Subject: [IPFIX] R: New AD review of draft-ietf-ipfix-flow-selection-tech-10.txt

From: "Salvatore D'Antonio" <[email-masked]>
Date: Mon, 5 Nov 2012 16:03:53 +0100

Dear Benoit,

My comments to your comments inline.

Da: Benoit Claise [mailto:[email-masked]] 
Inviato: martedì 30 ottobre 2012 23:01
A: [email-masked]; [email-masked]
Cc: [email-masked]
Oggetto: Re: [IPFIX] New AD review of
draft-ietf-ipfix-flow-selection-tech-10.txt

Dear draft-ietf-ipfix-flow-selection-tech authors,

I was expecting a quick discussion on the very few remaining issues...
That has not happened.
The draft status is: AD evaluation, Revised ID Needed.

Regards, Benoit

Dear authors,

The draft improved quite dramatically. 
Thanks for that.
See in line for some more comments. I removed all unnecessary text.

Dear authors,

I'm performing the (new) AD review of
draft-ietf-ipfix-flow-selection-tech-10.txt
Lucky you, an extra pair of eyes specifically looking at your draft 

If some points have been discussed already on the mailing list, let me know.
I have to admit that I have not been following the latest iterations of this
draft.

IMHO, this document needs some more work... 
I don't think that this document is really in line with the other
Intermediate Processes documents: 
    http://tools.ietf.org/html/rfc6235
    http://tools.ietf.org/html/draft-ietf-ipfix-a9n-03
Note that I might have some more comments once all the points in this email
are addressed, as there are many ;-)
However, I'm available for a conf. call to clarify my points if you want to 

See in-line. 

...

     8.2.  Registration of Object Identifier  . . . . . . . . . . . . 32 
   9.  Security Considerations  . . . . . . . . . . . . . . . . . . . 32 
   10. Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 34 
   11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 34 
     11.1. Normative References . . . . . . . . . . . . . . . . . . . 34 
     11.2. Informative References . . . . . . . . . . . . . . . . . . 34 
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 35 

Don't you have to include the non-normative XML in the appendix, as it was
done for RFC5102, RFC5103? 

I will do in the next version of the ID. 

2.  Terminology 

   This document is consistent with the terminology introduced in 
   [RFC5101], [RFC5470], [RFC5475] and [RFC3917].  As in [RFC5101] and 
   [RFC5476], the first letter of each IPFIX-specific and PSAMP-specific 
   term is capitalized along with the flow selection specific terms 
   defined here. 

   * Packet Classification 

      Packet Classification is a process by which packets are mapped to 
      specific Flow Records based on packet properties or external 
      properties (e.g. interface).  The properties (e.g. header 
      information, packet content, AS number) make up the Flow Key. In 
      case a Flow Record for a specific Flow Key already exists the Flow 
      Record is updated, otherwise a new Flow Record is created. 

How is this different that the Metering Process (RFC5101)?

   Metering Process
 
      The Metering Process generates Flow Records.  Inputs to the
      process are packet headers and characteristics observed at an
      Observation Point, and packet treatment at the Observation Point
      (for example, the selected output interface).
 
      The Metering Process consists of a set of functions that includes
      packet header capturing, timestamping, sampling, classifying, and
      maintaining Flow Records.
 
      The maintenance of Flow Records may include creating new records,
      updating existing ones, computing Flow statistics, deriving
      further Flow properties, detecting Flow expiration, passing Flow
      Records to the Exporting Process, and deleting Flow Records.

What is the connection with the Metering Process?
Figure 1 seems to suggest that Packet Classification is a subset of the
Metering Process...

not sure that one was answered.

Yes. I already answered. Packet Classification is a function of the Metering
process. Your interpretation is correct.

   * Packet Aggregation Process 

      In the IPFIX Metering Process the Packet Aggregation Process 
      aggregates packet data into flow data and forms the Flow Records. 

How is this different from the Metering Process?

the "Packet Aggregation Process" is not used in the document. Why do we need
it?

