Subject: [ipfix] proposal for protocol sec. 9.3.1 (meter statistics)

From: Maurizio Molina <[email-masked]>
Date: Mon, 02 Feb 2004 19:24:12 +0100

Hi,
I reviwed section 9.3.1 of the IPFIX protocol draft, and here's my 
proposal about how to better define the "meter statistic" information 
that can be useful  from a collector perspective. I defined only 
information that IMHO a meter/exporter can keep up to date without 
complex scannings of its internal data structure.
Maurizio
9.3.1   The Metering Process Statistics Option Template

The Metering Process Statistics Option Template specifies information 
about losses in the metering/exporting process and other information 
useful for the collector to understand whether pathological situations 
(e.g. discarding of a lot of flow records) are happening.
The information can be divided in 4 categories: General, Dropped Packets, 
Dropped Flows, Active flows.

1) General Info

     ipfixOption             The value MUST be METER_STATS
     observationDomain       Scope ID
     time;                   When this record was generated 

2) Dropped Packets

Info about dropped packets and bytes at the meter that could 
not be attributed to flows (*) or could not be recorded for the flows 
they had been attributed to(**). FU stands for Flow Un-attributed

     droppedFUPacketCount   Packets dropped by Metering Process
                             at the specified scope ID
     droppedFUByteCount     Bytes dropped by Metering Process at the 
                             specified scope ID
     timeFirstFUDropped     Time of the first packet dropped at the 
                             Specified scope ID
     timeLastFUDropped      Time of the last packet dropped at the 
                             Specified scope ID

With the above information, a collector can reconstruct the dynamic of 
the macro-flow of all FU discarded packets

(*) this doesn't account for packets that have been discarded before the 
metering process, e.g. because of RED, for sampling or for explicit 
firewalling rules
(**) discarding of packets after flow classification can e.g. happen if 
room for a new flow record is not available

3) Dropped Flows

Info on dropped flows at the meter/flow recording/exporter and on packets 
and byte therein contained. FA stands for Flow Attributed

     droppedFlows(*)         flows dropped due to 
                             resource starvation at the
                             specified scope ID
     droppedFAPacketCount(**)Packets in the dropped flows
     droppedFAByteCount(**)  Bytes in the dropped flows
     timeFirstFADropped      Time of the first packet within the 
                             dropped flows
     timeLastFADropped       Time of the last packet within the 
                             dropped flows

With the above information, a collector can reconstruct the dynamic of 
the macro-flow of all FA discarded packets, and have an indication of the 
average packet and byte size of these flows.

(*) flows only account to the above only if when they were discarded 
their packet count was different since their last exporting
(**) only packets and bytes having arrived since last flow exporting 
account for this counter

4) Active flows

Info on flows currently receiving traffic

     activeFlows             Number of flows whose packet counter
                             changed since their last exporting at
                             the specified scope ID
     packetCountInActFlows   packets arrived to active flows since
                             their last exporting time
     byteCountInActFlows     bytes arrived to active flows since
                             their last exporting time

With the above information, a collector can know how many flows are 
receiving traffic and how many packets and bytes arrived since the last 
exporting. By comparing these counters with the number of received flow 
records and bytes and packets in them, a collector can estimate the 
exporter latency and understand if there are pathological situations at 
the exporter (e.g. flow records never exported).

A Metering Process Statistics Option template MUST contain ipfixOption, 
scopeID, time and droppedFlows. It SHOULD contain droppedFAPacketCount 
droppedFAByteCount droppedFUPacketCount droppedFUByteCount. It MAY 
contain the other information listed above.