Subject: [ipfix] Section on special devices (a.k.a middlebox)

From: Ganesh Sadasivan <[email-masked]>
Date: Fri, 01 Aug 2003 12:22:23 -0700

One of the action items in IETF -57 was to include in the arch. doc.a
section on
special devices/traffic and mention that it would be described in detail

as to how IPFIX would handle these in a separate document. Here is
some text on this topic that can go into the arch. doc. Please send
your comments/corrections on the sections below.

Thanks
Ganesh

12.2. IPFIX flow collection from special devices

   IPFIX could be implemented on devices which perform one or more of
   the following special services :

     * Explicitly drop packets. For example, a device which provides
       firewall service drops packets based on some administrative
       policy.
     * Alter the flow keys of interest. For example a device which
       provides NAT service can change source or(and) destination IP
       address.

   In the cases above, there should be clear guidelines as to

     - How and when to classify the packets as flows in the IPFIX device

     - What extra information be  exported so that the collector can
       make a clear interpretation of the received flow records.

   This topic is out of scope in this document and would be discussed in

   detail in another TBD document.

12.3. IPFIX flow collection for special traffic

   An IPFIX device could be doing one or more of generating, receiving,
   altering special traffic types which are listed below.

     * Tunnel traffic: The IPFIX device could be head, midpoint or
       endpoint of a tunnel. For example, GRE, IPinIP, UTI traffic.
     * VPN traffic: The IPFIX device could be a Provider Edge device
       which receives traffic from customer sites belonging to different

       Virtual Private Networks.

   In the cases above, there should be clear guidelines as to
     - How and when to classify the packets as flows in the IPFIX
       device.
     - If multiple encapsulation are used to define flows how to convey
       the same fields (e.g. IP address) in different layers.
     - How to differentiate flows based on different private domains.
       For example, Overlapping IP addresses in Layer-3 VPNs

   This topic is out of scope in this document and would be discussed in

   detail in another TBD document.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/