draft-ietf-psamp-protocol-02.txt   draft-ietf-psamp-protocol-03.txt 
PSAMP working group PSAMP working group
Internet Draft EDITOR: B. Claise Internet Draft EDITOR: B. Claise
draft-ietf-psamp-protocol-02.txt Cisco Systems draft-ietf-psamp-protocol-03.txt Cisco Systems
Expires: April 2006 October 2005 Expires: April 2006 October 2005
Packet Sampling (PSAMP) Protocol Specifications Packet Sampling (PSAMP) Protocol Specifications
Status of this Memo Status of this Memo
By submitting this Internet-Draft, each author represents that any By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79. aware will be disclosed, in accordance with Section 6 of BCP 79.
skipping to change at page 2, line 14 skipping to change at page 2, line 14
document specifies in detail how the IPFIX protocol is used for document specifies in detail how the IPFIX protocol is used for
PSAMP export of packet information. PSAMP export of packet information.
Conventions used in this document Conventions used in this document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119. document are to be interpreted as described in RFC 2119.
Table of Contents Table of Contents
1. Points of Discussion........................................3 1. Points of Discussion.........................................3
1.1 Open Issues................................................3 1.1 Open Issues................................................3
1.2 Action Items...............................................4 1.2 Action Items...............................................4
2. Introduction................................................5 2. Introduction.................................................4
3. PSAMP Documents Overview....................................5 3. PSAMP Documents Overview.....................................5
4. Terminology.................................................6 4. Terminology..................................................5
4.1 IPFIX Terminology..........................................6 4.1 IPFIX Terminology..........................................6
4.2 PSAMP Terminology.........................................10 4.2 PSAMP Terminology.........................................10
4.2.1 Observation Points, Packet Streams and Packet Content11 4.2.1 Packet Streams and Packet Content......................10
4.2.2 Selection Process....................................11 4.2.2 Selection Process......................................11
4.2.3 Reporting Process....................................13 4.2.3 Reporting..............................................12
4.2.4 Measurement Process..................................13 4.2.4 Exporting Process......................................13
4.2.5 Exporting Process....................................14 4.2.5 PSAMP Device...........................................13
4.2.6 PSAMP Device.........................................14 4.2.6 Selection Methods......................................13
4.2.7 Selection Methods....................................14 4.3 IPFIX and PSMAP Terminology Comparison....................15
4.3 IPFIX and PSMAP Terminology Comparison....................16 4.3.1 PSAMP and IPFIX Processes..............................16
4.3.1 PSAMP and IPFIX Processes............................16 4.3.2 Packet Report, Packet Interpretation, and Data Record..16
4.3.2 Packet Report, Packet Interpretation, and Data Record17 5. Differences between PSAMP and IPFIX.........................16
5. Differences between PSAMP and IPFIX........................17 5.1 Architecture Point of View................................16
5.1 Architecture Point of View................................17 5.2 Protocol Point of View....................................18
5.2 Protocol Point of View....................................19 5.3 Information Model Point of View...........................18
5.3 Information Model Point of View...........................19 6. PSAMP Requirements versus the IPFIX Solution................19
6. PSAMP Requirements versus the IPFIX Solution...............20 6.1 IPFIX Solution for the PSAMP Requirements.................19
6.1 IPFIX Solution for the PSAMP Requirements.................20 6.2 High Level View of the Integration........................21
6.2 High Level View of the Integration........................22 7. Using the IPFIX Protocol for PSAMP..........................22
7. Using the IPFIX Protocol for PSAMP.........................23 7.1 Selector ID...............................................22
7.1 Selector ID...............................................23 7.2 The Associations..........................................22
7.2 The Associations..........................................23 7.3 Packet Reports............................................22
7.3 Packet Reports............................................23 7.3.1 Basic Packet Reports...................................22
7.3.1 Basic Packet Reports.................................23 7.3.2 Extended Packet Reports................................24
7.3.2 Extended Packet Reports..............................25 7.4 Report Interpretation.....................................25
7.4 Report Interpretation.....................................26 7.4.1 Associations Report Interpretation.....................25
7.4.1 Associations Report Interpretation...................26 7.4.2 Selector Report Interpretation.........................27
7.4.2 Selector Report Interpretation.......................29 7.4.2.1 Systematic Count-Based Sampling.......................28
7.4.2.1 Systematic Count-Based Sampling......................29 7.4.2.2 Systematic Time-Based Sampling........................29
7.4.2.2 Systematic Time-Based Sampling.......................30 7.4.2.3 Random n-out-of-N Sampling............................30
7.4.2.3 Random n-out-of-N Sampling...........................31 7.4.2.4 Uniform Probabilistic Sampling........................31
7.4.2.4 Uniform Probabilistic Sampling.......................33 7.4.2.5 Property Match Filtering..............................32
7.4.2.5 Non-uniform Probabilistic Sampling...................33 7.4.2.6 Hash-Based Filtering..................................34
7.4.2.6 Non-uniform Flow State Sampling......................33 7.4.2.7 Other Selection Methods...............................34
7.4.2.7 Match Based Filtering and Router State Filtering.....33 7.4.3 Associations Statistics Report Interpretation..........34
7.4.2.8 Hash Based Filtering.................................35 7.4.4 Accuracy Report Interpretation.........................37
7.4.3 Associations Statistics Report Interpretation........35 7.4.5 Observation Point Report Interpretation................37
7.4.4 Accuracy Report Interpretation.......................37 8. Security Considerations.....................................37
7.4.5 Observation Point Report Interpretation..............37 9. IANA Considerations.........................................37
8. Security Considerations....................................37 9.1 IPFIX Related Considerations..............................37
9. IANA Considerations........................................38 9.2 PSAMP Related Considerations..............................37
10. References................................................38 10. References.................................................38
10.1 Normative References.....................................38 10.1 Normative References.....................................38
10.2 Informative References...................................38 10.2 Informative References...................................38
11. Acknowledgments...........................................38 11. Acknowledgments............................................39
1. 1. Points of Discussion
Points of Discussion
1.1 1.1 Open Issues
Open Issues
This section covers the open issues, still to be resolved/updated in This section covers the open issues, still to be resolved/updated in
this draft: this draft:
PROTO-01 [PSAMP-FMWK] mentions the optional Export Packets
compression (see section 8.5) Should we mention this in this
document?
PROTO-02 From a protocol point of view, there a no differences
between the Field Match Filtering and the Router State Filtering as
defined in [PSAMP-TECH]. The only difference concerns the I.E. on
which we do the filtering... part of the packet in one case, not part
of the packet in the other case. Proposal: merge the 2 methods in
[PSAMP-TECH]
PROTO-03 The second open issue is concerned with reporting the
sequential order of sampling and filtering. => order of the scope.
We spot a new problem: we could export twice the hash value. How to
distinguish them? How to know that the hash value 1 corresponds to a
specific definition specified in an Option Template.
PROTO-04 Should probably have a separate section for the examples? PROTO-04 Should probably have a separate section for the examples?
PROTO-05 Transport protocol: SCTP and/or UDP and/or TCP. Nothing is
mentioned at this stage. [PSAMP-FMWK] and PSAMP charter specifically
mention UDP.
PROTO-06 Even if the notion of Associations ID is mentioned in
[PSAMP-TECH], maybe a term such as SelectionPath or PathID would be
more appropriate.
PROTO-07 Even if [PSAMP-TECH] section 7.1 and 7.2 describes that "The
ASSOCIATIONS field describes the Observation Point and optionally the
IPFIX processes to which the packet Selector is associated. Values:
<STREAM ID, IPFIX Metering process ID, IPFIX Exporting process ID,
IDs of other associated processes>", we can't see an example where
the IPFIX process(es) ID would be required. Don't we have enough with
the list of Selector IDs?
PROTO-08 Instead of sending the input sequence number for each PROTO-08 Instead of sending the input sequence number for each
selector ID, a counter64 value, associated with every packet, the selector ID, a counter64 value, associated with every packet, the
working group should discuss the possibility to send the information working group should discuss the possibility to send the information
on regular basis with an option template record. Specifically in the on regular basis with an option template record. Specifically in the
case of Composite Selector, we would send multiple times a 64-bit case of Composite Selector, we would send multiple times a 64-bit
counter in each packet. counter in each packet.
PROTO-09 "The algorithm specific Information Elements, defining
configuration parameters for match-based and router state filtering,
are taken from the full range of available IPFIX Information Elements
[IPFIX-INFO]". What about the ones from [PSAMP-INFO]? In other words,
are they I.E.s in [PSAMP-INFO] that we could use for the match-based
and router state filtering?
PROTO-10 We probably don't need the section 6.2 named "High Level
view of the integration", as this section was an intermediate step in
an interim version of the draft. To be discussed.
PROTO-11 Discuss how to implement the accuracy report interpretation PROTO-11 Discuss how to implement the accuracy report interpretation
PROTO-12 Discuss how to implement the observation point report PROTO-12 Discuss how to implement the observation point report
interpretation (if we need one) interpretation (if we need one)
PROTO-13 The solution in this document is based on the fact that PROTO-16 IANA considerations section to be completed.
https://psg.com/lists/psamp/psamp.2005/msg00050.html is taken into Two questions:
account. That means: no range for the filtering 1. I'm not too sure whether we should mandate a new IETF RFC for the
new selection method description?
2. I'm not too sure whether we should mandate new IANA-registered
information elements for the new selection method?
In other words, can we have proprietary selection method in the
selectorAlgorithm Information Element?
1.2 PROTO-17 "Encrypted Packets: Selectors that interpret packet fields
Action Items must be configurable to ignore (i.e. not select) encrypted packets,
when they are detected". "Since packet encryption alters the meaning
of encrypted fields, field match filtering must be configurable to
ignore encrypted packets, when detected." I guess we will need extra
text for this.
PROTO-101 See EDITOR'S NOTE PROTO-18 "The exporting process must have an export rate limit,
configurable per Exporting Process". I guess we need extra text for
this.
PROTO-102 insert double spaces after the end of each sentence. PROTO-19 "the timestamp of observation of the packet at the
Observation Point. The timestamp should be reported to microsecond
resolution." Nothing is mentioned in this draft regarding this issue.
PROTO-103 Should briefly discuss the fact that PSAMP is OK with IPFIX PROTO-20 Hash based filtering to be completed.
requirements in terms of time (uSec precision)
1.2 Action Items
PROTO-101 See EDITOR'S NOTE
PROTO-104 Fix the terminology sections, as a last step before PROTO-104 Fix the terminology sections, as a last step before
publication publication
PROTO-105 Section 6 about "PSAMP requirements": check if any changes
with the version 5 of [PSAMP-FMWK]. This draft is based on ietf-
psamp-framework-04.txt.
PROTO-106 Extend security considerations by a discussion on exported PROTO-106 Extend security considerations by a discussion on exported
Payload. Consider whether [PSAMP-INFO] or [PSAMP-PROTO] or both Payload. Consider whether [PSAMP-INFO] or [PSAMP-PROTO] or both
is/are the place(s). is/are the place(s).
PROTO-107 All the examples in section 7 should contain the PROTO-107 Provide the equivalent for variable length I.E.
