Subject: [lmap] FW: New Version Notification for draft-eardley-lmap-terminology-01.txt

From: <[email-masked]>
Date: Thu, 2 May 2013 10:52:04 +0100

I updated the draft http://tools.ietf.org/html/draft-eardley-lmap-terminology
Thank-you for all the comments!

(the draft is a possible starting point for terminology for the prospective lmap wg)

Best wishes
phil

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: 02 May 2013 09:40
To: Al Morton; Eardley,PL,Philip,TUB8 R; Burbridge,T,Trevor,TUB8 R; Al C.Morton; Marcelo Bagnulo
Subject: New Version Notification for draft-eardley-lmap-terminology-01.txt

A new version of I-D, draft-eardley-lmap-terminology-01.txt
has been successfully submitted by Philip Eardley and posted to the IETF repository.

Filename:	 draft-eardley-lmap-terminology
Revision:	 01
Title:		 Terminology for Large MeAsurement Platforms (LMAP)
Creation date:	 2013-05-02
Group:		 Individual Submission
Number of pages: 10
URL:             http://www.ietf.org/internet-drafts/draft-eardley-lmap-terminology-01.txt
Status:          http://datatracker.ietf.org/doc/draft-eardley-lmap-terminology
Htmlized:        http://tools.ietf.org/html/draft-eardley-lmap-terminology-01
Diff:            http://www.ietf.org/rfcdiff?url2=draft-eardley-lmap-terminology-01

Abstract:
   This documents defines terminology for Large Scale Measurement
   Platforms.

The IETF Secretariat

---

From: Jérôme Benoit <[email-masked]>
Date: Thu, 2 May 2013 17:06:35 +0200

On Thu, 2 May 2013 10:52:04 +0100 in
<[email-masked]>,

> Thank-you for all the comments!

2.  Summary

I dislike the terminology "Measurement Peer", I prefer "Measurement
Landmarks". The measurement agent with talk to different peer (MC,
etc.), only one or several of these peer(s) will be used to target the
measurement task.     

3.   LMAP Terminology 

"Bootstrap Protocol: A protocol that initialises a Measurement Agent
				     ^ initialize ?
with the information necessary to talk to a Controller."

Why do you use "function" everywhere ? It's a functionality. 

Measurement Method vs. Measurement Task vs. Passive Measurement Method

I tend to disagree in the differentiation unless you explain what is
really the difference. When people design measurement (active or
passive), they build a complete methodology that will differ in term
requirements but the output will be metrics if case of active
measurement and for passive measurement ... it really depend : 

Use case one : I choose to not put the TCP session inter-packets delay
calculation on the measurement agent, I just extract the timestamp and
sequence number of each packets in one TCP session and sent them. 
Use case two : To bootstrap a passive measurement that will detect
network anomalies, I need to build a "fingerprint" database of
network behaviours, to do so, I need to send something that will
look like a netflow data model to build such a fingerprint
database. This use case is more a bootstrapping measurement method
to permit to build a passive measurement method. 

What matter here, it's the overall repartition of the intelligence
between each logical component of the measurement system. Passive
measurement method will need to put more intelligence in the MA.    

3.1  Other potentially useful terminology

Measurement Parameter and Environmental Constraint

Same as before : it's in the measurement method if it's needed.

I think you should create a distinct paragraph for the measurement
method.  

4.  Commentary and notes

"By definition a Measurement Peer does not interact with a Controller
or Collector" 

Not sure it's a wise idea : the measurement method will have to ensure
that the peer or landmark is for example not overloaded, or correctly
on time, or just alive. Why not saying that the measurement controller
is also tracking some states of measurement peer or landmark and
will then either postpone some future measurement to this landmark ? 
If you choose to not do so, measurement method will need mix their
primary functionality : do measurement and also check that should be
part of the measurement method : can I do the measurement with the
peer or landmark ? 

Cheers.   
 
