report Interpretation,
For Random n-out-of-N Sampling
Notes:
* A samplingAlgorithm value of 3 represents Random n-out-of-N
sampling.
* samplingSize and samplingPopulation are of type unsigned32 but are
compressed down to one octet here.
7.4.2.4 Uniform Probabilistic Sampling
EDITOR'S NOTE: to be completed
7.4.2.5 Non-uniform Probabilistic Sampling
EDITOR'S NOTE: to be completed
7.4.2.6 Non-uniform Flow State Sampling
EDITOR'S NOTE: to be completed
7.4.2.7 Match Based Filtering and Router State Filtering
This classification includes match(es) on field(s) within a packet
and match(es) on properties of the router state. With this method, a
packet is selected if a specific field in the packet equals a
predefined value.
The algorithm specific Information Elements, defining configuration
parameters for match-based and router state filtering, are taken from
the full range of available IPFIX Information Elements [IPFIX-INFO].
Further Information Elements MAY be defined by proprietary
Information Elements [IPFIX-PROTO]
When multiple different Information Elements are defined, the filter
acts as a logical AND. Note that the logical OR is not covered by
these PSAMP specifications. The match based filtering and router
state filtering Options Template Record MUST NOT have multiple
identical Information Elements. The result of the filter is
independent from the order of the Information Elements in the Option
Template Record, but the order may be important for implementation
purposes, as the first filter will have to work at a higher rate. In
any case, an implementation is not constrained to respect the filter
ordering, as long as the result is the same, and it may even
implement the composite filtering in filtering in one single step.
EDITOR'S NOTE: "The algorithm specific Information Elements, defining
configuration parameters for match-based and router state filtering,
are taken from the full range of available IPFIX Information Elements
[IPFIX-INFO] ". What about the ones from [PSAMP-INFO]? In other
words, are they I.E.s in [PSAMP-INFO] that we could use for the
match-based and router state filtering?
Example of a match based filter Selector, whose rules are:
IPv4 Source Address = 10.0.0.1
IPv4 Next-Hop Address = 10.0.1.1
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 266 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 | Scope 1 = selectorId |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 | Option 1 = selectorAlgorithm |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Length = 1 | Option 2 = sourceIPv4Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 2 Length = 4 | Option 3 =ipNextHopIPv4Address|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 3 Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 266 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| selectorId (scope) = 21 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| .Algorithm= 1 | sourceIPv4Address = 10.0.0 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... .1 | ipNextHopIPv4Address = 10.0.1 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... .1 |
+-+-+-+-+-+-+-+-+
Figure J: Example of the Selector Report Interpretation,
For match based and router state Filtering
Notes:
* A samplingAlgorithm value of 7 represents match based filtering.
* In this filter there is a mix of information from the packet and
information from the router.
7.4.2.8 Hash Based Filtering
EDITOR'S NOTE: to be completed
7.4.3 Associations Statistics Report Interpretation
A Selector MAY be used in multiple Associations. However, each use of
a Selector must be independent, so each separate logical instances of
a Selector MUST maintain its separate Selection State and statistics.
The Associations Statistics Report Interpretation MUST include the
number of packets seen (Population Size) and the number of packets
selected (Sample Size) by each instance of its Primitive Selector.
Within an Association composed of several Primitive Selectors, the
number of packets selected for one Selector is equal to the number of
packets seen by the next Selector. The order of the Selectors in the
Associations Statistics Report Interpretation MUST match the order of
the Selectors in the Association, as defined in the Associations
Report Interpretation.
The Associations Statistics Report Interpretation MUST also contain
the number of packets observed at the Observation.
For every Associations ID, the PSAMP Device MUST export an
Associations statistics Report Interpretation using an Options
Template with the following Information Element:
Scope: AssociationsId
Non-scope: packetsObserved
packetsSelected (one or more)
The packetsObserved Information Element contains the number of
packets seen at the Observation Point, and as a consequence passed to
the first Selector in the Association. The packetsSelected
Information Element contains the number of packets selected by the
various Selectors in the Associations.
The Attained Selection Fraction can be calculated for each Selector
by dividing the number of packets selected for that Selector by the
previous value.
