[IPFIX] R: New AD review of draft-ietf-ipfix-flow-selection-tech-10.txt

["Salvatore D'Antonio" <[e-mail]>]

Dear Benoit,

 

The new version of the Internet Draft on Flow Selection Techniques has been
published.

 

Answers to your comments inline.

 

Best regards,

 

Salvatore

 

Da: Benoit Claise [mailto:[e-mail]] 
Inviato: venerdì 1 giugno 2012 12:38
A: [e-mail]; [e-mail]
Cc: [e-mail]
Oggetto: New AD review of draft-ietf-ipfix-flow-selection-tech-10.txt

 

Dear authors,

I'm performing the (new) AD review of
draft-ietf-ipfix-flow-selection-tech-10.txt
Lucky you, an extra pair of eyes specifically looking at your draft 

If some points have been discussed already on the mailing list, let me know.
I have to admit that I have not been following the latest iterations of this
draft.

IMHO, this document needs some more work... 
I don't think that this document is really in line with the other
Intermediate Processes documents: 
    http://tools.ietf.org/html/rfc6235
    http://tools.ietf.org/html/draft-ietf-ipfix-a9n-03
Note that I might have some more comments once all the points in this email
are addressed, as there are many ;-)
However, I'm available for a conf. call to clarify my points if you want to 

See in-line. 




Internet Engineering Task Force                             S. D'Antonio 
Internet-Draft                                      University of Napoli 
Intended status: Standards Track                            "Parthenope" 
Expires: October 25, 2012                                       T. Zseby 
                                                         CAIDA/FhG FOKUS 
                                                                C. Henke 
                                          Tektronix Communication Berlin 
                                                               L. Peluso 
                                                    University of Napoli 
                                                          April 23, 2012 


                       Flow Selection Techniques 
              draft-ietf-ipfix-flow-selection-tech-11.txt 

Abstract 

   Flow selection is the process of selecting a subset of flows from all 
   observed flows.  The Flow Selection Process may be located at an 
   observation point, or on an IPFIX Mediator.  Flow selection reduces 
   the effort of post-processing flow data and transferring Flow 
   Records.  This document describes motivations for flow selection and 
   presents flow selection techniques.  It provides an information model 
   for configuring flow selection techniques and discusses what 
   information about a flow selection process should be exported. 

- Be consistent with terms capitalization. Flow, Observation Point, for
example, are not capitalized in the abstract

 

Done.


The following paragraph is good and consistent with the other IPFIX
documents, but make sure you include all the terms that you need.

   This document is consistent with the terminology introduced in
   [RFC5101], [RFC5470], [RFC5475] and [RFC3917].  As in [RFC5101] and
   [RFC5476], the first letter of each IPFIX-specific and PSAMP-specific
   term is capitalized along with the flow selection specific terms
   defined here.


Requirements Language 

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 
   document are to be interpreted as described in RFC 2119 [RFC2119]. 

Status of this Memo 

   This Internet-Draft is submitted in full conformance with the 
   provisions of BCP 78 and BCP 79. 

   Internet-Drafts are working documents of the Internet Engineering 
   Task Force (IETF).  Note that other groups may also distribute 
   working documents as Internet-Drafts.  The list of current Internet- 
   Drafts is at http://datatracker.ietf.org/drafts/current/. 

   Internet-Drafts are draft documents valid for a maximum of six months 
   and may be updated, replaced, or obsoleted by other documents at any 
   time.  It is inappropriate to use Internet-Drafts as reference 
   material or to cite them other than as "work in progress." 

   This Internet-Draft will expire on October 25, 2012. 



D'Antonio, et al.       Expires October 25, 2012                [Page 1] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


Copyright Notice 

   Copyright (c) 2012 IETF Trust and the persons identified as the 
   document authors.  All rights reserved. 

   This document is subject to BCP 78 and the IETF Trust's Legal 
   Provisions Relating to IETF Documents 
   (http://trustee.ietf.org/license-info) in effect on the date of 
   publication of this document.  Please review these documents 
   carefully, as they describe your rights and restrictions with respect 
   to this document.  Code Components extracted from this document must 
   include Simplified BSD License text as described in Section 4.e of 
   the Trust Legal Provisions and are provided without warranty as 
   described in the Simplified BSD License. 

   This document may contain material from IETF Documents or IETF 
   Contributions published or made publicly available before November 
   10, 2008.  The person(s) controlling the copyright in some of this 
   material may not have granted the IETF Trust the right to allow 
   modifications of such material outside the IETF Standards Process. 
   Without obtaining an adequate license from the person(s) controlling 
   the copyright in such materials, this document may not be modified 
   outside the IETF Standards Process, and derivative works of it may 
   not be created outside the IETF Standards Process, except to format 
   it for publication as an RFC or to translate it into languages other 
   than English. 

