Information Element ID instead of the Information Element name. Here is an example of a basic Packet Report, with a SelectionPath
Example: Option 3 = samp.PacketSpace value of 9 (will be explained later on) and ipPacketSection
Corrected Example: Option 3 = 305 Information Element of 12 bytes, encoded with a fixed length.
This is an example of PROTO-15, to be put in section 7.3.1
2. PROTO-108 Have a statement that this protocol specification
Introduction meets all requirements for the PSAMP protocol stated in the framework
except ... An then have a list of bullets, where at minimum there is
stated "not yet covered" or a longer explanation why it is not
covered. This would be replacement for the long list of requirements
in section 6.1
2. Introduction
The name PSAMP is a contraction of the phrase Packet SAMPling. The The name PSAMP is a contraction of the phrase Packet SAMPling. The
word "sampling" captures the idea that only a subset of all packets word "sampling" captures the idea that only a subset of all packets
passing a network element will be selected for reporting. PSAMP passing a network element will be selected for reporting. PSAMP
selection operations include random selection, deterministic selection operations include random selection, deterministic
selection (filtering), and deterministic approximations to random selection (filtering), and deterministic approximations to random
selection (hash-based selection). selection (hash-based selection).
The IP Flow information export (IPFIX) protocol specified in [IPFIX- The IP Flow information export (IPFIX) protocol specified in [IPFIX-
PROTO] exports IP traffic information [IPFIX-INFO] observed at PROTO] exports IP traffic information [IPFIX-INFO] observed at
network devices. This matches the general protocol requirements network devices. This matches the general protocol requirements
outlined in the PSAMP framework [PSAMP-FMWK]. However, there are some outlined in the PSAMP framework [PSAMP-FMWK]. However, there are
architectural differences between IPFIX and PSAMP in the requirements some architectural differences between IPFIX and PSAMP in the
for an export protocol. While the IPFIX architecture [IPFIX-ARCH] is requirements for an export protocol. While the IPFIX architecture
focused on gathering and exporting IP traffic flow information, the [IPFIX-ARCH] is focused on gathering and exporting IP traffic flow
focus of the PSAMP framework [PSAMP-FMWK] is on exporting information information, the focus of the PSAMP framework [PSAMP-FMWK] is on
on individual packets. This basic difference and a set of derived exporting information on individual packets. This basic difference
differences in protocol requirements are outlined in Section 5. and a set of derived differences in protocol requirements are
Despite these differences, the IPFIX protocol is well suited as PSAMP outlined in Section 5. Despite these differences, the IPFIX protocol
protocol. Section 5 specifies how the IPFIX protocol is used for the is well suited as PSAMP protocol. Section 5 specifies how the IPFIX
export of packet samples. Required extensions of the IPFIX protocol is used for the export of packet samples. Required
information model are specified in the PSAMP information model extensions of the IPFIX information model are specified in the PSAMP
[PSAMP-INFO]. information model [PSAMP-INFO].
3. 3. PSAMP Documents Overview
PSAMP Documents Overview
[PSAMP-FMWK]: "A Framework for Packet Selection and Reporting", [PSAMP-FMWK]: "A Framework for Packet Selection and Reporting",
describes the PSAMP framework for network elements to select subsets describes the PSAMP framework for network elements to select subsets
of packets by statistical and other methods, and to export a stream of packets by statistical and other methods, and to export a stream
of reports on the selected packets to a collector. of reports on the selected packets to a collector.
[PSAMP-TECH]: "Sampling and Filtering Techniques for IP Packet [PSAMP-TECH]: "Sampling and Filtering Techniques for IP Packet
Selection", describes the set of packet selection techniques Selection", describes the set of packet selection techniques
supported by PSAMP. supported by PSAMP.
[PSAMP-PROTO]: "Packet Sampling (PSAMP) Protocol Specifications" [PSAMP-PROTO]: "Packet Sampling (PSAMP) Protocol Specifications"
(this document), specifies the export of packet information from a (this document), specifies the export of packet information from a
PSAMP Exporting Process to a PSAMP Colleting Process PSAMP Exporting Process to a PSAMP Colleting Process
[PSAMP-INFO]: "Information Model for Packet Sampling Exports" defines [PSAMP-INFO]: "Information Model for Packet Sampling Exports" defines
an information and data model for PSAMP. an information and data model for PSAMP.
[PSAMP-MIB]: "Definitions of Managed Objects for Packet Sampling" [PSAMP-MIB]: "Definitions of Managed Objects for Packet Sampling"
describes the PSAMP Management Information Base describes the PSAMP Management Information Base
4. 4. Terminology
Terminology
As the IPFIX export protocol is used to export the PSAMP information, As the IPFIX export protocol is used to export the PSAMP information,
the relevant IPFIX terminology from [IPFIX-PROTO] is copied over in the relevant IPFIX terminology from [IPFIX-PROTO] is copied over in
this document. The terminology summary table in section 4.1 gives a this document. The terminology summary table in section 4.1 gives a
quick overview of the relationships between the different IPFIX quick overview of the relationships between the different IPFIX
terms. The PSAMP terminology defined here is fully consistent with terms. The PSAMP terminology defined here is fully consistent with
all terms listed in [PSAMP-TECH] and [PSAMP-FMWK] but only all terms listed in [PSAMP-TECH] and [PSAMP-FMWK] but only
definitions that are only relevant to the PSAMP protocol appear here. definitions that are only relevant to the PSAMP protocol appear here.
The section 5.4 applies the PSAMP terminology to the IPFIX protocol The section 5.4 applies the PSAMP terminology to the IPFIX protocol
terminology. terminology.
4.1 4.1 IPFIX Terminology
IPFIX Terminology
EDITOR'S NOTE: The terminology has been entirely copied over from EDITOR'S NOTE: The terminology has been entirely copied over from
[IPFIX-PROTO]. Before publication, we should evaluate which terms [IPFIX-PROTO]. Before publication, we should evaluate which terms
should be kept, if not all. The ones required for sure so far are: should be kept, if not all. The ones required for sure so far are:
Flow Record, Flow, Information Element, Metering Process, Collector, Flow Record, Flow, Information Element, Metering Process, Collector,
Scope, Set, Template Record, Data Record, Data Set, Template Set, Scope, Set, Template Record, Data Record, Data Set, Template Set,
Template Record(s), Options Template Set, Options Template Record. Template Record(s), Options Template Set, Options Template Record.
Note: the IPFIX Exporting Process was not used, as the PSAMP Note: the IPFIX Exporting Process was not used, as the PSAMP
Exporting Process is more specific. Exporting Process is more specific.
skipping to change at page 10, line 45 skipping to change at page 10, line 20
| Data Set | / | Data Record(s) | | Data Set | / | Data Record(s) |
+------------------+--------------------+------------------------+ +------------------+--------------------+------------------------+
| Template Set | Template Record(s) | / | | Template Set | Template Record(s) | / |
+------------------+--------------------+------------------------+ +------------------+--------------------+------------------------+
| Options Template | Options Template | / | | Options Template | Options Template | / |
| Set | Record(s) | | | Set | Record(s) | |
+------------------+--------------------+------------------------+ +------------------+--------------------+------------------------+
Figure A: Terminology Summary Table Figure A: Terminology Summary Table
4.2 4.2 PSAMP Terminology
PSAMP Terminology
EDITOR'S NOTE: The terminology has been entirely copied over from EDITOR'S NOTE: The terminology has been entirely copied over from
[PSAMP-TECH], except for some (almost) similar terms where only the [PSAMP-TECH], except for some (almost) similar terms where only the
IPFIX terms were kept (for example, observation point). Before IPFIX terms were kept (for example, observation point). Before
publication, we should evaluate which terms should be kept. The ones publication, we should evaluate which terms should be kept. The ones
required for sure so far are: Selector, Composite Selector, Packet required for sure so far are: Selector, Composite Selector, Packet
Reports, Packet Interpretation, PSAMP device, Collector, Filtering, Reports, Packet Interpretation, PSAMP device, Collector, Filtering,
Sampling. Note that the terms Selector ID and Association ID, coming Sampling. Note that the terms Selector ID and Association ID, coming
from [PSAMP-FMWK], has been added in the Selection Process section. from [PSAMP-FMWK], has been added in the Selection Process section.
4.2.1 Observation Points, Packet Streams and Packet Content 4.2.1 Packet Streams and Packet Content
Observed Packet Stream Observed Packet Stream
The Observed Packet Stream is the set of all packets observed at the The Observed Packet Stream is the set of all packets observed at the
Observation Point. Observation Point.
Packet Stream Packet Stream
A packet stream denotes a subset of the Observed Packet Stream that A packet stream denotes a set of packets that flows past some
flows past some specified point within the measurement process. An specified point within the Selection Process. An example of a Packet
example of a Packet Stream is the output of the selection process. Stream is the output of the selection process. Note that packets
selected from a stream, e.g. by Sampling, do not necessarily possess
a property by which they can be distinguished from packets that have
not been selected. For this reason the term "stream" is favored over
"flow", which is defined as set of packets with common properties
[IPFIX-REQ].
Packet Content Packet Content
The packet content denotes the union of the packet header (which The packet content denotes the union of the packet header (which
includes link layer, network layer and other encapsulation headers) includes link layer, network layer and other encapsulation headers)
and the packet payload. and the packet payload.
4.2.2 Selection Process 4.2.2 Selection Process
Selection Process Selection Process
A Selection Process takes the Observed Packet Stream as its input and A Selection Process takes the Observed Packet Stream as its input and
selects a subset of that stream as its output. selects a subset of that stream as its output.
skipping to change at page 11, line 37 skipping to change at page 11, line 18
4.2.2 Selection Process 4.2.2 Selection Process
Selection Process Selection Process
A Selection Process takes the Observed Packet Stream as its input and A Selection Process takes the Observed Packet Stream as its input and
selects a subset of that stream as its output. selects a subset of that stream as its output.
Selection State Selection State
A Selection Process may maintain state information for use by the A Selection Process may maintain state information for use by the
Selection Process and/or the reporting process. At a given time, the Selection Process. At a given time, the Selection State may depend
Selection State may depend on packets observed at and before that on packets observed at and before that time, and other variables.
time, and other variables. Examples include: Examples include:
(i) sequence numbers of packets at the input of Selectors; (i) sequence numbers of packets at the input of Selectors;
(ii) a timestamp of observation of the packet at the (ii) a timestamp of observation of the packet at the
Observation Point; Observation Point;
(iii) iterators for pseudorandom number generators; (iii) iterators for pseudorandom number generators;
(iv) hash values calculated during selection; (iv) hash values calculated during selection;
(v) indicators of whether the packet was selected by a (v) indicators of whether the packet was selected by a
given Selector; given Selector;
Selection Processes may change portions of the Selection State as a Selection Processes may change portions of the Selection State as a
result of processing a packet. Selection state for a packet is to result of processing a packet. Selection state for a packet is to
reflect the state after processing the packet. reflect the state after processing the packet.
Selector Selector
A Selector defines the action of a Selection Process on a single A Selector defines the action of a Selection Process on a single
skipping to change at page 12, line 20 skipping to change at page 11, line 47
Selector Selector
A Selector defines the action of a Selection Process on a single A Selector defines the action of a Selection Process on a single
packet of its input. If selected, the packet becomes an element of packet of its input. If selected, the packet becomes an element of
the output Packet Stream. the output Packet Stream.
