Re: [IPFIX] WGLC for draft-ietf-ipfix-text-adt-00.txt
Paul Aitken <paitken@cisco.com> Tue, 28 January 2014 14:34 UTC
Return-Path: <paitken@cisco.com>
X-Original-To: ipfix@ietfa.amsl.com
Delivered-To: ipfix@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 308021A0420 for <ipfix@ietfa.amsl.com>; Tue, 28 Jan 2014 06:34:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.669
X-Spam-Level:
X-Spam-Status: No, score=-6.669 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FF_IHOPE_YOU_SINK=2.166, HTML_MESSAGE=0.001, J_CHICKENPOX_37=0.6, J_CHICKENPOX_55=0.6, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t-UjeH7jmkqy for <ipfix@ietfa.amsl.com>; Tue, 28 Jan 2014 06:33:57 -0800 (PST)
Received: from aer-iport-1.cisco.com (aer-iport-1.cisco.com [173.38.203.51]) by ietfa.amsl.com (Postfix) with ESMTP id ACE021A041B for <ipfix@ietf.org>; Tue, 28 Jan 2014 06:33:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=57921; q=dns/txt; s=iport; t=1390919633; x=1392129233; h=message-id:date:from:mime-version:to:subject:references: in-reply-to; bh=ab5XAaKW6UDAxBZtvPrrrk09jZ5gYKUfj35hDOgizFw=; b=drFZYInQ0boSCLxtAsWTi0mNreLMnL+8VsdFA4OEnwLV7gDifE9c6zlj 829R9C+R9UWYWtmF9rq9OrpMjrgHY79zm6nHE8dPdStgboJHStHiIIo0a mUWBdb/s1JqG+9GbNsNMakRDh+eCq8jMVfJSjRuLMikOs2ytuseUHOggr g=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: Ag0FADK/51KQ/khR/2dsb2JhbABQCoMMOL0ugRAWdIIlAQEBAwEaAV0GCQILEg8WAQENCQMCAQIBCS4OBgEMBgIBAQWHdAgNyV0XBI4OCgEGBAcBJDOEOASUQINogTKFFotXgy2BaAkX
X-IronPort-AV: E=Sophos;i="4.95,736,1384300800"; d="scan'208,217";a="4304524"
Received: from ams-core-1.cisco.com ([144.254.72.81]) by aer-iport-1.cisco.com with ESMTP; 28 Jan 2014 14:33:51 +0000
Received: from cisco.com (mrwint.cisco.com [64.103.70.36]) by ams-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id s0SEXo2L010890 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 28 Jan 2014 14:33:51 GMT
Received: from [10.147.1.39] (dhcp-10-147-1-39.cisco.com [10.147.1.39]) by cisco.com (8.14.4+Sun/8.8.8) with ESMTP id s0SEXo9c013810; Tue, 28 Jan 2014 14:33:50 GMT
Message-ID: <52E7BFCE.8080701@cisco.com>
Date: Tue, 28 Jan 2014 14:33:50 +0000
From: Paul Aitken <paitken@cisco.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: Brian Trammell <trammell@tik.ee.ethz.ch>, "ipfix@ietf.org" <ipfix@ietf.org>
References: <9AB93E4127C26F4BA7829DEFDCE5A6E868910E0D@DAPHNIS.office.hd>
In-Reply-To: <9AB93E4127C26F4BA7829DEFDCE5A6E868910E0D@DAPHNIS.office.hd>
Content-Type: multipart/alternative; boundary="------------080001010103000305030000"
Subject: Re: [IPFIX] WGLC for draft-ietf-ipfix-text-adt-00.txt
X-BeenThere: ipfix@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IPFIX WG discussion list <ipfix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipfix>, <mailto:ipfix-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipfix/>
List-Post: <mailto:ipfix@ietf.org>
List-Help: <mailto:ipfix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipfix>, <mailto:ipfix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Jan 2014 14:34:03 -0000
Dear all, Here's a review of draft-ietf-ipfix-text-adt-00. P. > > > IPFIX Working Group B. Trammell > Internet-Draft ETH Zurich > Intended status: Informational January 20, 2014 > Expires: July 24, 2014 > > > Textual Representation of IPFIX Abstract Data Types > draft-ietf-ipfix-text-adt-00.txt > > Abstract > > This document defines UTF-8 representations for IPFIX abstract data > types, to support interoperable usage of the IPFIX Information > Elements with protocols based on textual encodings. > > Status of This Memo > > This Internet-Draft is submitted in full conformance with the > provisions of BCP 78 and BCP 79. > > Internet-Drafts are working documents of the Internet Engineering > Task Force (IETF). Note that other groups may also distribute > working documents as Internet-Drafts. The list of current Internet- > Drafts is at http://datatracker.ietf.org/drafts/current/. > > Internet-Drafts are draft documents valid for a maximum of six months > and may be updated, replaced, or obsoleted by other documents at any > time. It is inappropriate to use Internet-Drafts as reference > material or to cite them other than as "work in progress." > > This Internet-Draft will expire on July 24, 2014. > > Copyright Notice > > Copyright (c) 2014 IETF Trust and the persons