Re: [IPFIX] IPFIX export: SNMP versus physical Interface

Paul Aitken <paitken@cisco.com> Tue, 26 July 2011 13:23 UTC

Return-Path: <paitken@cisco.com>
X-Original-To: ipfix@ietfa.amsl.com
Delivered-To: ipfix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FAD721F8C58 for <ipfix@ietfa.amsl.com>; Tue, 26 Jul 2011 06:23:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.599
X-Spam-Level:
X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qTH2TKj7pHV0 for <ipfix@ietfa.amsl.com>; Tue, 26 Jul 2011 06:23:49 -0700 (PDT)
Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by ietfa.amsl.com (Postfix) with ESMTP id CBF7021F8C2E for <ipfix@ietf.org>; Tue, 26 Jul 2011 06:23:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=paitken@cisco.com; l=1242; q=dns/txt; s=iport; t=1311686629; x=1312896229; h=message-id:date:from:mime-version:to:subject:references: in-reply-to:content-transfer-encoding; bh=2sojrMSa/2ZjwA9GEy28KbJWfrkJOjU4a6yvXSUXvj4=; b=LQeA2ygo+rt7iraXlK5soN4OGQoCK65t6bY5Q27m/nZs1n9O0U4jxzp1 AjVY1ldehIgiHZ6OSAC3Ig9RW7Gx5wI9i8hd/WBv/8HviHCaOVUe3AmPZ tUYHix8jpaAuw37HVf5fdnb8tmurh/JktYTuKMOYdSkYIG1WzdIYTVPwA w=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: Av8EANy+Lk6Q/khL/2dsb2JhbAA1AQEBAQIBFAEpRgYMDBgJIg8JAwIBAgECUQcODwEBH6c1d4h8oyaeY4ZABJJyhQeLWg
X-IronPort-AV: E=Sophos;i="4.67,269,1309737600"; d="scan'208";a="104362409"
Received: from ams-core-2.cisco.com ([144.254.72.75]) by ams-iport-1.cisco.com with ESMTP; 26 Jul 2011 13:23:47 +0000
Received: from [10.61.83.209] (ams3-vpn-dhcp5074.cisco.com [10.61.83.209]) by ams-core-2.cisco.com (8.14.3/8.14.3) with ESMTP id p6QDNlCf013759 for <ipfix@ietf.org>; Tue, 26 Jul 2011 13:23:47 GMT
Message-ID: <4E2EBFEA.7080109@cisco.com>
Date: Tue, 26 Jul 2011 14:23:54 +0100
From: Paul Aitken <paitken@cisco.com>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.18) Gecko/20110617 Lightning/1.0b2 Thunderbird/3.1.11
MIME-Version: 1.0
To: IETF IPFIX Working Group <ipfix@ietf.org>
References: <4E2EB359.8070309@cisco.com> <20110726131514.GA6421@elstar.local>
In-Reply-To: <20110726131514.GA6421@elstar.local>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [IPFIX] IPFIX export: SNMP versus physical Interface
X-BeenThere: ipfix@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: IPFIX WG discussion list <ipfix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipfix>, <mailto:ipfix-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipfix>
List-Post: <mailto:ipfix@ietf.org>
List-Help: <mailto:ipfix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipfix>, <mailto:ipfix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Jul 2011 13:23:50 -0000

Juergen,

> On Tue, Jul 26, 2011 at 01:30:17PM +0100, Paul Aitken wrote:
>> Dear IPFIXers,
>>
>> I noticed that the definitions of fields 10 and 14, and fields 252
>> and 253 are confusingly similar. See below.
>>
>> Cisco uses fields 10 and 14 to export the logical or virtual
>> interface (eg. SVI, tunnel), while fields 252 and 253 export the
>> actual physical interface.
>>
>> For example, if we have an SVI configured on a VLAN, the SNMP index
>> of the SVI would be exported using fields 10 and 14, while the SNMP
>> index of the physical port in that VLAN would be exported with
>> fields 252 and 253.
>>
>> So I propose to update fields 10 and 11 to say, "the index of the
>> logical or virtual interface ...", to contrast with 252 and 253
>> which say, "The index of a networking device's physical interface
>> ...".
> Not sure this is right because if I only have a physical interface and
> no logical/virtual interfaces, I think I still want to report the
> physical interface in fields 10 and 11, no? I am not sure why there is
> actually a need to change something here.

In this case, physical == logical, so either 10/14 or 252/253 would be 
correct.

We've always used 10/14 in this case.

P.