The Selector can make use of the following information in determining The Selector can make use of the following information in determining
whether a packet is selected: whether a packet is selected:
(i) the packet's content; (i) the Packet Content;
(ii) information derived from the packet's treatment at the (ii) information derived from the packet's treatment at the
Observation Point; Observation Point;
(iii) any selection state that may be maintained by the (iii) any selection state that may be maintained by the
Selection Process. Selection Process.
Composite Selector Composite Selector
A Composite Selector is an ordered composition of Selectors, in which A Composite Selector is an ordered composition of Selectors, in which
the output Packet Stream issuing from one Selector forms the input the output Packet Stream issuing from one Selector forms the input
Packet Stream to the succeeding Selector. Packet Stream to the succeeding Selector.
Primitive Selector Primitive Selector
A Selector is primitive if it is not a Composite Selector. A Selector is primitive if it is not a Composite Selector.
Selector ID Selector ID
The Selector ID is the unique ID identifying a Primitive Selector. The Selector ID is the unique ID identifying a Primitive Selector.
The ID is unique within the Observation Domain.
Associations ID Selection Path
From all the packets observed at an Observation Point, only a few From all the packets observed at an Observation Point, only a few
packets are selected by one or more Selectors. The Associations ID is packets are selected by one or more Selectors. The Selection Path is
a unique value describing the Observation Point and the Selector IDs a unique value describing the Observation Point and the Selector IDs
through which the packets are selected. The Associations ID is through which the packets are selected. The Selection Path is unique
represented by the associationsID Information Element [PSAMP-INFO]. per Observation Domain. The Selection Path is represented by the
selectionPath Information Element [PSAMP-INFO].
4.2.3 Reporting Process
Reporting Process
A Reporting Process creates a Report Stream on packets selected by a
Selection Process, in preparation for export. The input to the
Reporting Process comprises that information available to the
Selection Process per selected packet, specifically:
(i) the selected packet's content;
(ii) information derived from the selected packet's
treatment at the Observation Point;
(iii) any Selection State maintained by the inputting 4.2.3 Reporting
Selection Process, reflecting any modifications to the
Selection State made during selection of the packet.
Packet Reports Packet Reports
Packet Reports comprise a configurable subset of a packet's input to Packet Reports comprise a configurable subset of a packet's input to
the reporting process, including the packet's content, information the Selection Process, including the Packet Content, information
relating to its treatment (for example, the output interface), and relating to its treatment (for example, the output interface), and
its associated selection state (for example, a hash of the packet's its associated selection state (for example, a hash of the Packet
content) Content)
Report Interpretation: Report Interpretation:
Report Interpretation comprises subsidiary information, relating to Report Interpretation comprises subsidiary information, relating to
one or more packets, that is used for interpretation of their packet one or more packets, that are used for interpretation of their Packet
reports. Examples include configuration parameters of the Selection Reports. Examples include configuration parameters of the Selection
Process and of the Reporting Process. Process.
Report Stream: Report Stream:
The Report Stream is the output of a Reporting Process, comprising The Report Stream is the output of a Selection Process, comprising
two distinguished types of information: Packet Reports, and Report two distinguished types of information: Packet Reports, and Report
Interpretation. Interpretation.
4.2.4 Measurement Process 4.2.4 Exporting Process
Measurement Process
A Measurement Process is the composition of a Selection Process that
takes the Observed Packet Stream as its input, followed by a
Reporting Process.
4.2.5 Exporting Process
Exporting Process: Exporting Process:
An Exporting Process sends, in the form of Export Packet, the output An Exporting Process sends, in the form of Export Packet, the output
of one or more Measurement Processes to one or more Collectors. of one or more Selection Processes to one or more Collectors.
Export Packet: Export Packet:
An Export Packet is a combination of Report Interpretation and/or one An Export Packet is a combination of Report Interpretation and/or one
or more Packet Reports are bundled by the Exporting Process into a or more Packet Reports are bundled by the Exporting Process into a
Export Packet for exporting to a Collector. Export Packet for exporting to a Collector.
4.2.6 PSAMP Device 4.2.5 PSAMP Device
PSAMP Device PSAMP Device
A PSAMP Device is a device hosting at least an Observation Point, a A PSAMP Device is a device hosting at least an Observation Point, a
Measurement Process and an Exporting Process. Typically, Selection Process and an Exporting Process. Typically, corresponding
corresponding Observation Point(s), Measurement Process(es) and Observation Point(s), Selection Process(es) and Exporting Process(es)
Exporting Process(es) are co-located at this device, for example at a are co-located at this device, for example at a router.
router.
4.2.7 Selection Methods 4.2.6 Selection Methods
Filtering Filtering
A filter is a Selector that selects a packet deterministically based A filter is a Selector that selects a packet deterministically based
on the Packet Content, or its treatment, or functions of these on the Packet Content, or its treatment, or functions of these
occurring in the Selection State. Examples include field match occurring in the Selection State. Examples include field match
Filtering, and Hash-based Selection. Filtering, and Hash-based Selection.
Sampling Sampling
skipping to change at page 16, line 25 skipping to change at page 15, line 27
Configured Selection Fraction Configured Selection Fraction
The Configured Selection Fraction is the ratio of the number of The Configured Selection Fraction is the ratio of the number of
packets selected by a Selector from an input Population, to the packets selected by a Selector from an input Population, to the
Population Size, as based on the configured selection parameters. Population Size, as based on the configured selection parameters.
Attained Selection Fraction Attained Selection Fraction
The Attained Selection Fraction is the actual ratio of the The Attained Selection Fraction is the actual ratio of the
number of packets selected by a Selector from an input number of packets selected by a Selector from an input
Population, to the Population Size. Population, to the Population Size. For some Sampling methods the
For some sampling methods the Attained Selection Fraction can differ Attained Selection Fraction can differ from the Configured Selection
from the Configured Selection Fraction due to, for example, the Fraction due to, for example, the inherent statistical variability in
inherent statistical variability in sampling decisions of Sampling decisions of probabilistic Sampling and Hash-based
probabilistic Sampling and Hash-based Selection. Nevertheless, for Selection. Nevertheless, for large Population Sizes and properly
large Population Sizes and properly configured Selectors, the configured Selectors, the Attained Selection Fraction usually
Attained Selection Fraction usually approaches the Configured approaches the Configured Selection Fraction.
Selection Fraction.
4.3 4.3 IPFIX and PSMAP Terminology Comparison
IPFIX and PSMAP Terminology Comparison
EDITOR'S NOTE: EDITOR'S NOTE:
Some terms between IPFIX and PSAMP were almost similar but not Some terms between IPFIX and PSAMP were almost similar but not
quite: quite:
- observation point. I kept the one from IPFIX. However, if the - observation point. I kept the one from IPFIX. However, if the
PSAMP/IPFIX definitons would be aligned, it would better. PSAMP/IPFIX definitons would be aligned, it would better.
- exporting process. I kept the one from PSAMP - exporting process. I kept the one from PSAMP.
- Collector: I kept the one from IPFIX, which implies that I used - Collector: I kept the one from IPFIX, which implies that I used
the Collecting Process defined in IPFIX (it speaks about flows, but the Collecting Process defined in IPFIX (it speaks about flows, but
there is no PSAMP Collecting Process definition) there is no PSAMP Collecting Process definition)
The PSAMP terminology has been specified with an IPFIX background, as The PSAMP terminology has been specified with an IPFIX background, as
PSAMP and IPFIX have similar terms. However, this section explains a PSAMP and IPFIX have similar terms. However, this section explains a
couple of non compatible terms between IPFIX and PSAMP. couple of non compatible terms between IPFIX and PSAMP.
4.3.1 PSAMP and IPFIX Processes 4.3.1 PSAMP and IPFIX Processes
The figure B indicates the sequence of the three processes
(selection, reporting, and exporting) within the PSAMP Device. The
composition of the Selection Process followed by the Reporting
Process is known as the Measurement Process.
+---------+ +---------+ +---------+ The figure B indicates the sequence of the processes (selection and
Observed |Selection| |Reporting| |Exporting| exporting) within the PSAMP Device.
Packet--->|Process |--->|Process |--->|Process |--->Collector
Stream +---------+ +---------+ +---------+ +----------+ +-----------+
\----Measurement Process-----/ Observed | Metering | | Exporting |
Packet--->| Process |----->| Process |--->Collector
Stream +----------+ +-----------+
Figure B: PSAMP Processes Figure B: PSAMP Processes
The PSAMP Measurement Process can be viewed as analogous to the IPFIX The Selection Process, which takes an Observed Packet Stream as its
Metering Process. The PSAMP Measurement Process takes an Observed input, and produces Packet Reports as its output, is an integral part
Packet Stream as its input, and produces Packet Reports as its of the Metering Process, which by its definition, produces Flow
output. The IPFIX Metering Process produces Flow Records as its Records as its output.
output. The distinct name "Measurement Process" has been retained in
PSAMP in order to avoid potential confusion in settings where IPFIX
and PSAMP coexist, and in order to avoid the implicit requirement
that the PSAMP version satisfy the requirements of an IPFIX Metering
Process.
4.3.2 Packet Report, Packet Interpretation, and Data Record 4.3.2 Packet Report, Packet Interpretation, and Data Record
The PSAMP terminology speaks of Packet Report and Packet The PSAMP terminology speaks of Packet Report and Packet
Interpretation, while the IPFIX terminology speaks of Data Record and Interpretation, while the IPFIX terminology speaks of Data Record and
(Option) Template Record. The Packet Report, which comprises (Option) Template Record. The Packet Report, which comprises
information about the observed packet, can be viewed as analogous to information about the observed packet, can be viewed as analogous to
the Data Record defined by a Template Record. The Packet the Data Record defined by a Template Record. The Packet
Interpretation, which comprises subsidiary information used for the Interpretation, which comprises subsidiary information used for the
interpretation of the packet reports, can be viewed as analogous to interpretation of the Packet Reports, can be viewed as analogous to
the Data Record defined by an Option Template Record. the Data Record defined by an Option Template Record.
5. 5.
Differences between PSAMP and IPFIX Differences between PSAMP and IPFIX
The output of the IPFIX working group relevant for this draft is The output of the IPFIX working group relevant for this draft is
structured into three documents: structured into three documents:
- IP Flow information architecture [IPFIX-ARCH] - IP Flow information architecture [IPFIX-ARCH]
- IPFIX Protocol Specifications [IPFIX-PROTO] - IPFIX protocol specifications [IPFIX-PROTO]
- IP Flow information export information model [IPFIX-INFO] - IP Flow information export information model [IPFIX-INFO]
5.1 5.1
Architecture Point of View Architecture Point of View
Traffic Flow measurement as described in the IPFIX requirements Traffic Flow measurement as described in the IPFIX requirements
[RFC3917] and the IPFIX architecture [IPFIX-ARCH] can be separated [RFC3917] and the IPFIX architecture [IPFIX-ARCH] can be separated
into two stages: packet processing and Flow processing. into two stages: packet processing and Flow processing.
The figure C illustrates these stages. The figure C illustrates these stages.
On stage 1, all processing steps act on packets. Packets are On stage 1, all processing steps act on packets. Packets are
captured, time stamped, selected by one or more selection steps and captured, time stamped, selected by one or more selection steps and
finally forwarded to packet classification that maps packets to finally forwarded to packet classification that maps packets to
Flows. The packets selection steps may include filtering and sampling Flows. The packets selection steps may include Filtering and
functions. Sampling functions.