identified as the > document authors. All rights reserved. > > This document is subject to BCP 78 and the IETF Trust's Legal > Provisions Relating to IETF Documents > (http://trustee.ietf.org/license-info) in effect on the date of > publication of this document. Please review these documents > carefully, as they describe your rights and restrictions with respect > to this document. Code Components extracted from this document must > include Simplified BSD License text as described in Section 4.e of > the Trust Legal Provisions and are provided without warranty as > described in the Simplified BSD License. > > > > > > Trammell Expires July 24, 2014 [Page 1] > > Internet-Draft IPFIX Text Types January 2014 > > > Table of Contents > > 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 > 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 > 3. Identifying Information Elements . . . . . . . . . . . . . . 3 > 4. Data Type Encodings . . . . . . . . . . . . . . . . . . . . . 3 > 4.1. octetArray . . . . . . . . . . . . . . . . . . . . . . . 3 > 4.2. unsigned8, unsigned16, unsigned32, and unsigned64 . . . . 4 > 4.3. signed8, signed16, signed32, and signed64 . . . . . . . . 4 > 4.4. float32 and float64 . . . . . . . . . . . . . . . . . . . 5 > 4.5. boolean . . . . . . . . . . . . . . . . . . . . . . . . . 6 > 4.6. macAddress . . . . . . . . . . . . . . . . . . . . . . . 6 > 4.7. string . . . . . . . . . . . . . . . . . . . . . . . . . 6 > 4.8. dateTime* . . . . . . . . . . . . . . . . . . . . . . . . 7 > 4.9. ipv4Address . . . . . . . . . . . . . . . . . . . . . . . 7 > 4.10. ipv6Address . . . . . . . . . . . . . . . . . . . . . . . 8 > 4.11. basicList, subTemplateList, and subTemplateMultiList . . 8 > 5. Security Considerations . . . . . . . . . . . . . . . . . . . 8 > 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 > 7. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 > 7.1. Normative References . . . . . . . . . . . . . . . . . . 8 > 7.2. Informative References . . . . . . . . . . . . . . . . . 9 > Appendix A. Example . . . . . . . . . . . . . . . . . . . . . . 9 > Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 11 > > 1. Introduction > > The IPFIX Information Model, as defined by the IANA IPFIX Information > Element Registry [iana-ipfix-assignments], provides a rich set of > Information Elements for description of information aboutnetwork > entities and network traffic data,and abstract data types for these > Information Elements. The IPFIX Protocol Specification [RFC7011], in Perhaps, though it's not limited just to networks ;-) You're suggesting that the IANA registry is the reference for the ADTs, rather than 7012? 7012 isn't mentioned until section 4. > turn, defines a big-endian binary encoding for these abstract data > types suitable for use with the IPFIX Protocol. +xref for the protocol spec? > However, present and future operations and management protocols and > applications may use textual encodings, and generic framing and > structure as in JSON or XML. A definition of canonical textual > encodings for the IPFIX abstract data types would allow this set of > Information Elements to be used for such applications, and for these > applications to interoperate with IPFIX applications at the > Information Element definition level. > > Note that templating or other mechanisms for data description for > such applications and protocols are application specific, and > therefore out of scope for this document: only Information Element > identification and data value representation are defined here. > > > > > Trammell Expires July 24, 2014 [Page 2] > > Internet-Draft IPFIX Text Types January 2014 > > > 2. Terminology > > Capitalized terms defined in the IPFIX Protocol Specification > [RFC7011] and the IPFIX Information Model [RFC7012] are used in this > document as defined in those documents. In addition, this document > defines the following terminology for its own use: > > Enclosing Context > Textual representation of IPFIX data values is applied to use the > IPFIX Information Model within some existing textual format (e.g. > XML, JSON). This outer format is referred to as the Enclosing I can't parse that. Should it be, "A textual representation ..." ? > Context within this document. Enclosing Contexts define escaping > and