D'Antonio, et al.       Expires October 25, 2012                [Page 2] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


Table of Contents 

   1.  Scope  . . . . . . . . . . . . . . . . . . . . . . . . . . . .  4 
   2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  4 
   3.  Difference between Flow Selection and Packet Selection . . . .  7 
   4.  Flow selection as a Function in the IPFIX Architecture . . . .  8 
     4.1.  Flow selection during the Metering Process . . . . . . . . 10 
     4.2.  Flow selection during the Exporting Process  . . . . . . . 10 
     4.3.  Flow selection as a function of the IPFIX Mediator . . . . 10 
   5.  Flow Selection Techniques  . . . . . . . . . . . . . . . . . . 11 
     5.1.  Flow Filtering . . . . . . . . . . . . . . . . . . . . . . 11 
       5.1.1.  Property Match Filtering . . . . . . . . . . . . . . . 11 
       5.1.2.  Hash-based Flow Filtering  . . . . . . . . . . . . . . 12 
     5.2.  Flow Sampling  . . . . . . . . . . . . . . . . . . . . . . 12 
       5.2.1.  Systematic sampling  . . . . . . . . . . . . . . . . . 12 
       5.2.2.  Random Sampling  . . . . . . . . . . . . . . . . . . . 13 
     5.3.  Flow-state Dependent Flow Selection  . . . . . . . . . . . 13 
     5.4.  Flow-state Dependent Packet Selection  . . . . . . . . . . 14 
   6.  Configuration of Flow Selection Techniques . . . . . . . . . . 14 
     6.1.  Flow Selection Parameters  . . . . . . . . . . . . . . . . 16 
     6.2.  Description of Flow-state Dependent Packet Selection . . . 18 
   7.  Information Model for Flow Selection Configuration and 
       Reporting  . . . . . . . . . . . . . . . . . . . . . . . . . . 18 
     7.1.  flowSelectorAlgorithm  . . . . . . . . . . . . . . . . . . 20 
     7.2.  flowSelectedOctetDeltaCount  . . . . . . . . . . . . . . . 21 
     7.3.  flowSelectedPacketDeltaCount . . . . . . . . . . . . . . . 21 
     7.4.  flowSelectedFlowDeltaCount . . . . . . . . . . . . . . . . 21 
     7.5.  selectorIDTotalFlowsObserved . . . . . . . . . . . . . . . 22 
     7.6.  selectorIDTotalFlowsSelected . . . . . . . . . . . . . . . 22 
     7.7.  samplingFlowInterval . . . . . . . . . . . . . . . . . . . 22 
     7.8.  samplingFlowSpace  . . . . . . . . . . . . . . . . . . . . 23 
     7.9.  flowSamplingTimeInterval . . . . . . . . . . . . . . . . . 23 
     7.10. flowSamplingTimeSpace  . . . . . . . . . . . . . . . . . . 24 
     7.11. hashFlowDomain . . . . . . . . . . . . . . . . . . . . . . 24 
   8.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 24 
     8.1.  Registration of Information Elements . . . . . . . . . . . 24 
     8.2.  Registration of Object Identifier  . . . . . . . . . . . . 32 
   9.  Security Considerations  . . . . . . . . . . . . . . . . . . . 32 
   10. Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 34 
   11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 34 
     11.1. Normative References . . . . . . . . . . . . . . . . . . . 34 
     11.2. Informative References . . . . . . . . . . . . . . . . . . 34 
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 35 

Don't you have to include the non-normative XML in the appendix, as it was
done for RFC5102, RFC5103? 









D'Antonio, et al.       Expires October 25, 2012                [Page 3] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


1.  Scope 

   This document describes flow selection techniques for network traffic 
   measurements.  A flow is defined as a set of packets with common 
   properties as described in [RFC5101].  Flow selection can be done to 
   limit the resource demands for capturing, storing, exporting and 
   post-processing of Flow Records.  It also can be used to select a 
   particular set of flows that are of interest to a specific 
   application.  This document provides a categorization of flow 
   selection techniques and describes configuration and reporting 
   parameters for them.  In order to be compliant with this document, at 
   least one of the flow selection schemes MUST be implemented.  That 
   means that the configuration parameters as well as the reporting 
   Information Elements for this particular scheme MUST be supported. 

Last sentence could be fine, but express that the way to configure the
Intermediate Flow Selection Process is out of scope of this document.

 

Ok, the sentence has been removed.


   This document also addresses configuration and reporting parameters 
   for flow-state dependent packet selection as described in [RFC5475], 
   although this technique is categorized as packet selection.  The 
   reason is that flow-state dependent packet selection techniques often 
   aim at the reduction of resources for flow capturing and flow 
   processing.  Furthermore, they were only briefly discussed in 

Not sure what "they" refers to

 

Fixed.





   [RFC5475].  Therefore we included configuration and reporting 
   considerations for such techniques in this document. 


please remove "we", "us", "our" from the draft.



Done.



2.  Terminology 

   This document is consistent with the terminology introduced in 
   [RFC5101], [RFC5470], [RFC5475] and [RFC3917].  As in [RFC5101] and 
   [RFC5476], the first letter of each IPFIX-specific and PSAMP-specific 
   term is capitalized along with the flow selection specific terms 
   defined here. 


   * Packet Classification 

      Packet Classification is a process by which packets are mapped to 
      specific Flow Records based on packet properties or external 
      properties (e.g. interface).  The properties (e.g. header 
      information, packet content, AS number) make up the Flow Key. In 
      case a Flow Record for a specific Flow Key already exists the Flow 
      Record is updated, otherwise a new Flow Record is created. 


