draft-ietf-psamp-protocol-03.txt   draft-ietf-psamp-protocol-04.txt 
PSAMP working group PSAMP working group
Internet Draft EDITOR: B. Claise Internet Draft EDITOR: B. Claise
draft-ietf-psamp-protocol-03.txt Cisco Systems draft-ietf-psamp-protocol-04.txt Cisco Systems
Expires: April 2006 October 2005 Expires: September 2006 March 2006
Packet Sampling (PSAMP) Protocol Specifications Packet Sampling (PSAMP) Protocol Specifications
Status of this Memo Status of this Memo
By submitting this Internet-Draft, each author represents that any By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79. aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
skipping to change at page 1, line 31 skipping to change at page 1, line 31
Internet-Drafts are draft documents valid for a maximum of six Internet-Drafts are draft documents valid for a maximum of six
months and may be updated, replaced, or obsoleted by other documents months and may be updated, replaced, or obsoleted by other documents
at any time. It is inappropriate to use Internet-Drafts as at any time. It is inappropriate to use Internet-Drafts as
reference material or to cite them other than as "work in progress". reference material or to cite them other than as "work in progress".
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html http://www.ietf.org/shadow.html
This Internet-Draft will expire on April 23, 2006. This Internet-Draft will expire on September 30, 2006.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2005). Copyright (C) The Internet Society (2006).
Abstract Abstract
This document specifies the export of packet information from a This document specifies the export of packet information from a
PSAMP Exporting Process to a PSAMP Colleting Process. For export of PSAMP Exporting Process to a PSAMP Collecting Process. For export
packet information the IP Flow Information eXport (IPFIX) protocol of packet information the IP Flow Information eXport (IPFIX)
is used, as both the IPFIX and PSAMP architecture match very well protocol is used, as both the IPFIX and PSAMP architecture match
and the means provided by the IPFIX protocol are sufficient. The very well and the means provided by the IPFIX protocol are
document specifies in detail how the IPFIX protocol is used for sufficient. The document specifies in detail how the IPFIX protocol
PSAMP export of packet information. is used for PSAMP export of packet information.
Conventions used in this document Conventions used in this document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119. document are to be interpreted as described in RFC 2119 [RFC2119].
Table of Contents Table of Contents
1. Points of Discussion.........................................3 1. Introduction................................................3
1.1 Open Issues................................................3 2. PSAMP Documents Overview....................................3
1.2 Action Items...............................................4 3. Terminology.................................................4
2. Introduction.................................................4 3.1 IPFIX Terminology..........................................4
3. PSAMP Documents Overview.....................................5 3.2 PSAMP Terminology..........................................8
4. Terminology..................................................5 3.2.1 Packet Streams and Packet Content.....................8
4.1 IPFIX Terminology..........................................6 3.2.2 Selection Process.....................................9
4.2 PSAMP Terminology.........................................10 3.2.3 Reporting............................................10
4.2.1 Packet Streams and Packet Content......................10 3.2.4 Exporting Process....................................11
4.2.2 Selection Process......................................11 3.2.5 PSAMP Device.........................................11
4.2.3 Reporting..............................................12 3.2.6 Selection Methods....................................11
4.2.4 Exporting Process......................................13 3.3 IPFIX and PSMAP Terminology Comparison....................13
4.2.5 PSAMP Device...........................................13 3.3.1 PSAMP and IPFIX Processes............................13
4.2.6 Selection Methods......................................13 3.3.2 Packet Report, Packet Interpretation, and Data Record14
4.3 IPFIX and PSMAP Terminology Comparison....................15 4. Differences between PSAMP and IPFIX........................14
4.3.1 PSAMP and IPFIX Processes..............................16 4.1 Architecture Point of View................................14
4.3.2 Packet Report, Packet Interpretation, and Data Record..16 4.2 Protocol Point of View....................................16
5. Differences between PSAMP and IPFIX.........................16 4.3 Information Model Point of View...........................16
5.1 Architecture Point of View................................16 5. PSAMP Requirements versus the IPFIX Solution...............16
5.2 Protocol Point of View....................................18 5.1 High Level View of the Integration........................17
5.3 Information Model Point of View...........................18 6. Using the IPFIX Protocol for PSAMP.........................18
6. PSAMP Requirements versus the IPFIX Solution................19 6.1 Selector ID...............................................18
6.1 IPFIX Solution for the PSAMP Requirements.................19 6.2 The Selection Sequence....................................18
6.2 High Level View of the Integration........................21 6.3 The Exporting Process.....................................18
7. Using the IPFIX Protocol for PSAMP..........................22 6.4 Packet Report.............................................18
7.1 Selector ID...............................................22 6.4.1 Basic Packet Report..................................19
7.2 The Associations..........................................22 6.4.2 Extended Packet Report...............................21
7.3 Packet Reports............................................22 6.5 Report Interpretation.....................................23
7.3.1 Basic Packet Reports...................................22 6.5.1 Selection Sequence Report Interpretation.............23
7.3.2 Extended Packet Reports................................24 6.5.2 Selector Report Interpretation.......................25
7.4 Report Interpretation.....................................25 6.5.2.1 Systematic Count-Based Sampling......................25
7.4.1 Associations Report Interpretation.....................25 6.5.2.2 Systematic Time-Based Sampling.......................27
7.4.2 Selector Report Interpretation.........................27 6.5.2.3 Random n-out-of-N Sampling...........................28
7.4.2.1 Systematic Count-Based Sampling.......................28 6.5.2.4 Uniform Probabilistic Sampling.......................29
7.4.2.2 Systematic Time-Based Sampling........................29 6.5.2.5 Property Match Filtering.............................30
7.4.2.3 Random n-out-of-N Sampling............................30 6.5.2.6 Hash-Based Filtering.................................32
7.4.2.4 Uniform Probabilistic Sampling........................31 6.5.2.7 Other Selection Methods..............................35
7.4.2.5 Property Match Filtering..............................32 6.5.3 Selection Sequence Statistics Report Interpretation..35
7.4.2.6 Hash-Based Filtering..................................34 6.5.4 Accuracy Report Interpretation.......................38
7.4.2.7 Other Selection Methods...............................34 7. Security Considerations....................................41
7.4.3 Associations Statistics Report Interpretation..........34 8. IANA Considerations........................................41
7.4.4 Accuracy Report Interpretation.........................37 8.1 IPFIX Related Considerations..............................41
7.4.5 Observation Point Report Interpretation................37 8.2 PSAMP Related Considerations..............................41
8. Security Considerations.....................................37 9. References.................................................42
9. IANA Considerations.........................................37 9.1 Normative References......................................42
9.1 IPFIX Related Considerations..............................37 9.2 Informative References....................................42
9.2 PSAMP Related Considerations..............................37 10. Acknowledgments...........................................43
10. References.................................................38
10.1 Normative References.....................................38
10.2 Informative References...................................38
11. Acknowledgments............................................39
1. Points of Discussion
1.1 Open Issues
This section covers the open issues, still to be resolved/updated in
this draft:
PROTO-04 Should probably have a separate section for the examples?
PROTO-08 Instead of sending the input sequence number for each
selector ID, a counter64 value, associated with every packet, the
working group should discuss the possibility to send the information
on regular basis with an option template record. Specifically in the
case of Composite Selector, we would send multiple times a 64-bit
counter in each packet.
PROTO-11 Discuss how to implement the accuracy report interpretation
PROTO-12 Discuss how to implement the observation point report
interpretation (if we need one)
PROTO-16 IANA considerations section to be completed.
Two questions:
1. I'm not too sure whether we should mandate a new IETF RFC for the
new selection method description?
2. I'm not too sure whether we should mandate new IANA-registered
information elements for the new selection method?
In other words, can we have proprietary selection method in the
selectorAlgorithm Information Element?
PROTO-17 "Encrypted Packets: Selectors that interpret packet fields
must be configurable to ignore (i.e. not select) encrypted packets,
when they are detected". "Since packet encryption alters the meaning
of encrypted fields, field match filtering must be configurable to
ignore encrypted packets, when detected." I guess we will need extra
text for this.
PROTO-18 "The exporting process must have an export rate limit,
configurable per Exporting Process". I guess we need extra text for
this.
PROTO-19 "the timestamp of observation of the packet at the
Observation Point. The timestamp should be reported to microsecond
resolution." Nothing is mentioned in this draft regarding this issue.
PROTO-20 Hash based filtering to be completed.
1.2 Action Items
PROTO-101 See EDITOR'S NOTE
PROTO-104 Fix the terminology sections, as a last step before
publication
PROTO-106 Extend security considerations by a discussion on exported
Payload. Consider whether [PSAMP-INFO] or [PSAMP-PROTO] or both
is/are the place(s).
PROTO-107 Provide the equivalent for variable length I.E.
Here is an example of a basic Packet Report, with a SelectionPath
value of 9 (will be explained later on) and ipPacketSection
Information Element of 12 bytes, encoded with a fixed length.
This is an example of PROTO-15, to be put in section 7.3.1
PROTO-108 Have a statement that this protocol specification
meets all requirements for the PSAMP protocol stated in the framework
except ... An then have a list of bullets, where at minimum there is
stated "not yet covered" or a longer explanation why it is not
covered. This would be replacement for the long list of requirements
in section 6.1
2. Introduction 1.
Introduction
The name PSAMP is a contraction of the phrase Packet SAMPling. The The name PSAMP is a contraction of the phrase Packet SAMPling. The
word "sampling" captures the idea that only a subset of all packets word "sampling" captures the idea that only a subset of all packets
passing a network element will be selected for reporting. PSAMP passing a network element will be selected for reporting. PSAMP
selection operations include random selection, deterministic selection operations include random selection, deterministic
selection (filtering), and deterministic approximations to random selection (filtering), and deterministic approximations to random
selection (hash-based selection). selection (hash-based selection).
The IP Flow information export (IPFIX) protocol specified in [IPFIX- The IP Flow information export (IPFIX) protocol specified in [IPFIX-
PROTO] exports IP traffic information [IPFIX-INFO] observed at PROTO] exports IP traffic information [IPFIX-INFO] observed at
network devices. This matches the general protocol requirements network devices. This matches the general protocol requirements
outlined in the PSAMP framework [PSAMP-FMWK]. However, there are outlined in the PSAMP framework [PSAMP-FMWK]. However, there are
some architectural differences between IPFIX and PSAMP in the some architectural differences between IPFIX and PSAMP in the
requirements for an export protocol. While the IPFIX architecture requirements for an export protocol. While the IPFIX architecture
[IPFIX-ARCH] is focused on gathering and exporting IP traffic flow [IPFIX-ARCH] is focused on gathering and exporting IP traffic flow
information, the focus of the PSAMP framework [PSAMP-FMWK] is on information, the focus of the PSAMP framework [PSAMP-FMWK] is on
exporting information on individual packets. This basic difference exporting information on individual packets. This basic difference
and a set of derived differences in protocol requirements are and a set of derived differences in protocol requirements are
outlined in Section 5. Despite these differences, the IPFIX protocol outlined in Section 4. Despite these differences, the IPFIX protocol
is well suited as PSAMP protocol. Section 5 specifies how the IPFIX is well suited as PSAMP protocol. Section 5 specifies how the IPFIX
protocol is used for the export of packet samples. Required protocol is used for the export of packet samples. Required
extensions of the IPFIX information model are specified in the PSAMP extensions of the IPFIX information model are specified in the PSAMP
information model [PSAMP-INFO]. information model [PSAMP-INFO].
3. PSAMP Documents Overview 2.
PSAMP Documents Overview
[PSAMP-FMWK]: "A Framework for Packet Selection and Reporting", [PSAMP-FMWK]: "A Framework for Packet Selection and Reporting",
describes the PSAMP framework for network elements to select subsets describes the PSAMP framework for network elements to select subsets
of packets by statistical and other methods, and to export a stream of packets by statistical and other methods, and to export a stream
of reports on the selected packets to a collector. of reports on the selected packets to a collector.