quoting rules for represented data values. > > 3. Identifying Information Elements > > The IPFIX Information Element Registry [iana-ipfix-assignments] > defines a set of Information Elementsand numbered by Information - "and" > Element Identifiers, and named for human-readability. These > Information Element Identifiers are meant for use with the IPFIX > protocol, and have little meaning when applying the IPFIX Information > Element Registry to textual representations. > > Instead, applications using textual representations of Information > ElementsSHOULD use Information Element names to identify them; see > Appendix A for examples illustrating this principle. It's a SHOULD rather than a MUST. Would the IE identifier numbers be equally as valid? > > 4. Data Type Encodings > > Each subsection of this section defines a textual encoding for the > abstract data types defined in [RFC7012]. This section uses ABNF > [RFC5234], including the Core Rules inAppendix B, to describe the > format of textual representations of IPFIX abstract data types. It's unclear whether that's Appendix B of this document or of 5234. > > 4.1. octetArray > > If the Enclosing Context defines a representation for binary objects, > that representation SHOULD be used. > > Otherwise,since the goal of textual representation of Information > Elements is readability over compactness, the values of Information This goal should be mentioned much earlier! > Elements of the octetArray data type are represented as a string of > pairs of hexadecimal digits, one pair per byte, in the order the > bytes would appear on the wire were the octetArray encoded directly > in IPFIX per [RFC7011]. Whitespace may occur between any pair of > digits to assist in human readability of the string, but is not > necessary, and must be disregarded by any process reading the string. > In ABNF: > > > > Trammell Expires July 24, 2014 [Page 3] > > Internet-Draft IPFIX Text Types January 2014 > > > hex-octet = 2HEXDIGIT > > octetarray = 1* (hex-octet [WSP]) There's an implicit assumption of 8-bit bytes here. An alternative encoding of "0b [10]*" (eg, 0b10101100) might sometimes be useful, eg for bitflags > 4.2. unsigned8, unsigned16, unsigned32, and unsigned64 > > If the Enclosing Context defines a representation for unsigned > integers, that representation SHOULD be used. > > In the special case that the unsigned Information Element has > identifier semantics, and refers to a set of codepoints, either in an > external registry, a sub-registry, or directly in the description of > the Information Element, then the name or short description for that > codepoint MAY be used to improve readability. > > Otherwise, the values of Information Elements of an unsigned integer > type may be represented either as unprefixed base-10 (decimal) > strings, or as base-16 (hexadecimal) strings prefixed by '0x'; in > ABNF: > > unsigned = 1*DIGIT / '0x' 1*HEXDIG > > Leading zeroes are allowed in either encoding, and do not signify > base-8 (octal) encoding. > > The encoded value must be in range for the corresponding abstract > data type or Information Element.Out of range values should be > interpreted as clipped to the implicit range for the Information That would be another use case for the unobserved-fields draft: not available, insufficient data, or value is out of range. > Element as defined by the abstract data type, or to the explicit > range of the Information Element if defined. Minimum and maximum > values for abstract data types are shown in Table 1 below. > > +------------+---------+----------------------+ > | type | minimum | maximum | > +------------+---------+----------------------+ > | unsigned8 | 0 | 255 | > | unsigned16 | 0 | 65536 | > | unsigned32 | 0 | 4294967295 | > | unsigned64 | 0 | 18446744073709551615 | > +------------+---------+----------------------+ > > Table 1: Ranges for unsigned abstract data types Consider comma-ising the values to make them easier to read? > > 4.3. signed8, signed16, signed32, and signed64 > > If the Enclosing Context defines a representation for signed > integers, that representation SHOULD be used. > > > > > Trammell Expires July 24, 2014 [Page 4] > > Internet-Draft IPFIX Text Types January 2014 > > > Otherwise, the values of Information Elements of signed integer types > should be