How is this different that the Metering Process (RFC5101)?

Packet Classification is a function of the Metering Process.

 

   Metering Process
 
      The Metering Process generates Flow Records.  Inputs to the
      process are packet headers and characteristics observed at an
      Observation Point, and packet treatment at the Observation Point
      (for example, the selected output interface).
 
      The Metering Process consists of a set of functions that includes
      packet header capturing, timestamping, sampling, classifying, and
      maintaining Flow Records.
 
      The maintenance of Flow Records may include creating new records,
      updating existing ones, computing Flow statistics, deriving
      further Flow properties, detecting Flow expiration, passing Flow
      Records to the Exporting Process, and deleting Flow Records.

What is the connection with the Metering Process?
Figure 1 seems to suggest that Packet Classification is a subset of the
Metering Process...

Your interpretation is correct.




   * Packet Aggregation Process 

      In the IPFIX Metering Process the Packet Aggregation Process 
      aggregates packet data into flow data and forms the Flow Records. 

How is this different from the Metering Process?



The definition of Packet Aggregation Process has been removed.

 

      After the aggregation step only the aggregated flow information is 
      available.  Information about individual packets is lost. 



D'Antonio, et al.       Expires October 25, 2012                [Page 4] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   * Flow Selection Process 

      A Flow Selection Process takes Flow Records as its input and 
      selects a subset of this set as its output.  A Flow Selection 
      Process MAY run in several places within the IPFIX architecture. 
      A Flow Selection Process MAY be part of an IPFIX Metering Process, 
      Exporting Process or as an Intermediate Selection Process as 
      defined for the IPFIX Mediator [RFC6183]. 


If you look at the RFC6235, you will see 

   Intermediate Anonymization Process:   An intermediate process that
      takes Data Records and transforms them into Anonymized Data
      Records.
 

To be perfect correct, the correct way is like it's done in
http://tools.ietf.org/html/draft-ietf-ipfix-a9n-03

   Intermediate Aggregation Process:   an Intermediate Process as in
      [RFC6183 <http://tools.ietf.org/html/rfc6183> ] that aggregates
records, based upon a set of Flow Keys
      or functions applied to fields from the record.

What should be done here is 

Intermediate Flow Selection Process: an Intermediate Process as in
      [RFC6183 <http://tools.ietf.org/html/rfc6183> ] that ...
 

Btw, you will see that "Intermediate Flow Selection Process" is already
defined in the figure where you get it right.

Finally, your sentence "A Flow Selection Process MAY be part of an IPFIX
Metering Process,  Exporting Process or as an Intermediate Selection Process
as 
defined for the IPFIX Mediator [RFC6183]. ":
- must contain "A Intermediate Flow Selection Process MAY be part of an
IPFIX Metering Process ..."
- must be reflected in figure 1, where I only see the Intermediate Flow
Selection Process in the IPFIX Mediator. Could also be present in Exporting
Process and in the Metering Process. As figure 1 is the only figure, all
possibilities must be displayed. See as an example
http://tools.ietf.org/html/draft-ietf-ipfix-a9n-03 figure 1

A new definition of Intermediate Flow Selection Process and a new figure
have been included in the Draft.. 


   * Flow Selection State 

      A Flow Selection Process SHOULD maintain state information for use 

normally, we try to avoid MAY/SHOULD/MUST in definition

 

Fixed





      by the Flow Selector.  At a given time, the Flow Selection State 
      may depend on flows and packets observed at and before that time, 
      as well as other variables.  Examples include: 

        (i)   sequence number of packets and accounted Flow Records; 

        (ii)  number of selected flows; 

        (iii) number of observed flows; 

        (iv)  current flow cache occupancy; 

        (v)   flow specific counters, lower and upper bounds; 

        (vi)  flow selection timeout intervals. 

   * Flow Selector 

      A Flow Selector defines the action of a Flow Selection Process on 
      a single flow of its input.  The Flow Selector can make use of the 
      following information in order to establish whether a flow has to 
      be selected or not: 

        (i)   the content of the Flow Record; 

        (ii)  any state information related to the Metering Process or 
              Exporting Process; 

        (iii) any Flow Selection State that may be maintained by the 
              Flow Selection Process. 

I see many terms: 

Packet Classification, Packet Aggregation Process, Flow Selection Process,
Flow Selection State, Intermediate Process, Intermediate Selection Process,
etc...

Please have a new figure that put combines all these terms. Something such
as the figure in section 3.1 from http://tools.ietf.org/html/rfc5474
It might be your figure 1, but I don't even see those terms in there, or
figure 3 in
http://tools.ietf.org/html/draft-ietf-ipfix-configuration-model-10



Figure 1 has been modified to address this comment.

 

   * Complete Flow 

      A Complete Flow consists of all the packets that enter the Flow 
      Selection Process within the flow time-out interval, and which 
      belong to the same flow as defined by the flow definition in 



D'Antonio, et al.       Expires October 25, 2012                [Page 5] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


      [RFC5470].  For this definition only packets that arrive at the 
      Flow Selection Process are considered.  That means, packets that 
      are not observed at the Flow Selection Process because of prior 
      packet selection or packet loss are not considered as belonging to 
      the Complete Flow. 

what does the second sentence add?