[PSAMP-TECH]: "Sampling and Filtering Techniques for IP Packet [PSAMP-TECH]: "Sampling and Filtering Techniques for IP Packet
Selection", describes the set of packet selection techniques Selection", describes the set of packet selection techniques
supported by PSAMP. supported by PSAMP.
[PSAMP-PROTO]: "Packet Sampling (PSAMP) Protocol Specifications" [PSAMP-PROTO]: "Packet Sampling (PSAMP) Protocol Specifications"
(this document), specifies the export of packet information from a (this document), specifies the export of packet information from a
PSAMP Exporting Process to a PSAMP Colleting Process PSAMP Exporting Process to a PSAMP Collecting Process.
[PSAMP-INFO]: "Information Model for Packet Sampling Exports" defines [PSAMP-INFO]: "Information Model for Packet Sampling Exports" defines
an information and data model for PSAMP. an information and data model for PSAMP.
[PSAMP-MIB]: "Definitions of Managed Objects for Packet Sampling" [PSAMP-MIB]: "Definitions of Managed Objects for Packet Sampling"
describes the PSAMP Management Information Base describes the PSAMP Management Information Base.
4. Terminology 3.
Terminology
As the IPFIX export protocol is used to export the PSAMP information, As the IPFIX export protocol is used to export the PSAMP information,
the relevant IPFIX terminology from [IPFIX-PROTO] is copied over in the relevant IPFIX terminology from [IPFIX-PROTO] is copied over in
this document. The terminology summary table in section 4.1 gives a this document. The terminology summary table in section 4.1 gives a
quick overview of the relationships between the different IPFIX quick overview of the relationships between the different IPFIX
terms. The PSAMP terminology defined here is fully consistent with terms. The PSAMP terminology defined here is fully consistent with
all terms listed in [PSAMP-TECH] and [PSAMP-FMWK] but only all terms listed in [PSAMP-TECH] and [PSAMP-FMWK] but only
definitions that are only relevant to the PSAMP protocol appear here. definitions that are only relevant to the PSAMP protocol appear here.
The section 5.4 applies the PSAMP terminology to the IPFIX protocol Section 5.4 applies the PSAMP terminology to the IPFIX protocol
terminology. terminology.
4.1 IPFIX Terminology 3.1
IPFIX Terminology
EDITOR'S NOTE: The terminology has been entirely copied over from The IPFIX terminology section has been entirely copied over from
[IPFIX-PROTO]. Before publication, we should evaluate which terms [IPFIX-PROTO], except for the IPFIX Exporting Process term, which is
should be kept, if not all. The ones required for sure so far are: defined more precisely in the PSAMP terminology section.
Flow Record, Flow, Information Element, Metering Process, Collector,
Scope, Set, Template Record, Data Record, Data Set, Template Set,
Template Record(s), Options Template Set, Options Template Record.
Note: the IPFIX Exporting Process was not used, as the PSAMP
Exporting Process is more specific.
Observation Point Observation Point
An Observation Point is a location in the network where IP packets An Observation Point is a location in the network where IP packets
can be observed. Examples include: a line to which a probe is can be observed. Examples include: a line to which a probe is
attached, a shared medium, such as an Ethernet-based LAN, a single attached, a shared medium, such as an Ethernet-based LAN, a single
port of a router, or a set of interfaces (physical or logical) of a port of a router, or a set of interfaces (physical or logical) of a
router. router.
Note that every Observation Point is associated with an Observation Note that every Observation Point is associated with an Observation
skipping to change at page 10, line 17 skipping to change at page 8, line 29
| +--------------------+------------------------+ | +--------------------+------------------------+
| Set | Template | Record | | Set | Template | Record |
+------------------+--------------------+------------------------+ +------------------+--------------------+------------------------+
| Data Set | / | Data Record(s) | | Data Set | / | Data Record(s) |
+------------------+--------------------+------------------------+ +------------------+--------------------+------------------------+
| Template Set | Template Record(s) | / | | Template Set | Template Record(s) | / |
+------------------+--------------------+------------------------+ +------------------+--------------------+------------------------+
| Options Template | Options Template | / | | Options Template | Options Template | / |
| Set | Record(s) | | | Set | Record(s) | |
+------------------+--------------------+------------------------+ +------------------+--------------------+------------------------+
Figure A: Terminology Summary Table Figure A: Terminology Summary Table
4.2 PSAMP Terminology 3.2
PSAMP Terminology
EDITOR'S NOTE: The terminology has been entirely copied over from The PSAMP terminology section has been copied over from [PSAMP-TECH].
[PSAMP-TECH], except for some (almost) similar terms where only the
IPFIX terms were kept (for example, observation point). Before
publication, we should evaluate which terms should be kept. The ones
required for sure so far are: Selector, Composite Selector, Packet
Reports, Packet Interpretation, PSAMP device, Collector, Filtering,
Sampling. Note that the terms Selector ID and Association ID, coming
from [PSAMP-FMWK], has been added in the Selection Process section.
4.2.1 Packet Streams and Packet Content 3.2.1 Packet Streams and Packet Content
Observed Packet Stream Observed Packet Stream
The Observed Packet Stream is the set of all packets observed at the The Observed Packet Stream is the set of all packets observed at the
Observation Point. Observation Point.
Packet Stream Packet Stream
A packet stream denotes a set of packets that flows past some A packet stream denotes a set of packets that flows past some
specified point within the Selection Process. An example of a Packet specified point within the Selection Process. An example of a Packet
Stream is the output of the selection process. Note that packets Stream is the output of the Selection Process. Note that packets
selected from a stream, e.g. by Sampling, do not necessarily possess selected from a stream, e.g. by Sampling, do not necessarily possess
a property by which they can be distinguished from packets that have a property by which they can be distinguished from packets that have
not been selected. For this reason the term "stream" is favored over not been selected. For this reason the term "stream" is favored over
"flow", which is defined as set of packets with common properties "flow", which is defined as set of packets with common properties
[IPFIX-REQ]. [IPFIX-REQ].
Packet Content Packet Content
The packet content denotes the union of the packet header (which The packet content denotes the union of the packet header (which
includes link layer, network layer and other encapsulation headers) includes link layer, network layer and other encapsulation headers)
and the packet payload. and the packet payload.
4.2.2 Selection Process 3.2.2 Selection Process
Selection Process Selection Process
A Selection Process takes the Observed Packet Stream as its input and A Selection Process takes the Observed Packet Stream as its input and
selects a subset of that stream as its output. selects a subset of that stream as its output.
Selection State Selection State
A Selection Process may maintain state information for use by the A Selection Process may maintain state information for use by the
Selection Process. At a given time, the Selection State may depend Selection Process. At a given time, the Selection State may depend
skipping to change at page 11, line 32 skipping to change at page 9, line 38
(i) sequence numbers of packets at the input of Selectors; (i) sequence numbers of packets at the input of Selectors;
(ii) a timestamp of observation of the packet at the (ii) a timestamp of observation of the packet at the
Observation Point; Observation Point;
(iii) iterators for pseudorandom number generators; (iii) iterators for pseudorandom number generators;
(iv) hash values calculated during selection; (iv) hash values calculated during selection;
(v) indicators of whether the packet was selected by a (v) indicators of whether the packet was selected by a
given Selector; given Selector.
Selection Processes may change portions of the Selection State as a Selection Processes may change portions of the Selection State as a
result of processing a packet. Selection state for a packet is to result of processing a packet. Selection state for a packet is to
reflect the state after processing the packet. reflect the state after processing the packet.
Selector Selector
A Selector defines the action of a Selection Process on a single A Selector defines the action of a Selection Process on a single
packet of its input. If selected, the packet becomes an element of packet of its input. If selected, the packet becomes an element of
the output Packet Stream. the output Packet Stream.
skipping to change at page 12, line 24 skipping to change at page 10, line 31
Primitive Selector Primitive Selector
A Selector is primitive if it is not a Composite Selector. A Selector is primitive if it is not a Composite Selector.
Selector ID Selector ID
The Selector ID is the unique ID identifying a Primitive Selector. The Selector ID is the unique ID identifying a Primitive Selector.
The ID is unique within the Observation Domain. The ID is unique within the Observation Domain.
Selection Path Selection Sequence
From all the packets observed at an Observation Point, only a few From all the packets observed at an Observation Point, only a few
packets are selected by one or more Selectors. The Selection Path is packets are selected by one or more Selectors. The Selection
a unique value describing the Observation Point and the Selector IDs Sequence is a unique value per Observation Domain describing the
through which the packets are selected. The Selection Path is unique Observation Point and the Selector IDs through which the packets are
per Observation Domain. The Selection Path is represented by the selected.
selectionPath Information Element [PSAMP-INFO].
4.2.3 Reporting 3.2.3 Reporting
Packet Reports Packet Reports
Packet Reports comprise a configurable subset of a packet's input to Packet Reports comprise a configurable subset of a packet's input to
the Selection Process, including the Packet Content, information the Selection Process, including the Packet Content, information
relating to its treatment (for example, the output interface), and relating to its treatment (for example, the output interface), and
its associated selection state (for example, a hash of the Packet its associated selection state (for example, a hash of the Packet
Content) Content)
Report Interpretation: Report Interpretation
Report Interpretation comprises subsidiary information, relating to Report Interpretation comprises subsidiary information, relating to
one or more packets, that are used for interpretation of their Packet one or more packets, that are used for interpretation of their Packet
Reports. Examples include configuration parameters of the Selection Reports. Examples include configuration parameters of the Selection
Process. Process.
Report Stream: Report Stream
The Report Stream is the output of a Selection Process, comprising The Report Stream is the output of a Selection Process, comprising
two distinguished types of information: Packet Reports, and Report two distinguished types of information: Packet Reports, and Report
Interpretation. Interpretation.
4.2.4 Exporting Process 3.2.4 Exporting Process
Exporting Process: Exporting Process
An Exporting Process sends, in the form of Export Packet, the output An Exporting Process sends, in the form of Export Packets, the output
of one or more Selection Processes to one or more Collectors. of one or more Selection Processes to one or more Collectors.
Export Packet: Export Packet
An Export Packet is a combination of Report Interpretation and/or one An Export Packet is a combination of Report Interpretation(s) and/or
or more Packet Reports are bundled by the Exporting Process into a one or more Packet Reports that are bundled by the Exporting Process
Export Packet for exporting to a Collector. into a Export Packet for exporting to a Collector.
4.2.5 PSAMP Device 3.2.5 PSAMP Device
PSAMP Device PSAMP Device
A PSAMP Device is a device hosting at least an Observation Point, a A PSAMP Device is a device hosting at least an Observation Point, a
Selection Process and an Exporting Process. Typically, corresponding Selection Process and an Exporting Process. Typically, corresponding
Observation Point(s), Selection Process(es) and Exporting Process(es) Observation Point(s), Selection Process(es) and Exporting Process(es)
are co-located at this device, for example at a router. are co-located at this device, for example at a router.
4.2.6 Selection Methods 3.2.6 Selection Methods
Filtering Filtering
A filter is a Selector that selects a packet deterministically based A filter is a Selector that selects a packet deterministically based
on the Packet Content, or its treatment, or functions of these on the Packet Content, or its treatment, or functions of these
occurring in the Selection State. Examples include field match occurring in the Selection State. Examples include field match
Filtering, and Hash-based Selection. Filtering, and Hash-based Selection.
Sampling Sampling
skipping to change at page 14, line 40 skipping to change at page 12, line 47
A deterministic map from the Hash Domain into the Hash Range. A deterministic map from the Hash Domain into the Hash Range.
Hash Selection Range Hash Selection Range
A subset of the Hash Range. The packet is selected if the action of A subset of the Hash Range. The packet is selected if the action of
the Hash Function on the Hash Domain for the packet yields a result the Hash Function on the Hash Domain for the packet yields a result
in the Hash Selection Range. in the Hash Selection Range.