I agree with you. We do not need such definition. I will remove it in the
new version of the ID. 

      After the aggregation step only the aggregated flow information is 
      available.  Information about individual packets is lost. 

Intermediate Flow Selection Process: an Intermediate Process as in
      [RFC6183 <http://tools.ietf.org/html/rfc6183> ] that ...

The new definition improved a lot:

 * Intermediate Flow Selection Process
 
      An Intermediate Flow Selection Process takes Flow Records as its
      input and selects a subset of this set as its output.
      Intermediate Flow Selection Process is a more general concept than
      Intermediate Selection Process as defined in [RFC6183
<http://tools.ietf.org/html/rfc6183> ].  While an
      Intermediate Selection Process selects Flow Records from a
      sequence based upon criteria-evaluated Flow record values and
      passes only those Flow Records that match the criteria, an
      Intermediate Flow Selection Process selects Flow Records using
      selection criteria applicable to a larger set of Flow
      characteristics and information.

But is there a reason why this definition can't be based on "intermediate
Process" from RFC 6183:

Intermediate Process
 
      An Intermediate Process takes a record stream as its input from
      Collecting Processes, Metering Processes, IPFIX File Readers,
      other Intermediate Processes, or other record sources; performs
      some transformations on this stream based upon the content of each
      record, states maintained across multiple records, or other data
      sources; and passes the transformed record stream as its output to
      Exporting Processes, IPFIX File Writers, or other Intermediate
      Processes in order to perform IPFIX Mediation.  Typically, an
      Intermediate Process is hosted by an IPFIX Mediator.
      Alternatively, an Intermediate Process may be hosted by an
      Original Exporter.
 
According to the definition of “Intermediate Process” from RFC 6183, such a
process is typically hosted by an IPFIX Mediator. Alternatively, it may be
hosted by an Original Exporter. In my view, an Intermediate Flow Selection
Process could be also hosted by a Collector.

So 

 * Intermediate Flow Selection Process
 
      An Intermediate Flow Selection Process is an Intermediate Process as
in
      [RFC6183 <http://tools.ietf.org/html/rfc6183> ] that takes Flow
Records as its
      input and selects a subset of this set as its output.
      Intermediate Flow Selection Process is a more general concept than
      Intermediate Selection Process as defined in [RFC6183
<http://tools.ietf.org/html/rfc6183> ].  While an
      Intermediate Selection Process selects Flow Records from a
      sequence based upon criteria-evaluated Flow record values and
      passes only those Flow Records that match the criteria, an
      Intermediate Flow Selection Process selects Flow Records using
      selection criteria applicable to a larger set of Flow
      characteristics and information.

Regarding terminology, I still some instances of "observation point". Should
be "Observation Point"

I will fix them.

...

4.  Flow selection as a Function in the IPFIX Architecture 

Thanks for your new figure 1.
One editorial change: change the + in the left vertical line.

Ok, will do.

      +======|========================+      |
      |      |  Mediator              |      |
      +    +-V-------------------+    |      |
      |    | Collecting Process  |    |      |
      +    +---------------------+    |      |
      |    | Intermediate Flow   |    |      |
      |    | Selection Process   |    |      |
      +    +---------------------+    |      |
      |    |  Exporting Process  |    |      |
      +    +-|-------------------+    |      |
      +======|========================+      |

5.1.  Flow Filtering 

   Flow Filtering is a deterministic function on the IPFIX Flow Record 
   content.  If the relevant flow characteristics are already observable 
   at packet level (e.g.  Flow Keys), Flow Filtering can be applied 
   before aggregation at packet level.  In order to be compliant with 
   this document, at least the Property Match Filtering MUST be 
   implemented. 

This contradicts.

   In order to be compliant with this document, at
   least one of the flow selection schemes MUST be implemented.

Actually, wrong cut/paste.
This contradicts, in section 1:

   In order to be compliant with this document, at
   least the Property Match Filtering MUST be implemented.

This comment is not clear to me. Both in Section 1 and in Section 5.1 (Flow
Filtering) I used the same sentence “In order to be compliant with this
document, at least the Property Match Filtering MUST be implemented”.