The second sentence has been removed.


   * Flow Filtering 

      Flow Filtering selects flows based on a deterministic function on 
      the Flow Record content, Flow Selection State, external properties 
      (e.g. ingress interface) or external events (e.g violated Access 
      Control List).  If the relevant parts of the Flow Record content 
      can already be observed at packet level (e.g.  Flow Keys from 
      packet header fields) Flow Filtering can be performed at packet 
      level by Property Match Filtering as described in [RFC5475]. 



   * Hash-based Flow Filtering 

      Hash-based Flow Filtering is a deterministic flow filter function 
      that selects flows based on a Hash Function.  The Hash Function is 
      calculated over parts of the Flow Record content or external 
      properties which are called the Hash Domain.  If the hash value 
      falls into a predefined Hash Selection Range the flow is selected. 
      Hash-based Flow Filtering can already applied at packet level, in 
      which case the Hash Domain MUST contain the Flow Key of the 
      packet.  In case Hash-based Flow Filtering is used to select the 
      same subset of flows at different observation points, the Hash 
      Domain MUST comprise parts of the packet or flow thar are 
      invariant on the packet/flow path.  Also refer to the according 
      Trajectory Sampling Application Example on packet level in 
      [RFC5475] 

   * Flow-state Dependent Flow Selection 

      Flow-state Dependent Flow Selection is a selection function that 
      selects or drops flows based on the current Flow Selection State. 
      The selection can be either deterministic, random or non-uniform 
      random. 

   * Flow-state Dependent Packet Selection 

      Flow-state Dependent Packet Selection is a selection function that 
      selects or drops packets based on the current Flow Selection 
      State.  The selection can be either deterministic, random or non- 
      uniform random.  Flow-state Dependent Packet Selection can be used 
      to prefer the selection of packets belonging to specific flows. 
      For example the selection probability of packets belonging to 
      flows that are already within the Flow Cache may be higher than 



D'Antonio, et al.       Expires October 25, 2012                [Page 6] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


      for packets that have not been recorded yet. 

   * Flow Sampling 

      Flow Sampling selects flows based on Flow Record sequence or 
      arrival times (e.g. entry in flow cache, arrival time at Exporter 
      or Mediator).  The selection can be systematic (e.g. every n-th 
      flow) or based on a random function (e.g. select each Flow Record 
      with probability p, or randomly select n out of N Flow Records). 


3.  Difference between Flow Selection and Packet Selection 

   Flow selection differs from packet selection described in [RFC5475]. 

   Packet selection techniques consider packets as the basic element and 
   the parent population consists of all packets observed at an 
   observation point.  In contrast to this the basic elements in flow 
   selection are the flows.  The parent population consists of all 
   observed flows and the selection process operates on the flows.  The 
   major characteristics of flow selection are the following: 

   -       Flow selection takes flows as basic elements.  For packet 
           selection, packets are considered as basic elements. 

   -       Flow selection can only take place after Packet 
           Classification, because the classification rules determine to 
           which flow a packet belongs.  Packet selection can be applied 
           before and after Packet Classification. 

I don't understand the last sentence.



An example has been added to clarify the sentence.


   -       Flow selection operates on Complete Flows.  That means that 
           after the Flow Selection Process either all packets of the 
           flow are kept or all packets of the flow are discarded.  That 
           means that if the flow selection is preceded by a packet 
           selection process the Complete Flow consists only of the 
           packets that were not discarded during the packet selection. 

   There are some techniques that are difficult to unambiguously 
   categorize into one of the categories.  Here we give some guidance 
   how to categorize such techniques: 

   -       Techniques that can be considered as both packet and flow 
           selection: some packet selection techniques result in the 
           selection of Complete Flows and therefore can be considered 
           as packet or as flow selection at the same time.  An example 
           is Property Match Filtering of all packets to a specific 
           destination address.  If flows are defined based on 
           destination addresses, such a packet selection also results 
           in a flow selection and can be considered as packet or flow 



D'Antonio, et al.       Expires October 25, 2012                [Page 7] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


           selection. 

   -       Flow-state Dependent Packet Selection (as described in 
           [RFC5475]): there exist techniques that select packets based 
           on the flow state, e.g. based on the number of already 
           observed packets belonging to the flow.  Examples of these 
           techniques from the literature are "Sample and Hold" [EsVa01] 
           "Fast Filtered Sampling" [MSZC10] or the "Sticky Sampling" 
           algorithm presented in [MaMo02].  Such techniques can be used 
           to influence which flows are captured (e.g. increase the 
           selection of packets belonging to large flows) and reduce the 
           number of flows that need to be stored in the flow cache. 
           Nevertheless, such techniques do not necessarily select 
           Complete Flows, because they do not ensure that all packets 
           of a selected flow are captured.  Therefore Flow-state 
           Dependent Packet Selection methods that do not ensure that 
           either all or no packets of a flow are selected strictly 
           speaking have to be considered as packet selection techniques 
           and not as flow selection techniques. 


