Subject: Re: [nmrg] Netflow/IPFIX workshop: information and request for feedback
From: Juergen Schoenwaelder <[email-masked]>
To: Ramin Sadre <[email-masked]>
Cc: [email-masked]
Date: Thu, 31 Jul 2008 18:39:09 +0200
List-Id: Network Management Research Group <nmrg.ibr.cs.tu-bs.de>

On Thu, Jul 31, 2008 at 05:37:12PM +0200, Ramin Sadre wrote:

>   EMANICS Workshop on Netflow/IPFIX usage in network management
>   http://www.simpleweb.org/netflow/
> The workshop will take place October 30, at the LRZ Munich, Germany.
>
> We would highly appreciate your feedback and, of course, your
> participation. In addition, we kindly ask you to express your opinion
> on making the workshop a joint Emanics&IRTF-NMRG event.

I like to get more feedback whether NMRG people support such a joint
NMRG meeting plan and whether they plan to attend / contribute to such
a meeting. Since there is a direct relationship to IETF work (IPFIX),
this workshop might be an opportunity to get different groups of
people to talk and exchange ideas.

To the organizers: If this becomes an NMRG workshop, you have to make
sure that the event is recorded in the form of minutes. In addition,
it is desirable to report any significant outcomes in a form easily
accessible to the IETF community (e.g. an Internet-Draft or a
presentation at one of the upcoming IETF meetings).

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

Date: Thu, 31 Jul 2008 17:37:12 +0200
From: Ramin Sadre <[email-masked]>
To: [email-masked]
Subject: [nmrg] Netflow/IPFIX workshop: information and request for feedback

Dear list members,

(we apologize for multiple postings)

as already announced some days ago, the EMANICS network of excellence
is currently preparing the
   EMANICS Workshop on Netflow/IPFIX usage in network management
   http://www.simpleweb.org/netflow/
The workshop will take place October 30, at the LRZ Munich, Germany.

We would highly appreciate your feedback and, of course, your
participation. In addition, we kindly ask you to express your opinion
on making the workshop a joint Emanics&IRTF-NMRG event.

We want the workshop to be an opportunity for people to exchange and
discuss their experiences and ideas. To structure the discussions
the workshop will be organized into several discussion topics.
For each discussion topic, there will be short presentations (5-10 minutes)
introducing the topic, followed by a discussion round.

Currently, the following topics are planned:
    1.   "What technologies are available to analyze flow data?"
       Presentations:
           * Flow record query languages.
           * Using SQL databases for flow processing.
    2. "What can be expected from distributed analysis techniques?"
       Presentations:
           * A distributed architecture for IP flow analysis.
    3. "Should we have a standard format for the annotation of Netflow/IPFIX traces?"
       Presentations:
           * Labeling flow traces for intrusion detection evaluation.
    4. "For what kind of applications can Netflow/IPFIX be used?"
       Presentations:
           * Network anomaly characterization using flows.
           * Application level dependency discovery with flows.
           * Management of light paths in optical networks using flows.

The above list is still preliminary and we welcome your contributions
and suggestions.

Regards,
Ramin Sadre

Date: Thu, 31 Jul 2008 15:35:04 +0200
From: Juergen Schoenwaelder <[email-masked]>
To: [email-masked]
Mail-Followup-To: [email-masked]
Subject: [nmrg] trace meta data and anonymization / pseudonymization
Reply-To: [email-masked]

Hi,

during the review of <draft-irtf-nmrg-snmp-measure-05>, two items
popped up several times:

a) trace meta-data

   The question is what meta-data should be recoded, what should it
   include, are there specific formats to record meta-data etc.

b) trace anonymization/pseudonymization

   Which anonymization/pseudonymization transforms are out there and
   how strong are they or which pitfalls should be known/avoided while
   doing trace anonymization.

I believe both subjects are important and especially b) is also
relevant for work in the IETF (the IPFIX WG is starting to work on
anonymization mediators for IPFIX).