8.  IANA Considerations 

8.1.  Registration of Information Elements 

Table 3: Information Elements to be registered, you can't put the value 1,
2, 3, 
You need TBD1, TBD2, etc...
And you must add
"IANA Note: please replace TBD1, TBD2, ... with the assigned values,
throughout the document."

Thanks. I will fix this point.

8.2.  Registration of Object Identifier 

RFC 5815 is obsoleted by RFC 6615 <http://tools.ietf.org/html/rfc6615> 

What you want is an extra in http://www.iana.org/assignments/smi-numbers,
pointing to this RFC:

Sub-registry Name: IPFIX-SELECTOR-MIB Functions
Reference: [RFC6615]
Registration Procedures: Expert Review 
Prefix:
iso.org.dod.internet.mgmt.mib-2.ipfixSelectorMIB.ipfixSelectorObjects.ipfixS
electorFunctions 
(1.3.6.1.2.1.194.1.1)
 
Decimal Name                  Description                       Reference
------- --------------------- --------------------------------- ---------
1       ipfixFuncSelectAll    Select everything                 [RFC6615]
2       psampSampCountBased   Systematic Count-based Sampling   [RFC6727]
3       psampSampTimeBased    Systematic Time-based Sampling    [RFC6727]
4       psampSampRandOutOfN   Random n-out-of-N Sampling        [RFC6727]
5       psampSampUniProb      Universal Probabilistic Sampling  [RFC6727]
6       psampFiltPropMatch    Property Match Filtering          [RFC6727]
7       psampFiltHash         Hash-based Filtering              [RFC6727]

So you need TBDx

Ok.

   +---------+-----------------------+---------------------+-----------+
   | Decimal | Name                  | Description         | Reference |
   +---------+-----------------------+---------------------+-----------+
   |  TBDx   | flowSelectorAlgorithm | This Object         | [RFCyyyy] |
   |         |                       | Identifier          |           |
   |         |                       | identifies the Flow |           |
   |         |                       | selection technique |           |
   |         |                       | (e.g., Filtering,   |           |
   |         |                       | Sampling) that is   |           |
   |         |                       | applied by the Flow |           |
   |         |                       | Selection Process   |           |
   +---------+-----------------------+---------------------+-----------+
 
               Table 4: Object Identifiers to be registered

"IANA Note: please replace TBDx with the assigned value, throughout the
document."

Btw, there is a mismatch between the IANA registry and the table in section
7.1:

   +----+------------------------+--------------------------+
   | ID |        Technique         |      Parameters          |
   +----+------------------------+--------------------------+
   | 1  | Systematic count-based | flowSamplingInterval     |
   |    | Sampling               | flowSamplingSpacing      |
   +----+------------------------+--------------------------+
   | 2  | Systematic time-based  | flowSamplingTimeInterval |
   |    | Sampling               | flowSamplingTimeSpacing  |
   +----+------------------------+--------------------------+
   | 3  | Random n-out-of-N      | samplingSize             |
   |    | Sampling               | samplingPopulation       |
   +----+------------------------+--------------------------+
   | 4  | Uniform probabilistic  | samplingProbability      |
   |    | Sampling               |                          |
   +----+------------------------+--------------------------+
   | 5  | Property Match         | Information Element      |
   |    | Filtering              | Value Range              |
   +----+------------------------+--------------------------+
   |   Hash-based Filtering      | hashInitialiserValue     |
   +----+------------------------+ hashFlowDomain           |
   | 6  | using BOB              | hashSelectedRangeMin     |
   +----+------------------------+ hashSelectedRangeMax     |
   | 7  | using IPSX             | hashOutputRangeMin       |
   +----+------------------------+ hashOutputRangeMax       |
   | 8  | using CRC              |                          |
   +----+------------------------+--------------------------+
   | 9  | Flow-state Dependent   | No agreed Parameters     |
   |    | Flow Selection         |                          |
   +----+------------------------+--------------------------+
 
Also, in this table above, you need "TBDx" instead of 9
 
Ok.

