Re: [IPFIX] RFC5101: time first flow dropped and time last flow dropped

[Gerhard Muenz <[e-mail]>]

Hi Benoit,

You are right. I was confused because "time first packet ignored" is 
not an IE name.

Regards,
Gerhard



On Thu, 22 Sep 2011 01:11:23 +0200, Benoit Claise wrote:
> Hi Gerhard,
>
>  Thanks for your reply.
>  See in line.
>
>> Hi Benoit,
>>
>> See comments inline.
>>
>> On 20.09.2011 16:19, Benoit Claise wrote:
>>
>>> Dear all,
>>>
>>> [this email addresses
>>> draft-claise-ipfix-protocol-rfc5101bis-00.txt, TO DO -> "time
>>> first flow dropped" and "time last flow dropped" inconsistency.
>>> See the discussion on the list.]
>>>
>>> Paul Aitken discovered this issue.,
>>>
>>> From [RFC5101], section 4.3. The Exporting Process Reliability
>>> Statistics Option Template
>>>
>>> time first flow dropped
>>> The timestamp of the first Flow was dropped by
>>> the Metering Process. For this timestamp, any
>>> of the "flowStart" timestamp Information
>>> Elements flowStartMilliseconds,
>>> flowStartMicroseconds, flowStartNanoseconds, and
>>> flowStartDeltaMicroseconds can be used.
>>>
>>> time last flow dropped
>>> The timestamp of the last IP packet that was
>>> ignored by the Metering Process. For this
>>> timestamp, any of the "flowEnd" timestamp
>>> Information Elements flowEndMilliseconds,
>>> flowEndMicroseconds, flowEndNanoseconds, and
>>> flowEndDeltaMicroseconds can be used.
>>>
>>> Firstly, these definitions are inconsistent since the names and
>>> the first definition say "flow" while the second definition says
>>> "IP packet". Obviously "IP packet" != "flow" :-o
>>>
>>> Secondly, "The timestamp of the first Flow was dropped by the
>>> Metering Process." is bad English: at least it's missing "that".
>>>
>>> Thirdly, the section 4.2 doesn't take into account a metering
>>> process id. Indeed, what if we have multiple caches on the
>>> exporter?
>>>
>>> Here is a proposal for 4.2 and 4.3. The underlined parts are new
>>>
>>> 4.2. THE METERING PROCESS RELIABILITY STATISTICS OPTION TEMPLATE
>>>
>>> The Metering Process Reliability Option Template specifies the
>>> structure of a Data Record for reporting lack of reliability in
>>> the
>>> Metering Process. It SHOULD contain the following Information
>>> Elements that are defined in [RFC5102 [1]]:
>>>
>>> observationDomainId
>>> An identifier of an Observation Domain that
>>> is locally unique to the Exporting Process.
>>> This Information Element MUST be defined as a
>>> Scope Field.
>>>
>>> meteringProcessId (*)
>>> The identifier of the Metering Process for
>>> which lack of reliability is reported. There
>>> This Information Element MUST be defined as a
>>> Scope Field.
>>>
>>> ignoredPacketTotalCount
>>> The total number of IP packets that the
>>> Metering Process did not process.
>>>
>>> ignoredOctetTotalCount
>>> The total number of octets in observed IP
>>> packets that the Metering Process did not
>>> process.
>>>
>>> time first packet ignored
>>> The timestamp of the first IP packet that was
>>> ignored by the Metering Process. For this
>>> timestamp, any of the "flowStart" timestamp
>>> Information Elements flowStartMilliseconds,
>>> flowStartMicroseconds, flowStartNanoseconds,
>>> and flowStartDeltaMicroseconds can be used.
>>>
>>> time last packet ignored
>>> The timestamp of the last IP packet that was
>>> ignored by the Metering Process. For this
>>> timestamp, any of the "flowEnd" timestamp
>>> Information Elements flowEndMilliseconds,
>>> flowEndMicroseconds, flowEndNanoseconds, and
>>> flowEndDeltaMicroseconds can be used.
>>
>> I do not find these IEs in RFC5102.
>  Which ones? flowEndMilliseconds, flowEndMicroseconds,
> flowEndNanoseconds, and flowEndDeltaMicroseconds
>  There are in http://www.iana.org/assignments/ipfix/ipfix.xml [2]
>  However, re-reading
>
>  time first packet ignored
>  The timestamp of the first IP packet that was
>  ignored by the Metering Process. For this
>  timestamp, any of the "flowStart" timestamp
>  Information Elements flowStartMilliseconds,
>  flowStartMicroseconds, flowStartNanoseconds,
>  and flowStartDeltaMicroseconds can be used.
>
>  time last packet ignored
>  The timestamp of the last IP packet that was
>  ignored by the Metering Process. For this
>  timestamp, any of the "flowEnd" timestamp
>  Information Elements flowEndMilliseconds,
>  flowEndMicroseconds, flowEndNanoseconds, and
>  flowEndDeltaMicroseconds can be used.
>  And http://www.iana.org/assignments/ipfix/ipfix.xml [3] for the