-- 
Jérôme Benoit aka fraggle
La Météo du Net - http://grenouille.com
OpenPGP Key ID : 9FE9161D
Key fingerprint : 9CA4 0249 AF57 A35B 34B3 AC15 FAA0 CB50 9FE9 161D

---

From: <[email-masked]>
Date: Fri, 3 May 2013 09:23:47 +0100

Jerome

Thanks for the comments

In-line
phil

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Jérôme Benoit
> Sent: 02 May 2013 16:07
> To: [email-masked]
> Subject: Re: [lmap] FW: New Version Notification for draft-eardley-
> lmap-terminology-01.txt
> 
> > I updated the draft
> > http://tools.ietf.org/html/draft-eardley-lmap-terminology

Measurement Peer vs Landmark - I'm easy either way.

> with the information necessary to talk to a Controller."

Initialise vs initialize. For several words -ise and -ize are alternative spellings in UK English (-ise is somewhat more common)

> Why do you use "function" everywhere ? It's a functionality.

I don't think there's a clear difference between function and functionality. Functionality roughly seems to mean a set of functions. At least function is less typing!

> sequence number of each packets in one TCP session and sent them.

I'd say that the Measurement Method (which is Passive) is to "extract the timestamp and sequence number of every packet in a TCP session", whilst the associated (Passive) Measurement Task would be something like "for the TCP session from the source 192.0.2.0 destined for 198.51.100.0 and starting at UTC 13:01 and 58.6 seconds on 2013-06-15, then extract the timestamp and sequence number of every packet in the TCP session"

> network anomalies, I need to build a "fingerprint" database of network
> behaviours, to do so, I need to send something that will look like a
> netflow data model to build such a fingerprint database. This use case
> is more a bootstrapping measurement method to permit to build a passive
> measurement method.

For example the Measurement Method could be "compare the traffic with a fingerprint" and the associated Measurement Task "compare the traffic on incoming interface #3 with fingerprint #17 starting at UTC 13:01 and 58.6 seconds on 2013-06-15"

> Same as before : it's in the measurement method if it's needed.

correct

> I think you should create a distinct paragraph for the measurement

Not sure what you mean - there's a paragraph where Measurement Method is defined

> is also tracking some states of measurement peer or landmark and will
> then either postpone some future measurement to this landmark ?
> part of the measurement method : can I do the measurement with the peer
> or landmark ?

The thinking is that, as a "pre" part of the measurement method, the Measurement Agent may check with the Measurement Peer (/Landmark) that it can run the test (it's not overloaded etc). some people call this "admission control". I think that sometimes "admission control" will be done and sometimes it won't - depends on the type of test (how much could it load up the Peer), whether you have some other way of alleviating potential issues (eg load balancing at the Peer), whether the Measurement Method itself incorporates a back-off algorithm, how much risk you're prepared to take (of overloading the Peer), whether it's easier to detect/delete "dodgy" measurement results etc

An alternative is for the "admission control" to involve the Measurement Controller. Personally I don't like this - it means that there has to be communication involving the Controller, Peer and MA before every single Measurement Task is involved in this process, and also it won't work if the Peer is a non-IPPM/LMAP device.

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 3 May 2013 10:30:11 +0200

> Measurement Peer vs Landmark - I'm easy either way.

I do not follow your argument. We call it a 'Measurement Peer' and
obviously this is not a 'Controller' nor a 'Collector'. I fail to see
why there can be any confusion because we call it 'Measurement Peer'
and not just 'peer'.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: "MORTON JR., ALFRED C (AL)" <[email-masked]>
Date: Fri, 3 May 2013 08:09:34 -0400

> Juergen Schoenwaelder
> Sent: Friday, May 03, 2013 4:30 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: Re: [lmap] FW: New Version Notification for draft-eardley-lmap-
> terminology-01.txt
> 

To me, a "Landmark" would have a single specific position in the architecture,
and that meaning overlaps with the "measurement points" specified in the 
Reference path draft.