4.  Flow selection as a Function in the IPFIX Architecture 

   Figure 1 shows the IPFIX reference model as defined in [RFC5470] and 
   shows the Packet Classification and Packet Aggregation Process in the 
   Metering Process. 

























D'Antonio, et al.       Expires October 25, 2012                [Page 8] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


                       Packet(s) coming in to Observation Point(s) 
                         |                                     | 
                         v                                     v 
        +----------------+---------------------------+   +-----+-------+ 
        |          Metering Process                  |   |             | 
        |                                            |   |             | 
        |   packet header capturing                  |   |             | 
        |        |                                   |...| Metering    | 
        |   timestamping                             |   | Process N   | 
        |        |                                   |   |             | 
        |   packet sampling                          |   |             | 
        |        |                                   |   |             | 
        |   (packet classification)                  |   |             | 
        |        |                                   |   |             | 
        |   packet filtering*                        |   |             | 
        |        |                                   |   |             | 
        |   (packet aggregation)*                    |   |             | 
        |        |                                   |   |             | 
        +--------|-----------------------------------+   +-----|-------+ 
            Flow Records                                   Flow Records

                 |                                             | 



                 +----------------------+----------------------+ 
                                        | 
                 +----------------------|-----------------+ 
                 | Exporting Process*                     | 
                 +----------------------+-----------------+ 
                                        |  IPFIX (Flow Records) 
                                        v 
              +-------------------------|-----------------------+ 
              |  IPFIX Mediator         |                       | 
              |                         v                       | 
              |               Collecting Process(es)            | 
              |                         |                       | 
              |      Intermediate Flow Selection Process (*)    | 
              |                         |                       | 
              |               Exporting Process(es) (*)             | 
              +-------------------------|-----------------------+ 
                                        v 
                                      IPFIX 

         (*) indicates where flow selection can take place. 

            Figure 1: Flow selection in the IPFIX Architecture 

Please express the physical boundary between the Exporter and the IPFIX
Mediator

Why is packet classification in brackets?
(packet aggregation), do you mean the Intermediate Aggregation Process in
http://tools.ietf.org/html/draft-ietf-ipfix-a9n-03?

The figure has been completely changed.


   In contrast to packet selection, flow selection is always applied 
   after the packets are classified into flows.  Flows can be selected 
   at different stages of the measurement chain: 




D'Antonio, et al.       Expires October 25, 2012                [Page 9] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   1.  during the Metering Process 

   2.  during Exporting Process(es) 

   3.  during an Intermediate Selection Process on a Mediator 

It's not "during" but "in". 

 

Fixed.


Please display the 3 points above in the figure

Done.

 


4.1.  Flow selection during the Metering Process 


   In the Packet Aggregation Process the packet information is used to 
   update the Flow Records in the flow cache.  Flow selection that is 
   applied before aggregation equals a packet selection process.  The 
   flow still consists of individual packets.  Those are then selected 
   based on the classification information, i.e. based on the flow they 
   belong to.  Flow selection before aggregation can be based on the 
   fields of the Flow Key (also on a hash value over these fields), but 
   not based on characteristics that are only available after packet 
   aggregation (e.g. flow size, flow duration).  Flow selection during 
   the Metering Process is applied to reduce resources for all 
   succeeding processes or to select specific flows of interest in case 
   such flow characteristics are already observable at packet level 
   (e.g. flows to specific IP addresses).  In contrast, Flow-state 
   Dependent Packet Selection is a packet selection method, because it 
   does not necessarily select Complete Flows. 

4.2.  Flow selection during the Exporting Process 

   The Flow Selection Process at the Exporter is similar to an 
   Intermediate Selection Process as described in [RFC6183] and works on 
   Flow records.  Flow selection during the Exporting Process can 
   therefore also depend on flow characteristics that are only visible 
   after the aggregation of packets, such as flow size and flow 
   duration.  

Why can't this be done in the Metering Process as well?

Changes have been made to section 4.2 to address this comment.





The Exporting Process may implement policies for exporting 
   only a subset of the Flow Records which have been stored in the 
   system memory in order to unload flow export and flow post- 
   processing.  Flow selection during the Exporting Process may select 
   only the subset of Flow Records which are of interest to the users 
   application, or select only as many Flow Records as can be handled by 
   the available resources (e.g. limited export link capacity). 

4.3.  Flow selection as a function of the IPFIX Mediator 

   As shown in Figure 1, flow selection can be performed as an 

Please rewrite these section 4.* based on the Intermediate Flow Selection
Process, and not flow selection, which is not defined.

 

Done.





   Intermediate Process within an IPFIX Mediator [RFC6183].  The 
   Intermediate Selection Process takes Flow Record stream as its input 
   and selects Flow Records from a sequence based upon criteria- 
   evaluated record values.  The Intermediate Selection Process can 
   again apply a flow selection technique to obtain flows of interest to 
   the application.  Further, the Intermediate Selection Process can 



D'Antonio, et al.       Expires October 25, 2012               [Page 10] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   base its selection decision on the correlation of data from different 
   observation points, 

or most of the time Exporters (which btw, you should show this in the
figure)
See figure A in RFC 6183



Observation Points replaced by Exporters.