I am just bringing this up here so that people are aware of this
outcome of the review process and if there are people who are actually
interested to work on some of this, please speak up and we can see
whether there is sufficient interest and critical mass.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

From: <[email-masked]>
To: "NMRG" <[email-masked]>
Date: Thu, 31 Jul 2008 15:35:04 +0200
Organization: prive
Subject: [nmrg] Fw: Request to publish draft-irtf-nmrg-snmp-measure-05 as Informational RFC

FYI

Bert Wijnen
Document Shepherd

----- Original Message ----- 
From: "Bert Wijnen (IETF)" <[email-masked]>
To: "Aaron Falk" <[email-masked]>
Cc: "IRSG" <[email-masked]>
Sent: Thursday, July 31, 2008 3:33 PM
Subject: Request to publish draft-irtf-nmrg-snmp-measure-05 as Informational 
RFC

> Aaron, this is a request to publish this document as an Informational RFC.
>
> The NMRG has gone through a number of review stages. Also individuals
> who are know to be active in this space have been approached for review.
> This is all recorded in the issue tracker under ticket #9, see:
>
>    http://www3.tools.ietf.org/group/irtf/trac/ticket/9
>
> Summary of review:
>   - 15 reviews were recieved on this document during NMRG review period.
>     this led to explanation from the author and to a few revisions to
>     include the required changes/clarifications.
>   - Each revision was posted and the NMRG has had time to review and
>     further comment.
>   - OPS AREA Director Dan Romascanu did issue an IETF Last Call on
>     revision 3 of this document because it DOES ask for a URI registration
>     by IANA. No objections/comments were received.
>   - revision 4 was also reviewed by Karin R. Sollins which led to one more
>     revision, the final revision (05)
>   - The final revision (05) was reviewed by the IRSG members
>     Karin R. Sollins and Stephen Farrell; They both voted YES on the IRSG 
> Poll for this revision. No objections were received.
>
> I have updated the status to: IRSG review concluded.
>
> Let me know if I need to do anything else.
>
> Bert Wijnen
> Document Shepherd
>
>
> 

From: "Bert Wijnen \(IETF\)" <[email-masked]>
To: "NMRG" <[email-masked]>
Date: Thu, 31 Jul 2008 15:11:22 +0200
Organization: Consultant
Subject: [nmrg] Fw: [IRTF] #9: IRSG Poll completed and document OKed by IRSG

FYI

Bert Wijnen
Document shepherd

----- Original Message ----- 
From: "IRTF" <[email-masked]>
Sent: Thursday, July 31, 2008 3:04 PM
Subject: Re: [IRTF] #9: IRSG Poll completed and document OKed by IRSG

> Ticket #9: IRSG Poll completed and document OKed by IRSG
>
>>From [email-masked]):
>
>  * summary:  draft-irtf-nmrg-snmp-measure review => IRSG Poll completed
>              and document OKed by IRSG
>  * milestone:  2. IRSG review received => 3. IRSG review concluded
>
>
>
> IRSG Poll has completed. Both Karin S. Rollins and Stephen Farrell
> votes YES. No objections were recieved (as far as I know, if any were
> posted to the IRSG list, then I have not seen them, because I am
> not on that list; But Aaron informed me the document has been OKed,
> so I assume there were no objections).
>
> Now working on the request to publish (to be expected soon).
>
> Bert
>
>
> --------------------------------------------------+-------------------------
> Reporter:  [email-masked]                  |        Owner: 
> [email-masked]
>     Type:  doc review                            |       Status:  reopened
> Priority:  routine                               |    Milestone:  3. IRSG 
> review concluded
> Component:  nmrg                                  |      Version:  -05
> Severity:                                        |   Resolution:
> Keywords:  NMRG review of snmp-measure document  |
> --------------------------------------------------+-------------------------
> -- 
> Ticket URL: 
> <http://www3.tools.ietf.org/group/irtf/trac/ticket/9#comment:25>
> IRTF <http://tools.ietf.org/group/irtf/>
> IRTF Tracker
>
> 

From: Aiko Pras <[email-masked]>
To: "Romascanu, Dan (Dan)" <[email-masked]>, Ramin Sadre <[email-masked]>
Subject: Re: [nmrg] Workshop on Netflow usage
Date: Mon, 28 Jul 2008 10:32:46 +0200
Cc: Aiko Pras <[email-masked]>, [email-masked]

1) I will attend such workshop
2) I propose to use "Netflow/IPFIX", instead of "Netflow"
Reason for using both terms:
- Since we are an IRTF WG, it would be good to promote "IPFIX"
- Since the term "Netflow" is better known than "IPFIX", we should  
also use the term "Netflow"