- I see "Flow Selection", but this term is not defined.

I will replace “Flow Selection” with “Intermediate Flow Selection Process”. 

Thanks.

Regards, Benoit.

Thanks a lot.

Kind regards,

Salvatore

_______________________________________________
IPFIX mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipfix

  _____  

Nessun virus nel messaggio.
Controllato da AVG - www.avg.com
Versione: 2012.0.2221 / Database dei virus: 2441/5364 - Data di rilascio:
30/10/2012

---

From: Benoit Claise <[email-masked]>
Date: Thu, 08 Nov 2012 10:14:49 -0500

Dear Salvatore,

I removed the comments on which we agree, for clarity.
> *Da:*Benoit Claise [mailto:[email-masked]]
> *Inviato:* martedì 30 ottobre 2012 23:01
> *A:* [email-masked]; [email-masked]
> *Cc:* [email-masked]
> *Oggetto:* Re: [IPFIX] New AD review of 
>            [RFC6183  <http://tools.ietf.org/html/rfc6183>] that ...
>
>       
>
>            Intermediate Selection Process as defined in [RFC6183  <http://tools.ietf.org/html/rfc6183>].  While an
>
>     But is there a reason why this definition can't be based on
>     "intermediate Process" from RFC 6183:
>
>     Intermediate Process
>
>       
>
>     According to the definition of "Intermediate Process" from RFC 6183, such a process is typically hosted by an IPFIX Mediator. Alternatively, it may be hosted by an Original Exporter. In my view, an Intermediate Flow Selection Process could be also hosted by a Collector.
>
Sure. Then the Collector becomes a Collector that contains a mediator 
function.
I don't see the problem.

    Intermediate Process

       An Intermediate Process takes a record stream as its input from
       _Collecting Processes_, Metering Processes, IPFIX File Readers,
       other Intermediate Processes,

My concern if you use your definition is that it doesn't build on the 
framework RFC 6183
>           _  An Intermediate Flow Selection Process is an Intermediate Process as in_
>
>     _       [_RFC6183  <http://tools.ietf.org/html/rfc6183>_] that_  takes Flow Records as its
>
>            Intermediate Selection Process as defined in [RFC6183  <http://tools.ietf.org/html/rfc6183>].  While an
>

>     This comment is not clear to me. Both in Section 1 and in Section
>     5.1 (Flow Filtering) I used the same sentence "In order to be
>     compliant with this document, at least the Property Match
>     Filtering MUST be implemented".
>
>
>
Solved with version 12.
However, I'm wondering if the resolution is correct.
version 11:

    ...

Version 12:

Listing all the selection techniques,

    5  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-5>.  Flow Selection Techniques  . . . . . . . . . . . . . . . . . .10  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-10>
      5.1  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-5.1>.  Flow Filtering . . . . . . . . . . . . . . . . . . . . . .11  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-11>
        5.1.1  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-5.1.1>.  Property Match Filtering . . . . . . . . . . . . . . .11  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-11>
        5.1.2  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-5.1.2>.  Hash-based Flow Filtering  . . . . . . . . . . . . . .11  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-11>
      5.2  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-5.2>.  Flow Sampling  . . . . . . . . . . . . . . . . . . . . . .12  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-12>
        5.2.1  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-5.2.1>.  Systematic sampling  . . . . . . . . . . . . . . . . .12  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-12>
        5.2.2  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-5.2.2>.  Random Sampling  . . . . . . . . . . . . . . . . . . .12  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-12>
      5.3  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-5.3>.  Flow-state Dependent Flow Selection  . . . . . . . . . . .13  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-13>
      5.4  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-5.4>.  Flow-state Dependent Packet Selection  . . . . . . . . . .14  <http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-14>

It means that a device that implements Flow Sampling was compliant with 
version 11 thanks to the sentence "In order to be compliant with this 
document, at least one of the flow selection schemes MUST be 
implemented" and is not compliant any longer with version 12
It seems like an important change to me since the WGLC, on which the WG 
must agree.