Hash-based Selection Hash-based Selection
Filtering specified by a Hash Domain, a Hash Function, and Hash Range Filtering specified by a Hash Domain, a Hash Function, a Hash Range
and a Hash Selection Range. and a Hash Selection Range.
Approximative Selection Approximative Selection
Selectors in any of the above categories may be approximated by Selectors in any of the above categories may be approximated by
operations in the same or another category for the purposes of operations in the same or another category for the purposes of
implementation. For example, uniform pseudorandom Sampling may be implementation. For example, uniform pseudorandom Sampling may be
approximated by Hash-based Selection, using a suitable Hash Function approximated by Hash-based Selection, using a suitable Hash Function
and Hash Domain. In this case, the closeness of the approximation and Hash Domain. In this case, the closeness of the approximation
depends on the choice of Hash Function and Hash Domain. depends on the choice of Hash Function and Hash Domain.
Population Population
A Population is a Packet Stream, or a subset of a Packet Stream. A A Population is a Packet Stream, or a subset of a Packet Stream. A
Population can be considered as a base set from which packets are Population can be considered as a base set from which packets are
selected. An example is all packets in the Observed Packet Stream selected. An example is all packets in the Observed Packet Stream
that are observed within some specified time interval. that are observed within some specified time interval.
Population Size Population Size
The Population Size is the number of all packets in the Population. The Population Size is the number of all packets in the Population.
Sample Size Sample Size
skipping to change at page 15, line 35 skipping to change at page 13, line 44
The Attained Selection Fraction is the actual ratio of the The Attained Selection Fraction is the actual ratio of the
number of packets selected by a Selector from an input number of packets selected by a Selector from an input
Population, to the Population Size. For some Sampling methods the Population, to the Population Size. For some Sampling methods the
Attained Selection Fraction can differ from the Configured Selection Attained Selection Fraction can differ from the Configured Selection
Fraction due to, for example, the inherent statistical variability in Fraction due to, for example, the inherent statistical variability in
Sampling decisions of probabilistic Sampling and Hash-based Sampling decisions of probabilistic Sampling and Hash-based
Selection. Nevertheless, for large Population Sizes and properly Selection. Nevertheless, for large Population Sizes and properly
configured Selectors, the Attained Selection Fraction usually configured Selectors, the Attained Selection Fraction usually
approaches the Configured Selection Fraction. approaches the Configured Selection Fraction.
4.3 IPFIX and PSMAP Terminology Comparison 3.3
IPFIX and PSMAP Terminology Comparison
EDITOR'S NOTE:
Some terms between IPFIX and PSAMP were almost similar but not
quite:
- observation point. I kept the one from IPFIX. However, if the
PSAMP/IPFIX definitons would be aligned, it would better.
- exporting process. I kept the one from PSAMP.
- Collector: I kept the one from IPFIX, which implies that I used
the Collecting Process defined in IPFIX (it speaks about flows, but
there is no PSAMP Collecting Process definition)
The PSAMP terminology has been specified with an IPFIX background, as The PSAMP terminology has been specified with an IPFIX background, as
PSAMP and IPFIX have similar terms. However, this section explains a PSAMP and IPFIX have similar terms. However, this section explains
couple of non compatible terms between IPFIX and PSAMP. the non compatible terms between IPFIX and PSAMP.
4.3.1 PSAMP and IPFIX Processes
3.3.1 PSAMP and IPFIX Processes
The figure B indicates the sequence of the processes (selection and The figure B indicates the sequence of the processes (selection and
exporting) within the PSAMP Device. exporting) within the PSAMP Device.
+----------+ +-----------+ +----------+ +-----------+
Observed | Metering | | Exporting | Observed | Metering | | Exporting |
Packet--->| Process |----->| Process |--->Collector Packet--->| Process |----->| Process |--->Collector
Stream +----------+ +-----------+ Stream +----------+ +-----------+
Figure B: PSAMP Processes Figure B: PSAMP Processes
The Selection Process, which takes an Observed Packet Stream as its The Selection Process, which takes an Observed Packet Stream as its
input, and produces Packet Reports as its output, is an integral part input and produces Packet Reports as its output, is an integral part
of the Metering Process, which by its definition, produces Flow of the Metering Process, which by its definition produces Flow
Records as its output. Records as its output.
4.3.2 Packet Report, Packet Interpretation, and Data Record 3.3.2 Packet Report, Packet Interpretation, and Data Record
The PSAMP terminology speaks of Packet Report and Packet The PSAMP terminology speaks of Packet Report and Packet
Interpretation, while the IPFIX terminology speaks of Data Record and Interpretation, while the IPFIX terminology speaks of Data Record and
(Option) Template Record. The Packet Report, which comprises (Option) Template Record. The PSAMP Packet Report, which comprises
information about the observed packet, can be viewed as analogous to information about the observed packet, can be viewed as analogous to
the Data Record defined by a Template Record. The Packet the IPFIX Data Record defined by a Template Record. The PSAMP Packet
Interpretation, which comprises subsidiary information used for the Interpretation, which comprises subsidiary information used for the
interpretation of the Packet Reports, can be viewed as analogous to interpretation of the Packet Reports, can be viewed as analogous to
the Data Record defined by an Option Template Record. the IPFIX Data Record defined by an Option Template Record.
5. 4.
Differences between PSAMP and IPFIX Differences between PSAMP and IPFIX
The output of the IPFIX working group relevant for this draft is The output of the IPFIX working group relevant for this draft is
structured into three documents: structured into three documents:
- IP Flow information architecture [IPFIX-ARCH] - IP Flow information architecture [IPFIX-ARCH]
- IPFIX protocol specifications [IPFIX-PROTO] - IPFIX protocol specifications [IPFIX-PROTO]
- IP Flow information export information model [IPFIX-INFO] - IP Flow information export information model [IPFIX-INFO]
5.1 4.1
Architecture Point of View Architecture Point of View
Traffic Flow measurement as described in the IPFIX requirements Traffic Flow measurement as described in the IPFIX requirements
[RFC3917] and the IPFIX architecture [IPFIX-ARCH] can be separated [RFC3917] and the IPFIX architecture [IPFIX-ARCH] can be separated
into two stages: packet processing and Flow processing. into two stages: packet processing and Flow processing.
The figure C illustrates these stages. Figure C illustrates these stages.
On stage 1, all processing steps act on packets. Packets are In stage 1, all processing steps act on packets. Packets are
captured, time stamped, selected by one or more selection steps and captured, time stamped, selected by one or more selection steps and
finally forwarded to packet classification that maps packets to finally forwarded to packet classification that maps packets to
Flows. The packets selection steps may include Filtering and Flows. The packets selection steps may include Filtering and
Sampling functions. Sampling functions.
On stage 2, all processing steps act on Flows. After packets are In stage 2, all processing steps act on Flows. After packets are
classified (mapped to Flows), Flows are generated, or updated if they classified (mapped to Flows), Flows are generated or updated if they
exist already. Flow generation and update steps may be performed exist already. Flow generation and update steps may be performed
repeatedly for aggregating Flows. Finally, Flows are exported. repeatedly for aggregating Flows. Finally, Flows are exported.
Packet Sampling as described in the PSAMP framework [PSAMP-FMWK] Packet Sampling as described in the PSAMP framework [PSAMP-FMWK]
covers only stage 1 of the IPFIX architecture with the packet covers only stage 1 of the IPFIX architecture with the packet
classification replaced by packet record export. classification replaced by packet record export.
IPFIX architecture PSAMP framework IPFIX architecture PSAMP framework
packet header packet header packet header packet header
skipping to change at page 18, line 4 skipping to change at page 16, line 4
| Flow | | Flow |
| selection | | selection |
| | | | | |
+-------+ | +-------+ |
| | | |
v | v |
Flow Record / Flow Record /
export export
Figure C: Comparison of IPFIX architecture and PSAMP framework Figure C: Comparison of IPFIX architecture and PSAMP framework
5.2 Protocol Point of View 4.2
Protocol Point of View
Concerning the protocol, the major difference between IPFIX and PSAMP Concerning the protocol, the major difference between IPFIX and PSAMP
is that the IPFIX protocol exports Flow Records while the PSAMP is that the IPFIX protocol exports Flow Records while the PSAMP
protocol exports Packet Records. From a pure export point of view, protocol exports Packet Records. From a pure export point of view,
IPFIX will not distinguish a Flow Record composed of several packets IPFIX will not distinguish a Flow Record composed of several packets
aggregated together, from a Flow Record composed of a single packet. aggregated together from a Flow Record composed of a single packet.
So the PSAMP export can be seen as special IPFIX Flow Record So the PSAMP export can be seen as special IPFIX Flow Record
containing information about a single packet. containing information about a single packet.
All extensions of the IPFIX protocol that are required to satisfy the All extensions of the IPFIX protocol that are required to satisfy the
PSAMP requirements, have already been incorporated in the IPFIX PSAMP requirements have already been incorporated in the IPFIX
protocol [IPFIX-PROTO], which was developed in parallel with the protocol [IPFIX-PROTO], which was developed in parallel with the
PSAMP protocol. An example is the need of a data type for protocol PSAMP protocol. An example is the need for a data type for protocol
fields that have flexible length, such as an octet array. This was fields that have flexible length, such as an octet array. This was
added to the IPFIX protocol specification in order to meet the added to the IPFIX protocol specification in order to meet the
requirement of the PSAMP protocol to report content of captured requirement of the PSAMP protocol to report content of captured
packets, for example the first octets of a packet. packets, for example the first octets of a packet.
5.3 Information Model Point of View 4.3
Information Model Point of View
From the information model point of view, the overlap between both From the information model point of view, the overlap between both
the IPFIX and PSAMP protocols is quite large. Most of the the IPFIX and PSAMP protocols is quite large. Most of the
Information Elements in the IPFIX protocol are also relevant for Information Elements in the IPFIX protocol are also relevant for
exporting packet information, for example all fields reporting packet exporting packet information, for example all fields reporting packet
header properties. Only a few Information Elements, such as header properties. Only a few Information Elements, such as
flowCount, packetCount (whose value will always be 1 for PSAMP) etc., flowCount, packetCount (whose value will always be 1 for PSAMP) etc.,
cannot be used in a meaningful way by the PSAMP protocol. Also, cannot be used in a meaningful way by the PSAMP protocol. Also,
IPFIX protocol requirements concerning stage 2 of figure C do not IPFIX protocol requirements concerning stage 2 of figure C do not
apply to the PSAMP metering process. apply to the PSAMP metering process.
Further required extensions apply to the information model. Even if Further required extensions apply to the information model. Even if
the IPFIX charter speaks of sampling, no Sampling related Information the IPFIX charter speaks of Sampling, no Sampling related Information
Elements are specified in [IPFIX-INFO]. The task of specifying them Elements are specified in [IPFIX-INFO]. The task of specifying them
was intentionally left for the PSAMP information model [PSAMP-INFO]. was intentionally left for the PSAMP information model [PSAMP-INFO].
A set of several additional fields is required for satisfying the A set of several additional fields is required for satisfying the
requirements for the PSAMP information model [PSAMP-TECH]. requirements for the PSAMP information model [PSAMP-TECH].
Additional required extensions of the information model concern
packet filtering, and the field reporting content of a packet using
the flexible length data type mentioned above.
Exploiting the extensibility of the IPFIX information model, the Exploiting the extensibility of the IPFIX information model, the
required extension is covered by the PSAMP information model required extension is covered by the PSAMP information model
specified in [PSAMP-INFO]. specified in [PSAMP-INFO].
6. PSAMP Requirements versus the IPFIX Solution 5.
PSAMP Requirements versus the IPFIX Solution
In the "Generic Requirements for PSAMP" section, [PSAMP-FMWK] In the "Generic Requirements for PSAMP" section, [PSAMP-FMWK]
describes some requirements that affect directly the PSAMP export describes some requirements that affect directly the PSAMP export
protocol. protocol.
