Subject: [ipfix-req] Content Based Sampling

From: Mark Thibodeau <[email-masked]>
Date: Tue, 25 Feb 2003 11:46:40 -0500

Hi,

I have some questions about the requirements for sampling.  From
requirements 8:

....
5.2.  Sampling

...
   selection of one packet can for instance be triggered by its arrival
   time (time-based sampling), by its position in the flow (count-based
   sampling) or by the packet content (content-based sampling).
....

What is meant by "content-based sampling"?  Is this basically ACL
filtering that tells you whether or not to monitor a flow?

If it refers to ACL filtering, then I have some more questions.

....
6.1.  Information Model
....

     14. if sampling is used: sampling configuration
....

If we are using content-based sampling, what information do we want
exported with the flow?  Is it basically an ACL rule identifier?  Or do
we want to export the entire ACL rule itself?

If we need to export a rule identifier or something like that, then
there is another situation which presents itself.

Let's say there are multiple rules which can cause packets to be
monitored.  If we are also doing aggregation, there is the potential for
2 or more ACL rules to all point to the same flow record.  When this
flow record is exported, which rule identifier should it give?

There is also another situation.  An implementation could support
simultaneously ACL filtering and packet sampling.  For instance, only
the flows that match a certain ACL rule will be monitored.  However,
only every 100th packet is sampled.   If this combination is supported,
what is the sampling configuration that is exported?  Should we export
the rule identifier as well as the sampling rate?

Thanks,
Mark

--

****************************************************
* Mark Thibodeau, P Eng.
* 670 RSP Development - Firmware Designer
* Alcatel CID - (613) 784-5375
* Fax - (613) 599-3696
* [email-masked]
****************************************************

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/