represented as optionally-prefixed base-10 (decimal) > strings. In ABNF: > > sign = "+" / "-" > > signed = [sign] 1*DIGIT > > If the sign is omitted, it is assumed to be positive. Leading zeroes > are allowed, and do not signify base-8 (octal) encoding. > > The encoded value must be in range for the corresponding abstract > data type or Information Element. Out of range values should be > interpreted as clipped to the implicit range for the Information > Element as defined by the abstract data type, or to the explicit > range of the Information Element if defined. Minimum and maximum > values for abstract data types are shown in Table 2 below. > > +----------+----------------------+----------------------+ > | type | minimum | maximum | > +----------+----------------------+----------------------+ > | signed8 | -128 | +127 | > | signed16 | -32768 | +32767 | > | signed32 | -2147483648 | +2147483647 | > | signed64 | -9223372036854775808 | +9223372036854775807 | > +----------+----------------------+----------------------+ > > Table 2: Ranges for signed abstract data types Are +0, 0, and -0 all valid? > > 4.4. float32 and float64 > > If the Enclosing Context defines a representation for floating point > numbers, that representation SHOULD be used. > > Otherwise, the values of Information Elements of float32 or float64 > types are represented as an optionally sign-prefixed, optionally > base-10 exponent-suffixed, floating point decimal number. In ABNF: > > sign = "+" / "-" > > exponent = 'e' 1*3DIGIT > > right-decimal = '.' 0*DIGIT > > mantissa = 1*DIGIT [right-decimal] > > float = [sign] mantissa [exponent] > > > > > Trammell Expires July 24, 2014 [Page 5] > > Internet-Draft IPFIX Text Types January 2014 > > > The expressed value is ( mantissa * 10 ^ exponent ). If the sign is > omitted, it is assumed to be positive. If the exponent is omitted, > it is assumed to be zero. Leading zeroes may appear in the mantissa > and/or the exponent. > > Minimum and maximum values for abstract data types are shown in > Table3below. Typo, "3 below". > > +---------+----------------+----------------+ > | type | minimum abs(x) | maximum abs(x) | > +---------+----------------+----------------+ > | float32 | 5.877e-39 | 3.403e38 | > | float64 | 1.1125e-308 | +1.798e308 | > +---------+----------------+----------------+ > > Table 3: Ranges for floating-point abstract data types It's not clear how you got these values. The minimum is surely zero, and the encoding doesn't allow negative exponents. I agree with the maximums. > 4.5. boolean > > If the Enclosing Context defines a representation for boolean values, > that representation SHOULD be used. > > Otherwise, a true boolean value should be represented with the > literal string 1, and a false boolean value with the literal string > 0. In ABNF: > > boolean-yes = "1" > > boolean-no = "0" > > boolean = boolean-yes / boolean-no Why 1/0 rather than true/false or yes/no ? > > 4.6. macAddress > > MAC addresses are represented as IEEE 802 MAC-48 addresses, > hexadecimal bytes, most significant byte first, separated by colons. > In ABNF, using the hex-octet production from Section 4.1: > > macaddress = hex-octet 5( ":" hex-octet ) > > 4.7. string > > As Information Elements of the string type are simply UTF-8 encoded > strings, they are represented directly, subject to the escaping and > encoding rules of the Enclosing Context. If the Enclosing Context > cannot natively represent UTF-8 characters, the escaping facility > provided by the Enclosing Context must be used for non-representable > characters. Additionally, strings containing characters reserved in > > > > Trammell Expires July 24, 2014 [Page 6] > > Internet-Draft IPFIX Text Types January 2014 > > > the Enclosing Context (e.g. markup characters, quotes) must be > escaped or quoted according to the rules of the Enclosing Context. > > 4.8. dateTime* > > Timestamp abstract data types are represented generally as in > [RFC3339], with two important differences. First, all IPFIX > timestamps are expressed in terms of UTC, so textual representations > of these Information Elements areexplictly in UTC as well. Time Typo, "explicitly". > zone offsets are therefore not required or supported. Second, there > are four timestamp abstract data types, separated by the precision > which they can express. Fractional seconds must be omitted in > dateTimeSeconds, expressed in milliseconds in dateTimeMilliseconds, > and so on. > > In ABNF, taken from [RFC3339] and modified: > > date-fullyear = 4DIGIT > date-month = 2DIGIT ; 01-12 > date-mday = 2DIGIT ; 01-28, 01-29, 01-30, 01-31 > time-hour = 2DIGIT ; 00-23 > time-minute = 2DIGIT ; 00-59 > time-second = 2DIGIT ; 00-58, 00-59, 00-60 > time-msec = "." 