Subject: [ipfix] Flow key

From: [email-masked]
Date: Mon, 10 Feb 2003 19:51:11 -0500

After a conversation with Benoit there was general agreement
that a couple examples would be helpful. So here
is the updated text. Feel free to comment on the examples
or suggest other ones (note - the first paragraph is 
the same as before).

          It MUST also be possible to determine the
	  combination of properties is used for distinguishing 
	  flows i.e. the flow key. For example, if only one flow key
          is in use for long periods of time (e.g. months) and 
          the operator can glean that flow key by reviewing the 
          configuration,  the requirement is satisfied. However, 
          if multiple flow keys are in use or the flow keys change 
          dynamically,  then some other mechanism must be in place 
          to map flows to their corresponding flow key.

          Multiple flow keys may be in use, for example, if a metering 
          process classifies a packet using two different flows keys, 
          say K1 = {src-ip, dst-ip} and K2 = {src-AS , dst-AS} then 
          there can be two separate flows reported. One containing 
          the src-ip and dst-ip and the second containing the src-AS 
          and the dst-AS.

          If on the other hand if a metering process distinguishes
          flows based on src-ip, dst-ip, src-port, dst-port, but 
          the metering process then aggregates and reports one flow
          using src-as, dst-as as the flow key then only the latter
          flow and flow key need be reported.
          
          The last example, and likely the most common, is vendor
          A reports flows based on src-ip, dst-ip, src-port, dst-port
          and vendor B reports based on src-ip, dst-ip, src-port,
	  dst-port  and DSCP. If both vendors report flow key
	  information, then both flows can be appropriately processed.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Benoit Claise <[email-masked]>
Date: Tue, 11 Feb 2003 14:00:38 +0100

Paul,

A few minor comments.
See inline.

>          there can be two separate flows reported. One containing
flow _records _reported.

>          the metering process then aggregates and reports one flow
then aggregates_ (the classifying function is applied more than once, as 
foreseen in the metering process terminology _section)  and reports 
_flow records_

>          flow and flow key need be reported.
flow _record _and ...

Regards, Benoit.

---

From: Juergen Quittek <[email-masked]>
Date: Tue, 25 Feb 2003 19:05:56 +0100

Paul,

I avoided the term 'flow key'. When discussing with Benoit,
I found that the two of us have (both very reasonable) different
understandings of this term.

I think we should define this term, but we need a discussion on the
list about it. Since time is pressing for the requirements, I suggest
do it in the architecture document.

Following the purpose of your suggestion, I added the following
sentence to paragraph 3 of section 4:

  "But anyway, it MUST be ensured that a collecting process is
   able to clearly identify for each received flow record which flow
   key was used for distinguishing this flow from other ones."

Cheers,

    Juergen

-- Benoit Claise wrote on 11 February 2003 14:00 +0100:

> then aggregates_ (the classifying function is applied more than once, as foreseen in the metering process terminology _section)  and reports _flow records_
>