> "flowEnd" timestamp IE,
>  I now believe that we should be using this series of IEs
>
>> 322 observationTimeSeconds
>> 323 observationTimeMilliseconds
>> 324 observationTimeMicroseconds
>> 325 observationTimeNanoseconds
>
> 4.3. THE EXPORTING PROCESS RELIABILITY STATISTICS OPTION TEMPLATE
>
>  The Exporting Process Reliability Option Template specifies the
>  structure of a Data Record for reporting lack of reliability in the
>  Exporting process. It SHOULD contain the following Information
>  Elements that are defined in [RFC5102 [4]]:
>
>  Exporting Process ID
>  The identifier of the Exporting Process for
>  which lack of reliability is reported. There
>  are three Information Elements specified in
>  [RFC5102 [5]] that can be used for this purpose:
>  exporterIPv4Address, exporterIPv6Address, or
>  exportingProcessId. This Information Element
>  MUST be defined as a Scope Field.
>
>  notSentFlowTotalCount
>  The total number of Flows that were generated by
>  the Metering Process and dropped by the Metering
>  Process or by the Exporting Process instead of
>  being sent to the Collecting Process.
>
>  notSentPacketTotalCount
>  The total number of packets in Flow Records that
>  were generated by the Metering Process and
>  dropped by the Metering Process or by the
>  Exporting Process instead of being sent to the
>  Collecting Process.
>
>  notSentOctetTotalCount
>  The total number of octets in packets in Flow
>  Records that were generated by the Metering
>  Process and dropped by the Metering Process or
>  by the Exporting Process instead of being sent
>  to the Collecting Process.
>
>  time first flow dropped
>   The time at which the first Flow Record was dropped by
>  the Exporting Process. For this timestamp, any
>  of the "flowStart" timestamp Information
>  Elements flowStartMilliseconds,
>  > flowStartDeltaMicroseconds can be used. time last flow dropped The
>> time at which the last Flow Record was dropped by the Exporting
>> Process. For this timestamp, any of the "flowEnd" timestamp
>> Information Elements flowEndMilliseconds, flowEndMicroseconds,
>> flowEndNanoseconds, and flowEndDeltaMicroseconds can be used.
>> Again, I do not find these IEs in RFC5102.
>> Same remark, I believe we should be using for the two previous IEs
>>
>>> 322 observationTimeSeconds
>>> 323 observationTimeMilliseconds
>>> 324 observationTimeMicroseconds
>>> 325 observationTimeNanoseconds
>> Regards, Benoit.
>>
>> The Exporting Process SHOULD export the Data Record specified by
>> the
>> Exporting Process Reliability Statistics Option Template on a
>> regular
>> basis or based on some export policy. This periodicity or export
>> policy SHOULD be configurable.
>>
>> (*) regarding the meteringProcessId, we were hesitating between the
>> meteringProcessId and the cache id
>> 1. there is a meteringProcessId in IPFIX IANA while there is no
>> cache id
>>
>> meteringProcessId should do the job.
>>
>> 2. if the IPFIX exporter is configured from [IPFIX-CONF], what
>> should be the value in meteringProcessId?
>> [IPFIX-CONF] doesn't mention the meteringProcessId, but a cache
>> name.
>> From figure 1 and 2, it seems that there is a one to one matching
>> between the cache and the metering process.
>> If this is the case, a solution could be to add a meteringProcess
>> inside the cache in the figure 12 in [IPFIX-CONF] below
>>
>> See reply to Pauls mail.
>>
>> Regards,
>> Gerhard
>>
>> 4.3. CACHE CLASS
>>
>> +-----------------------------------+ | Cache |
>> +-----------------------------------+ 1 +------------------+ | name
>> |--------| immediateCache/ | | dataRecords {readOnly} | |
>> timeoutCache/ | | cacheDiscontinuityTime {readOnly} | |
>> naturalCache/ | | | | permanentCache | | | +------------------+ | |
>> |
>  | 0..* +------------------+ | |--------->| ExportingProcess |
> +-----------------------------------+ +-----------------
>
>> Figure 12: Cache class What do you think? Do you see another way?
>>
>> Regards, Paul & Benoit.
> br>
>
> _______________________________________________
> IPFIX mailing list
> [e-mail] [6]
> https://www.ietf.org/mailman/listinfo/ipfix [7]
>
>>
>
>
> Links:
> ------
> [1] http://tools.ietf.org/html/rfc5102
> [2] http://www.iana.org/assignments/ipfix/ipfix.xml
> [3] http://www.iana.org/assignments/ipfix/ipfix.xml
> [4] http://tools.ietf.org/html/rfc5102
> [5] http://tools.ietf.org/html/rfc5102
> [6] mailto:[e-mail]
> [7] https://www.ietf.org/mailman/listinfo/ipfix