On stage 2, all processing steps act on Flows. After packets are On stage 2, all processing steps act on Flows. After packets are
classified (mapped to Flows), Flows are generated, or updated if they classified (mapped to Flows), Flows are generated, or updated if they
exist already. Flow generation and update steps may be performed exist already. Flow generation and update steps may be performed
repeatedly for aggregating Flows. Finally, Flows are exported. repeatedly for aggregating Flows. Finally, Flows are exported.
Packet sampling as described in the PSAMP framework [PSAMP-FMWK] Packet Sampling as described in the PSAMP framework [PSAMP-FMWK]
covers only stage 1 of the IPFIX architecture with the packet covers only stage 1 of the IPFIX architecture with the packet
classification replaced by packet record export. classification replaced by packet record export.
IPFIX architecture PSAMP framework IPFIX architecture PSAMP framework
packet header packet header packet header packet header
capturing \ capturing capturing \ capturing
| | | | | |
timestamping | timestamping timestamping | timestamping
| | | | | |
skipping to change at page 19, line 8 skipping to change at page 18, line 4
| Flow | | Flow |
| selection | | selection |
| | | | | |
+-------+ | +-------+ |
| | | |
v | v |
Flow Record / Flow Record /
export export
Figure C: Comparison of IPFIX architecture and PSAMP framework Figure C: Comparison of IPFIX architecture and PSAMP framework
5.2 Protocol Point of View
5.2
Protocol Point of View
Concerning the protocol, the major difference between IPFIX and PSAMP Concerning the protocol, the major difference between IPFIX and PSAMP
is that the IPFIX protocol exports Flow Records while the PSAMP is that the IPFIX protocol exports Flow Records while the PSAMP
protocol exports packet records. From a pure export point of view, protocol exports Packet Records. From a pure export point of view,
IPFIX will not distinguish a Flow Record composed of several packets IPFIX will not distinguish a Flow Record composed of several packets
aggregated together, from a Flow Record composed of a single packet. aggregated together, from a Flow Record composed of a single packet.
So the PSAMP export can be seen as special IPFIX Flow Record So the PSAMP export can be seen as special IPFIX Flow Record
containing information about a single packet. containing information about a single packet.
All extensions of the IPFIX protocol that are required to satisfy the All extensions of the IPFIX protocol that are required to satisfy the
PSAMP requirements, have already been incorporated in the IPFIX PSAMP requirements, have already been incorporated in the IPFIX
protocol [IPFIX-PROTO], which was developed in parallel with the protocol [IPFIX-PROTO], which was developed in parallel with the
PSAMP protocol. An example is the need of a data type for protocol PSAMP protocol. An example is the need of a data type for protocol
fields that have flexible length, such as an octet array. This was fields that have flexible length, such as an octet array. This was
added to the IPFIX protocol specification in order to meet the added to the IPFIX protocol specification in order to meet the
requirement of the PSAMP protocol to report content of captured requirement of the PSAMP protocol to report content of captured
packets, for example the first octets of a packet. packets, for example the first octets of a packet.
5.3 5.3 Information Model Point of View
Information Model Point of View
From the information model point of view, the overlap between both From the information model point of view, the overlap between both
the IPFIX and PSAMP protocols is quite large. Most of the data fields the IPFIX and PSAMP protocols is quite large. Most of the
in the IPFIX protocol are also relevant for exporting packet Information Elements in the IPFIX protocol are also relevant for
information, for example all fields reporting packet header exporting packet information, for example all fields reporting packet
properties. Only a few fields, such as flowCount, packetCount (whose header properties. Only a few Information Elements, such as
value will always be 1 for PSAMP) etc., cannot be used in a flowCount, packetCount (whose value will always be 1 for PSAMP) etc.,
meaningful way by the PSAMP protocol. Also, IPFIX protocol cannot be used in a meaningful way by the PSAMP protocol. Also,
requirements concerning stage 2 of figure C do not apply to the PSAMP IPFIX protocol requirements concerning stage 2 of figure C do not
metering process. apply to the PSAMP metering process.
Further required extensions apply to the information model. Even if Further required extensions apply to the information model. Even if
the IPFIX charter speaks of sampling, no sampling related Information the IPFIX charter speaks of sampling, no Sampling related Information
Elements are specified in [IPFIX-INFO]. The task of specifying them Elements are specified in [IPFIX-INFO]. The task of specifying them
was intentionally left for the PSAMP information model. A set of was intentionally left for the PSAMP information model [PSAMP-INFO].
several additional fields is required for satisfying the requirements A set of several additional fields is required for satisfying the
for the PSAMP information model [PSAMP-TECH]. requirements for the PSAMP information model [PSAMP-TECH].
Additional required extensions of the information model concern Additional required extensions of the information model concern
packet filtering, and the field reporting content of a packet using packet filtering, and the field reporting content of a packet using
the flexible length data type mentioned above. the flexible length data type mentioned above.
Exploiting the extensibility of the IPFIX information model, the Exploiting the extensibility of the IPFIX information model, the
required extension is covered by the PSAMP information model required extension is covered by the PSAMP information model
specified in [PSAMP-INFO]. specified in [PSAMP-INFO].
6. 6. PSAMP Requirements versus the IPFIX Solution
PSAMP Requirements versus the IPFIX Solution
[PSAMP-FMWK] describes some requirements that affect directly the In the "Generic Requirements for PSAMP" section, [PSAMP-FMWK]
export protocol. Refer to the following sections: describes some requirements that affect directly the PSAMP export
. section 3.2 "Reporting Process Requirements" protocol.
. section 3.3 "Exporting Process Requirements"
. section 5 "Reporting Process"
[PSAMP-FMWK] also describes in the section 3.1 one requirement that, In the "Generic Selection Process Requirements" section, [PSAMP-FMWK]
if not directly related to the export protocol, will put some describes one requirement that, if not directly related to the export
constraints on it: protocol, will put some constraints on it. Parallel Measurements:
Selection Process Requirements: multiple independent selection processes at the same entity.
- Parallel Measurements: multiple independent measurement
processes at the same entity."
[PSAMP-FMWK] finally describes in the section 5 some requirements In the "Reporting Process" section, [PSAMP-FMWK] finally describes a
regarding the reporting process. This series of requirements series of requirements specifying the different Information Elements
specifies the different Information Elements that MUST and SHOULD that MUST and SHOULD reported to the Collector. Nevertheless IPFIX,
reported to the Collector. Nevertheless IPFIX, being a generic export being a generic export protocol, can export any Information Elements
protocol, can export any Information Elements as long as there are as long as there are described in the information model. So these
described in the information model. So these requirements are mainly requirements are mainly targeted for the [PSAMP-INFO] document.
targeted for the [PSAMP-INFO] document.
6.1 6.1 IPFIX Solution for the PSAMP Requirements
IPFIX Solution for the PSAMP Requirements
Let's address the PSAMP requirements one by one. Let's address the PSAMP requirements that influence the export
protocol.
* Parallel Measurements: multiple independent measurement processes * Extensibility: the protocol must be able to accommodate additional
at the same entity. Refer to [PSAMP-FMWK] section 3.1 "Selection packet selectors not currently defined.
Process Requirements".
This requirement is addressed by exporting the Associations ID This requirement is addressed by the IPFIX information model, which
Information Element in every packet report. Note that without this is extensible.
* Parallel Measurement Processes: the protocol must support
simultaneous operation of multiple independent Measurement Processes
at the same host.
This requirement is addressed by exporting the selectionPath
Information Element in every Packet Report. Note that without this
requirement, exporting the Selector ID in a Scope part of every requirement, exporting the Selector ID in a Scope part of every
single packet report could have been sufficient. single Packet Report could have been sufficient.
* Transparency: allow transparent interpretation of measurements as * Encrypted Packets: Selectors that interpret packet fields must be
communicated by PSAMP reporting, without any need to obtain configurable to ignore (i.e. not select) encrypted packets, when they
additional information concerning the observed packet stream. Refer are detected.
to [PSAMP-FMWK] section 3.2 "Reporting Process Requirements".
This requirement is addressed by exporting the Associations ID EDITOR'S NOTE: I guess we will need extra text for this.
Information Element in every Packet Report (a Data Record specified
in Template Record) and exporting the associated selection algorithm
and selection parameters Information Elements in the Packet
Interpretation (a Data Record specified in Options Template Record).
* Robustness to Information Loss: allow robust interpretation of * Indication of Information Loss: the Report Stream must include
measurements with respect to reports missing due to data loss, e.g. sufficient information to indicate or allow the detection of loss
in transport, or within the measurement, reporting or Exporting occurring within the Selection, Reporting or Exporting Processes, or
Processes. Inclusion in reporting of information that enables the in transport. This may be achieved by the use of sequence numbers.
accuracy of measurements to be determined. Refer to [PSAMP-FMWK]
section 3.2 "Reporting Process Requirements".
An Options Template, with updated statistics, MUST be sent on regular An Options Template, with updated statistics, MUST be sent on regular
basis. This Options Template contains for example the total number of basis. This Options Template contains for example the total number
packet report exported from the PSAMP device, the total number of of Packet Report exported from the PSAMP device, the total number of
packet observed, etc... Thus the Collector can compare the number of packet observed, etc... Thus the Collector can compare the number of
packet report received per selector ID with the number actually Packet Report received per selector ID with the number actually
metered and/or sent. In case of discrepancy, a new sampling rate metered and/or sent. In case of discrepancy, a new Sampling rate
could be computed. could be computed.
* Faithfulness: all reported quantities that relate to the packet * Accuracy: the Report Stream must include information that enables
treatment MUST reflect the router state and configuration encountered the accuracy of measurements to be determined.
by the packet at the time it is received by the measurement process.
Refer to [PSAMP-FMWK] section 3.2 "Reporting Process Requirements".
This requirement doesn't concern the export protocol itself but the This requirement is address with the accuracy report interpretation,
Metering Process, even if described in the "Reporting Process that sends the accuracy of the measurements.
Requirements" section.
* Privacy: selection of the content of packet reports will be EDITOR'S NOTE: is this the accuracy or the precision?
* Privacy: selection of the content of Packet Reports will be
cognizant of privacy and anonymity issues while being responsive to cognizant of privacy and anonymity issues while being responsive to
the needs of measurement applications, and in accordance with RFC the needs of measurement applications, and in accordance with RFC
2804. Full packet capture of arbitrary packet streams is explicitly 2804. Full packet capture of arbitrary packet streams is explicitly
out of scope. Refer to [PSAMP-FMWK] section 3.2 "Reporting Process out of scope.
Requirements".
This requirement doesn't concern the export protocol itself, even if This requirement doesn't concern the export protocol itself.
described in the "Reporting Process Requirements" section.
* Timeliness: reports on selected packets MUST be made available to * Timeliness: configuration must allow for limiting of buffering
the Collector quickly enough to support near real time applications. delays for the formation and transmission for Export Packets.
Specifically, any report on a packet MUST be dispatched within 1
second of the time of receipt of the packet by the measurement
process. Refer to [PSAMP-FMWK] section 3.3 "Export Process
Requirements".
