Subject: [ipfix] RE: [ipfix-eval] Re: next version of IPFIX requirements

From: Juergen Quittek <[email-masked]>
Date: Tue, 25 Feb 2003 07:40:52 +0100

Carter,

Yes, I agree. Just used a slightly different phrasing:

  "When anonymized flow data is exported, this MUST be clearly indicated
   to all receiving collecting processes, such that they can distinguish
   anonymized data from non-anonymized data."

Cheers,

    Juergen

-- Carter Bullard wrote on 30 January 2003 23:54 -0500:

> Hey Juergen,
>    With regard to section 6.7 Anonymization. Because
> anonymization constraints/requirements have not been
> described, it is important that there be some indication
> that the data generated by the probe does not represent
> truth.  I recommend this additional text:
>
>>   6.7.  Anonymization
>>
>>   The exporting process MAY be capable of anonymizing source and
>>   destination IP addresses in flow data before exporting them. It MAY
>>   support anonymization of port numbers and other fields. Please note
>>   that anonymization is not originally an application requirement, but
>>   derived from general requirements for treatment of measured traffic
>>   data within a network.
>
>     When the source produces anonymized flow data, an indication
>     that some form of anonymization has been performed MUST be
>     present, in order to help distinguish truthful vs. non-truthful
>     data.
>
> I hope all see the need for this type of requirement given that
> some of the applications that are envisioned for IP Flow Data
> are critical applications that would require some truth assurances
> in the data.  While an anonymization indicator won't prevent
> problems, it would help eliminate some obvious problems.
>
> Any suggestions on wording would be appreciated.
>
>
> Carter
>
>
>
>
>> -----Original Message-----
>> From: majordomo listserver
>> [mailto:[email-masked]] On Behalf Of Nevil Brownlee
>> Sent: Thursday, January 30, 2003 10:56 PM
>> To: Juergen Quittek
>> Cc: [email-masked]; [email-masked];
>> [email-masked]
>> Subject: [ipfix-eval] Re: next version of IPFIX requirements
>>
>>
>> Quoting Juergen Quittek <[email-masked]>:
>>
>> > Hi Dave and Nevil,
>> >
>> > There is a new version of the IPFIX requirements. You can
>> preview it at
>> >
>> >   http://www.ibr.cs.tu-bs.de/~quittek/draft-ietf-ipfix-reqs-08.txt
>> >
>> > Before posting it I want to get your OK on changing the author list.
>> > Following Dave's reminder on the mailing list, I checked
>> the document
>> > against the I-D nits. Among some minor issues, I found that
>> the maximum
>> > length of the author list is 5. In the last version of the
>> requirements
>> > the length of the list was 6. Therefore, I cut the list.
>> When checking
>> > the contribution of all listed authors, I found a big gap
>> between the
>> > first four and the remaining two authors. Therefore, I
>> removed Georg and
>> > KC from the author list and instead mentioned them explicitly in the
>> > acknowledgements section. Additionally, I mentioned the
>> names of many
>> > other contributors in the acknowledgement.
>> >
>> > I will post the document as soon as I have your OK on this change.
>>
>> Good idea to check the I-D nits, we don't want little things
>> like that
>> to slow the RFC process !
>>
>> I agree with your change to the authors list - Georg and KC came into
>> the Requirements draft fairly late, as I remember.  Go ahead
>> and submit
>> the draft, and at the same time, you'd better send a note to Georg and
>> KC telling them about the change (and why we've made it).
>>
>> Cheers, Nevil
>>
>> --------------------------------------------------------------
>> ---------
>>    Nevil Brownlee                   Director, Technology Development
>>    Phone: +64 9 373 7599 x88941     ITSS, The University of Auckland
>>    FAX: +64 9 373 7021      Private Bag 92019, Auckland, New Zealand
>> vil@auckland
>>
>> -------------------------------------------------
>> This mail sent through University of Auckland
>> http://www.auckland.ac.nz/
>>
>>
>> --
>> Help        mailto:[email-masked] and say "help"
>> in message body
>> Unsubscribe mailto:[email-masked] and say
>> "unsubscribe ipfix" in message body
>> Archive     http://ipfix.doit.wisc.edu/archive/
>>
>
>

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/