3*DIGIT > time-usec = "." 6*DIGIT > time-nsec = "." 9*DIGIT > partial-time = time-hour ":" time-minute ":" time-second > > datetimeseconds = full-date "T" partial-time > datetimemilliseconds = full-date "T" partial-time "." time-msec > datetimemicroseconds = full-date "T" partial-time "." time-usec > datetimenanoseconds = full-date "T" partial-time "." time-nsec > > 4.9. ipv4Address > > IP version 4 addresses are represented in dotted-quad format, most- > significant-byte first, as it would in a Uniform Resource Identifier > [RFC3986]; the ABNF for an IPv4 address is taken from [RFC3986] and > reproduced below: > > dec-octet = DIGIT ; 0-9 > / %x31-39 DIGIT ; 10-99 > / "1" 2DIGIT ; 100-199 > / "2" %x30-34 DIGIT ; 200-249 > / "25" %x30-35 ; 250-255 > > ipv4address = dec-octet 3("." dec-octet) Note that the whitespace format here is different from all other uses in the document (eg, macaddress and ipv6address). For consistency it should be 3( "." dec-octet ) > > > > > Trammell Expires July 24, 2014 [Page 7] > > Internet-Draft IPFIX Text Types January 2014 > > > 4.10. ipv6Address > > IP version 6 addresses are represented as in section 2.2 of > [RFC4291], as updated by section 4 of [RFC5952]. The ABNF for an > IPv6 address is taken from [RFC3986] and reproduced below: > > ls32 = ( h16 ":" h16 ) / IPv4address > ; least-significant 32 bits of address > h16 = 1*4HEXDIG > ; 16 bits of address represented in hexadecimal > ; zeroes to suppressed as in RFC 5952 > > ipv6address = 6( h16 ":" ) ls32 > / "::" 5( h16 ":" ) ls32 > / [ h16 ] "::" 4( h16 ":" ) ls32 > / [ *1( h16 ":" ) h16 ] "::" 3( h16 ":" ) ls32 > / [ *2( h16 ":" ) h16 ] "::" 2( h16 ":" ) ls32 > / [ *3( h16 ":" ) h16 ] "::" h16 ":" ls32 > / [ *4( h16 ":" ) h16 ] "::" ls32 > / [ *5( h16 ":" ) h16 ] "::" h16 > / [ *6( h16 ":" ) h16 ] "::" > > 4.11. basicList, subTemplateList, and subTemplateMultiList > > These abstract data types, defined for IPFIX Structured Data > [RFC6313], do not represent actual data types; they are instead > designed to provide a mechanism by which complex structure can be > represented in IPFIX below the template level. It is assumed that > protocols using textual Information Element representation will > provide their own structure. Therefore, Information Elements of > these Data Types MUST NOT be used in textual representations. > > 5. Security Considerations > > This document does not present any additional security measures > beyond those presented by [RFC7011]. security considerations != security measures. The text usually reads something like, "No additional security considerations are introduced in this document. The same security considerations as for the IPFIX protocol [RFC7011] apply." > > 6. IANA Considerations > > This document has no considerations for IANA. > > 7. References > > 7.1. Normative References > > [RFC3339] Klyne, G., Ed. and C. Newman, "Date and Time on the > Internet: Timestamps", RFC 3339, July 2002. > > > > > Trammell Expires July 24, 2014 [Page 8] > > Internet-Draft IPFIX Text Types January 2014 > > > [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform > Resource Identifier (URI): Generic Syntax", STD 66, RFC > 3986, January 2005. > > [RFC4291] Hinden, R. and S. Deering, "IP Version 6 Addressing > Architecture", RFC 4291, February 2006. > > [RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax > Specifications: ABNF", STD 68, RFC 5234, January 2008. > > [RFC5952] Kawamura, S. and M. Kawashima, "A Recommendation for IPv6 > Address Text Representation", RFC 5952, August 2010. > > [RFC7011] Claise, B., Trammell, B., and P. Aitken, "Specification of > the IP Flow Information Export (IPFIX) Protocol for the > Exchange of Flow Information", STD 77, RFC 7011, September > 2013. > > [iana-ipfix-assignments] > Internet Assigned Numbers Authority, , "IP Flow > Information Export Information Elements > (http://www.iana.org/assignments/ipfix/ipfix.xml)", > November 