Subject: [ipfix] Pull Model for Template Loss

From: "MEYER,JEFFREY D (HP-Cupertino,ex1)" <[email-masked]>
Date: Sun, 18 May 2003 22:42:39 -0400

Hi,

  An alternative to using a "push model" to enable the collector to locate
the latest template, what about a pull based model.

  I could picture two basic models:

    1. SNMP based whereby a template descriptor is made available.  Rather
than 
      representing this in some binary format, I'd recommend a simple XML
format.

    2. A URL based scheme where FTP,TFTP or HTTP requests (one or all) would
be
      allowed and templates retrieved.  This does not require a file system,

      obviously the responder on the port can respond to get requests from
in
      memory images of the templates.

  Alternatively a hybrid approach could be used with some URL(s) available
as
  a MIB variable, and the URL could specify a variety of alternatives such
as
  http://..., snmp://..., ftp://..., tftp://...

  I think given the rate of change of these templates, and the likelihood of
  drops in the UDP mode (which is the only one deployed today), enabling 
  asynchronous retrieval would be a good thing.

Regards,

  Jeff Meyer

-----Original Message-----
From: Ganesh Sadasivan [mailto:[email-masked]]
Sent: Friday, May 16, 2003 3:26 PM
To: Tal Givoly
Cc: Mark Fullmer; [email-masked]
Subject: Re: [ipfix] Lost Flow Records - Synch Message

- Periodic refreshing would be good - especially in a lossy network and
when  template config change is taking place even if the transport is
reliable. Periodicity can be configured, based on the exporter and the
network through which the export data traverses.

- The same holds good for life-time for templates. The end-of-life is
an alternative to using option templates or some other means to that
a template is unconfigured.

Thanks
Ganesh

Tal Givoly wrote:

> Mark,
>
> It seems to me pretty obvious that periodic retransmission of templates
> introduces undue complexity in the collector to buffer data for an
arbitrary
> period of time until such time that it knows how to decode packets for
which
> it has not received the templates. By transmitting only the templates (not
> necessarily the data) over a transport that is reliable (such as TCP or
> SCTP), you avoid this undue complexity. This doesn't imply that the data
> itself doesn't flow over a partially reliable transport (SCTP-PR or UDP).
>
> Furthermore, templates don't need lifetimes. Templates could remain in
> effect from the beginning of a session until changed during that session
or
> by tearing down that session and establishing a new one for the new
> templates. Lifetimes introduce yet another unnecessary complexity.
>
> In general, the way templates are defined in NetFlow v9 (with transient
> identifier) implies that different record structures (templates) must be
> identified IMPLICITLY by virtue of the specific set of attributes within
the
> template. So supposing a collector needs to decode a set of templates in a
> communication - an attribute-by-attribute comparison needs to be used to
> identify what is the meaning of the data in the template. There is no
> reference to some externally defined record structure. I believe this is
> going to be one of the major drawbacks of the current template mechanism
> (this item has been discussed on the mailing list -
> http://ipfx.doit.wisc.edu/list/ipfix/archive/1336.html).
>
> Tal
>
> -----Original Message-----
> From: majordomo listserver [mailto:[email-masked]]On Behalf
> Of Mark Fullmer
> Sent: Thursday, May 15, 2003 6:17 PM
> To: Tal Givoly
> Cc: [email-masked]
> Subject: Re: [ipfix] Lost Flow Records - Synch Message
>
> I don't think there's much more than periodic retransmission
> of templates and some option data to support a lossy control channel.
>
> v9 has lifetimes for templates which is one way to solve some issues
> with a connectionless lossy transport, that is something else that
> can go away.
>
> I agree though, if we don't need to support this I'd rather not, but
there's
> still DCCP.
>
> mark
>
> On Mon, May 12, 2003 at 09:01:15AM -0700, Tal Givoly wrote:
> > Mark,
> >
> > But even if we do use SCTP-PR, the "control" information (such as
> templates,
> > indication of synch messages, etc.) is most likely to be transported
over
> > the reliable SCTP link rather than the partially reliable one. This was
> > suggested by Benoit in the IETF meeting. In that case, should we
introduce
> > undue complexity by supportinging arbitrary theoretical protocols?
> >
> > Tal
> >
>
> --
> Help        mailto:[email-masked] and say "help" in message
> body
> Unsubscribe mailto:[email-masked] and say
> "unsubscribe ipfix" in message body
> Archive     http://ipfix.doit.wisc.edu/archive/
>
> --
> Help        mailto:[email-masked] and say "help" in message
body
> Unsubscribe mailto:[email-masked] and say
> "unsubscribe ipfix" in message body
> Archive     http://ipfix.doit.wisc.edu/archive/

--
Help        mailto:[email-masked] and say "help" in message
body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/