In the "Generic Selection Process Requirements" section, [PSAMP-FMWK] In the "Generic Selection Process Requirements" section, [PSAMP-FMWK]
describes one requirement that, if not directly related to the export describes one requirement that, if not directly related to the export
protocol, will put some constraints on it. Parallel Measurements: protocol, will put some constraints on it. Parallel Measurements:
multiple independent selection processes at the same entity. multiple independent selection processes at the same entity.
In the "Reporting Process" section, [PSAMP-FMWK] finally describes a Finally, [PSAMP-FMWK] describes a series of requirements specifying
series of requirements specifying the different Information Elements the different Information Elements that MUST and SHOULD be reported
that MUST and SHOULD reported to the Collector. Nevertheless IPFIX, to the Collector. Nevertheless IPFIX, being a generic export
being a generic export protocol, can export any Information Elements protocol, can export any Information Elements as long as there are
as long as there are described in the information model. So these described in the information model. So these requirements are mainly
requirements are mainly targeted for the [PSAMP-INFO] document. targeted for the [PSAMP-INFO] document.
6.1 IPFIX Solution for the PSAMP Requirements
Let's address the PSAMP requirements that influence the export
protocol.
* Extensibility: the protocol must be able to accommodate additional
packet selectors not currently defined.
This requirement is addressed by the IPFIX information model, which
is extensible.
* Parallel Measurement Processes: the protocol must support
simultaneous operation of multiple independent Measurement Processes
at the same host.
This requirement is addressed by exporting the selectionPath
Information Element in every Packet Report. Note that without this
requirement, exporting the Selector ID in a Scope part of every
single Packet Report could have been sufficient.
* Encrypted Packets: Selectors that interpret packet fields must be
configurable to ignore (i.e. not select) encrypted packets, when they
are detected.
EDITOR'S NOTE: I guess we will need extra text for this.
* Indication of Information Loss: the Report Stream must include
sufficient information to indicate or allow the detection of loss
occurring within the Selection, Reporting or Exporting Processes, or
in transport. This may be achieved by the use of sequence numbers.
An Options Template, with updated statistics, MUST be sent on regular
basis. This Options Template contains for example the total number
of Packet Report exported from the PSAMP device, the total number of
packet observed, etc... Thus the Collector can compare the number of
Packet Report received per selector ID with the number actually
metered and/or sent. In case of discrepancy, a new Sampling rate
could be computed.
* Accuracy: the Report Stream must include information that enables
the accuracy of measurements to be determined.
This requirement is address with the accuracy report interpretation,
that sends the accuracy of the measurements.
EDITOR'S NOTE: is this the accuracy or the precision?
* Privacy: selection of the content of Packet Reports will be
cognizant of privacy and anonymity issues while being responsive to
the needs of measurement applications, and in accordance with RFC
2804. Full packet capture of arbitrary packet streams is explicitly
out of scope.
This requirement doesn't concern the export protocol itself.
* Timeliness: configuration must allow for limiting of buffering
delays for the formation and transmission for Export Packets.
The IPFIX protocol specifications [IPFIX-PROTO] describe an
inactivity timeout for the Flow expiration. This inactivity timeout
is configurable, with a minimum value of 0 for immediate expiration.
Note that this minimum value of 0 will force every single Data Record
to contain information about a single packet and not an aggregation
of packets.
* Congestion Avoidance: export of a report stream across a network
MUST be congestion avoiding in compliance with RFC 2914.
IPFIX, by its charter, MUST also respect this requirement.
* Secure Export:
- confidentiality: the option to encrypt exported data must be
provided.
- integrity: alterations in transit to exported data must be
detectable at the Collector
- authenticity: authenticity of exported data must be verifiable by
the Collector in order to detect forged data.
The motivation here is the same as for security in IPFIX export.
* Compression: to conserve network bandwidth and resources at the
Collector, the Export Packets may be compressed before export.
With the choice of IPFIX as PSAMP export protocol, the compression
option mentioned in the framework is not addressed.
* The exporting process must have an export rate limit, configurable
per Exporting Process.
EDITOR'S NOTE: this is an open issue. The PSAMP protocol specifications meets almost all the protocol
requirements stated in the PSAMP framework document [PSAMP-FMWK]:
* The timestamp of observation of the packet at the Observation * Extensibility
Point. The timestamp should be reported to microsecond resolution. * Parallel measurement processes
* Encrypted packets
* Indication of information loss
* Accuracy
* Privacy
* Timeliness
* Congestion avoidance
* Secure export
* Export rate limit
* Microsecond timestamp resolution
EDITOR'S NOTE: this is an open issue. The only requirement that is not met is Export Packet compression.
With the choice of IPFIX as PSAMP export protocol, the export packet
compression option mentioned in the section 8.5 of the framework
document [PSAMP-FMWK] is not addressed.
6.2 High Level View of the Integration 5.1
High Level View of the Integration
The Template Record in the Template Set is used to describe the The Template Record in the Template Set is used to describe the
different PSAMP Information Elements that will be exported to the different PSAMP Information Elements that will be exported to the
Collector. The Collector decodes the Template Record in the Template Collector. The Collector decodes the Template Record in the Template
Set and knows which Information Elements to expect when it receives Set and knows which Information Elements to expect when it receives
the Data Records in the Data Set, i.e. the PSAMP Packet Reports. the Data Records in the Data Set, i.e. the PSAMP Packet Reports.
Typically, in the base level of the PSAMP functionality, the Template Typically, in the base level of the PSAMP functionality, the Template
Set will contain the input sequence number, the packet fragment (some Set will contain the input sequence number, the packet fragment (some
number of contiguous bytes from the start of the packet or from the number of contiguous bytes from the start of the packet or from the
start of the payload) and the Selection Path. start of the payload) and the Selection Sequence.
The Options Template Record in the Options Template Set is used to The Options Template Record in the Options Template Set is used to
describe the different PSAMP Information Elements that concern the describe the different PSAMP Information Elements that concern the
Metering Process itself: Sampling and/or Filtering functions, plus Metering Process itself: Sampling and/or Filtering functions, and the
the associated parameters. The Collector decodes the Options associated parameters. The Collector decodes the Options Template
Template Records in the Option Template Set and knows which Records in the Option Template Set and knows which Information
Information Elements to expect when it receives the Data Records in Elements to expect when it receives the Data Records in the Data Set,
the Data Set, i.e. the PSAMP Report Interpretation. Typically, the i.e. the PSAMP Report Interpretation. Typically, the Options
Options Template would contain the Selection Path, the Sampling or Template would contain the Selection Sequence, the Sampling or
Filtering functions, and the Sampling or Filtering associated Filtering functions, and the Sampling or Filtering associated
parameters. parameters.
PSAMP requires all the different possibilities of the IPFIX protocol PSAMP requires all the different possibilities of the IPFIX protocol
specifications [IPFIX-PROTO]. That is the 3 types of Set (Data Set, specifications [IPFIX-PROTO]. That is the 3 types of Set (Data Set,
Template Set and Options Templates Set) with the 2 types of Templates Template Set and Options Templates Set) with the 2 types of Templates
Records (Template Record and Options Template Record), as described Records (Template Record and Options Template Record), as described
in the figure A. As a consequence, PSAMP can't rely on a subset of in the figure A. As a consequence, PSAMP can't rely on a subset of
the IPFIX protocol specifications are described in [IPFIX-PROTO]. the IPFIX protocol specifications are described in [IPFIX-PROTO].
The entire IPFIX protocol specifications [IPFIX-PROTO] MUST be The entire IPFIX protocol specifications [IPFIX-PROTO] MUST be
implemented for the PSAMP export. implemented for the PSAMP protocol.
7. Using the IPFIX Protocol for PSAMP 6.
Using the IPFIX Protocol for PSAMP
7.1 Selector ID 6.1
Selector ID
The Selector ID is the unique ID identifying a Primitive Selector. The Selector ID is the unique ID identifying a Primitive Selector.
Each Primitive Selector MUST have a unique ID within the Observation Each Primitive Selector MUST have a unique ID within the Observation
Domain. Domain. The Selector ID is represented by the selectorId Information
Element [PSAMP-INFO].
7.2 The Associations 6.2
The Selection Sequence ID
From all the packets observed at an Observation Point, a subset of From all the packets observed at an Observation Point, a subset of
packets is selected by one or more Selectors. The Selection Path is packets is selected by one or more Selectors. The Selection Sequence
a unique value describing the Observation Point and the Selector is the combination of an Observation Point and one or more
ID(s) through which the packets are selected. The Selection Path is Selector(s) through which the packets are selected. The Selection
represented by the selectionPath Information Element [PSAMP-INFO]. Sequence ID is a unique value representing that combination. The
Selection Sequence ID is represented by the selectionSequenceId
Information Element [PSAMP-INFO].
7.3 Packet Reports 6.3
The Exporting Process
For each Associations, for each selected packet, a Packet Report MUST An Exporting Process MUST be able to limit the export rate according
be created. The format of the Packet Report is specified in a to a configurable value. The Exporting Process MAY limit the export
Template Record contained in a Template Set. rate on a per Collecting Process basis.
6.4
Packet Report
For each Selection Sequences, for each selected packet, a Packet
Report MUST be created. The format of the Packet Report is specified
in a Template Record contained in a Template Set.
There are two types of Packet Report, as described in [PSAMP-FWMK]: There are two types of Packet Report, as described in [PSAMP-FWMK]:
the basic Packet Report and the extended Packet Report. the basic Packet Report and the extended Packet Report.
7.3.1 Basic Packet Reports 6.4.1 Basic Packet Report
For each selected packet, the Packet Report MUST contain the For each selected packet, the Packet Report MUST contain the
following information: following information:
- The selectionPath Information Element - The selectionSequenceId Information Element
- The hash value (digestHashValue) generated by the digest hash
function. If there are no digest functions in the selection
sequence then no element needs to be sent. If there is more than
one digest function then each hash value must be included in
the same order as they appear in the selection sequence.
- Some number of contiguous bytes from the start of the packet, - Some number of contiguous bytes from the start of the packet,
including the packet header (which includes link layer, network layer including the packet header (which includes link layer, network layer
and other encapsulation headers) and some subsequent bytes of the and other encapsulation headers) and some subsequent bytes of the
packet payload. Alternatively, the number of contiguous bytes may packet payload. Alternatively, the number of contiguous bytes may
start at the beginning of the payload. The Layer2PacketSection, start at the beginning of the payload. The dataLinkFrameSection,
l2PayloadPacketSection, mplsLabelStackSection, mplsLabelStackSection, mplsPayloadPacketSection, ipPacketSection, and
mplsPayloadPacketSection, ipPacketSection, and ipPayloadPacketSection ipPayloadPacketSection PSAMP Information Elements are available for
PSAMP Information Elements are available for this use. this use.
- The input sequence number(s) of any Selectors that acted on the
packet, represented by the selectorInputSequenceNumber Information
Element.
The contiguous Information Elements (Layer2PacketSection, For each selected packet, the Packet Report SHOULD contain the
l2PayloadPacketSection, mplsLabelStackSection, following information:
mplsPayloadPacketSection, ipPacketSection, and - the observationTimeMicroSeconds Information Element
ipPayloadPacketSection) MAY be encoded with a fixed length field or
with a variable sized field. If one of these Information Elements is
encoded with a fixed length field whose length is too long for the
number of contiguous bytes in the selected packet, padding MUST NOT
be used. In this case, the Exporting Process MUST export the
information either in a new Template Record with the correct fixed
length field, or either in a new Template Record with a variable
length field.
EDITOR'S NOTE: instead of sending the input sequence number for each In the Packet Report, the PSAMP device MUST be capable of exporting
selector ID, a counter64 value, associated with every packet, the the number of observed packets and the number of packets selected by
working group should discuss the possibility to send the information each instance of its Primitive Selectors (as described by the non
on regular basis with an option template record. Specifically in the scope Information Elements of the Selection Sequence Statistics
case of Composite Selector, we would send multiple times a 64-bit Report Interpretation) although it MAY be a configurable option not
counter in each packet. The example below doesn't contain the input to include them. If exported, the Attained Selection Fraction may
sequence number. be calculated precisely for the Observed Packet Stream. The Packet
Report MAY include only the final selector packetSelected, to act as
an index for that selection sequence in the Selection Sequence
Statistics Report Interpretation, which also allows the calculation
of the Attained Selection Fraction.
