Re: [IPFIX] new IPFIX fields for traffic classification

Hi, Paul,

A suggestion: if these are encoded in strings, why not specify a delimiter-separated ID space and have a single flowClassification string with this delimiter separated space.

IE "flowClassification" = "email.gmail", "ftp-group.ftp-data" and so on?

This would allow sub-sub-sub categories, as well ("voip.skype.datachannel.noudp.v5")

Cheers,

Brian

On Jun 13, 2011, at 5:04 PM, Paul Aitken wrote:

> Dear IPFIX experts,
> 
> Cisco would like to define some new IPFIX fields for traffic classification so we can attach classification information to each exported flow.
> 
> Unlike many other fields, we don't propose to encode these fields numerically, so the usual option table mapping numbers to names won't be necessary.
> 
> Instead, these fields would contain strings. Each field would be extensible so new strings could be added in future. In fact, we expect this to be a regular occurrence as new classifications are defined.
> 
> However, it's not desirable - and perhaps not even possible - to list all the classification values. So there won't be any complete or exhaustive value list for any of these fields, and IANA won't maintain a registry for each field.
> 
> This is similar to the existing wlanSSID, interfaceName and VRFname fields: while we can define the purpose of these fields, the values cannot be listed exhaustively. These can only be defined as generic strings, and no attempt should be made to register all the possible values.
> 
> While we've already defined enterprise-specific fields, we feel these fields will be generally useful to the community. Nevil has asked for discussion before approving our request for new IANA field allocations.
> 
> So, please discuss... ;-)
> 
> 
> Specifically, the fields which we'd like to define are:
> 
>    * Category = a protocol attribute which broadly groups a set of protocols having the same characteristic.
>        e.g. file-sharing, email.
> 
>    * Sub-category = a second level category attribute
>        e.g. p2p-file-transfer, gmail
> 
>    * Application-group = a protocol attribute which groups a set of protocols belonging to same application.
>        e.g. ftp-group
> 
> 
> Cheers,
> P.
> 
> _______________________________________________
> IPFIX mailing list
> IPFIX@ietf.org
> https://www.ietf.org/mailman/listinfo/ipfix