A measurement peer can be anywhere in the network, which is the sort
of generality needed at the control level.  Also, the Controller and MA
are not peers, certainly not in the way that two MAs can be peers when 
they coordinate to perform tests.

Al

---

From: Jérôme Benoit <[email-masked]>
Date: Fri, 3 May 2013 17:06:49 +0200

On Fri, 3 May 2013 08:09:34 -0400 in
<[email-masked]>,
MORTON JR., ALFRED C (AL) "MORTON JR., ALFRED C (AL)"

> and that meaning overlaps with the "measurement points" specified in the 

A landmark is a peer on steroid : It can do some treatment on the
received packets (whatever layer) : mirroring -layer 3-, simulate
layer 7 protocol, etc. It's basically a targeted implementation of a
sockets server (using RAW sockets and with pluggable "treatment" on
the received packets)   

The basic network functionalities that all OSes offer (ICMP, TCP, UDP)
being network element, endpoint, firewall permit to do some
measurement but the most common part of each active measurement is one or several
intelligent endpoints.   

> they coordinate to perform tests.

Can we call them measurement endpoint (them being intelligent or not) ?

---

From: Jérôme Benoit <[email-masked]>
Date: Fri, 3 May 2013 18:16:45 +0200

On Fri, 3 May 2013 09:23:47 +0100 in
<[email-masked]>,

> I don't think there's a clear difference between function and functionality. Functionality roughly seems to mean a set of functions. At least function is less typing!

Well ... :)
You need a set of functions to implement a measurement task for
example. 

> For example the Measurement Method could be "compare the traffic with a fingerprint" and the associated Measurement Task "compare the traffic on incoming interface #3 with fingerprint #17 starting…

OK. fine. 

> Not sure what you mean - there's a paragraph where Measurement Method is defined

Do not differentiate active and passive measurement method in the
terminology. A measurement method can be both, just state the
difference in the definition and the derived measurement task will
fellow the method (active or passive).  

> The thinking is that, as a "pre" part of the measurement method, the Measurement Agent may check with the Measurement Peer (/Landmark) that it can run the test (it's not overloaded etc). some peopl…

I've read the thread on CAC and I responded : It's much more
complicated than introducing a simple CAC mechanism on the Measurement
Peer/Landmark/Enpoint. The primary use case is : 

* P2P overlay measurement method; 
* The derived measurement task; 
* The metrics of interest collected during the measurement; 

This measurement method will exhibit the first constraint : the number
of active Peer/Endpoint/Landmark that have the capability or
functionality to do the measurement task => you need a MA states and
capabilities tracker. The second constraint is the network load induced
by such a measurement => you need a dependency on a other measurement
method and derived task that will be able to evaluate the link capacity
between each MA or pull the ISP network elements load to stop the
measurement quickly. The third constraint is a that the
Peer/Landmark/Endpoint can be reached (most MA are runt behind a CPE,
most CPE have a firewall with different security level -traceroute
with UDP are not possible with some default security level settings-,
most CPE support UPnP, some UPnP implementation in CPE are problematic)

So to resume : 
* CAC between MA and M Peer/Landmark/Endpoint can be enough most of the
  time
* The current design of the LMAP lack of much more thought coherency
  mechanism between each logical component to permit to run ends to
  ends measurement (MAs talk to MAs).

To solve point two, I propose to introduce a MA state and capabilities 
tracker, make it optional and non mandatory, postponed to most
important detailed architecture work before, no pb but please take
it into account : such a tracker is a simple key/value store and
nowadays, you can find a bunch of implementation of such a store. The
work will be on the protocol to interact with such a tracker. 