 

e.g. by only selecting flows that were at least 
   recorded on two observation points. 







5.  Flow Selection Techniques 

   A flow selection technique selects either all or none of the packets 

I see sometimes flow selection, sometimes flow selection technique,
sometimes selection technique, sometimes flow selection scheme,
sometimesflow selection methods, sometimes Flow Selection Process which
should really be the Intermediate Flow Selection Process... 
It's difficult to read the draft, as it misses some cohesion: this clearly
shows that different parts of the document have been written by different
persons. 
Please review the entire document with a fresh mind, as if you would
discover for the first time, and you will see what I mean. 
The entire draft needs some improvements on that matter.

 

The document has been reviewed. 

The terms “scheme” and “method” replaced by technique.






   of a flow, otherwise the technique has to be considered as packet 
   selection.  We distinguish between Flow Filtering and Flow Sampling. 

5.1.  Flow Filtering 

   Flow Filtering is a deterministic function on the IPFIX Flow Record 
   content.  If the relevant flow characteristics are already observable 
   at packet level (e.g.  Flow Keys), Flow Filtering can be applied 
   before aggregation at packet level.  In order to be compliant with 
   this document, at least the Property Match Filtering MUST be 
   implemented. 

This contradicts.

   In order to be compliant with this document, at
   least one of the flow selection schemes MUST be implemented.
 
Ok, agreed. The contradiction has been fixed.






 
5.1.1.  Property Match Filtering 





   Property Match Filtering can be performed similarly to Property Match 


   Filtering for packet selection described in [RFC5475].  The 


   difference is that, instead of packet fields, Flow Record fields are 


   here used to derive the selection decision.  Property Match Filtering 


   is typically used to select a specific subset of the flows that are 


   of interest to a particular application (e.g. all flows to a specific 


   destination, all large flows, etc.).  Properties on which the 


   filtering is based can be Flow Keys, Flow Timestamps, or Per-Flow 


   Counters described in [RFC5102].  Examples of properties are the flow 


   size in bytes, the number of packets in the flow, the observation 


   time of the first or last packet, or the maximum packet length.  An 


   example is to select flows with more than a threshold number of 


   observed octets.  The selection criteria can be a specific value, a 


   set of specific values, or an interval.  For example, a flow is 


   selected if destinationIPv4Address and the total number of packets of 


   the flow equal two predefined values.  Property Match Filtering can 


   be applied during the Metering Process if the properties are already 


   observable at the packet level (e.g.  Flow Key fields).  For example, 


   a flow is selected if sourceIPv4Address and sourceIPv4PrefixLength 


   equal, respectively, two specific values. 





   There are content-based Property Match Filtering techniques that 


   require a computation on the current flow cache.  An example is the 


   selection of the largest flows or a percentage of flows with the 


   longest lifetime.  This type of Property Match Filtering is also used 


   in flow selection techniques that react to external events (e.g. 











D'Antonio, et al.       Expires October 25, 2012               [Page 11] 


 


Internet-Draft          Flow Selection Techniques             April 2012 








   resource constraint).  For example when the flow cache is full, the 


   Flow Record with the lowest flow volume per current flow life time 


   may be deleted. 





5.1.2.  Hash-based Flow Filtering 





   Hash-based Flow Filtering uses a Hash Function h to map the Flow Key 


   c onto a Hash Range R. A flow is selected if the hash value h(c) is 


   within the Hash Selection Range S, which is a subset of R. Hash-based 


   Flow Filtering can be used to emulate a random sampling process but 


   still enable the correlation between selected flow subsets at 


   different observation points.  Hash-based Flow Filtering is similar 


   to Hash-based Packet Selection, and in fact is identical when Hash- 


   based Packet Selection uses the Flow Key that defines the flow as the 


   hash input.  Nevertheless there may be the incentive to apply Hash- 


   based Flow Filtering not on the packet level during the Metering 


   Process, for example when the size of the selection range and 


   therefore the sampling probability is dependent on the number of 


   observed flows. 





5.2.  Flow Sampling 





   Flow Sampling operates on Flow Record sequence or arrival times.  It 


   can use either a systematic or a random function for the selection 


   process.  Flow Sampling usually aims at the selection of a 


   representative subset of all flows in order to estimate 


   characteristics of the whole set (e.g. mean flow size in the 


   network). 





5.2.1.  Systematic sampling 





   Systematic sampling is a deterministic selection function. 


   Systematic sampling may be a periodic selection of the N-th Flow 


   Record which arrives at the Exporting or Intermediate Selection 


   Process.  

Intermediate Flow Selection Process



Systematic sampling MAY be applied during the Metering 
   Process.  An example would be to create, besides the Flow cache of 
   selected flows, an additional data structure that saves the Flow Keys 
   of the flows that are not selected.  The selection of a flow would 
   then be based on the first packet of a flow.  Everytime a packet 
   belonging to a new flow (which is neither in the data structure of 
   the selected or not selected flows) arrives at the measurement point, 

what is a measurement point?



Measurement point replaced with Observation Point.