Regards, Benoit

---

From: "Salvatore D'Antonio" <[email-masked]>
Date: Wed, 14 Nov 2012 09:37:48 +0100

Dear Benoit,

My answers inline.

Da: Benoit Claise [mailto:[email-masked]] 
Inviato: giovedì 8 novembre 2012 16:15
A: Salvatore D'Antonio
Cc: [email-masked]; [email-masked];
[email-masked]
Oggetto: Re: R: [IPFIX] New AD review of
draft-ietf-ipfix-flow-selection-tech-10.txt

Dear Salvatore,

Dear Benoit,

 

 

 

Intermediate Process

Ok, it’s clear to me now. I will modify the text of the definition
accordingly.

   Intermediate Process

 

So 

 

Ok, will do.

5.1.  Flow Filtering 

This contradicts.

Solved with version 12.

   ...

Version 12:

   5
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-
5> .  Flow Selection Techniques  . . . . . . . . . . . . . . . . . . 10
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-10>

     5.1
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-
5.1> .  Flow Filtering . . . . . . . . . . . . . . . . . . . . . . 11
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-11>

       5.1.1
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-
5.1.1> .  Property Match Filtering . . . . . . . . . . . . . . . 11
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-11>

       5.1.2
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-
5.1.2> .  Hash-based Flow Filtering  . . . . . . . . . . . . . . 11
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-11>

     5.2
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-
5.2> .  Flow Sampling  . . . . . . . . . . . . . . . . . . . . . . 12
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-12>

       5.2.1
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-
5.2.1> .  Systematic sampling  . . . . . . . . . . . . . . . . . 12
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-12>

       5.2.2
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-
5.2.2> .  Random Sampling  . . . . . . . . . . . . . . . . . . . 12
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-12>

     5.3
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-
5.3> .  Flow-state Dependent Flow Selection  . . . . . . . . . . . 13
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-13>

     5.4
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#section-
5.4> .  Flow-state Dependent Packet Selection  . . . . . . . . . . 14
<http://tools.ietf.org/html/draft-ietf-ipfix-flow-selection-tech-12#page-14>

It means that a device that implements Flow Sampling was compliant with
version 11 thanks to the sentence "In order to be compliant with this
document, at least one of the flow selection schemes MUST be implemented"
and is not compliant any longer with version 12
It seems like an important change to me since the WGLC, on which the WG must
agree.

I agree. A new WGLC is needed to have feedback on this change from the WG.

Best regards,

Salvatore

Regards, Benoit

  _____  

Nessun virus nel messaggio.
Controllato da AVG - www.avg.com
Versione: 2012.0.2221 / Database dei virus: 2441/5381 - Data di rilascio:
07/11/2012

---

From: Benoit Claise <[email-masked]>
Date: Mon, 19 Nov 2012 17:14:22 +0100

Dear Salvatore,

Thanks for your feedback.
I believe a new version is required, then a WG LC again

Regards, Benoit
> *Inviato:* giovedì 8 novembre 2012 16:15
> *A:* Salvatore D'Antonio
> *Cc:* [email-masked]; 
> [email-masked]; 
> *Oggetto:* Re: R: [IPFIX] New AD review of 
>     *A:* [email-masked] <mailto:[email-masked]>;
>     [email-masked]
>     <mailto:[email-masked]>
>     *Cc:* [email-masked] <mailto:[email-masked]>
> Ok, it's clear to me now. I will modify the text of the definition 
> accordingly.
>
>     Intermediate Process
>   
> It means that a device that implements Flow Sampling was compliant 
> with version 11 thanks to the sentence "In order to be compliant with 
> this document, at least one of the flow selection schemes MUST be 
> It seems like an important change to me since the WGLC, on which the 
> WG must agree.
>
> ------------------------------------------------------------------------
>
> Controllato da AVG - www.avg.com <http://www.avg.com>
> Versione: 2012.0.2221 / Database dei virus: 2441/5381 - Data di 
> rilascio: 07/11/2012
>