2012. > > 7.2. Informative References > > [RFC6313] Claise, B., Dhandapani, G., Aitken, P., and S. Yates, > "Export of Structured Data in IP Flow Information Export > (IPFIX)", RFC 6313, July 2011. > > [RFC7012] Claise, B. and B. Trammell, "Information Model for IP Flow > Information Export (IPFIX)", RFC 7012, September 2013. > > [RFC7013] Trammell, B. and B. Claise, "Guidelines for Authors and > Reviewers of IP Flow Information Export (IPFIX) > Information Elements", BCP 184, RFC 7013, September 2013. > > Appendix A. Example > > In this section, we examine an IPFIX Template and a Data Record > defined by that Template, and show how that Data Record would be > represented in JSON according to the specification in this document. > Note that this is specifically NOT a recommendation for a particular > representation, merely an illustration of the encodings in this > document. > > Figure 1 shows a Template in IESpec format as defined in section 10.1 > of [RFC7013]. A Message containing this Template and a Data Record > > > > Trammell Expires July 24, 2014 [Page 9] > > Internet-Draft IPFIX Text Types January 2014 > > > is shown in Figure 2, and a corresponding JSON Object using the text > format defined in this document is shown in Figure 3. > > flowStartMilliseconds(152)<dateTimeMilliseconds>[8] > flowEndMilliseconds(153)<dateTimeMilliseconds>[8] > octetDeltaCount(1)<unsigned64>[4] > packetDeltaCount(2)<unsigned64>[4] > sourceIPv6Address(27)<ipv4Address>[4]{key} > destinationIPv6Address(28)<ipv4Address>[4]{key} > sourceTransportPort(7)<unsigned16>[2]{key} > destinationTransportPort(11)<unsigned16>[2]{key} > protocolIdentifier(4)<unsigned8>[1]{key} > tcpControlBits(6)<unsigned8>[1] > flowEndReason(136)<unsigned8>[1] > > Figure 1: Sample flow template (IPFIX) Perhaps, "Sample IPFIX flow template in IESpec format"? Consider dropping the "IPFIX", since it's almost meaningless here. > > 1 2 3 4 5 6 > 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ > | 0x000a | length 135 | export time 1352140263 | msg > | sequence 0 | domain 1 | hdr > | SetID 2 | length 52 | tid 256 | fields 11 | tmpl > | IE 152 | length 8 | IE 153 | length 8 | set > | IE 1 | length 4 | IE 2 | length 4 | > | IE 27 | length 16 | IE 28 | length 16 | > | IE 7 | length 2 | IE 11 | length 2 | > | IE 4 | length 1 | IE 6 | length 1 | > | IE 136 | length 1 | SetID 256 | length 83 | data > | start time 1352140261135 | set > | end time 1352140262880 | > | octets 195383 | packets 88 | > | sip6 | > | 2001:0db8:000c:1337:0000:0000:0000:0002 | > | dip6 | > | 2001:0db8:000c:1337:0000:0000:0000:0003 | > | sp 80 | dp 32991 | prt 6 | tcp 19| fe 3 | > +-------------------------------------------------------+ The figure is 63 chars wide rather than 64; each column is 15 chars wide. It might be clearer to draw the usual 1-bit-per-column, 32-bit-wide figure. > Figure 2: IPFIX message containing sample flow Is it still an IPFIX message? Should message be capitalised? > > > > > > > > > > > > Trammell Expires July 24, 2014 [Page 10] > > Internet-Draft IPFIX Text Types January 2014 > > > { > "flowStartMilliseconds": "2012-11-05T18:31:01.135", > "flowEndMilliseconds": "2012-11-05T18:31:02.880", > "octetDeltaCount": 195383, > "packetDeltaCount": 88, > "sourceIPv6Address": "2001:db8:c:1337::2", > "destinationIPv6Address": "2001:db8:c:1337::3", > "sourceTransportPort": 80, > "destinationTransportPort": 32991, > "protocolIdentifier": "tcp", > "tcpControlBits": 19, > "flowEndReason": 3 > } > > Figure 3: JSON object containing sample flow Note that the quoting, and colon/comma format are JSON specific. P. > > Author's Address > > Brian Trammell > Swiss Federal Institute of Technology Zurich > Gloriastrasse 35 > 8092 Zurich > Switzerland > > Phone: +41 44 632 70 13 > Email: trammell@tik.ee.ethz.ch > > > > > > > > > > > > > > > > > > > > > > > > > > Trammell Expires July 24, 2014 [Page 11]
- [IPFIX] WGLC for draft-ietf-ipfix-text-adt-00.txt Juergen Quittek
- Re: [IPFIX] WGLC for draft-ietf-ipfix-text-adt-00… Paul Aitken
- Re: [IPFIX] WGLC for draft-ietf-ipfix-text-adt-00… Andrew Feren
- Re: [IPFIX] WGLC for draft-ietf-ipfix-text-adt-00… Brian Trammell
- Re: [IPFIX] WGLC for draft-ietf-ipfix-text-adt-00… Paul Aitken
- Re: [IPFIX] WGLC for draft-ietf-ipfix-text-adt-00… Brian Trammell