Here is an example of a basic Packet Report, with a SelectionPath The contiguous Information Elements (dataLinkFrameSection,
value of 9 and ipHeaderPacketSection Information Element of 12 bytes, mplsLabelStackSection, mplsPayloadPacketSection, ipPacketSection,
0x4500 005B A174 0000 FF11 832E, encoded with a fixed length field. and ipPayloadPacketSection) MAY be encoded with a fixed length field
or with a variable sized field. If one of these Information
Elements is encoded with a fixed length field whose length is too
long for the number of contiguous bytes in the selected packet,
padding MUST NOT be used. In this case, the Exporting Process MUST
export the information either in a new Template Record with the
correct fixed length field, or either in a new Template Record with
a variable length field.
Here is an example of a basic Packet Report, with a
SelectionSequenceId value of 9 and ipHeaderPacketSection Information
Element of 12 bytes, 0x4500 005B A174 0000 FF11 832E, encoded with a
fixed length field.
IPFIX Template Record: IPFIX Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 2 | Length = 16 | | Set ID = 2 | Length = 24 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 260 | Field Count = 2 | | Template ID = 260 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| selectionPath = 321 | Field Length = 4 | | selectionSequenceId = 301 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| digestHashValue = 326 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ipHeaderPacketSection = 313 | Field Length = 12 | | ipHeaderPacketSection = 313 | Field Length = 12 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|observationTimeMicroSeconds=324| Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The associated IPFIX Data Record: The associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 260 | Length = 20 | | Set ID = 260 | Length = 28 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 9 | | 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0x9123 0613 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0x4500 005B | | 0x4500 005B |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0xA174 0000 | | 0xA174 0000 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0xFF11 832E | | 0xFF11 832E |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| observation time encoded as dateTimeSeconds [IPFIX-PROTO] |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure D: Example of a Basic Packet Report Figure D: Example of a Basic Packet Report
Here is an example of a basic Packet Report, with a SelectionPath Here is an example of a basic Packet Report, with a
value of 9 (will be explained later on) and ipPacketSection SelectionSequenceId value of 9 and ipHeaderPacketSection Information
Information Element of 12 bytes, encoded with a variable length. Element of 12 bytes, 0x4500 005B A174 0000 FF11 832E, encoded with a
variable sized field.
EDITOR'S NOTE: to be added IPFIX Template Record:
7.3.2 Extended Packet Reports 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 2 | Length = 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 261 | Field Count = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| selectionSequenceId = 301 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ipHeaderPacketSection = 313 | Field Length = 65535 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 261 | Length = 21 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length = 12 | 0x4500 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 005B | 0xA174 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 0000 | 0xFF11 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 832E |
+-+-+-+-+-+-+-+-+
Figure E: Example of a Basic Packet Report,
with a variable sized field
6.4.2 Extended Packet Report
Alternatively to the basic Packet Report, the extended Packet Report Alternatively to the basic Packet Report, the extended Packet Report
MAY contain extra Information Elements related to the protocols used MAY contain other Information Elements related to the protocols used
in the packet (such as source and destination IP addresses), related in the packet (such as source and destination IP addresses), related
to the packet treatment (such as output interface, destination BGP to the packet treatment (such as output interface, destination BGP
autonomous system), related to the Selection State associated with autonomous system), or related to the Selection State associated with
the packet (such as timestamp, hash value). the packet (such as timestamp, hash value).
It is envisaged that selection of fields for extended Packet Reports It is envisaged that selection of fields for extended Packet Reports
may be used to reduce reporting bandwidth, in which case the option may be used to reduce reporting bandwidth, in which case the option
to report some number of contiguous bytes from the start of the to report some number of contiguous bytes from the start of the
packet, mandatory in the basic Packet Report, may not be exercised. packet, mandatory in the basic Packet Report, may not be exercised.
In this case, the Packet Content MAY be omitted. Note this In this case, the Packet Content MAY be omitted. Note this
configuration is quite similar to an IPFIX device for which a configuration is quite similar to an IPFIX device for which a
Template Record containing information about a single packet is Template Record containing information about a single packet is
reported. reported.
skipping to change at page 24, line 41 skipping to change at page 22, line 22
IPFIX Template Record: IPFIX Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 2 | Length = 32 | | Set ID = 2 | Length = 32 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 261 | Field Count = 6 | | Template ID = 261 | Field Count = 6 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| selectionPath = 321 | Field Length = 4 | |0| selectionSequenceId = 301 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| sourceIPv4Address = 44 | Field Length = 4 | |0| sourceIPv4Address = 44 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| destinationIPv4Address = 45 | Field Length = 4 | |0| destinationIPv4Address = 45 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| totalLengthIPv4 = 190 | Field Length = 2 | |0| totalLengthIPv4 = 190 | Field Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| tcpSourcePort = 182 | Field Length = 2 | |0| tcpSourcePort = 182 | Field Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| tcpDestinationPort = 183 | Field Length = 2 | |0| tcpDestinationPort = 183 | Field Length = 2 |
skipping to change at page 25, line 23 skipping to change at page 23, line 4
| 9 | | 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10.0.0.1 | | 10.0.0.1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10.0.1.106 | | 10.0.1.106 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 72 | 1372 | | 72 | 1372 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 80 | | 80 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure F: Example of an Extended Packet Report
Figure E: Example of an Extended Packet Report 6.5
Report Interpretation
7.4 Report Interpretation
To make full sense of the Packet Reports there are a number of To make full sense of the Packet Reports there are a number of
additional pieces of information that must be communicated to the additional pieces of information that must be communicated to the
Collector: Collector:
- The details about which Selectors and Observation Points are being - The details about which Selectors and Observation Points are being
used within an Associations MUST be provided using the Associations used within a Selection Sequences MUST be provided using the
Report Interpretation. Selection Sequence Report Interpretation.
- The configuration details of each Selector MUST be provided using - The configuration details of each Selector MUST be provided using
the Selector Report Interpretation. the Selector Report Interpretation.
- The Selector ID statistics MUST be provided using the - The Selector ID statistics MUST be provided using the Selection
AssociationsStatistics Report Interpretation. Sequence Statistics Report Interpretation.
- The accuracies of the reported fields MUST be provided using the - The accuracies of the reported fields MUST be provided using the
Accuracy Report Interpretation. Accuracy Report Interpretation.
- Further information about each Observation Point MAY be provided
using the Observation Point Report Interpretation.
EDITOR'S NOTE: to be discussed on the mailing list.
7.4.1 Associations Report Interpretation 6.5.1 Selection Sequence Report Interpretation
Each Packet Report contains a selectionPath Information Element that Each Packet Report contains a selectionSequenceId Information Element
identifies the particular combination of Observation Point and that identifies the particular combination of Observation Point and
Selector(s) used for its selection. For every selectionPath Selector(s) used for its selection. For every selectionSequenceId
Information Element in use, the PSAMP Device MUST export an Information Element in use, the PSAMP Device MUST export a Selection
Associations Report Interpretation using an Options Template with the Sequence Report Interpretation using an Options Template with the
following Information Element: following Information Elements:
Scope: selectionPath Scope: selectionSequenceId
Non-Scope: observationPointId Non-Scope: one Information Element representing
the Observation Point
selectorId (one or more) selectorId (one or more)
If the packets are selected by a Composite Selector, the Selection An Information Element representing the Observation Point would
Path field is composed of several Primitive Selectors. In such a typically be taken from the ingressInterface, egressInterface,
case, the Associations Report Interpretation MUST contain the list of lineCardId, exporterIPv4Address, exporterIPv6Address Information
all the Primitive Selector IDs in the Selection Path. If multiple Elements (specified in [IPFIX-INFO]), but not limited to those: any
Selectors are contained in the Associations Report Interpretation, Information Element specified in [IFPIX-INFO] or [PSAMP-INFO] can
the Selectors ID MUST be identified in the order they are used. potentially be used. In case of more complex Observation Points
(such as a list of interfaces, a bus, etc..), a new Information
Element describing the new type of Observation Point must be
specified, along with an option template record describing it in more
details (if necessary).
The observationPointID SHOULD be first Information Element and the If the packets are selected by a Composite Selector, the Selection
optional processes SHOULD be last ones so that the path of the Sequence is composed of several Primitive Selectors. In such a case,
selected Packet is provided in the logical order. the Selection Sequence Report Interpretation MUST contain the list of
all the Primitive Selector IDs in the Selection Sequence. If
multiple Selectors are contained in the Selection Sequence Report
Interpretation, the selectorId's MUST be identified in the order they
are used.
Example of a Two Selection Path: Example of two Selection Sequences:
Selection Path 7 (Filter->Sampling): Selection Sequence 7 (Filter->Sampling):
observationPointID 1 (Interface 5), ingressInterface 5
selectorId 5 (Filter, match IPV4SourceAddress 10.0.0.1), selectorId 5 (Filter, match IPV4SourceAddress 10.0.0.1)
selectorId 10 (Sampler, Random 1 out-of ten), selectorId 10 (Sampler, Random 1 out-of ten)
meteringProcessID 15 (IPFIX Metering Process)
Selection Path 9 (Sampling->Filtering): Selection Sequence 9 (Sampling->Filtering):
observationPointID 1 (Interface 5), ingressInterface 5
selectorId 10 (Sampler, Random 1 out-of ten), selectorId 10 (Sampler, Random 1 out-of ten)
selectorId 5 (Filter, match IPV4SourceAddress 10.0.0.1), selectorId 5 (Filter, match IPV4SourceAddress 10.0.0.1)
meteringProcessID 15 (IPFIX Metering Process)
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 | | Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 262 | Field Count = 5 | | Template ID = 262 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 4 |0| selectionPath = 321 | | Scope Field Count = 1 |0| selectionSequenceId = 301 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| observationPointId = 320 | | Scope 1 Length = 4 |0| ingressInterface = 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| selectorId = 300 | | Field Length = 4 |0| selectorId = 300 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| selectorId = 300 | | Field Length = 4 |0| selectorId = 300 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 | | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
EDITOR'S NOTE: check the observationPointId
The associated IPFIX Data Record: The associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 262 | Length = 36 | | Set ID = 262 | Length = 36 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 7 | | 7 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 1 | | 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 | | 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10 | | 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 9 | | 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 1 | | 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10 | | 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 | | 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure F: Example of an Associations Report Interpretation Figure G: Example of a Selection Sequence Report Interpretation
Notes: Notes:
* There are two Records here in the same Data Set. Each record * There are two Records here in the same Data Set. Each record
defines a different Selection Path. defines a different Selection Sequence.
* If a different Selection Path used three Selectors then a different * If, for example, a different Selection Sequence is composed of
Options Template would have to be used. three Selectors then a different Options Template with three
selectorId Information Elements (instead of two) must be used.
