Re: [IPFIX] Export of long lived flow information

Paul Aitken <paitken@cisco.com> Mon, 29 October 2012 11:56 UTC

Return-Path: <paitken@cisco.com>
X-Original-To: ipfix@ietfa.amsl.com
Delivered-To: ipfix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 703C821F85FA for <ipfix@ietfa.amsl.com>; Mon, 29 Oct 2012 04:56:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -8.595
X-Spam-Level:
X-Spam-Status: No, score=-8.595 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8, TRACKER_ID=2.003]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9nSzlLpu1HWG for <ipfix@ietfa.amsl.com>; Mon, 29 Oct 2012 04:56:33 -0700 (PDT)
Received: from ams-iport-3.cisco.com (ams-iport-3.cisco.com [144.254.224.146]) by ietfa.amsl.com (Postfix) with ESMTP id 5557221F85E4 for <ipfix@ietf.org>; Mon, 29 Oct 2012 04:56:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4425; q=dns/txt; s=iport; t=1351511793; x=1352721393; h=message-id:date:from:mime-version:to:cc:subject: references:in-reply-to; bh=jaCxUv1zijp5Qhl/3D8kKl9JphtnsgBRbSm6cmxVLuQ=; b=VQ5FomhP3gCf/z1nsjpzOnNhvNqgp9CfugPK3sI1Jfws8CYyykPgBnNp mhwNCSDIko+jaBdM6FV/ZjTWuScPzTQZMTs+g+smE4A/I/5CUE4Uh+FMY wyt5ifvFbbG5yU4oIYbXk7Hcb5HzWAUZ88uiuQ1E6W9Renqm+R0CFx5X9 8=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AgQGAKdtjlCQ/khN/2dsb2JhbABEi3e2a4EIgh8BAQQSAWUBEAsEHRYPCQMCAQIBRRMBBwEBHodknCufTI8ugyQDlXSFaYhugWuCbw
X-IronPort-AV: E=Sophos;i="4.80,671,1344211200"; d="scan'208,217";a="9173434"
Received: from ams-core-4.cisco.com ([144.254.72.77]) by ams-iport-3.cisco.com with ESMTP; 29 Oct 2012 11:56:32 +0000
Received: from [10.55.95.150] (dhcp-10-55-95-150.cisco.com [10.55.95.150]) by ams-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id q9TBuUWr015355; Mon, 29 Oct 2012 11:56:30 GMT
Message-ID: <508E6EF2.8000801@cisco.com>
Date: Mon, 29 Oct 2012 11:56:34 +0000
From: Paul Aitken <paitken@cisco.com>
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:15.0) Gecko/20120912 Thunderbird/15.0.1
MIME-Version: 1.0
To: ipfix@ietf.org
References: <CCAF4E37.114EE%andrewf@plixer.com>
In-Reply-To: <CCAF4E37.114EE%andrewf@plixer.com>
Content-Type: multipart/alternative; boundary="------------000300030107040209010001"
Cc: John Court <johnwcrt@au1.ibm.com>
Subject: Re: [IPFIX] Export of long lived flow information
X-BeenThere: ipfix@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: IPFIX WG discussion list <ipfix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipfix>, <mailto:ipfix-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipfix>
List-Post: <mailto:ipfix@ietf.org>
List-Help: <mailto:ipfix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipfix>, <mailto:ipfix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 29 Oct 2012 11:56:34 -0000

Should we change "this Flow" to "accounted in this Flow Record" 
throughout the registry?

I counted 67 instances. eg:


octetDeltaCount

          The number of octets since the previous report (if any)
          in incoming packets for this Flow at the Observation Point.


tcpControlBits

          TCP control bits observed for packets of this Flow.
          The information is encoded in a set of bit fields.
          For each TCP control bit, there is a bit in this
          set.  A bit is set to 1 if any observed packet of this
          Flow has the corresponding TCP control bit set to 1.
          A value of 0 for a bit indicates that the corresponding
          bit was not set in any of the observed packets
of this Flow.


flowDurationMilliseconds

          The difference in time between the first observed packet
of this Flow and the last observed packet of this Flow.


ingressInterface

            The index of the IP interface where packets of this Flow
            are being received.


egressInterface

            The index of the IP interface where packets of
            this Flow are being sent.

P.