Re: sending strings data into IPfix stream

Brian Trammell <trammell@tik.ee.ethz.ch> Mon, 01 July 2013 09:28 UTC

Content-Type: text/plain; charset="iso-8859-1"
Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\))
Subject: Re: sending strings data into IPfix stream
From: Brian Trammell <trammell@tik.ee.ethz.ch>
In-Reply-To: <51D14680.90809@lpsc.in2p3.fr>
Date: Mon, 01 Jul 2013 11:28:25 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <180BD9A1-3325-471A-8BB6-F80A73F5535A@tik.ee.ethz.ch>
References: <51D14680.90809@lpsc.in2p3.fr>
To: DESCOMBES Thierry <descombes@lpsc.in2p3.fr>
Cc: ietf@ietf.org
Precedence: list

Hi, Thierry,

Have a look in the IANA information element registry (http://www.iana.org/assignments/ipfix) to see if there are existing IEs for the information you want to export. 

Hostnames, I think, are not there -- in general, IPFIX exporters deal in addresses taken from observed packets and leave it up to the collector to do reverse resolution, due to (1) the amount of time DNS reverse lookups can take, blocking measurement activity on a (presumably) resource-constrained metering process, as well as (2) the ambiguity inherent within reverse lookups (due to e.g. misconfigured local and/or authoritative resolvers). In an environment where you have a good, internal database of hostnames (e.g. because the metering process is colocated with a DHCP server), this is more likely to be useful, though.

If you'd like to export information _not_ in the IANA Information Element registry, you have two options; (1) defining new enterprise-specific IEs scoped by your Private Enterprise Number (see Section 3.2 and example A.2.2. in http://tools.ietf.org/html/draft-ietf-ipfix-protocol-rfc5101bis) or (2) submitting a new Information Element definition for addition to the IANA registry (see http://tools.ietf.org/html/draft-ietf-ipfix-ie-doctors-07/ for guidelines on writing such a definition).

Keep in mind, for strings, you'll almost certainly be dealing with variable-length IE export; see section 7 of http://tools.ietf.org/html/draft-ietf-ipfix-protocol-rfc5101bis.

Cheers,

Brian

On 1 Jul 2013, at 11:06 , DESCOMBES Thierry <descombes@lpsc.in2p3.fr> wrote:

> Hello,
> Not sure if this is the right list for this type of message ...
> I am developing an IPFIX exporter. It exports IP flows, and I'd like now to export some extra information (strings) about the machines on the LAN (the hostname of the machine, and others information ...)
> What is the right way to do that (IPFIX fields to use, template options or not ...)
> Thank you very much in advance. Regards
> T. Descombes

Re: sending strings data into IPfix stream DESCOMBES Thierry
sending strings data into IPfix stream DESCOMBES Thierry
Re: sending strings data into IPfix stream Brian Trammell