 

   a counter is increased.  In case the counter is increased to a 
   multiple of N a new flow cache entry is created, and in case the 
   counter is not a multiple of N the Flow Key is added to the data 
   structure for not selected flows. 

   Systematic sampling can also be time-based.  Time-based systematic 
   sampling is applied by only creating flows that are observed between 

flows -> Flows all over the doc.



Done.


D'Antonio, et al.       Expires October 25, 2012               [Page 12] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   time-based start and stop triggers.  The time interval may be applied 
   at packet level during the Metering Process or after aggregation on 
   flow level, e.g. by selecting a flow arriving at the Exporting 
   Process every n seconds. 

5.2.2.  Random Sampling 

   Random flow sampling is based on a random process which requires the 
   calculation of random numbers.  One can differentiate between n-out-N 
   and probabilistic flow sampling. 

5.2.2.1.  n-out-of-N Flow Sampling 

   In n-out-of-N Sampling, n elements are selected out of the parent 
   population that consists of N elements.  One example would be to 
   generate n different random numbers in the range [1,N] and select all 
   flows that have a flow position equal to one of the random numbers. 

5.2.2.2.  Probabilistic Flow Sampling 

   In probabilistic Sampling, the decision whether or not a flow is 
   selected is made in accordance with a predefined selection 
   probability.  For probabilistic Sampling, the Sample Size can vary 
   for different trials.  The selection probability does not necessarily 
   have to be the same for each flow.  Therefore, we distinguish between 
   uniform probabilistic sampling (with the same selection probability 
   for all flows) and non-uniform probabilistic sampling (where the 
   selection probability can vary for different flows).  For non-uniform 
   probabilistic Flow Sampling the sampling probability may be adjusted 
   according to the Flow Record content.  An example would be to 
   increase the selection probability of large volume flows over small 
   volume flows as described in the Smart Sampling technique [DuLT01]. 

5.3.  Flow-state Dependent Flow Selection 

   Flow-state Dependent Flow Selection can be a deterministic or random 
   flow selection process based on the Flow Record content and the flow 
   state which may be kept additionally for each of the flows.  External 
   processes may update counters, bounds and timers for each of the Flow 
   Records and the Flow Selection Process utilises this information for 
   the selection decision.  A review of Flow-state Dependent Flow 
   Selection techniques that aim at the selection of the most frequent 
   items by keeping additional flow state information can be found in 
   [CoHa08].  Flow-state Dependent Flow Selection can only be applied 
   after packet aggregation, when a packet has been assigned to a flow. 
   The selection process then decides based upon the flow state for each 
   flow if it is kept in the flow cache or not.  Two Flow State 
   Dependent Flow Selection Algorithms are here described: 



D'Antonio, et al.       Expires October 25, 2012               [Page 13] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   The frequent algorithm [KaPS03] is a technique that aims at the 
   selection of all flows that at least exceed a 1/k fraction of the 
   Observed Packet Stream.  

to come back to one of my previous point, please add Observed Packet Stream
to the extra figure 



The algorithm has only a flow cache of size 
   k-1 and each flow in the cache has an additional counter.  The 
   counter is incremented each time a packet belonging to the flow in 
   the flow cache is observed.  In case the observed packet does not 
   belong to any flow all counters are decremented and if any of the 
   flow counters has a value of zero the flow is replaced with a flow 
   formed from the new packet. 

   Lossy counting is a selection technique that identifies all flows 
   whose packet count exceeds a certain percentage of the whole observed 
   packet stream (e.g. 5% of all packets) with a certain estimation 
   error e.  Lossy counting separates the observed packet stream in 
   windows of size N=1/e, where N is an amount of consecutive packets. 
   For each observed flow an additional counter will be held in the flow 
   state.  The counter is incremented each time a packet belonging to 
   the flow is observed and all counters are decremented at the end of 
   each window and all flows with a counter of zero are removed from the 
   flow cache. 

5.4.  Flow-state Dependent Packet Selection 

   Flow-state Dependent Packet Selection is not a flow selection 
   technique but a packet selection technique.  Nevertheless we will 
   describe configuration and reporting parameters for this technique in 
   this document.  An example is the "Sample and Hold" algorithm 
   [EsVa01] that tries to prefer large volume flows in the selection. 
   When a packet arrives it is selected when a Flow Record for this 
   packet already exists.  In case there is no Flow Record, the packet 
   is selected by a certain probability that is dependent on the packet 
   size. 


6.  Configuration of Flow Selection Techniques 

   This section describes the configuration parameters of the flow 
   selection techniques presented above.  It provides the basis for an 
   information model to be adopted in order to configure the Flow 
   Selection Process within an IPFIX Device.  The actual information 
   model with the Information Elements (IEs) for the configuration is 
   described together with the reporting IEs in section 7.  The 
   following table gives an overview of the defined selection 
   techniques, where they can be applied and what their input parameters 
   are.  Depending on where the flow selection techniques are applied 
   different input parameters can be configured. 