7.4.2 Selector Report Interpretation 6.5.2 Selector Report Interpretation
An IPFIX Data Record, defined by an Option Template Record, MUST be An IPFIX Data Record, defined by an Option Template Record, MUST be
used to send the configuration details of every Selector in use. The used to send the configuration details of every Selector in use. The
Option Template Record MUST contain the selectorId Information Option Template Record MUST contain the selectorId Information
Element as the Scope field and the SelectorAlgorithm Information Element as the Scope field and the SelectorAlgorithm Information
Element followed by some specific configuration parameters: Element followed by some specific configuration parameters:
Scope: selectorId Scope: selectorId
Non-scope: selectorAlgorithm Non-scope: selectorAlgorithm
algorithm specific Information Elements algorithm specific Information Elements
skipping to change at page 28, line 4 skipping to change at page 25, line 35
An IPFIX Data Record, defined by an Option Template Record, MUST be An IPFIX Data Record, defined by an Option Template Record, MUST be
used to send the configuration details of every Selector in use. The used to send the configuration details of every Selector in use. The
Option Template Record MUST contain the selectorId Information Option Template Record MUST contain the selectorId Information
Element as the Scope field and the SelectorAlgorithm Information Element as the Scope field and the SelectorAlgorithm Information
Element followed by some specific configuration parameters: Element followed by some specific configuration parameters:
Scope: selectorId Scope: selectorId
Non-scope: selectorAlgorithm Non-scope: selectorAlgorithm
algorithm specific Information Elements algorithm specific Information Elements
The algorithm specific Information Elements are specified in the The algorithm specific Information Elements are specified in the
following subsections, depending on the selection method represented following subsections, depending on the selection method represented
by the value of the selectorAlgorithm. by the value of the selectorAlgorithm.
The Associations statistics MUST be exported periodically. 6.5.2.1 Systematic Count-Based Sampling
7.4.2.1 Systematic Count-Based Sampling
In systematic count-based Sampling, the start and stop triggers for In systematic count-based Sampling, the start and stop triggers for
the Sampling interval are defined in accordance to the spatial packet the Sampling interval are defined in accordance with the spatial
position (packet count) [PSAMP-TECH]. packet position (packet count) [PSAMP-TECH].
The REQUIRED algorithm specific Information Elements in case of
The REQUIRED algorithm specific Information Elements in the case of
systematic count-based Sampling are: systematic count-based Sampling are:
samplingPacketInterval: number of packets selected in a row samplingPacketInterval: number of packets selected in a row
samplingPacketSpace: number of packets between selections samplingPacketSpace: number of packets between selections
Example of a simple 1 out-of 10 systematic count-based Selector Example of a simple 1 out-of 10 systematic count-based Selector
definition, where the samplingPacketInterval is 1 and the definition, where the samplingPacketInterval is 1 and the
samplingPacketSpace is 9. samplingPacketSpace is 9.
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 | | Set ID = 3 | Length = 26 |
skipping to change at page 28, line 34 skipping to change at page 26, line 17
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 | | Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 263 | Field Count = 4 | | Template ID = 263 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 300 | | Scope Field Count = 1 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| selectorAlgorithm = 302 | | Scope 1 Length = 4 |0| selectorAlgorithm = 304 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0|samplingPacketInterval = 304 | | Field Length = 1 |0|samplingPacketInterval = 305 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingPacketSpace = 305 | | Field Length = 1 |0| samplingPacketSpace = 306 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 | | Field Length = 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record: Associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 263 | Length = 11 | | Set ID = 263 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 15 | | 15 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 1 | 1 | 9 | | 1 | 1 | 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure G: Example of the Selector Report Interpretation, Figure H: Example of the Selector Report Interpretation,
For Systematic Count-Based Sampling For Systematic Count-Based Sampling
Notes: Notes:
* A selectorAlgorithm value of 1 represents systematic count-based * A selectorAlgorithm value of 1 represents systematic count-based
Sampling. Sampling.
* samplingPacketInterval and samplingPacketSpace are of type * samplingPacketInterval and samplingPacketSpace are of type
unsigned32 but are compressed down to one octet here, as allowed by unsigned32 but are compressed down to one octet here, as allowed by
the IPFIX protocol specifications [IPFIX-PROTO]. the IPFIX protocol specifications [IPFIX-PROTO].
7.4.2.2 Systematic Time-Based Sampling 6.5.2.2 Systematic Time-Based Sampling
In systematic time-based Sampling, the start and stop triggers are In systematic time-based Sampling, the start and stop triggers are
used to define the Sampling intervals [PSAMP-TECH]. The REQUIRED used to define the Sampling intervals [PSAMP-TECH]. The REQUIRED
algorithm specific Information Elements in case of systematic time- algorithm specific Information Elements in the case of systematic
based Sampling are: time-based Sampling are:
samplingTimeInterval: time (in ms) when packets are selected samplingTimeInterval: time (in us) when packets are selected
samplingTimeSpace: time (in ms) between selections samplingTimeSpace: time (in us) between selections
Example of a 100 ms out-of 1000 ms systematic time-based Selector Example of a 100 us out-of 1000 us systematic time-based Selector
definition, where the samplingTimeInterval is 100 and the definition, where the samplingTimeInterval is 100 and the
samplingTimeSpace is 900 samplingTimeSpace is 900
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 | | Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 264 | Field Count = 4 | | Template ID = 264 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 300 | | Scope Field Count = 1 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| selectorAlgorithm = 302 | | Scope 1 Length = 4 |0| selectorAlgorithm = 304 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingTimeInterval = 306 | | Field Length = 1 |0| samplingTimeInterval = 307 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingTimeSpace = 307 | | Field Length = 1 |0| samplingTimeSpace = 308 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 2 | | Field Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record: Associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 264 | Length = 16 | | Set ID = 264 | Length = 12 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 16 | | 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 2 | 100 | 900 | | 2 | 100 | 900 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure H: Example of the Selector Report Interpretation, Figure I: Example of the Selector Report Interpretation,
For Systematic Time-Based Sampling For Systematic Time-Based Sampling
Notes: Notes:
* A selectorAlgorithm value of 2 represents systematic time-based * A selectorAlgorithm value of 2 represents systematic time-based
Sampling. Sampling.
* samplingTimeInterval and samplingTimeSpace are of type unsigned32 * samplingTimeInterval and samplingTimeSpace are of type unsigned32
but are compressed down here. but are compressed down here.
7.4.2.3 Random n-out-of-N Sampling 6.5.2.3 Random n-out-of-N Sampling
In random n-out-of-N Sampling, n elements are selected out of the In random n-out-of-N Sampling, n elements are selected out of the
parent population that consists of N elements [PSAMP-TECH]. The parent population that consists of N elements [PSAMP-TECH]. The
REQUIRED algorithm specific Information Elements in case of random n- REQUIRED algorithm specific Information Elements in case of random n-
out-of-N Sampling are: out-of-N Sampling are:
samplingSize: number of packets selected samplingSize: number of packets selected
samplingPopulation: number of packets in selection population samplingPopulation: number of packets in selection population
Example of a 1 out-of 10 random n-out-of-N Sampling Selector: Example of a 1 out-of 10 random n-out-of-N Sampling Selector:
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 | | Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 265 | Field Count = 4 | | Template ID = 265 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 300 | | Scope Field Count = 1 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| selectorAlgorithm = 302 | | Scope 1 Length = 4 |0| selectorAlgorithm = 304 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingSize = 309 | | Field Length = 1 |0| samplingSize = 309 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingPopulation = 308 | | Field Length = 1 |0| samplingPopulation = 310 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 | | Field Length = 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record: Associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 265 | Length = 11 | | Set ID = 265 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 17 | | 17 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 3 | 1 | 10 | | 3 | 1 | 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure I: Example of the Selector Report Interpretation, Figure J: Example of the Selector Report Interpretation,
For Random n-out-of-N Sampling For Random n-out-of-N Sampling
Notes: Notes:
* A selectorAlgorithm value of 3 represents Random n-out-of-N * A selectorAlgorithm value of 3 represents Random n-out-of-N
sampling. Sampling.
* samplingSize and samplingPopulation are of type unsigned32 but are * samplingSize and samplingPopulation are of type unsigned32 but are
compressed down to one octet here. compressed down to one octet here.
7.4.2.4 Uniform Probabilistic Sampling 6.5.2.4 Uniform Probabilistic Sampling
In uniform probabilistic Sampling, each element has the same In uniform probabilistic Sampling, each element has the same
probability p of beings are selected from the parent population probability p of being selected from the parent population [PSAMP-
[PSAMP-TECH]. The algorithm specific Information Element in case of TECH]. The algorithm specific Information Element in case of uniform
uniform probabilistic Sampling is: probabilistic Sampling is:
samplingProbablility: a floating point number for the Sampling samplingProbablility: a floating point number for the Sampling
probability. probability.
Example of a 15% uniform probability Sampling Selector: Example of a 15% uniform probability Sampling Selector:
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 22 | | Set ID = 3 | Length = 22 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 271 | Field Count = 3 | | Template ID = 271 | Field Count = 3 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 300 | | Scope Field Count = 1 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| selectorAlgorithm = 302 | | Field Length = 4 |0| selectorAlgorithm = 304 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingProbablility = X | | Field Length = 1 |0| samplingProbabilility = 311 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 | | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
EDITOR'S NOTE: check the value of samplingProbablility in [PSAMP-
INFO]
Associated IPFIX Data Record: Associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 271 | Length = 11 | | Set ID = 271 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 20 | | 20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 4 | 0.15 | | 4 | 0.15 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | | |
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
Figure I: Example of the Selector Report Interpretation, Figure K: Example of the Selector Report Interpretation,
For Uniform Probabilistic Sampling For Uniform Probabilistic Sampling
Notes: Notes:
* A selectorAlgorithm value of 4 represents Uniform Probabilistic * A selectorAlgorithm value of 4 represents Uniform Probabilistic
Sampling. Sampling.
* samplingProbablility is of type float64 but is compressed down to a
float32 here.
7.4.2.5 Property Match Filtering 6.5.2.5 Property Match Filtering
This classification includes match(es) on field(s) within a packet This classification includes match(es) on field(s) within a packet
and/or on properties of the router state. With this method, a packet and/or on properties of the router state. With this method, a packet
is selected if a specific field in the packet equals a predefined is selected if a specific field in the packet equals a predefined
value. value.
The algorithm specific Information Elements, defining configuration The algorithm specific Information Elements defining configuration
parameters for property match filtering, are taken from the full parameters for property match filtering are taken from the full range
range of available Information Elements. of available Information Elements.
When multiple different Information Elements are defined, the filter When multiple different Information Elements are defined, the filter
acts as a logical AND. Note that the logical OR is not covered by acts as a logical AND. Note that the logical OR is not covered by
these PSAMP specifications. The property match Filtering Options these PSAMP specifications. The property match Filtering Options
Template Record MUST NOT have multiple identical Information Template Record MUST NOT have multiple identical Information
Elements. The result of the filter is independent from the order of Elements. The result of the filter is independent from the order of
the Information Elements in the Option Template Record, but the order the Information Elements in the Option Template Record, but the order
may be important for implementation purposes, as the first filter may be important for implementation purposes, as the first filter
will have to work at a higher rate. In any case, an implementation will have to work at a higher rate. In any case, an implementation
is not constrained to respect the filter ordering, as long as the is not constrained to respect the filter ordering as long as the
result is the same, and it may even implement the composite Filtering result is the same, and it may even implement the composite Filtering
in Filtering in one single step. in Filtering in one single step.
Since encryption alters the meaning of encrypted fields, when the
Property Match Filtering classification is based on the encrypted
field(s) in the packet, it MUST be able to recognize that the
field(s) are not available and MUST NOT select those packets.
Even if they are ignored, the encrypted packets MUST be accounted for
in the Selector packetsObserved Information Element [PSAMP-INFO],
part of the Selection Sequence Statistics Report Interpretation.
Example of a match based filter Selector, whose rules are: Example of a match based filter Selector, whose rules are:
IPv4 Source Address = 10.0.0.1 IPv4 Source Address = 10.0.0.1
IPv4 Next-Hop Address = 10.0.1.1 IPv4 Next-Hop Address = 10.0.1.1
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 | | Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 266 | Field Count = 4 | | Template ID = 266 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 300 | | Scope Field Count = 1 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| selectorAlgorithm = 302 | | Scope 1 Length = 4 |0| selectorAlgorithm = 304 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| sourceIPv4Address = 8 | | Field Length = 1 |0| sourceIPv4Address = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| ipNextHopIPv4Address = 15 | | Field Length = 4 |0| ipNextHopIPv4Address = 15 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 | | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record: Associated IPFIX Data Record:
skipping to change at page 34, line 7 skipping to change at page 31, line 47
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 21 | | 21 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 | 10.0.0 ... | | 5 | 10.0.0 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... .1 | 10.0.1 ... | | ... .1 | 10.0.1 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... .1 | | ... .1 |
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
Figure J: Example of the Selector Report Interpretation, Figure L: Example of the Selector Report Interpretation,
For match based and router state Filtering For match based and router state Filtering
Notes: Notes:
* A selectorAlgorithm value of 5 represents property match Filtering. * A selectorAlgorithm value of 5 represents property match Filtering.