Say MA receive M Task MT(i) that have constraint C1 and C2, The MA
ask to http://lmap.tracker.domain.tld/total_number_agent_online
ad ask to
http://lmap.tracker.domain.tld/total_number_agent_online_with_measurement_i_capabilities 
before running the measurement task MT(i) to ensure that it can be
done. The checks are part of the MT, the intelligence of the decision
is part of the MA and the MA contact the tracker (you can make part of
the bootstrapping protocol) 

I've already explained some time ago that this kind of features should
be in the measurement system but nobody listen to me (/me crying) :)

> An alternative is for the "admission control" to involve the Measurement Controller. Personally I don't like this - it means that there has to be communication involving the Controller, Peer and MA…

Fine. The rationale for CAC implemented this way sound good but (yes, I
always have a but :)) I really prefer to not introduce another bias on
the peer/landmark/endpoint via the CAC overhead - the system is already
full of bias : cross traffic, OS bias, etc. Plus I do not think
CAC between MA and Measurement Peer/Landmark/Endpoint will cover all use
case. The point of the tracker is to permit to give to MA
information on the measurement system and let the MA decide want to
do for a MT. 

Cheers.

---

From: "MORTON JR., ALFRED C (AL)" <[email-masked]>
Date: Fri, 3 May 2013 12:41:26 -0400

Jérôme, please see brief replies below,

> From: Jérôme Benoit [mailto:[email-masked]]
> Sent: Friday, May 03, 2013 11:07 AM
> To: MORTON JR., ALFRED C (AL)
> Cc: Juergen Schoenwaelder; [email-masked]; [email-masked]

[acm] The "steroids" seem to be a description of specific measurement capabilities.
The names in the terminology draft were intended to have a generic purpose,
so devices can eventually include some capabilities and some not, 
all to be decided when there is an agreed-on characterization plan.

> Can we call them measurement endpoint (them being intelligent or not) ?

[acm] You can, but in some measurement scenarios like single-point passive measurement
(the measurement point is not at the end of anything) it won't be accurate.
No ends, no peers, just a Measurement Agent doing its job at a measurement point.

Al

---

From: "Guangqing Deng" <[email-masked]>
Date: Sat, 4 May 2013 18:16:03 +0800

Hi, Juergen, once I see the term "measurement peer", what comes into my mind next
is the term "measurement server". Maybe that is because of the peer-to-peer network 
where the "peer" and "server" are the two basic roles of this kind of network. But the 
term "measurement peer" is Ok for me if a more suitable term has not been found.

Guangqing Deng
cnnic 

From: Juergen Schoenwaelder
Date: 2013-05-03 16:30
To: philip.eardley
CC: jerome.benoit; lmap
Subject: Re: [lmap] FW: New Version Notification for draft-eardley-lmap-terminology-01.txt

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
lmap mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/lmap

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Sat, 4 May 2013 12:29:02 +0200

> term "measurement peer" is Ok for me if a more suitable term has not been found.

Measurement server was an early term but then people argued that this
thing may not necessary act as a server for the measurement to be
performed and hence we now have measurement peer since it is more
neutral.

/js

---

From: <[email-masked]>
Date: Tue, 7 May 2013 15:56:50 +0100

> important detailed architecture work before, no pb but please take it
> into account : such a tracker is a simple key/value store and nowadays,
> you can find a bunch of implementation of such a store. The work will
> be on the protocol to interact with such a tracker.
> 

Ok, I think we agree that the initial charter should concentrate on the "most of the time" scenarios, and leave the optional stuff for later.

Thanks
phil

> Say MA receive M Task MT(i) that have constraint C1 and C2, The MA ask
> to http://lmap.tracker.domain.tld/total_number_agent_online
> ad ask to
> > An alternative is for the "admission control" to involve the
> Measurement Controller. Personally I don't like this - it means that
> there has to be communication involving the Controller, Peer and MA
> before every single Measurement Task is involved in this process, and
> also it won't work if the Peer is a non-IPPM/LMAP device.
> 
> full of bias : cross traffic, OS bias, etc. Plus I do not think CAC
> between MA and Measurement Peer/Landmark/Endpoint will cover all use
> case. The point of the tracker is to permit to give to MA information
> on the measurement system and let the MA decide want to do for a MT.
> 
> Cheers.
> 
> --