EDITOR'S NOTE: the term "dispatched" is not clear. Does it mean sent
from the Metering Processing to the Exporting Process? Or put into a
packet by the Exporting Process? Or written on the wire?
The IPFIX protocol specifications [IPFIX-PROTO] describe an The IPFIX protocol specifications [IPFIX-PROTO] describe an
inactivity timeout for the Flow expiration. This inactivity timeout inactivity timeout for the Flow expiration. This inactivity timeout
is configurable, with a minimum value of 0 for immediate expiration. is configurable, with a minimum value of 0 for immediate expiration.
Note that this minimum value of 0 will force every single Data Record Note that this minimum value of 0 will force every single Data Record
to contain information about a single packet and not an aggregation to contain information about a single packet and not an aggregation
of packets. of packets.
* Congestion Avoidance: export of a report stream across a network * Congestion Avoidance: export of a report stream across a network
MUST be congestion avoiding in compliance with RFC 2914. Refer to MUST be congestion avoiding in compliance with RFC 2914.
[PSAMP-FMWK] section 3.3 "Export Process Requirements".
IPFIX, by its charter, MUST also respect this requirement. IPFIX, by its charter, MUST also respect this requirement.
* Secure Export: * Secure Export:
- confidentiality: the option to encrypt exported data MUST be - confidentiality: the option to encrypt exported data must be
provided. provided.
- integrity: alterations in transit to exported data MUST be - integrity: alterations in transit to exported data must be
detectable at the Collector detectable at the Collector
- authenticity: authenticity of exported data MUST be verifiable by - authenticity: authenticity of exported data must be verifiable by
the Collector in order to detect forged data. the Collector in order to detect forged data.
The motivation here is the same as for security in IPFIX export. The motivation here is the same as for security in IPFIX export.
Refer to [PSAMP-FMWK] section 3.3 "Export Process Requirements".
6.2 * Compression: to conserve network bandwidth and resources at the
High Level View of the Integration Collector, the Export Packets may be compressed before export.
With the choice of IPFIX as PSAMP export protocol, the compression
option mentioned in the framework is not addressed.
* The exporting process must have an export rate limit, configurable
per Exporting Process.
EDITOR'S NOTE: this is an open issue.
* The timestamp of observation of the packet at the Observation
Point. The timestamp should be reported to microsecond resolution.
EDITOR'S NOTE: this is an open issue.
6.2 High Level View of the Integration
The Template Record in the Template Set is used to describe the The Template Record in the Template Set is used to describe the
different PSAMP Information Elements that will be exported to the different PSAMP Information Elements that will be exported to the
Collector. The Collector decodes the Template Record in the Template Collector. The Collector decodes the Template Record in the Template
Set and knows which Information Elements to expect when it receives Set and knows which Information Elements to expect when it receives
the Data Records in the Data Set, i.e. the PSAMP Packet Reports. the Data Records in the Data Set, i.e. the PSAMP Packet Reports.
Typically, in the base level of the PSAMP functionality, the Template Typically, in the base level of the PSAMP functionality, the Template
Set will contain the input sequence number, the packet fragment (some Set will contain the input sequence number, the packet fragment (some
number of contiguous bytes from the start of the packet) and the number of contiguous bytes from the start of the packet or from the
Associations ID. start of the payload) and the Selection Path.
The Options Template Record in the Options Template Set is used to The Options Template Record in the Options Template Set is used to
describe the different PSAMP Information Elements that concern the describe the different PSAMP Information Elements that concern the
Metering Process itself: sampling and/or filtering functions, plus Metering Process itself: Sampling and/or Filtering functions, plus
the associated parameters. The Collector decodes the Options Template the associated parameters. The Collector decodes the Options
Records in the Option Template Set and knows which Information Template Records in the Option Template Set and knows which
Elements to expect when it receives the Data Records in the Data Set, Information Elements to expect when it receives the Data Records in
i.e. the PSAMP Report Interpretation. Typically, the Options Template the Data Set, i.e. the PSAMP Report Interpretation. Typically, the
would contain the Associations ID, the sampling or filtering Options Template would contain the Selection Path, the Sampling or
functions, and the sampling or filtering associated parameters. Filtering functions, and the Sampling or Filtering associated
parameters.
PSAMP requires all the different possibilities of the IPFIX protocol PSAMP requires all the different possibilities of the IPFIX protocol
specifications [IPFIX-PROTO]. That is the 3 types of Set (Data Set, specifications [IPFIX-PROTO]. That is the 3 types of Set (Data Set,
Template Set and Options Templates Set) with the 2 types of Templates Template Set and Options Templates Set) with the 2 types of Templates
Records (Template Record and Options Template Record), as described Records (Template Record and Options Template Record), as described
in the figure A. As a consequence, PSAMP can't rely on a subset of in the figure A. As a consequence, PSAMP can't rely on a subset of
the IPFIX protocol specifications are described in [IPFIX-PROTO]. The the IPFIX protocol specifications are described in [IPFIX-PROTO].
entire IPFIX protocol specifications [IPFIX-PROTO] MUST be The entire IPFIX protocol specifications [IPFIX-PROTO] MUST be
implemented for the PSAMP export. implemented for the PSAMP export.
7. 7. Using the IPFIX Protocol for PSAMP
Using the IPFIX Protocol for PSAMP
7.1 7.1 Selector ID
Selector ID
The Selector ID is the unique ID identifying a Primitive Selector. The Selector ID is the unique ID identifying a Primitive Selector.
Each Primitive Selector MUST have a unique ID within the Observation Each Primitive Selector MUST have a unique ID within the Observation
Domain. Domain.
7.2 7.2 The Associations
The Associations
From all the packets observed at an Observation Point, a subset of From all the packets observed at an Observation Point, a subset of
packets is selected by one or more Selectors. The Associations ID is packets is selected by one or more Selectors. The Selection Path is
a unique value describing the Observation Point and the Selector IDs a unique value describing the Observation Point and the Selector
through which the packets are selected. The Associations ID is ID(s) through which the packets are selected. The Selection Path is
represented by the associationsId Information Element [PSAMP-INFO]. represented by the selectionPath Information Element [PSAMP-INFO].
Optionally, the IPFIX processes to which the packets are MAY be added
to the Associations ID. Example of IPFIX processes are IPFIX Metering
Process ID and IPFIX Exporting Process ID.
EDITOR'S NOTE: Even if [PSAMP-TECH] section 7.1 and 7.2 describes
that "The ASSOCIATIONS field describes the Observation Point and
optionally the IPFIX processes to which the packet Selector is
associated. Values: <STREAM ID, IPFIX Metering process ID, IPFIX
Exporting process ID, IDs of other associated processes>", we can't
see an example where the IPFIX process(es) ID would be required.
Don't we have enough with the list of Selector IDs?
7.3 7.3 Packet Reports
Packet Reports
For each Assocations, for each select packet, a Packet Report MUST be For each Associations, for each selected packet, a Packet Report MUST
created. The format of the Packet Report is specified in a Template be created. The format of the Packet Report is specified in a
Record contained in a Template Set. Template Record contained in a Template Set.
There are two types of Packet Report, as described in [PSAMP-FWMK]: There are two types of Packet Report, as described in [PSAMP-FWMK]:
the basic Packet Report and the extended Packet Report. the basic Packet Report and the extended Packet Report.
7.3.1 Basic Packet Reports 7.3.1 Basic Packet Reports
For each selected packet, the Packet Report MUST contain the For each selected packet, the Packet Report MUST contain the
following information: following information:
- The associationsId Information Element - The selectionPath Information Element
- Some number of contiguous bytes from the start of the packet, - Some number of contiguous bytes from the start of the packet,
including the packet header (which includes link layer, network layer including the packet header (which includes link layer, network layer
and other encapsulation headers) and some subsequent bytes of the and other encapsulation headers) and some subsequent bytes of the
packet payload. The Layer2PacketSection and ipPacketSection PSAMP packet payload. Alternatively, the number of contiguous bytes may
elements are available for this use. The Information Element can be start at the beginning of the payload. The Layer2PacketSection,
provided either with a fixed length field or with a variable sized l2PayloadPacketSection, mplsLabelStackSection,
field mplsPayloadPacketSection, ipPacketSection, and ipPayloadPacketSection
- the input sequence number(s) of any Selectors that acted on the PSAMP Information Elements are available for this use.
packet - The input sequence number(s) of any Selectors that acted on the
packet, represented by the selectorInputSequenceNumber Information
Element.
EDITOR'S NOTE: We should probably list all the possible Information The contiguous Information Elements (Layer2PacketSection,
Elements from [PSAMP-INFO]: Layer2PacketSection, ipPacketSection, l2PayloadPacketSection, mplsLabelStackSection,
etc... mplsPayloadPacketSection, ipPacketSection, and
ipPayloadPacketSection) MAY be encoded with a fixed length field or
with a variable sized field. If one of these Information Elements is
encoded with a fixed length field whose length is too long for the
number of contiguous bytes in the selected packet, padding MUST NOT
be used. In this case, the Exporting Process MUST export the
information either in a new Template Record with the correct fixed
length field, or either in a new Template Record with a variable
length field.
EDITOR'S NOTE: instead of sending the input sequence number for each EDITOR'S NOTE: instead of sending the input sequence number for each
selector ID, a counter64 value, associated with every packet, the selector ID, a counter64 value, associated with every packet, the
working group should discuss the possibility to send the information working group should discuss the possibility to send the information
on regular basis with an option template record. Specifically in the on regular basis with an option template record. Specifically in the
case of Composite Selector, we would send multiple times a 64-bit case of Composite Selector, we would send multiple times a 64-bit
counter in each packet. The example below doesn't contain the input counter in each packet. The example below doesn't contain the input
sequence number. sequence number.
Here is an example of a basic Packet Report, with an AssociationsId Here is an example of a basic Packet Report, with a SelectionPath
value of 9 (will be explained later on) and a fixed ipPacketSection value of 9 and ipHeaderPacketSection Information Element of 12 bytes,
field of 12 bytes: 0x4500 005B A174 0000 FF11 832E, encoded with a fixed length field.
IPFIX Template Record: IPFIX Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 2 | Length = 16 | | Set ID = 2 | Length = 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 260 | Field Count = 2 | | Template ID = 260 | Field Count = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = AssociationsId | IE Length = 4 | | selectionPath = 321 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = ipPacketSection | IE Length = 12 | | ipHeaderPacketSection = 313 | Field Length = 12 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The associated IPFIX Data Record: The associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 260 | Length = 20 | | Set ID = 260 | Length = 20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: AssociationsId = 9 | | 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: ipPacketSection = 0x4500 005B | | 0x4500 005B |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ...continued = 0xA174 0000 | | 0xA174 0000 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ...continued = 0xFF11 832E | | 0xFF11 832E |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure D: Example of a Basic Packet Report Figure D: Example of a Basic Packet Report
Here is an example of a basic Packet Report, with a SelectionPath
value of 9 (will be explained later on) and ipPacketSection
Information Element of 12 bytes, encoded with a variable length.