The statistics for the whole sequence SHOULD be taken at a single
logical point in time, the input value for a Selector MUST equal the
output value of the previous selector.
Example of Associations Statistics Report Interpretation:
Associations set 7 (Filter->Sampling):
Observed 100 (observationPointID 1, Interface 5)
Selected 50 (selectorId 5, match IPV4SourceAddress 10.0.0.1)
Selected 6 (selectorId 10, Sampler: Random one out-of ten)
Associations set 9 (Sampling->Filtering):
Observed 100 (observationPointID 1, Interface 5)
Selected 10 (selectorId 10, Sampler: Random one out-of ten)
Selected 3 (selectorId 5, match IPV4SourceAddress 10.0.0.1)
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 30 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 267 | Field Count = 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 | Scope 1 = AssociationsId |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 | Option 1 = packetsObserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Length = 4 | Option 2 = packetsSelected |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 2 Length = 4 | Option 4 = packetsSelected |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 3 Length = 4 | Option 5 = packetsSelected |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 4 Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The associate IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 267 | Length = 24 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: AssociationsId = 7 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: packetsObserved = 100 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: packetsSelected = 50 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: packetsSelected = 6 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: AssociationsId = 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: packetsObserved = 100 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: packetsSelected = 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: packetsSelected = 3 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure K: Example of the Association Statistics Report
Interpretation
Notes:
* The Attained Packet Fractions for the first set of Associations
are:
Filter 10: 50/100
Sampler 5: 6/50
Number of samples sent to Metering Process: 6
* The Attained Packet Fractions for the second set of Associations
are:
Sampler 5: 10/100
Filter 10: 3/10
Number of samples sent to Metering Process: 3
7.4.4 Accuracy Report Interpretation
The inherent accuracy of the Information Elements in the Packet
Report MUST be reported in order to enable the Collector to determine
the accuracy of the measurements.
EDITOR'S NOTE: to be completed
7.4.5 Observation Point Report Interpretation
For each Observation Point, an Observation Option Report
Interpretation MAY be sent.
EDITOR'S NOTE: to be completed
8. 8.
Security Considerations Security Considerations
As IPFIX has been selected as the PSAMP export protocol and as the As IPFIX has been selected as the PSAMP export protocol and as the
PSAMP security requirements are not stricter than the IPFIX security PSAMP security requirements are not stricter than the IPFIX security
requirements, refer to the IPFIX export protocol [IPFIX-PROTO] for requirements, refer to the IPFIX export protocol [IPFIX-PROTO] for
the security considerations. the security considerations.
9. 9.
IANA Considerations IANA Considerations
The only IANA considerations in this document concerns the extension The only IANA considerations in this document concern the extension
of Information Elements, FlowSet ID and Scope. Refer to the IANA of Information Elements, Set ID and Scope. Refer to the IANA
considerations section in [IPFIX-PROTO] where those possible new considerations section in [IPFIX-PROTO] where those possible new
assignments are specified. assignments are specified.
10. 10.
References References
10.1 10.1
Normative References Normative References
[PSAMP-SAMPLE-TECH] T. Zseby, M. Molina, F. Raspall, N. Duffield [PSAMP-TECH] T. Zseby, M. Molina, N. Duffield, S. Niccolini, F.
