Re: [IPFIX] [Sender: [e-mail]] Re: Maji - an open source IPFIX meter implementation

[Gerhard Muenz <[e-mail]>]

Hi Andrew,

>>> Looking again, you seem to have have a start, stop and mask value for
>>> each filter.  So what would you expect the behaviour to be of a filter
>>> that demands a TCP flags value of 0 when faced with a UDP packet?
>>
>> I do not know. Is it defined somewhere?
> 
> Not as far as I know, however if you're matching on and IPv4 address of
> 192.168.0.1, I would not expect all IPv6 traffic to pass the filter.

Is it useful to add a note to PSAMP-TECH?

>>> My instinct is that it should reject the UDP packet because it cannot
>>> provide a TCP flags value of 0.  An alternate filter could be set up to
>>> accept UDP packets.
>>>
>>> If we agree on that point, then how about a TCP flags filter that
>>> filtered on TCP flags being in the range 0x00 to 0xFF.  It would accept
>>> all values for the TCP flags field, but reject packets that didn't have
>>> the field.
>>
>> Then, we could place a property match filter in front of the Cache that
>> matches all fields of the Cache Layout with mask=0x00 (or start=0 and
>> end=infinity) to ensure that all fields are present.
> 
> Exactly.
> 
> 
>> However, I'm a little bit confused about the following paragraph in
>> PSAMP-TECH:
>>
>> 6.1 Property Match Filtering
>>
>>     ....
>>
>>     A packet is selected if Field=Value. Masks and ranges are only
>>     supported to the extent to which [RFC5102] allows them e.g. by
>>     providing explicit fields like the netmasks for source and
>>     destination addresses.
>>
>> Also, PSAMP-PROTOCOL does not allow to export a value range [start,
>> stop] in an Option :(
> 
> Yes, I know.  It's very difficult to export min/max/mask using IPFIX
> without defining new Information Elements for each field you want to
> filter on.

Hm, I do not think that defining min/max/mask IEs for every existing IE
is needed. I'm sure that a better solution can be found.

>> Note that the configuration data model is based in PSAMP-MIB where
>> "start", "stop" and "mask" are mentioned as parameters of property match
>> filtering. It seems that these parameters are outdated?
> 
> When we added the Filtering Interpretation Report in version 02 we
> didn't have min/max/mask either.  There's just no easy way to export
> this sort of think in IPFIX without defining three additional I.E.s per
> field.  Unless anyone can think of something?

Yes:
http://tools.ietf.org/html/draft-sommer-ipfix-mediator-ext-01

In my opinion, the current property match filtering specified in PSAMP
is too restrictive because it only covers simplistic fiters that are
rarely used in practice. Maybe it should be removed from the documents
until a better solution is found.

Cheers,
Gerhard

-- 
Dipl.-Ing. Gerhard Münz
Chair for Network Architectures and Services (I8)
Department of Informatics
Technische Universität München
Boltzmannstr. 3, 85748 Garching bei München, Germany
Phone:  [phone]       Fax: [phone]
E-mail: [e-mail]    WWW: http://www.net.in.tum.de/~muenz