Subject: RE: [ipfix] IPFIX Header changes

From: "Carter Bullard" <[email-masked]>
Date: Thu, 20 Nov 2003 13:49:16 -0500

The Observation Domain ID should be (for all the obvious
reason and some not so obvious) a network address,
and unfortunately, 32-bits doesn't make it for IPv6 addresses.

Carter

-----Original Message-----
From: majordomo listserver [mailto:[email-masked]] On Behalf Of
Mark Fullmer
Sent: Thursday, November 20, 2003 11:22 AM
To: [email-masked]
Subject: [ipfix] IPFIX Header changes

1) The Count field should be changed to a Length representing the length
    of the IPFIX message.

2) sysUpTime and UNIX Secs can be removed.  These are fields that only
    need to be sent once, possibly slightly more often due to counter
    wrapping, per observation domain per session.  If we end up always
    using 64 bit timestamps in the flows this issue entirely goes away.
    See http://ipfix.doit.wisc.edu/archive/2147.html

3) Source ID should probably be called Observation Domain ID to
    be consistent with the rest of the document.  Prior versions of
    NetFlow used 16 bits for this field which seems sufficient.
    The v9 document uses 32.

4) I would like to see 8 bits of either the version number or
    observation domain changed to flag bits.

5) Based on the flag bit an optional "extension" for lack of a better
    name right now field can show up.  Alternatively use one of the
    "reserved" FlowSet ID's for extensions.  Extensions would be
    in TLV form.

6) With TCP and SCTP the Observation Domain is also something that
    probably only needs to be sent once but could optionally be sent
    per IPFIX message using extensions.

7) For PSAMP support the Length field (previously Count) may need to be
    extended to 24 bits so 64K packets can be transported via IPFIX.

mark

--
Help        mailto:[email-masked] and say "help" in message
body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Mark Fullmer <[email-masked]>
Date: Thu, 20 Nov 2003 14:55:04 -0500

That's a different problem (exporter ID) which also needs to be 
addressed.
Thanks for pointing out this needs to be IPV6 friendly.

The observation domain is there so that if for example a router with
multiple linecards, each running their own instance of a 
metering/exporter
process, all export to a single collector the collector will know
there are multiple exporters.

With UDP / prior versions of NetFlow this was the only field that the
collector could key off of to differentiate streams from multiple
linecards.  Ignoring this field meant among other things a collector
couldn't process the sequence numbers because each LC had its own space.

With TCP/SCTP there is now a connection (potentially) per LC, so the
collector can rely on the kernel to demux the streams and present
each LC as a different socket.  It depends on the implementation at
the exporter though.  Each LC may instead send the streams internally
to a "master" IPFIX exporter (ie the route processor) which then
maintains one TCP/SCTP connection to the collector.

In a nutshell either the header needs to always have this field
present so the protocol is optimized for the second case where
one TCP/SCTP connection from a device aggregates the
observations domains (linecards), or the first case where each
LC has its own exporter stream.  Cisco's products currently do
a separate metering/export process per LC with multiple export
streams.

And for the IPFIX over UDP proponents, no I'm not trying to break the
UDP transport.  There is a straightforward way to still allow
IPFIX to work over UDP, the discussion just doesn't belong on this list,
and the text is highly unlikely to make it into the ID.

mark