EDITOR'S NOTE: to be added
7.3.2 Extended Packet Reports 7.3.2 Extended Packet Reports
Alternatively to the basic Packet Report, the extended Packet Report Alternatively to the basic Packet Report, the extended Packet Report
MAY contain extra information related to the protocols used in the MAY contain extra Information Elements related to the protocols used
packet (such as source and destination IP addresses), related to the in the packet (such as source and destination IP addresses), related
packet treatment (such as output interface, destination BGP to the packet treatment (such as output interface, destination BGP
autonomous system), related to the Selection State associated with autonomous system), related to the Selection State associated with
the packet (such as timestamps, hash values). Using the IPFIX the packet (such as timestamp, hash value).
Information Elements [IPFIX-INFO], the extra information is added to
the Template Record.
It is envisaged that selection of fields for Extended Packet It is envisaged that selection of fields for extended Packet Reports
Reporting may be used to reduce reporting bandwidth, in which case may be used to reduce reporting bandwidth, in which case the option
the option to report some number of contiguous bytes from the start to report some number of contiguous bytes from the start of the
of the packet, mandatory in the basic Packet Report, may not be packet, mandatory in the basic Packet Report, may not be exercised.
exercised. In this case, the Packet Content MAY be omitted. Note this
configuration is quite similar to an IPFIX device for which a
Template Record containing information about a single packet is
reported.
Example of a detailed Extended Packet Report: Example of a detailed Extended Packet Report:
IPFIX Template Record: IPFIX Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 2 | Length = 32 | | Set ID = 2 | Length = 32 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 261 | Field Count = 6 | | Template ID = 261 | Field Count = 6 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = associationsId | IE Length = 4 | |0| selectionPath = 321 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = sourceIPv4Address | IE Length = 4 | |0| sourceIPv4Address = 44 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = destinationIPv4Address| IE Length = 4 | |0| destinationIPv4Address = 45 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = totalLengthIPv4 | IE Length = 2 | |0| totalLengthIPv4 = 190 | Field Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = tcpSourcePort | IE Length = 2 | |0| tcpSourcePort = 182 | Field Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IE ID = tcpDestinationPort | IE Length = 2 | |0| tcpDestinationPort = 183 | Field Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The associated IPFIX Data Record: The associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 261 | Length = 20 | | Set ID = 261 | Length = 20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: AssociationsId = 9 | | 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: sourceIPv4Address = 10.0.0.1 | | 10.0.0.1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: destinationIPv4Address = 10.0.1.106 | | 10.0.1.106 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Rec. 1: totalLengthIPv4 = 72 | Rec. 1: tcpSourcePort = 1372 | | 72 | 1372 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Rec. 1: tcpDestinationPort=80| | 80 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure E: Example of an Extended Packet Report Figure E: Example of an Extended Packet Report
7.4 7.4 Report Interpretation
Report Interpretation
To make full sense of the Packet Reports there are a number of To make full sense of the Packet Reports there are a number of
additional pieces of information that must be communicated to the additional pieces of information that must be communicated to the
Collector: Collector:
- The details about which Selectors and Observation Points are being - The details about which Selectors and Observation Points are being
used within an Associations MUST be provided using the Associations used within an Associations MUST be provided using the Associations
Report Interpretation. Report Interpretation.
- The configuration details of each Selector MUST be provided using - The configuration details of each Selector MUST be provided using
the Selector Report Interpretation. the Selector Report Interpretation.
- The Selector ID statistics MUST be provided using the - The Selector ID statistics MUST be provided using the
AssociationsStatistics Report Interpretation. AssociationsStatistics Report Interpretation.
- The accuracies of the reported fields MUST be provided using the - The accuracies of the reported fields MUST be provided using the
Accuracy Report Interpretation. Accuracy Report Interpretation.
- Further information about each Observation Point MAY be provided - Further information about each Observation Point MAY be provided
using the Observation Point Report Interpretation. using the Observation Point Report Interpretation.
EDITOR'S NOTE: to be discussed on the mailing list.
7.4.1 Associations Report Interpretation 7.4.1 Associations Report Interpretation
Each Packet Report contains an associationsId Information Element Each Packet Report contains a selectionPath Information Element that
that identifies the particular combination of Observation Point and identifies the particular combination of Observation Point and
Selectors used for its selection. For every associationsId Selector(s) used for its selection. For every selectionPath
Information Element in use, the PSAMP Device MUST export an Information Element in use, the PSAMP Device MUST export an
Associations Report Interpretation using an Options Template with the Associations Report Interpretation using an Options Template with the
following Information Element: following Information Element:
Scope: associationsId Scope: selectionPath
Non-Scope: observationPointId Non-Scope: observationPointId
selectorId (one or more) selectorId (one or more)
If the packets are selected by a Composite Selector, the Associations If the packets are selected by a Composite Selector, the Selection
ID field is composed of several Primitive Selectors. In such a case, Path field is composed of several Primitive Selectors. In such a
the Associations Report Interpretation MUST contain the list of all case, the Associations Report Interpretation MUST contain the list of
the Primitive Selector IDs in the Associations ID. If multiple all the Primitive Selector IDs in the Selection Path. If multiple
Selectors are contained in the Associations Report Interpretation, Selectors are contained in the Associations Report Interpretation,
the Selectors ID MUST be identified in the order they are used. the Selectors ID MUST be identified in the order they are used.
Optionally, the Associations Report Interpretation MAY contain the
following Information
Non-Scope: meteringProcessId
exportingProcessId
The observationPointID SHOULD be first Information Element and the The observationPointID SHOULD be first Information Element and the
optional processes SHOULD be last ones so that the path of the optional processes SHOULD be last ones so that the path of the
selected Packet is provided in the logical order. selected Packet is provided in the logical order.
EDITOR'S NOTE: Even if [PSAMP-TECH] section 7.1 and 7.2 describes Example of a Two Selection Path:
that "The ASSOCIATIONS field describes the Observation Point and
optionally the IPFIX processes to which the packet Selector is
associated. Values: <STREAM ID, IPFIX Metering process ID, IPFIX
Exporting process ID, IDs of other associated processes>", we can't
see an example where the IPFIX process(es) ID would be required.
Don't we have enough with the list of Selector IDs? If we don't need
the IPFIX Process ID, the following examples must be updated.
Example of a Two Associations ID:
Selection Path 7 (Filter->Sampling): Selection Path 7 (Filter->Sampling):
observationPointID 1 (Interface 5), observationPointID 1 (Interface 5),
selectorId 5 (Filter, match IPV4SourceAddress 10.0.0.1), selectorId 5 (Filter, match IPV4SourceAddress 10.0.0.1),
selectorId 10 (Sampler, Random 1 out-of ten), selectorId 10 (Sampler, Random 1 out-of ten),
meteringProcessID 15 (IPFIX Metering Process) meteringProcessID 15 (IPFIX Metering Process)
Selection Path 9 (Sampling->Filtering): Selection Path 9 (Sampling->Filtering):
observationPointID 1 (Interface 5), observationPointID 1 (Interface 5),
selectorId 10 (Sampler, Random 1 out-of ten), selectorId 10 (Sampler, Random 1 out-of ten),
selectorId 5 (Filter, match IPV4SourceAddress 10.0.0.1), selectorId 5 (Filter, match IPV4SourceAddress 10.0.0.1),
meteringProcessID 15 (IPFIX Metering Process) meteringProcessID 15 (IPFIX Metering Process)
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 30 | | Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 262 | Field Count = 5 | | Template ID = 262 | Field Count = 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 4 | Scope 1 = AssociationsId | | Scope Field Count = 4 |0| selectionPath = 321 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 | Option 1 = ObservationPointId |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Length = 4 | Option 2 = selectorId | | Scope 1 Length = 4 |0| observationPointId = 320 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 2 Length = 4 | Option 4 = selectorId | | Field Length = 4 |0| selectorId = 300 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 3 Length = 4 | Option 5 = MeteringProcessId | | Field Length = 4 |0| selectorId = 300 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 4 Length = 4 | | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
EDITOR'S NOTE: check the observationPointId
The associated IPFIX Data Record: The associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 262 | Length = 44 | | Set ID = 262 | Length = 36 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: AssociationsId = 7 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: ObservationPointId = 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: selectorId = 5 | | 7 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: selectorId = 10 | | 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: MeteringProcessId = 15 | | 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: AssociationsId = 9 | | 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: Obs.PointId = 1 | | 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: selectorId = 10 | | 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: selectorId = 5 | | 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: MeteringProcessId = 15 | | 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure F: Example of an Associations Report Interpretation Figure F: Example of an Associations Report Interpretation
Notes: Notes:
* There are two Records here in the same Data Set. Each record * There are two Records here in the same Data Set. Each record
defines a different Selection Path. defines a different Selection Path.
* If a different Selection Path used three Selectors then a different * If a different Selection Path used three Selectors then a different
Options Template would have to be used. Options Template would have to be used.
7.4.2 Selector Report Interpretation 7.4.2 Selector Report Interpretation
An IPFIX Data Record, defined by an Option Template Record, MUST be An IPFIX Data Record, defined by an Option Template Record, MUST be
used to send the configuration details of every Selector in use. The used to send the configuration details of every Selector in use. The
skipping to change at page 29, line 14 skipping to change at page 27, line 45
Notes: Notes:
* There are two Records here in the same Data Set. Each record * There are two Records here in the same Data Set. Each record
defines a different Selection Path. defines a different Selection Path.
* If a different Selection Path used three Selectors then a different * If a different Selection Path used three Selectors then a different
Options Template would have to be used. Options Template would have to be used.
7.4.2 Selector Report Interpretation 7.4.2 Selector Report Interpretation
An IPFIX Data Record, defined by an Option Template Record, MUST be An IPFIX Data Record, defined by an Option Template Record, MUST be
used to send the configuration details of every Selector in use. The used to send the configuration details of every Selector in use. The
Option Template Record MUST contain the selectorId as the Scope field Option Template Record MUST contain the selectorId Information
and the SelectorAlgorithm followed by some type specific Element as the Scope field and the SelectorAlgorithm Information
configuration fields as the data: Element followed by some specific configuration parameters:
Scope: selectorId Scope: selectorId
Non-scope: selectorAlgorithm Non-scope: selectorAlgorithm
algorithm specific Information Elements algorithm specific Information Elements
The algorithm specific Information Elements are specified in the The algorithm specific Information Elements are specified in the
following subsections, depending on the selection method represented following subsections, depending on the selection method represented
by the value of the selectorAlgorithm. by the value of the selectorAlgorithm.
The Associations statistics MUST be exported periodically. The Associations statistics MUST be exported periodically.
7.4.2.1 Systematic Count-Based Sampling 7.4.2.1 Systematic Count-Based Sampling
In systematic count-based Sampling, the start and stop triggers for In systematic count-based Sampling, the start and stop triggers for
the Sampling interval are defined in accordance to the spatial packet the Sampling interval are defined in accordance to the spatial packet
skipping to change at page 29, line 33 skipping to change at page 28, line 15
following subsections, depending on the selection method represented following subsections, depending on the selection method represented
by the value of the selectorAlgorithm. by the value of the selectorAlgorithm.
The Associations statistics MUST be exported periodically. The Associations statistics MUST be exported periodically.
7.4.2.1 Systematic Count-Based Sampling 7.4.2.1 Systematic Count-Based Sampling
In systematic count-based Sampling, the start and stop triggers for In systematic count-based Sampling, the start and stop triggers for
the Sampling interval are defined in accordance to the spatial packet the Sampling interval are defined in accordance to the spatial packet
position (packet count) [PSAMP-TECH]. position (packet count) [PSAMP-TECH].
