Subject: [ipfix-protocol] draft-ietf-ipfix-protocol-03.txt

From: Benoit Claise <[email-masked]>
Date: Sun, 15 Feb 2004 22:32:19 +0100

Dear all,

Here is the changes in the new version of the IPFIX protocol draft, 
posted today.

_New sections:

_- Flow Expiration section is now synchronized with [IPFIX-ARCH]. The 
text has been reorganized.
    4.0 Criteria for flow expiration and Export
    4.1 Flow Expiration
    4.2 Flow Export
- STRUCTURE CHANGED FROM:

    8. IPFIX Message Format........................................18
    8.1 Header Format.............................................18
    8.2 Field Type Format.........................................19
    8.3 Template FlowSet Format...................................20
    8.3.1 IETF Exclusive Template FlowSet Format.................20
    8.3.2 Vendor Specified Template FlowSet Format...............22
    8.4 Data FlowSet Format.......................................24
    9. Options.....................................................25
    9.1 Options Template FlowSet Format...........................25
    9.1.1 IETF Exclusive Options Template FlowSet Format.........25
    9.1.2 Vendor Specified Options Template FlowSet Format.......27
    9.2 Options Data Record Format................................29
    9.3 Specific IPFIX Options Templates..........................30
    9.3.1 The Metering Process Statistics Option Template........31

    TO:

    8. IPFIX Message Format........................................18
    8.1 Header Format.............................................18
    8.2 Field Type Format.........................................19
    8.3 Template FlowSet Format...................................20
    8.3.1 IETF Exclusive Template FlowSet Format.................20
    8.3.2 Vendor Specified Template FlowSet Format...............22
    8.4 Data FlowSet Format.......................................24
    8.5 Options Template FlowSet Format...........................25
    8.5.1 IETF Exclusive Options Template FlowSet Format......25
    8.5.2 Vendor Specified Options Template FlowSet Format....27
    8.5.3 Options Data Record Format..........................29
    9. Specific Reporting Requirements.............................30
    9.1 The Metering Process Statistics Option Template..........31

- section 9.3 "specific IPFIX Options Templates" is now a new section 
called "Specific Reporting Requirements"
  Comment from Juergen.
  Justification: for the first time in the protocol draft, we speak 
about the specific data types requiring an (option) template. And not 
anymore about the export format
- The transport section contains a new section 5.1 with the MAY, SHOULD, 
MUST requirements regarding the transport protocols.  This is a 
cut/paste from http://ipfix.doit.wisc.edu/archive/2377.html with some 
extra references.
- Security section: new TLS subsection

_Updates

_- Both [IPFIX-ARCH] and [IPFIX-PROTO] terminology sections are now in sync.

    * IP Traffic Flow:
        They were 2 different definitions in [IPFIX-ARCH] and [IPFIX-PROTO]
        The definition from [IPFIX-PROTO] is now used in both drafts. 
Nevertheless, the nice examples from the definition in [IPFIX-ARCH] are 
cut and pasted in a new section from [IPFIX-ARCH]
    * Metering Process
        They were 2 different definitions in [IPFIX-ARCH] and [IPFIX-PROTO]
        The paragraph 3 from the definition in [IPFIX-PROTO] is moved to 
a new section in [IPFIX-ARCH] while only paragraph 1 and 2 are kept
    * Flow Data Record. Remove the reference to Flow Record.
    * Flow Recording Process
       Updated to remove the upper case condition (ex: MAY)
    * Observation Domain
        changed according to http://ipfix.doit.wisc.edu/archive/2435.html
    * Observation Point/Observation Domain
       Instead of having "An Observation Domain is associated with every 
Observation Point." in the Observation Point definition, we now have 
"Every Observation  Point is associated with an Observation Domain" in 
the Observation Domain definition. This avoids a forward reference in 
the terminology.
    * IPFIX Message definition changed to
    An IPFIX Message is a message originating at the Exporting Process 
that carries the records of this Exporting Process and whose destination 
is the Collecting Process.
    Justification: an IPFIX Message might not always contain flow 
record. Comment from Juergen
- Header modified, as described in 
http://ipfix.doit.wisc.edu/archive/2362.html
- The abstract has been updated. The 2 main issues were:
     1. it doesn't use the keyword "specifies" (IESG feedback on the 
NetFlow version 9 draft)
     2. it should start with "This document" (IESG feedback on the 
NetFlow version 9 draft)
- The introduction contains some new text. Text proposed by Ganesh.
- Security section.
  Simplified throught to reduce detail that added little value.
  Corrected a couple of technical errors.
  This section required a new definition: the IPFIX Node, now added in 
the security section.
  Text from Stewart and Sebastian.
- There was no MAY, SHOULD, MUST in section 12 "Variable Length Data Type"
The IPFIX template mechanism is optimized for fixed length Information 
Elements [IPFIX-INFO]. Where an Information Element has a variable 
length the following mechanism MUST used to carry the length information.
- Change the IPFIX Header "Unix Secs" to "Export Time" as the name was 
confusing.
Comment from several persons.
- The Option Data Record Format can have multiple scopes. Changed to

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    FlowSet ID = Template ID   |          Length               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   Record 1 - Scope 1 Value    |   Record 1 - Scope 2 Value    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|              ...              |Record 1 - Option Field 1 Value|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Record 1 - Option Field 2 Value|             ...               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   Record 2 - Scope 1 Value    |   Record 2 - Scope 2 Value    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|              ...              |Record 2 - Option Field 1 Value|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Record 2 - Option Field 2 Value|             ...               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   Record 3 - Scope 1 Value    |   Record 3 - Scope 2 Value    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|              ...              |Record 3 - Option Field 1 Value|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Record 3 - Option Field 2 Value|             ...               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|              ...              |            Padding            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

_Editorial changes

_- Changed the may, should and must of the SCTP section to upper cases.
- terminology summary table clarified. Comment from Ganesh
- In Section 17.5, Data FlowSet with Options Data Records Example,there 
was an error: According to IPFIX Protocol Specification the Length Field 
should be 20 rather than 14.
- In Section 17, The message header's Version Number Field changed to be 
0x000a instead of 0x0009
- 9.1.1 section, "Options Template Record" modified to "Options Data 
Record".
Option 1 Field Type A numeric value that represents the type of field 
that would
appear in the Options Template Record. Refer to [IPFIX-INFO].
- References updated with the new draft versions
- Added "Note that not all Field Values do necessarily have a length of 
16 bit. " at the bottom of the figure in section 8.4
- Sequence Number update: removed "be cumulative"
- Section 4.1, clarification the metering process behaviour in case the 
inactivity timeout is set to 0.
- "The Exporter MUST code all binary integers of the Message Header and 
the different FlowSets in network byte order (also known as the 
big-endian byte ordering)." Added the Message Header

As always, your feedback is welcome. The first sections "open issues" 
and "action items" have been updated and numbered. Please correct me if 
I missed some.
Don't forget to also propose some new text when you address an issue ;)

To get the draft right now (this is a busy week for the drafts admin.), 
follow the procedure below

To get these files, please do the following...

   1. With a Netscape or Internet Explorer web browser open
      the following URL:
        http://www.cisco.com/pcgi-bin/specialaccess.cgi
   2. Enter all your details and at the 'Special Access Code' prompt, 
      enter in HFYYFPNH
   3. Click on the 'Submit' button.  This will bring you
      to a web page listing your files for pickup.
   4. Select each file listed.  Each selection will take
      you to the Software Download web page; click on any

Regards, Benoit.