Bye

Aiko

On 25 jul 2008, at 20:13, Romascanu, Dan (Dan) wrote:

> May I ask why is the goal of the workshop defined in terms of Netflow
> rather than IPFIX, which is an IETF standard?
>
> Dan
>
>
>> -----Original Message-----
>> From: [email-masked]
>> [mailto:[email-masked]] On Behalf Of Ramin Sadre
>> Sent: Tuesday, July 22, 2008 5:08 PM
>> To: [email-masked]
>> Subject: [nmrg] Workshop on Netflow usage
>>
>> Dear all,
>>
>> the Emanics Network of Excellence is currently planning a
>> workshop on Netflow usage, tentatively scheduled for October
>> 30th in Munich, Germany.
>>
>> Topic of the workshop is the usage of Netflow in network
>> management, in particular for (but not restricted
>> to) intrusion detection. It also comprises related topics
>> such as flow storage, querying, etc.
>>
>> Are you interested in such a workshop? What do you think to
>> organize it as a joint Emanics&IRTF-NMRG event?
>> Your comments are appreciated.
>>
>> Best regards,
>>
>> Ramin Sadre
>> University of Twente
>>
>> --
>> !! This message is brought to you via the `nmrg' mailing list.
>> !! Please do not reply to this message to unsubscribe. To
>> unsubscribe or adjust !! your settings, send a mail message
>> to <[email-masked]> !! or look at
>> https://mail.ibr.cs.tu-bs.de/mailman/listinfo/nmrg.
>>
>
> -- 
> !! This message is brought to you via the `nmrg' mailing list.
> !! Please do not reply to this message to unsubscribe. To  
> unsubscribe or adjust
> !! your settings, send a mail message to <[email-masked] 
> bs.de>
> !! or look at https://mail.ibr.cs.tu-bs.de/mailman/listinfo/nmrg.

Content-class: urn:content-classes:message
Subject: RE: [nmrg] Workshop on Netflow usage
Date: Fri, 25 Jul 2008 20:13:05 +0200
From: "Romascanu, Dan (Dan)" <[email-masked]>
To: "Ramin Sadre" <[email-masked]>, <[email-masked]>

May I ask why is the goal of the workshop defined in terms of Netflow
rather than IPFIX, which is an IETF standard? 

Dan

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Ramin Sadre
> Sent: Tuesday, July 22, 2008 5:08 PM
> To: [email-masked]
> Subject: [nmrg] Workshop on Netflow usage
> 
> Dear all,
> 
> the Emanics Network of Excellence is currently planning a 
> workshop on Netflow usage, tentatively scheduled for October 
> 30th in Munich, Germany.
> 
> Topic of the workshop is the usage of Netflow in network 
> management, in particular for (but not restricted
> to) intrusion detection. It also comprises related topics 
> such as flow storage, querying, etc.
> 
> Are you interested in such a workshop? What do you think to 
> organize it as a joint Emanics&IRTF-NMRG event?
> Your comments are appreciated.
> 
> Best regards,
> 
> Ramin Sadre
> University of Twente
> 
> --
> !! This message is brought to you via the `nmrg' mailing list.
> !! Please do not reply to this message to unsubscribe. To 
> unsubscribe or adjust !! your settings, send a mail message 
> to <[email-masked]> !! or look at 
> https://mail.ibr.cs.tu-bs.de/mailman/listinfo/nmrg.
> 

Date: Fri, 25 Jul 2008 12:47:04 +0200
From: Ramin Sadre <[email-masked]>
To: Benoit Claise <[email-masked]>
Subject: Re: [nmrg] Workshop on Netflow usage
Cc: [email-masked]

Benoit Claise wrote:
> Do you have a goal in mind for the workshop? Or simply the
 > exchange of ideas?
> Any idea on what you want to cover?

The goal of the workshop is to exchange experiences and ideas in the
usage of Netflow in network management.
We are open to all kind of usages, as well as to related topics such
as flow collection and storage, querying,..

The program will include presentations from several EMANICS members
who have done work in this area. Currently, presentations with the
following topics are planned:
  - flow query languages
  - network anomaly characterization using flows
  - distributed architecture for IP flow analysis
  - application level dependency discovery with flows

The workshop will take place on October 30, 2008 at the
LRZ in Munich, Germany. A web site with further information
will soon be announced.