The algorithm specific Information Elements in case of systematic The REQUIRED algorithm specific Information Elements in case of
count-based Sampling are: systematic count-based Sampling are:
samplingPacketInterval: number of packets selected in a row samplingPacketInterval: number of packets selected in a row
samplingPacketSpace: number of packets between selections samplingPacketSpace: number of packets between selections
Example of a simple 1 out-of 10 systematic count-based Selector Example of a simple 1 out-of 10 systematic count-based Selector
definition, where the samplingPacketInterval is 1 and the definition, where the samplingPacketInterval is 1 and the
samplingPacketSpace is 9. samplingPacketSpace is 9.
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 | | Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 263 | Field Count = 4 | | Template ID = 263 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 | Scope 1 = selectorId | | Scope Field Count = 1 |0| selectorId = 300 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 | Option 1 = selectorAlgorithm | | Scope 1 Length = 4 |0| selectorAlgorithm = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Length = 1 | Option 2 = samp.Pack.Interval | | Field Length = 1 |0|samplingPacketInterval = 304 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 2 Length = 1 | Option 3 = samp.PacketSpace | | Field Length = 1 |0| samplingPacketSpace = 305 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 3 Length = 1 | | Field Length = 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record: Associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 263 | Length = 11 | | Set ID = 263 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| selectorId (scope) = 15 | | 15 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| .Algorithm= 1 | .Interval= 1 | .Space = 09 | | 1 | 1 | 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure G: Example of the Selector Report Interpretation, Figure G: Example of the Selector Report Interpretation,
For Systematic Count-Based Sampling For Systematic Count-Based Sampling
Notes: Notes:
* A samplingAlgorithm value of 1 represents systematic count-based * A selectorAlgorithm value of 1 represents systematic count-based
Sampling. Sampling.
* samplingPacketInterval and samplingPacketSpace are of type * samplingPacketInterval and samplingPacketSpace are of type
unsigned32 but are compressed down to one octet here. unsigned32 but are compressed down to one octet here, as allowed by
the IPFIX protocol specifications [IPFIX-PROTO].
7.4.2.2 Systematic Time-Based Sampling 7.4.2.2 Systematic Time-Based Sampling
In systematic time-based Sampling, the start and stop triggers are In systematic time-based Sampling, the start and stop triggers are
used to define the Sampling intervals [PSAMP-TECH]. The algorithm used to define the Sampling intervals [PSAMP-TECH]. The REQUIRED
specific Information Elements in case of systematic time-based algorithm specific Information Elements in case of systematic time-
Sampling are: based Sampling are:
samplingTimeInterval: time (in ms) when packets are selected samplingTimeInterval: time (in ms) when packets are selected
samplingTimeSpace: time (in ms) between selections samplingTimeSpace: time (in ms) between selections
Example of a 100 ms out-of 1000 ms systematic time-based Selector Example of a 100 ms out-of 1000 ms systematic time-based Selector
definition, where the samplingTimeInterval is 100 and the definition, where the samplingTimeInterval is 100 and the
samplingTimeSpace is 900 samplingTimeSpace is 900
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 | | Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 264 | Field Count = 4 | | Template ID = 264 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 | Scope 1 = selectorId | | Scope Field Count = 1 |0| selectorId = 300 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 | Option 1 = selectorAlgorithm | | Scope 1 Length = 4 |0| selectorAlgorithm = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Length = 1 | Option 2 = samp.TimeInterval | | Field Length = 1 |0| samplingTimeInterval = 306 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 2 Length = 1 | Option 3 = samp.TimeSpace | | Field Length = 1 |0| samplingTimeSpace = 307 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 3 Length = 2 | | Field Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record: Associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 264 | Length = 16 | | Set ID = 264 | Length = 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| selectorId (scope) = 16 | | 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| .Algorithm= 2 | .Interval=100 | samplingTimeSpace = 900 | | 2 | 100 | 900 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure H: Example of the Selector Report Interpretation, Figure H: Example of the Selector Report Interpretation,
For Systematic Time-Based Sampling For Systematic Time-Based Sampling
Notes: Notes:
* A samplingAlgorithm value of 2 represents systematic time-based * A selectorAlgorithm value of 2 represents systematic time-based
Sampling. Sampling.
* samplingTimeInterval and samplingTimeSpace are of type unsigned32 * samplingTimeInterval and samplingTimeSpace are of type unsigned32
but are compressed down here. but are compressed down here.
7.4.2.3 Random n-out-of-N Sampling 7.4.2.3 Random n-out-of-N Sampling
In random n-out-of-N Sampling, n elements are selected out of the In random n-out-of-N Sampling, n elements are selected out of the
parent population that consists of N elements [PSAMP-TECH]. The parent population that consists of N elements [PSAMP-TECH]. The
algorithm specific Information Elements in case of random n-out-of-N REQUIRED algorithm specific Information Elements in case of random n-
Sampling are: out-of-N Sampling are:
samplingSize: number of packets selected samplingSize: number of packets selected
samplingPopulation: number of packets in selection population samplingPopulation: number of packets in selection population
Example of a 1 out-of 10 random n-out-of-N sampling Selector: Example of a 1 out-of 10 random n-out-of-N Sampling Selector:
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 | | Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 265 | Field Count = 4 | | Template ID = 265 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 | Scope 1 = selectorId | | Scope Field Count = 1 |0| selectorId = 300 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 | Option 1 = selectorAlgorithm | | Scope 1 Length = 4 |0| selectorAlgorithm = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Length = 1 | Option 2 = samplingSize | | Field Length = 1 |0| samplingSize = 309 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 2 Length = 1 | Option 3 = samplingPopulation | | Field Length = 1 |0| samplingPopulation = 308 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 3 Length = 1 | | Field Length = 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record: Associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 265 | Length = 11 | | Set ID = 265 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| selectorId (scope) = 17 | | 17 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| .Algorithm= 1 | .samp.Size= 1 | samp.Pop = 10 | | 3 | 1 | 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure I: Example of the Selector Report Interpretation, Figure I: Example of the Selector Report Interpretation,
For Random n-out-of-N Sampling For Random n-out-of-N Sampling
Notes: Notes:
* A samplingAlgorithm value of 3 represents Random n-out-of-N * A selectorAlgorithm value of 3 represents Random n-out-of-N
sampling. sampling.
* samplingSize and samplingPopulation are of type unsigned32 but are * samplingSize and samplingPopulation are of type unsigned32 but are
compressed down to one octet here. compressed down to one octet here.
7.4.2.4 Uniform Probabilistic Sampling 7.4.2.4 Uniform Probabilistic Sampling
EDITOR'S NOTE: to be completed In uniform probabilistic Sampling, each element has the same
probability p of beings are selected from the parent population
[PSAMP-TECH]. The algorithm specific Information Element in case of
uniform probabilistic Sampling is:
7.4.2.5 Non-uniform Probabilistic Sampling samplingProbablility: a floating point number for the Sampling
probability.
EDITOR'S NOTE: to be completed Example of a 15% uniform probability Sampling Selector:
7.4.2.6 Non-uniform Flow State Sampling IPFIX Options Template Record:
EDITOR'S NOTE: to be completed 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 22 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 271 | Field Count = 3 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 300 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| selectorAlgorithm = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingProbablility = X |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
7.4.2.7 Match Based Filtering and Router State Filtering EDITOR'S NOTE: check the value of samplingProbablility in [PSAMP-
INFO]
Associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 271 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 4 | 0.15 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+-+-+-+-+-+-+-+-+
Figure I: Example of the Selector Report Interpretation,
For Uniform Probabilistic Sampling
Notes:
* A selectorAlgorithm value of 4 represents Uniform Probabilistic
Sampling.
7.4.2.5 Property Match Filtering
This classification includes match(es) on field(s) within a packet This classification includes match(es) on field(s) within a packet
and match(es) on properties of the router state. With this method, a and/or on properties of the router state. With this method, a packet
packet is selected if a specific field in the packet equals a is selected if a specific field in the packet equals a predefined
predefined value. value.
The algorithm specific Information Elements, defining configuration The algorithm specific Information Elements, defining configuration
parameters for match-based and router state filtering, are taken from parameters for property match filtering, are taken from the full
the full range of available IPFIX Information Elements [IPFIX-INFO]. range of available Information Elements.
Further Information Elements MAY be defined by proprietary
Information Elements [IPFIX-PROTO]
When multiple different Information Elements are defined, the filter When multiple different Information Elements are defined, the filter
acts as a logical AND. Note that the logical OR is not covered by acts as a logical AND. Note that the logical OR is not covered by
these PSAMP specifications. The match based filtering and router these PSAMP specifications. The property match Filtering Options
state filtering Options Template Record MUST NOT have multiple Template Record MUST NOT have multiple identical Information
identical Information Elements. The result of the filter is Elements. The result of the filter is independent from the order of
independent from the order of the Information Elements in the Option the Information Elements in the Option Template Record, but the order
Template Record, but the order may be important for implementation may be important for implementation purposes, as the first filter
purposes, as the first filter will have to work at a higher rate. In will have to work at a higher rate. In any case, an implementation
any case, an implementation is not constrained to respect the filter is not constrained to respect the filter ordering, as long as the
ordering, as long as the result is the same, and it may even result is the same, and it may even implement the composite Filtering
implement the composite filtering in filtering in one single step. in Filtering in one single step.
EDITOR'S NOTE: "The algorithm specific Information Elements, defining
configuration parameters for match-based and router state filtering,
are taken from the full range of available IPFIX Information Elements
[IPFIX-INFO] ". What about the ones from [PSAMP-INFO]? In other
words, are they I.E.s in [PSAMP-INFO] that we could use for the
match-based and router state filtering?
Example of a match based filter Selector, whose rules are: Example of a match based filter Selector, whose rules are:
IPv4 Source Address = 10.0.0.1 IPv4 Source Address = 10.0.0.1
IPv4 Next-Hop Address = 10.0.1.1 IPv4 Next-Hop Address = 10.0.1.1
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 | | Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 266 | Field Count = 4 | | Template ID = 266 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 | Scope 1 = selectorId | | Scope Field Count = 1 |0| selectorId = 300 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 | Option 1 = selectorAlgorithm | | Scope 1 Length = 4 |0| selectorAlgorithm = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Length = 1 | Option 2 = sourceIPv4Address | | Field Length = 1 |0| sourceIPv4Address = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 2 Length = 4 | Option 3 =ipNextHopIPv4Address| | Field Length = 4 |0| ipNextHopIPv4Address = 15 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 3 Length = 4 | | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record: Associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 266 | Length = 11 | | Set ID = 266 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| selectorId (scope) = 21 | | 21 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| .Algorithm= 1 | sourceIPv4Address = 10.0.0 ... | | 5 | 10.0.0 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... .1 | ipNextHopIPv4Address = 10.0.1 ... | | ... .1 | 10.0.1 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... .1 | | ... .1 |
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
Figure J: Example of the Selector Report Interpretation, Figure J: Example of the Selector Report Interpretation,
For match based and router state Filtering For match based and router state Filtering
Notes: Notes:
* A samplingAlgorithm value of 7 represents match based filtering. * A selectorAlgorithm value of 5 represents property match Filtering.