"Sampling and Filtering Techniques for IP Packet Selection" draft- Raspall, "Sampling and Filtering Techniques for IP Packet Selection"
ietf-psamp-sample-tech-01.txt draft-ietf-psamp-sample-tech-07.txt
[PSAMP-MIB] T. Dietz, D. Romascanu, B. Claise "Definitions of [PSAMP-MIB] T. Dietz, B. Claise "Definitions of Managed Objects for
Managed Objects for Packet Sampling" draft-ietf-psamp-mib-01.txt Packet Sampling" draft-ietf-psamp-mib-04.txt
[PSAMP-INFO] T. Dietz, F. Dressler, G. Carle, B. Claise,
"Information Model for Packet Sampling Exports", draft-ietf-psamp-
info-00.txt
[IPFIX-ARCH] G. Sadasivan, N. Brownlee "Architecture Model for IP [PSAMP-INFO] T. Dietz, F. Dressler, G. Carle, B. Claise, "Information
Flow Information Export" draft-ietf-ipfix-arch-02.txt", June 2003 Model for Packet Sampling Exports", draft-ietf-psamp-info-02.txt
[IPFIX-INFO] P. Calato, J. Meyer, J. Quittek, "Information Model for [IPFIX-ARCH] G. Sadasivan, N. Brownlee, B. Claise, J. Quittek,
IP Flow Information Export" draft-ietf-ipfix-info-02, August 2003 "Architecture Model for IP Flow Information Export" draft-ietf-ipfix-
arch-08.txt"
[IPFIX-PROTO] B. Claise, M. Fullmer, P. Calato, R. Penno, "IPFIX [IPFIX-INFO] J. Quittek, S. Bryant, B. Claise, J. Meyer, "Information
Protocol Specifications", draft-ietf-ipfix-protocol-02.txt, June Model for IP Flow Information Export" draft-ietf-ipfix-info-11
2003
[RFC1771] Y. Rekhter, T. Li, "A Border Gateway Protocol 4 (BGP- [IPFIX-PROTO] B. Claise (Editor) "IPFIX Protocol Specifications",
4)", RFC 1771, March 1995. draft-ietf-ipfix-protocol-19.txt
[RFC1771] Y. Rekhter, T. Li, "A Border Gateway Protocol 4 (BGP-4)",
RFC 1771, March 1995.
10.2 10.2
Informative References Informative References
[PSAMP-FRAMEWORK] N. Duffield, D. Chiou, B. Claise, A. Greenber, M. [PSAMP-FMWK] D. Chiou, B. Claise, N. Duffield, A. Greenberg, M.
Grossglauser "A Framework for Passive Packet Measurement" draft- Grossglauser, P. Marimuthu, J. Rexford, G. Sadasivan, "A Framework
ietf-psamp-framework-04.txt for Passive Packet Measurement" draft-ietf-psamp-framework-10.txt
[IPFIX-REQ] J. Quittek, T. Zseby, B. Claise, S. Zander, [RFC3917] J. Quittek, T. Zseby, B. Claise, S. Zander, "Requirements
"Requirements for IP Flow Information Export" draft-ietf-ipfix-reqs- for IP Flow Information Export", RFC 3917, October 2004
10.txt, June 2003
11. 11.
Acknowledgments Acknowledgments
To be completed. The authors would like to thank the PSAMP group, especially Paul
Aitken for fruitful discussions and for proofreading the document.
Author’s Addresses Authors' Addresses
Benoit Claise Benoit Claise
Cisco Systems Cisco Systems
De Kleetlaan 6a b1 De Kleetlaan 6a b1
1831 Diegem 1831 Diegem
Belgium Belgium
Phone: +32 2 704 5622 Phone: +32 2 704 5622
E-mail: bclaise@cisco.com E-mail: bclaise@cisco.com
Juergen Quittek Juergen Quittek
NEC Europe Ltd. NEC Europe Ltd.
Network Laboratories Network Laboratories
Kurfuersten-Anlage 36 Kurfuersten-Anlage 36
69115 Heidelberg 69115 Heidelberg
Germany Germany
Phone: +49 6221 90511-15 Phone: +49 6221 90511-15
Email: quittek@ccrle.nec.de Email: quittek@ccrle.nec.de
Andrew Johnson
Cisco Systems
96 Commercial Quay
Edinburgh EH6 6LX
Scotland
Phone: +44 131 561 3641
Email: andrjohn@cisco.com
Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at ietf-
ipr@ietf.org.
The IETF has been notified of intellectual property rights claimed in
regard to some or all of the specification contained in this
document. For more information consult the online list of claimed
rights.
Disclaimer of Validity
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Copyright Statement
Copyright (C) The Internet Society (2005). This document is subject
to the rights, licenses and restrictions contained in BCP 78, and
except as set forth therein, the authors retain all their rights.
Acknowledgment
Funding for the RFC Editor function is currently provided by the
Internet Society
 End of changes. 83 change blocks. 
362 lines changed or deleted 1564 lines changed or added

This html diff was produced by rfcdiff 1.27, available from http://www.levkowetz.com/ietf/tools/rfcdiff/