Regards,
Ramin

Date: Thu, 24 Jul 2008 23:29:08 +0200
From: Benoit Claise <[email-masked]>
To: Ramin Sadre <[email-masked]>
Subject: Re: [nmrg] Workshop on Netflow usage
Cc: [email-masked]

Ramin,

Do you have a goal in mind for the workshop? Or simply the exchange of 
ideas?
Any idea on what you want to cover?

Regards, Benoit.
> Dear all,
>
> the Emanics Network of Excellence is currently planning
> a workshop on Netflow usage, tentatively scheduled for
> October 30th in Munich, Germany.
>
> Topic of the workshop is the usage of Netflow in
> network management, in particular for (but not restricted
> to) intrusion detection. It also comprises related topics
> such as flow storage, querying, etc.
>
> Are you interested in such a workshop? What do you think
> to organize it as a joint Emanics&IRTF-NMRG event?
> Your comments are appreciated.
>
> Best regards,
>
> Ramin Sadre
> University of Twente
>

Date: Tue, 22 Jul 2008 16:08:16 +0200
From: Ramin Sadre <[email-masked]>
To: [email-masked]
Subject: [nmrg] Workshop on Netflow usage

Dear all,

the Emanics Network of Excellence is currently planning
a workshop on Netflow usage, tentatively scheduled for
October 30th in Munich, Germany.

Topic of the workshop is the usage of Netflow in
network management, in particular for (but not restricted
to) intrusion detection. It also comprises related topics
such as flow storage, querying, etc.

Are you interested in such a workshop? What do you think
to organize it as a joint Emanics&IRTF-NMRG event?
Your comments are appreciated.

Best regards,

Ramin Sadre
University of Twente

From: "Bert Wijnen - IETF" <[email-masked]>
To: "Nmrg" <[email-masked]>
Date: Fri, 4 Jul 2008 12:00:57 +0200
Importance: Normal
Subject: [nmrg] FW: draft-irtf-nmrg-snmp-measure-05 IRSG poll

NMRG, this is FYI.

Unfortunately I was not aware that I needed to start the poll, and 
only learned this after returning from my vacation.

Anyway, let us hope that the IRSG approves this document within the
next couple of weeks.

Bert Wijnen 
document shepherd

-----Oorspronkelijk bericht-----
Van: Bert Wijnen - IETF [mailto:[email-masked]]
Verzonden: vrijdag 4 juli 2008 11:54
Aan: IRSG
Onderwerp: draft-irtf-nmrg-snmp-measure-05 IRSG poll

The IRSG review for draft-irtf-nmrg-snmp-measure-04.txt was completed
late May, by Karen R. Sollins, and the draft has been revised as
into a new version draft-irtf-nmrg-snmp-measure-05.txt on which Karen
and the NMRG have given their OK.

The draft-irtf-nmrg-snmp-measure-05.txt is available at:

 http://www.ietf.org/internet-drafts/draft-irtf-nmrg-snmp-measure-05.txt

The IRSG review is available form the IRTF Tracker web page at:

 http://www3.tools.ietf.org/group/irtf/trac/ticket/9 

This is a two-week IRSG poll.

Please use one of the poll responses defined in
  http://tools.ietf.org/id/draft-irtf-rfcs-01.txt 
(the draft has unfortunately expired, but is still there). 
Those possible poll responses are:

     o  'Ready to publish' -- requires a thorough read and reasonably
         detailed review

     o  'Not ready to publish' -- requires a thorough read, reasonably
        detailed review, and actionable comments.

     o  'No objection' -- I don't object if this document goes forward;
        I've read the document (perhaps quickly); I have some small
        comments which are not show stoppers; I don't have great
        expertise in the area.

     o  'Request more time to review' -- a commitment to provide a
        thorough review in a specified period of time.

And the most relevant rule is that "At least two other IRSG
members (besides the one sponsoring the document) need to
vote 'ready to publish' for the document to move forward."
So please read and vote,

Many thanks,
Bert Wijnen (Document Shepherd).
p.s. I assume that Juergen Schienwaelder sponsors the document,
but he is also author, so that is why I am shepherding.