* In this filter there is a mix of information from the packet and * In this filter there is a mix of information from the packet and
information from the router. information from the router.
7.4.2.6 Hash-Based Filtering 6.5.2.6 Hash-Based Filtering
EDITOR'S NOTE: to be completed In hash based selection a hash function is run on IPv4 traffic
the following fields MUST be used as input to that hash function:
- IP identification field
- Flags field
- Fragment offset
- Source IP address
- Destination IP address
- A number of bytes from the IP payload. The number of bytes and
starting offset MUST be configurable if the hash function supports
it.
For the bytes taken from the IP payload, IPSX has a fixed offset
of 0 bytes and a fixed size of 8 bytes. The number and offset of
payload bytes in the BOB function MUST be configurable. If any
of the configured set of bytes from the IP payload are unavailable
then 0 MUST be used, which may result in a different value than
if the hash function is run on a subset of the input.
The minimum configuration ranges MUST be as follows:
Number of bytes: from 8 to 32
Offset: from 0 to 64
If the selected payload bytes are not available and the hash function
can take a variable sized input then the hash function MUST be run
with the information which is available and a shorter size. Passing
0 as a substitute for missing payload bytes is only acceptable if
the hash function takes a fixed size as is the case with IPSX.
If the hash function can take an initialization value then this
value MUST be configurable.
A hash-based selection function MAY be configurable as a digest
function. Any selection process which is configured as a digest
function MUST have the output value included in the basic packet
report for any selected packet.
Each hash function used as a hash-based selector requires its own
value for the selectorAlgorithm. Currently we have BOB (6), IPSX (7)
and CRC (8) defined and any MAY be used for either Filtering
or creating a Packet Digest. Only BOB is recommended though and
SHOULD be used.
The REQUIRED algorithm specific Information Elements in case of hash
based selection are:
hashIPPayloadOffset - The payload offset used by a hash based
Selector
hashIPPayloadSize - The payload size used by a hash based
Selector
hashOutputRangeMin - One or more values for the beginning of
each potential output range.
hashOutputRangeMax - One or more values for the end of each
potential output range.
hashSelectedRangeMin - One or more values for the beginning of
each selected range.
hashSelectedRangeMax - One or more values for the end of each
selected range.
hashDigestOutput - A boolean value, TRUE if the output from
this selector has been configured to be
included in the packet report as a packet
digest.
NOTE: If more than one selection or output range needs to be sent
then the minimum and maximum elements may be repeated as needed.
These MUST make one or more non-overlapping ranges. The elements
SHOULD be sent as pairs of minimum and maximum in ascending order,
however if they are sent out of order then there will only be one
way to interpret the ranges to produce a non-overlapping range and
the Collecting Process MUST be prepared to accept and decode this.
The following algorithm specific Information Element MAY be sent,
but is optional for security considerations:
hashInitialiserValue - The initialiser value to the hash function.
Since encryption alters the meaning of encrypted fields, when the
Hash-Based Filtering classification is based on the encrypted
field(s) in the packet, it MUST be able to recognize that the
field(s) are not available and MUST NOT select those packets select
those packets. Even if they are ignored, the encrypted packets MUST
be accounted in the Selector packetsObserved Information Element
[PSAMP-INFO], part of the Selection Sequence Statistics Report
Interpretation.
Example of a hash based filter Selector, whose configuration is:
Hash Function = BOB
Hash IP Payload Offset = 0
Hash IP Payload Size = 16
Hash Initialiser Value = 0x9A3F9A3F
Hash Output Range = 0 to 0xFFFFFFFF
Hash Selected Range = 100 to 200 and 400 to 500
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 50 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 269 | Field Count = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 300 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| selectorAlgorithm = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| hashIPpayloadOffset = 327 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashIPpayloadSize = 328 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashInitialiserValue = 329 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashOutputRangeMin = 330 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashOutputRangeMax = 331 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashSeletionRangeMin = 332 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashSeletionRangeMax = 333 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashSeletionRangeMin = 332 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashSeletionRangeMax = 333 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 266 | Length = 45 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 22 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 6 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 0 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 16 | 0x9A3F9A ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 3F | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 0 | 0xFFFFFF ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... FF | ... 100 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... 200 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... 400 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... 500 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... |
+-+-+-+-+-+-+-+-+
Figure M: Example of the Selector Report Interpretation,
for Hash Based Filtering
Notes: Notes:
* A selectorAlgorithm value of 6 represents hash-based Filtering. * A selectorAlgorithm value of 6 represents hash-based Filtering
using the BOB algorithm.
7.4.2.7 Other Selection Methods 6.5.2.7 Other Selection Methods
Some potential new selection methods MAY be added. Some of the new Some potential new selection methods MAY be added. Some of the new
selection methods, such as non-uniform probabilistic Sampling and selection methods, such as non-uniform probabilistic Sampling and
flow state dependent Sampling, are described in [PSAMP-TECH], with flow state dependent Sampling, are described in [PSAMP-TECH], with
further references. further references.
Each new selection method MUST be assigned a unique value for the Each new selection method MUST be assigned a unique value for the
selectorAlgorithm Information Element. Its configuration selectorAlgorithm Information Element. Its configuration
parameter(s), along with the way to report it/them with an Options parameter(s), along with the way to report it/them with an Options
Template, MUST be clearly specified. Template, MUST be clearly specified.
7.4.3 Associations Statistics Report Interpretation 6.5.3 Selection Sequence Statistics Report Interpretation
A Selector MAY be used in multiple Associations. However, each use A Selector MAY be used in multiple Selection Sequences. However,
of a Selector must be independent, so each separate logical instances each use of a Selector must be independent, so each separate logical
of a Selector MUST maintain its separate Selection State and instance of a Selector MUST maintain its own individual Selection
statistics. State and statistics.
The Associations Statistics Report Interpretation MUST include the The Selection Sequence Statistics Report Interpretation MUST include
number of packets seen (Population Size) and the number of packets the number of observed packets (Population Size) and the number of
selected (Sample Size) by each instance of its Primitive Selector. packets selected (Sample Size) by each instance of its Primitive
Within an Association composed of several Primitive Selectors, the Selectors.
number of packets selected for one Selector is equal to the number of
packets seen by the next Selector. The order of the Selectors in the
Associations Statistics Report Interpretation MUST match the order of
the Selectors in the Association, as defined in the Associations
Report Interpretation.
The Associations Statistics Report Interpretation MUST also contain Within a Selection Sequence composed of several Primitive Selectors,
the number of packets observed at the Observation. the number of packets selected for one Selector is equal to the
number of packets seen by the next Selector. The order of the
Selectors in the Selection Sequence Statistics Report Interpretation
MUST match the order of the Selectors in the Selection Sequence.
For every Selection Path, the PSAMP Device MUST export an If the full set of statistics is not sent part of the Basic Packet
Associations statistics Report Interpretation using an Options Reports, the PSAMP Device MUST export a Selection Sequence Statistics
Template with the following Information Element: Report Interpretation for every Selection Sequence, using an Options
Template containing the following Information Elements:
Scope: SelectionPath Scope: selectionSequenceId
Non-scope: packetsObserved Non-scope: packetsObserved
packetsSelected (one or more) packetsSelected (first)
...
packetsSelected (last)
The packetsObserved Information Element contains the number of The packetsObserved Information Element [PSAMP-INFO] MUST contain the
packets seen at the Observation Point, and as a consequence passed to number of packets seen at the Observation Point, and as a consequence
the first Selector in the Association. The packetsSelected passed to the first Selector in the Selection Sequence. The
Information Element contains the number of packets selected by the packetsSelected Information Element [PSAMP-INFO] contains the number
various Selectors in the Associations. of packets selected by a Selector in the Selection Sequence.
The Attained Selection Fraction for the Selection Sequence is
calculated by dividing the number of observed packets
(packetsObserved Information Element) by the value of selected
packets (packetsSelected Information Element) for the last Selector.
The Attained Selection Fraction can be calculated for each Selector The Attained Selection Fraction can be calculated for each Selector
by dividing the number of packets selected for that Selector by the by dividing the number of packets selected for that Selector by the
previous value. value for the previous Selector.
The statistics for the whole sequence SHOULD be taken at a single The statistics for the whole sequence SHOULD be taken at a single
logical point in time, the input value for a Selector MUST equal the logical point in time; the input value for a Selector MUST equal the
output value of the previous selector. output value of the previous selector.
Example of Associations Statistics Report Interpretation: The Selection Sequence Statistics Report Interpretation MUST be
exported periodically.
Associations set 7 (Filter->Sampling): Example of Selection Sequence Statistics Report Interpretation:
Observed 100 (observationPointID 1, Interface 5) Selection Sequence 7 (Filter->Sampling):
Observed 100 (observationPointId 1, Interface 5)
Selected 50 (selectorId 5, match IPV4SourceAddress 10.0.0.1) Selected 50 (selectorId 5, match IPV4SourceAddress 10.0.0.1)
Selected 6 (selectorId 10, Sampler: Random one out-of ten) Selected 6 (selectorId 10, Sampler: Random one out-of ten)
Associations set 9 (Sampling->Filtering): Selection Sequence 9 (Sampling->Filtering):
Observed 100 (observationPointID 1, Interface 5) Observed 100 (observationPointId 1, Interface 5)
Selected 10 (selectorId 10, Sampler: Random one out-of ten) Selected 10 (selectorId 10, Sampler: Random one out-of ten)
Selected 3 (selectorId 5, match IPV4SourceAddress 10.0.0.1) Selected 3 (selectorId 5, match IPV4SourceAddress 10.0.0.1)
IPFIX Options Template Record: IPFIX Options Template Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 30 | | Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 267 | Field Count = 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectionPath = 321 | | Template ID = 267 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| packetsObserved = 324 | | Scope Field Count = 1 |0| selectionSequenceId = 301 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| packetsSelected = 325 | | Scope 1 Length = 4 |0| packetsObserved = 318 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| packetsSelected = 325 | | Field Length = 4 |0| packetsSelected = 319 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| packetsSelected = 325 | | Field Length = 4 |0| packetsSelected = 319 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 | | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The associate IPFIX Data Record: The associated IPFIX Data Record:
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 267 | Length = 24 | | Set ID = 267 | Length = 36 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 7 | | 7 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 100 | | 100 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 50 | | 50 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 6 | | 6 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 9 | | 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 100 | | 100 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10 | | 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 3 | | 3 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure K: Example of the Association Statistics Report Figure N: Example of the Selection Sequence Statistics Report
Interpretation Interpretation
Notes: Notes:
* The Attained Packet Fractions for the first set of Associations * The Attained Sampling Fractions for Selection Sequence 7 are:
are:
Filter 10: 50/100 Filter 10: 50/100
Sampler 5: 6/50 Sampler 5: 6/50
Number of samples sent to Metering Process: 6 Number of samples selected: 6
* The Attained Packet Fractions for the second set of Associations
are: * The Attained Sampling Fractions for Selection Sequence 9 are:
Sampler 5: 10/100 Sampler 5: 10/100
Filter 10: 3/10 Filter 10: 3/10
Number of samples sent to Metering Process: 3 Number of samples selected: 3
7.4.4 Accuracy Report Interpretation 6.5.4 Accuracy Report Interpretation
In order for the Collecting Process to determine the inherent
accuracy of the reported quantities (for example timestamps), the
PSAMP Device SHOULD send an Accuracy Report Interpretation.