* In this filter there is a mix of information from the packet and * In this filter there is a mix of information from the packet and
information from the router. information from the router.
7.4.2.8 Hash Based Filtering 7.4.2.6 Hash-Based Filtering
EDITOR'S NOTE: to be completed EDITOR'S NOTE: to be completed
Notes:
* A selectorAlgorithm value of 6 represents hash-based Filtering.
7.4.2.7 Other Selection Methods
Some potential new selection methods MAY be added. Some of the new
selection methods, such as non-uniform probabilistic Sampling and
flow state dependent Sampling, are described in [PSAMP-TECH], with
further references.
Each new selection method MUST be assigned a unique value for the
selectorAlgorithm Information Element. Its configuration
parameter(s), along with the way to report it/them with an Options
Template, MUST be clearly specified.
7.4.3 Associations Statistics Report Interpretation 7.4.3 Associations Statistics Report Interpretation
A Selector MAY be used in multiple Associations. However, each use of A Selector MAY be used in multiple Associations. However, each use
a Selector must be independent, so each separate logical instances of of a Selector must be independent, so each separate logical instances
a Selector MUST maintain its separate Selection State and statistics. of a Selector MUST maintain its separate Selection State and
statistics.
The Associations Statistics Report Interpretation MUST include the The Associations Statistics Report Interpretation MUST include the
number of packets seen (Population Size) and the number of packets number of packets seen (Population Size) and the number of packets
selected (Sample Size) by each instance of its Primitive Selector. selected (Sample Size) by each instance of its Primitive Selector.
Within an Association composed of several Primitive Selectors, the Within an Association composed of several Primitive Selectors, the
number of packets selected for one Selector is equal to the number of number of packets selected for one Selector is equal to the number of
packets seen by the next Selector. The order of the Selectors in the packets seen by the next Selector. The order of the Selectors in the
Associations Statistics Report Interpretation MUST match the order of Associations Statistics Report Interpretation MUST match the order of
the Selectors in the Association, as defined in the Associations the Selectors in the Association, as defined in the Associations
Report Interpretation. Report Interpretation.
The Associations Statistics Report Interpretation MUST also contain The Associations Statistics Report Interpretation MUST also contain
the number of packets observed at the Observation. the number of packets observed at the Observation.
For every Associations ID, the PSAMP Device MUST export an For every Selection Path, the PSAMP Device MUST export an
Associations statistics Report Interpretation using an Options Associations statistics Report Interpretation using an Options
Template with the following Information Element: Template with the following Information Element:
Scope: AssociationsId Scope: SelectionPath
Non-scope: packetsObserved Non-scope: packetsObserved
packetsSelected (one or more) packetsSelected (one or more)
The packetsObserved Information Element contains the number of The packetsObserved Information Element contains the number of
packets seen at the Observation Point, and as a consequence passed to packets seen at the Observation Point, and as a consequence passed to
the first Selector in the Association. The packetsSelected the first Selector in the Association. The packetsSelected
Information Element contains the number of packets selected by the Information Element contains the number of packets selected by the
various Selectors in the Associations. various Selectors in the Associations.
The Attained Selection Fraction can be calculated for each Selector The Attained Selection Fraction can be calculated for each Selector
skipping to change at page 36, line 24 skipping to change at page 36, line 6
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 30 | | Set ID = 3 | Length = 30 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 267 | Field Count = 5 | | Template ID = 267 | Field Count = 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 | Scope 1 = AssociationsId | | Scope Field Count = 1 |0| selectionPath = 321 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 | Option 1 = packetsObserved | | Scope 1 Length = 4 |0| packetsObserved = 324 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Length = 4 | Option 2 = packetsSelected | | Field Length = 4 |0| packetsSelected = 325 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 2 Length = 4 | Option 4 = packetsSelected | | Field Length = 4 |0| packetsSelected = 325 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 3 Length = 4 | Option 5 = packetsSelected | | Field Length = 4 |0| packetsSelected = 325 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 4 Length = 4 | | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The associate IPFIX Data Record: The associate IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 267 | Length = 24 | | Set ID = 267 | Length = 24 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: AssociationsId = 7 | | 7 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: packetsObserved = 100 | | 100 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: packetsSelected = 50 | | 50 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1: packetsSelected = 6 | | 6 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: AssociationsId = 9 | | 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: packetsObserved = 100 | | 100 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: packetsSelected = 10 | | 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2: packetsSelected = 3 | | 3 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure K: Example of the Association Statistics Report Figure K: Example of the Association Statistics Report
Interpretation Interpretation
Notes: Notes:
* The Attained Packet Fractions for the first set of Associations * The Attained Packet Fractions for the first set of Associations
are: are:
Filter 10: 50/100 Filter 10: 50/100
Sampler 5: 6/50 Sampler 5: 6/50
skipping to change at page 37, line 43 skipping to change at page 37, line 24
EDITOR'S NOTE: to be completed EDITOR'S NOTE: to be completed
7.4.5 Observation Point Report Interpretation 7.4.5 Observation Point Report Interpretation
For each Observation Point, an Observation Option Report For each Observation Point, an Observation Option Report
Interpretation MAY be sent. Interpretation MAY be sent.
EDITOR'S NOTE: to be completed EDITOR'S NOTE: to be completed
8. 8. Security Considerations
Security Considerations
As IPFIX has been selected as the PSAMP export protocol and as the As IPFIX has been selected as the PSAMP export protocol and as the
PSAMP security requirements are not stricter than the IPFIX security PSAMP security requirements are not stricter than the IPFIX security
requirements, refer to the IPFIX export protocol [IPFIX-PROTO] for requirements, refer to the IPFIX export protocol [IPFIX-PROTO] for
the security considerations. the security considerations.
9. 9. IANA Considerations
IANA Considerations
The only IANA considerations in this document concern the extension The PSAMP Protocol, as set out in this document, has two sets of
of Information Elements, Set ID and Scope. Refer to the IANA assigned numbers. Considerations for assigning them are discussed in
considerations section in [IPFIX-PROTO] where those possible new this section, using the example policies as set out in the
assignments are specified. "Guidelines for IANA Considerations" document IANA-RFC [RFC2434].
10. 9.1 IPFIX Related Considerations
References
10.1 As the PSAMP protocol uses the IPFIX protocol, refer to the IANA
Normative References considerations section in [IPFIX-PROTO] for the assignments of
numbers used in the protocol and for the numbers used in the
information model.
9.2 PSAMP Related Considerations
Each new selection method MUST be assigned a unique value for the
selectorAlgorithm Information Element. Its configuration
parameter(s), along with the way to report it/them with an Options
Template, MUST be clearly specified.
Each new selection method MUST be assigned a unique value for the
selectorAlgorithm Information Element. New assignments for the PSAMP
selection method will be administered by IANA, on a First Come First
Served basis [RFC 2434], subject to Expert Review [RFC 2434], i.e.
review by one of a group of experts designated by an IETF Operations
and Management Area Director. The group of experts must double check
the Information Elements definitions with already defined Information
Elements for completeness, accuracy and redundancy. Those experts
will initially be drawn from the Working Group Chairs and document
editors of the IPFIX and PSAMP Working Groups.
10. References
10.1 Normative References
[PSAMP-TECH] T. Zseby, M. Molina, N. Duffield, S. Niccolini, F. [PSAMP-TECH] T. Zseby, M. Molina, N. Duffield, S. Niccolini, F.
Raspall, "Sampling and Filtering Techniques for IP Packet Selection" Raspall, "Sampling and Filtering Techniques for IP Packet Selection"
draft-ietf-psamp-sample-tech-07.txt draft-ietf-psamp-sample-tech-07.txt
[PSAMP-MIB] T. Dietz, B. Claise "Definitions of Managed Objects for [PSAMP-MIB] T. Dietz, B. Claise "Definitions of Managed Objects for
Packet Sampling" draft-ietf-psamp-mib-04.txt Packet Sampling" draft-ietf-psamp-mib-05.txt
[PSAMP-INFO] T. Dietz, F. Dressler, G. Carle, B. Claise, "Information [PSAMP-INFO] T. Dietz, F. Dressler, G. Carle, B. Claise, "Information
Model for Packet Sampling Exports", draft-ietf-psamp-info-02.txt Model for Packet Sampling Exports", draft-ietf-psamp-info-03.txt
[IPFIX-ARCH] G. Sadasivan, N. Brownlee, B. Claise, J. Quittek, [IPFIX-ARCH] G. Sadasivan, N. Brownlee, B. Claise, J. Quittek,
"Architecture Model for IP Flow Information Export" draft-ietf-ipfix- "Architecture Model for IP Flow Information Export" draft-ietf-ipfix-
arch-08.txt" arch-09.txt"
[IPFIX-INFO] J. Quittek, S. Bryant, B. Claise, J. Meyer, "Information [IPFIX-INFO] J. Quittek, S. Bryant, B. Claise, J. Meyer, "Information
Model for IP Flow Information Export" draft-ietf-ipfix-info-11 Model for IP Flow Information Export" draft-ietf-ipfix-info-11.txt
[IPFIX-PROTO] B. Claise (Editor) "IPFIX Protocol Specifications", [IPFIX-PROTO] B. Claise (Editor) "IPFIX Protocol Specifications",
draft-ietf-ipfix-protocol-19.txt draft-ietf-ipfix-protocol-19.txt
[RFC1771] Y. Rekhter, T. Li, "A Border Gateway Protocol 4 (BGP-4)", [RFC1771] Y. Rekhter, T. Li, "A Border Gateway Protocol 4 (BGP-4)",
RFC 1771, March 1995. RFC 1771, March 1995.
10.2 [RFC2434] H. Alvestrand, T. Narten, "Guidelines for Writing an IANA
Informative References Considerations Section in RFCs", RFC 2434, October 1998.
10.2 Informative References
[PSAMP-FMWK] D. Chiou, B. Claise, N. Duffield, A. Greenberg, M. [PSAMP-FMWK] D. Chiou, B. Claise, N. Duffield, A. Greenberg, M.
Grossglauser, P. Marimuthu, J. Rexford, G. Sadasivan, "A Framework Grossglauser, P. Marimuthu, J. Rexford, G. Sadasivan, "A Framework
for Passive Packet Measurement" draft-ietf-psamp-framework-10.txt for Passive Packet Measurement" draft-ietf-psamp-framework-10.txt
[RFC3917] J. Quittek, T. Zseby, B. Claise, S. Zander, "Requirements [RFC3917] J. Quittek, T. Zseby, B. Claise, S. Zander, "Requirements
for IP Flow Information Export", RFC 3917, October 2004 for IP Flow Information Export", RFC 3917, October 2004
11. 11. Acknowledgments
Acknowledgments
The authors would like to thank the PSAMP group, especially Paul The authors would like to thank the PSAMP group, especially Paul
Aitken for fruitful discussions and for proofreading the document. Aitken for fruitful discussions and for proofreading the document.
Authors' Addresses Authors' Addresses
Benoit Claise Benoit Claise
Cisco Systems Cisco Systems
De Kleetlaan 6a b1 De Kleetlaan 6a b1
1831 Diegem 1831 Diegem
 End of changes. 225 change blocks. 
555 lines changed or deleted 545 lines changed or added

This html diff was produced by rfcdiff 1.28, available from http://www.levkowetz.com/ietf/tools/rfcdiff/