Subject: Re: [IPFIX] some comments on IANA IPFIX XML

From: Andrew Feren <[email-masked]>
Date: Fri, 01 Apr 2011 09:54:44 -0400

On 03/31/2011 01:15 PM, Brian Trammell wrote:
> hi, Andrew, all,
>
> On Mar 31, 2011, at 5:04 PM, Andrew Feren wrote:
>
>> On 03/31/2011 10:44 AM, Chris Inacio wrote:
>>> It would be really great to wrap the record entries (defined in ipfix.xsd, each record represents an IE,) within another record which records a PEN - so that people can publish their PEN's in a standard way.
>> This would be great.  A registry of all the info elements above 37,768 that have been taken by vendors trying to extend v9 would be nice too.
> It's up to each enterprise, of course, to determine which, whether, and how to make information about their enterprise-specific IEs (esIEs) available. I know that YAF's IEs (including esIEs) exported in PEN 6871 are documented on a manpage (http://tools.netsa.cert.org/yaf/yaf.html#OUTPUT), for example.
Understood.

I still think it would be useful to have a central (easily found) 
location where vendors could chose to make information about their 
enterprise specific IEs available.  Consider RFC 3954 which states:

" Refer to the latest documentation at http://www.cisco.com for the
    newly updated list."

There are, in fact, many updates available there, but good luck finding 
them if you don't already know they exist and exactly where to find 
them.  For IPFIX this problem is even worse.  Essentially "Refer to the 
latest documentation on any possible vendor site for the updated list of 
vendor specific IEs".

> FWIW, IANA's schema does have an<enterpriseId>  element for describing esIEs. Though the xsl that makes their webpage doesn't appear to use it.

I'm pleased to hear that it may at least be possible.

>> On a related note... Is anyone implementing rfc5610?
> There will be scantily-documented initial support for this in the working revision of ripfix, which requires some API interaction to make it work. I'll release this as soon as I track down the last bugs in UDP export.
Thanks for the tip.

-Andrew

---

From: Paul Aitken <[email-masked]>
Date: Mon, 25 Apr 2011 12:44:59 +0100

Chris,

>  The way IANA specifies the IPFIX registry for IE's is a little
>  twisted.
>
>  First, I can't validate the XML. I can get the ipfix.xml and the
>  ipfix.xsd, but it is wrapped in "registry" elements, which are not
>  described in ipfix.xsd (presumably they are defined somewhere in
>  IANA for use across their registries.)
>
>  Another little nit about registries: There are 2 registries in the
>  ipfix.xml. The first one describes the broad rules about IE's (0
>  is reserved, 1-127 is reserved for NetFlow v9 compatibility (with
>  expert review), and 128-32767 are for new (with expert review)). The
>  second one is a list of the IE's. Registry elements _can_ contain
>  created on and modified on dates.

Ideally, yes.

Perhaps the WG chairs would ask IANA to add and maintain this.

>  Unfortunately, in the ipfix.xml file, the first registry entry does
>  contain the created and modified on dates, while the second one
>  (with the actual elements) doesn't contain any created on/updated on
>  time stamps. So they are time stamping the wrong record in the
>  official registry.

Not so: the "created" and "updated" timestamps are at the outermost 
level, so they apply to the entire set of IANA IPFIX assignments.

>  It would be really great to wrap the record entries (defined in
>  ipfix.xsd, each record represents an IE,) within another record
>  which records a PEN - so that people can publish their PEN's in a
>  standard way.

A slightly different encoding is needed for the IANA standard versus PEN 
elements, since PEN doesn't apply to the standard elements.
It would be misleading to specify one - or even to specify a "not 
applicable" value.

>  The current record definition allows marking up an IE with a
>  "status" field. The possible entries for status are: current,
>  deprecated, obsolete. It would be really cool to also have
>  "transitioned", and then a pointer to another registry. Along with
>  that, I would want to time stamp the IE's separately, and to put in a
>  pointer to the transitioned to location. This would allow me to put
>  something wrapped in my PEN in a standard way, propose it to IANA,
>  get it moved, and then reuse that IE number in my space in the
>  future. I would need to leave the record in my IE XML forever,
>  assuming collector operators might not delete the corresponding
>  records "for a really long time." Collectors would then be required
>  to use the time stamps in the flow records to resolve IE's correctly.
>  Is that more complicated? Absolutely. But it does make IE's a lot
>  more portable between everyone, and people can then reuse IE's.

I was thinking of doing something similar in the exported data, so that 
an updated exporter can send a table of "I used to export <this-old-IE>" 
versus "now I export <this-new-IE>". The IEs could be private or public. 
Then a collector can seamlessly map between old and new data received 
from that device.

Cheers,
P.