The inherent accuracy of the Information Elements in the Packet The Accuracy Report Interpretation MUST be exported by an Option
Report MUST be reported in order to enable the Collector to determine Template Record with a scope that contains the Information Element
the accuracy of the measurements. for which the accuracy is required. In case the accuracy is specific
to a template, a second scope containing the templateId value MUST be
added to the Option Template Record. The accuracy SHOULD be reported
either with the fixedError Information Element [PSAMP-INFO], or with
the relativeError Information Element [PSAMP-INFO].
EDITOR'S NOTE: to be completed Accuracy Report Interpretation using the fixedError Information
Element:
Scope: informationElementId
Non-scope: fixedError
7.4.5 Observation Point Report Interpretation Accuracy Report Interpretation using the fixedError Information
Element and a double scope:
Scope: templateId
informationElementId
Non-scope: fixedError
For each Observation Point, an Observation Option Report Accuracy Report Interpretation using the relativeError Information
Interpretation MAY be sent. Element:
Scope: informationElementId
Non-scope: relativeError
EDITOR'S NOTE: to be completed Accuracy Report Interpretation using the relativeError Information
Element and a double scope:
Scope: templateId
informationElementId
Non-scope: relativeError
8. Security Considerations For example, the accuracy of an Information Element whose Abstract
Data Type is dateTimeMilliSeconds [IPFIX-INFO], for which the unit is
specified as milliseconds, can be specified with the fixedError
Information Element with the milliseconds units. In this case, the
error interval is the Information Element value +/- the value
reported in the fixedError.
For example, the accuracy of an Information Element to estimate the
accuracy of a sampled flow, for which the unit would be specified in
octets, can be specified with the relativeError Information Element
with the octet units. In this case, the error interval is the
Information Element value +/- the value reported in the relativeError
time the reported Information Element value.
Alternatively to reporting either the fixedError Information Element
or the relativeError Information Element in the Accuracy Report
Interpretation, both Information Elements MAY be present. This
scenario could help in more complex situations where the system clock
drifts, on the top of having its own accuracy, during the duration of
a measurement.
If the accuracy of a reported quantity changes on the Metering
Process, a new Accuracy Report Interpretation MUST be generated. The
Collecting Process MUST keep the accuracy of the latest Accuracy
Report Interpretation.
Example of an Accuracy Report Interpretation using the fixedError
Information Element and a double scope: the timeMicroSeconds
contained in the Template 5 has an accuracy of +/- 2 ms, represented
by the fixedError Information Element.
Scope: templateId = 6
informationElementId = timeMicroSeconds
Non-scope: fixedError = 2 ms
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 22 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 267 | Field Count = 3 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 2 |0| templateId = 145 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 2 |0| InformationElementId = 303 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 2 Length = 2 |0| fixedError = 320 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 267 | Length = 12 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 | 324 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 2 (encoded as a float32) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure O: Example of the Selection Sequence Statistics Report
Interpretation
Notes:
* fixedError is of type float64 but is compressed down to a float32
here.
The second example displays an Accuracy Report Interpretation using
the relativeError Information Element and a single scope: the
timeMicroSeconds has an error of 5 percents, represented by the
proportionalAccuracy Information Element.
Scope: informationElementId = timeMicroSeconds
Non-scope: relativeError = 0.05
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 18 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 268 | Field Count = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| InformationElementId = 303 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 2 |0| relativeError= 321 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 267 | Length = 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 324 | 0.05 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ...(encoded as a float32) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure P: Example of the Selection Sequence Statistics Report
Interpretation
Notes:
* relativeError is of type float64 but is compressed down to a
float32 here.
7.
Security Considerations
As IPFIX has been selected as the PSAMP export protocol and as the As IPFIX has been selected as the PSAMP export protocol and as the
PSAMP security requirements are not stricter than the IPFIX security PSAMP security requirements are not stricter than the IPFIX security
requirements, refer to the IPFIX export protocol [IPFIX-PROTO] for requirements, refer to the IPFIX export protocol [IPFIX-PROTO] for
the security considerations. the security considerations.
9. IANA Considerations In the basic Packet Report, a PSAMP Device exports some number of
contiguous bytes from the start of the packet, including the packet
header (which includes link layer, network layer and other
encapsulation headers) and some subsequent bytes of the packet
payload. The PSAMP Device SHOULD NOT export the full payload of
conversations, as this would mean wiretapping [RFC2804].
8.
IANA Considerations
The PSAMP Protocol, as set out in this document, has two sets of The PSAMP Protocol, as set out in this document, has two sets of
assigned numbers. Considerations for assigning them are discussed in assigned numbers. Considerations for assigning them are discussed in
this section, using the example policies as set out in the this section, using the example policies as set out in the
"Guidelines for IANA Considerations" document IANA-RFC [RFC2434]. "Guidelines for IANA Considerations" document IANA-RFC [RFC2434].
9.1 IPFIX Related Considerations 8.1
IPFIX Related Considerations
As the PSAMP protocol uses the IPFIX protocol, refer to the IANA As the PSAMP protocol uses the IPFIX protocol, refer to the IANA
considerations section in [IPFIX-PROTO] for the assignments of considerations section in [IPFIX-PROTO] for the assignments of
numbers used in the protocol and for the numbers used in the numbers used in the protocol and for the numbers used in the
information model. information model.
9.2 PSAMP Related Considerations 8.2
PSAMP Related Considerations
Each new selection method MUST be assigned a unique value for the Each new selection method MUST be assigned a unique value for the
selectorAlgorithm Information Element. Its configuration selectorAlgorithm Information Element. Its configuration
parameter(s), along with the way to report it/them with an Options parameter(s), along with the way to report it/them with an Options
Template, MUST be clearly specified. Template, MUST be clearly specified.
Each new selection method MUST be assigned a unique value for the New assignments for the PSAMP selection method will be administered
selectorAlgorithm Information Element. New assignments for the PSAMP by IANA, on a First Come First Served basis [RFC 2434], subject to
selection method will be administered by IANA, on a First Come First Expert Review [RFC 2434], i.e. review by one of a group of experts
Served basis [RFC 2434], subject to Expert Review [RFC 2434], i.e. designated by an IETF Operations and Management Area Director. The
review by one of a group of experts designated by an IETF Operations group of experts must double check the Information Elements
and Management Area Director. The group of experts must double check definitions with already defined Information Elements for
the Information Elements definitions with already defined Information completeness, accuracy and redundancy. Those experts will initially
Elements for completeness, accuracy and redundancy. Those experts be drawn from the Working Group Chairs and document editors of the
will initially be drawn from the Working Group Chairs and document IPFIX and PSAMP Working Groups.
editors of the IPFIX and PSAMP Working Groups.
10. References 9.
References
10.1 Normative References 9.1
Normative References
[RFC1771] Y. Rekhter, T. Li, "A Border Gateway Protocol 4 (BGP-4)",
RFC 1771, March 1995
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997
[RFC2434] H. Alvestrand, T. Narten, "Guidelines for Writing an IANA
Considerations Section in RFCs", RFC 2434, October 1998
[PSAMP-TECH] T. Zseby, M. Molina, N. Duffield, S. Niccolini, F. [PSAMP-TECH] T. Zseby, M. Molina, N. Duffield, S. Niccolini, F.
Raspall, "Sampling and Filtering Techniques for IP Packet Selection" Raspall, "Sampling and Filtering Techniques for IP Packet Selection"
draft-ietf-psamp-sample-tech-07.txt draft-ietf-psamp-sample-tech-07.txt
[PSAMP-MIB] T. Dietz, B. Claise "Definitions of Managed Objects for
Packet Sampling" draft-ietf-psamp-mib-05.txt
[PSAMP-INFO] T. Dietz, F. Dressler, G. Carle, B. Claise, "Information [PSAMP-INFO] T. Dietz, F. Dressler, G. Carle, B. Claise, "Information
Model for Packet Sampling Exports", draft-ietf-psamp-info-03.txt Model for Packet Sampling Exports", draft-ietf-psamp-info-03.txt
[IPFIX-ARCH] G. Sadasivan, N. Brownlee, B. Claise, J. Quittek, [IPFIX-ARCH] G. Sadasivan, N. Brownlee, B. Claise, J. Quittek,
"Architecture Model for IP Flow Information Export" draft-ietf-ipfix- "Architecture Model for IP Flow Information Export" draft-ietf-ipfix-
arch-09.txt" arch-09.txt"
[IPFIX-INFO] J. Quittek, S. Bryant, B. Claise, J. Meyer, "Information [IPFIX-INFO] J. Quittek, S. Bryant, B. Claise, J. Meyer, "Information
Model for IP Flow Information Export" draft-ietf-ipfix-info-11.txt Model for IP Flow Information Export" draft-ietf-ipfix-info-11.txt
[IPFIX-PROTO] B. Claise (Editor) "IPFIX Protocol Specifications", [IPFIX-PROTO] B. Claise (Editor) "IPFIX Protocol Specifications",
draft-ietf-ipfix-protocol-19.txt draft-ietf-ipfix-protocol-19.txt
[RFC1771] Y. Rekhter, T. Li, "A Border Gateway Protocol 4 (BGP-4)", 9.2
RFC 1771, March 1995. Informative References
[RFC2434] H. Alvestrand, T. Narten, "Guidelines for Writing an IANA
Considerations Section in RFCs", RFC 2434, October 1998.
10.2 Informative References [PSAMP-MIB] T. Dietz, B. Claise "Definitions of Managed Objects for
Packet Sampling" draft-ietf-psamp-mib-05.txt
[PSAMP-FMWK] D. Chiou, B. Claise, N. Duffield, A. Greenberg, M. [PSAMP-FMWK] D. Chiou, B. Claise, N. Duffield, A. Greenberg, M.
Grossglauser, P. Marimuthu, J. Rexford, G. Sadasivan, "A Framework Grossglauser, P. Marimuthu, J. Rexford, G. Sadasivan, "A Framework
for Passive Packet Measurement" draft-ietf-psamp-framework-10.txt for Passive Packet Measurement" draft-ietf-psamp-framework-10.txt
[RFC3917] J. Quittek, T. Zseby, B. Claise, S. Zander, "Requirements [RFC3917] J. Quittek, T. Zseby, B. Claise, S. Zander, "Requirements
for IP Flow Information Export", RFC 3917, October 2004 for IP Flow Information Export", RFC 3917, October 2004
11. Acknowledgments 10.
Acknowledgments
The authors would like to thank the PSAMP group, especially Paul The authors would like to thank the PSAMP group, especially Paul
Aitken for fruitful discussions and for proofreading the document. Aitken for fruitful discussions and for proofreading the document
several times.
Authors' Addresses Authors' Addresses
Benoit Claise Benoit Claise
Cisco Systems Cisco Systems
De Kleetlaan 6a b1 De Kleetlaan 6a b1
1831 Diegem 1831 Diegem
Belgium Belgium
Phone: +32 2 704 5622 Phone: +32 2 704 5622
E-mail: bclaise@cisco.com E-mail: bclaise@cisco.com
skipping to change at page 40, line 37 skipping to change at page 44, line 38
This document and the information contained herein are provided on an This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Copyright Statement Copyright Statement
Copyright (C) The Internet Society (2005). This document is subject Copyright (C) The Internet Society (2006). This document is subject
to the rights, licenses and restrictions contained in BCP 78, and to the rights, licenses and restrictions contained in BCP 78, and
except as set forth therein, the authors retain all their rights. except as set forth therein, the authors retain all their rights.
Acknowledgment Acknowledgment
Funding for the RFC Editor function is currently provided by the Funding for the RFC Editor function is currently provided by the
Internet Society Internet Society
 End of changes. 211 change blocks. 
579 lines changed or deleted 796 lines changed or added

This html diff was produced by rfcdiff 1.29, available from http://www.levkowetz.com/ietf/tools/rfcdiff/