Re: [IPFIX] Feedback: regarding draft-ietf-ipfix-mediation-protocol

[Benoit Claise <[e-mail]>]

Hi Rahul,

Thanks for your review.
See in line.
>
>
> Few comments.
>
>  1. Page 8:
>      1. The difference between "Intermediate Selection Process" and
>         "Intermediate Flow Selection Process" is not clear. Is the
>         first one selecting record purely on matching content (value
>         of the fields) in the record and the second one selecting on
>         matching attributes of the fields that are not part of the
>         record in *addition* to matching content in the record? An
>         example would help here.
>
Granted, this is difficult to understand from the definitions only. 
There is some history behind these two separate definitions. Anyway, you 
get it right from your message above.
I was thinking to add to a section 2.1 "Differences between Intermediate 
Selection Process and Intermediate Flow Selection Process" in the 
draft-ietf-ipfix-mediation-protocol draft. However, thinking about it 
some more, this section should really be done in 
draft-ietf-ipfix-flow-selection-tech-14, to avoid some more confusion.
There is already section 3. "Difference between Intermediate Flow 
Selection Process and Packet Selection". Some more text should be added 
on the difference between Intermediate Selection Process and 
Intermediate Flow Selection Process

When created, draft-ietf-ipfix-mediation-protocol will refer to that new 
section.

> 1.
>      1. Also in the example " e.g., Filteringonly records from a given
>         network to a given Collector" - Does "given network" means
>         "source-ip/source-prefix of the exporter"?.
>
It means matching the flow records to a certain prefix/AS/you-name-it, 
and exporting those matched flow records to an exporter.
See for example, section 6.1 in RFC 6183
This could be explained better in the new section in 
draft-ietf-ipfix-flow-selection-tech (See previous point)
>
> 1.
>  2. Page 13:
>      1. "Figure B" A typo? Should it be "Figure 3"?
>
Corrected.
>
> 1.
>
>
> General
>
>   * On correlation process – how to correlate, what cannot be
>     correlated, etc – is this out of scope of this draft? For example,
>     Mediator A receives metric N1 and N2 per 5-tuple from exporter X
>     and metric N3 and N4 per 5-tuple from exporter Y. Mediator A can
>     easily correlate and exporter N1, N2, N3 and N4 to another
>     collector C. If the key fields are not matching or one is subset
>     of other then data can either not be correlated or can be
>     represented in a different way. Most likely all of this out of
>     scope of this document but just wanted to check.
>
Yes, it's out of scope.
The specific techniques are described/specified in the respective drafts.

    Documents specifying the operations of specific Intermediate
    Processes cover the operation of these Processes within the IPFIX
    Mediator framework, and comply with the specifications given in this
    document; they may additionally specify the operation of the process
    independently, outside the context of an IPFIX Mediator, when this is
    appropriate.  The details of specific Intermediate Processes, when
    these have additional export specifications (e.g., metadata about the
    intermediate processing conveyed through IPFIX Options Templates),
    are each treated in their own document.  As of today, these documents
    are:

    1.  "IP Flow Anonymization Support", [RFC6235  <http://tools.ietf.org/html/rfc6235>], which describes
        Anonymization techniques for IP flow data and the export of
        Anonymized data using the IPFIX protocol.

    2.  "Flow Selection Techniques" [I-D.ietf-ipfix-flow-selection-tech  <http://tools.ietf.org/html/draft-ietf-ipfix-mediation-protocol-04#ref-I-D.ietf-ipfix-flow-selection-tech>],
        which describes the process of selecting a subset of Flows from
        all Flows observed at an Observation Point, the flow selection
        motivations, and some specific flow selection techniques.

    3.  "Exporting Aggregated Flow Data using IP Flow Information Export"
        [I-D.ietf-ipfix-a9n  <http://tools.ietf.org/html/draft-ietf-ipfix-mediation-protocol-04#ref-I-D.ietf-ipfix-a9n>] which describes Aggregated Flow export
        within the framework of IPFIX Mediators and defines an
        interoperable, implementation-independent method for Aggregated
        Flow export.

    This document specifies the IP Flow Information Export (IPFIX)
    protocol specific to Mediation, i.e. the specifications that all
    Intermediate Processes type must comply to.  Some extra
    specifications might be required per Intermediate Process type (In
    which case, the Intermediate Process specific document would cover
    those).



Note that http://tools.ietf.org/html/draft-ietf-ipfix-a9n-08 mentions 
correlation, as a special case of aggregation. However, it can be very 
complex, and mainly application specific, if we go beyond the simplest 
case. So we mentioned in section 4.2.1:

    The exact steps performed to correlate and normalize flows in this
    step are application-, implementation-, and deployment-specific, and
    will not be further specified in this document.


Regards, Benoit (as a contributor)