   Overview of Flow Selection Techniques: 



D'Antonio, et al.       Expires October 25, 2012               [Page 14] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   +------------------+-----------------+------------------------------+ 
   | Location         | Selection       | Selection Input              | 
   |                  | Method          |                              | 
   +------------------+-----------------+------------------------------+ 
   | During the       | Flow-state      | packet sampling              | 

location is not "during" but "in"

 

Fixed.





   | Metering Process | Dependent       | probabilities, Flow          | 
   | based on Packets | Packet          | Selection State, packet      | 
   |                  | Selection       | properties                   | 

I still don't get why "in the Metering Process" means, on packets?

 

“On packets” has been removed.





   +------------------+-----------------+------------------------------+ 

should 



   |                  | Property Match  | Flow record IEs, Selection   | 
   |                  | Flow Filtering  | Interval                     | 
   +------------------+-----------------+------------------------------+ 
   |                  | Hash-based Flow | selection range, Hash        | 
   |                  | Filtering       | Function, Flow Key, (seed)   | 
   +------------------+-----------------+------------------------------+ 
   |                  | Time-based      | flow position (derived from  | 
   |                  | Systematic Flow | arrival time of packets),    | 
   |                  | Sampling        | flow selection state         | 
   +------------------+-----------------+------------------------------+ 
   |                  | Sequence-based  | flow position (derived from  | 
   |                  | Systematic Flow | packet position), flow       | 
   |                  | Sampling        | selection state              | 
   +------------------+-----------------+------------------------------+ 
   |                  | Random Flow     | random number generator or   | 
   |                  | Sampling        | list and packet position,    | 
   |                  |                 | flow state                   | 
   +------------------+-----------------+------------------------------+ 

This location above applies to the 6 column, right? so make a big cell out
for "in the Metering Process based on packets"
Same remark below.
I was not able to create a big cell applying to the 6 columns. I simply used
the same text in the 6 columns. 



   | Exporting /      | Property Match  | Flow Record content, filter  | 
   | Intermediate     | Flow Filtering  | function                     | 
   | Selection        |                 |                              | 
   | Process          |                 |                              | 
   +------------------+-----------------+------------------------------+ 
   |                  | Hash-based Flow | selection range, Hash        | 
   |                  | Filtering       | Function, hash input (Flow   | 
   |                  |                 | Keys and other flow          | 
   |                  |                 | properties)                  | 
   +------------------+-----------------+------------------------------+ 
   |                  | Flow-state      | flow state parameters,       | 
   |                  | Dependent Flow  | random number generator or   | 
   |                  | Selection       | list                         | 
   +------------------+-----------------+------------------------------+ 
   |                  | Time-based      | flow arrival time, flow      | 
   |                  | Systematic Flow | state                        | 
   |                  | Sampling        |                              | 
   +------------------+-----------------+------------------------------+ 
   |                  | Sequence-based  | flow position, flow state    | 
   |                  | Systematic Flow |                              | 
   |                  | Sampling        |                              | 



D'Antonio, et al.       Expires October 25, 2012               [Page 15] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   |                  | Random Flow     | random number generator or   | 
   |                  | Sampling        | list and flow position, flow | 
   |                  |                 | state                        | 
   +------------------+-----------------+------------------------------+ 

Not sure what the "flow position".
Below, you use "Spacing" for this concept.




              Table 1: Overview of Flow Selection Techniques 

6.1.  Flow Selection Parameters 

   In this section, we define what parameters are required to describe 
   the most common Flow Selection techniques. 

You see, yet another new term, which is not in the terminology: Flow
Selection
And on the top of my head, it was not defined in any other documents
referenced in the terminology

 

The section title has been changed.


   Flow Selection Parameters: 

   For Property Match Filtering: 

   -   Information Element as specified in [iana-ipfix-assignments]): 
       Specifies the Information Element which is used as the property 
       in the filter expression. 

   -   Selection Value or Value Interval: 
       Specifies the value or interval of the filter expression. 
       Packets and Flow Record that have a value equal to the Selection 
       Value or within the Interval will be selected. 

   For Hash-based Flow Filtering: 

   -   Hash Domain: 
       Specifies the bits from the packet or flow which are taken as the 
       hash input to the Hash Function. 

   -   Hash Function: 
       Specifies the name of the Hash Function that is used to calculate 
       the hash value.  Possible Hash Functions are BOB [RFC5475], IPSX 
       [RFC5475], CRC-32 [Bra75] 

   -   Hash Selection Range: 
       Flows that have a hash value within the Hash Selection Range are 
       selected.  The Hash Selection Range can be a value interval or 
       arbitrary hash values within the Hash Range of the Hash Function. 

   -   Random Seed or Initializer Value: 
       Some Hash Functions require an initializing value.  In order to 
       make the selection decision more secure one can choose a random 
       seed that configures the hash function. 

   For Flow-state Dependent Flow Selection: 




D'Antonio, et al.       Expires October 25, 2012               [Page 16] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   -   frequency threshold: 
       Specifies the frequency threshold s for flow state dependent flow 
       selection techniques that try to find the most frequent items 
       within a dataset.  All flows which exceed the defined threshold 
       will be selected. 

   -   accuracy parameter: 
       specifies the accuracy parameter e for techniques that deal with 
       the frequent items problems.  The accuracy parameter defines the 
       maximum error, i.e. no flows that have a true frequency less than 
       ( s - e) N are selected, where s is the frequency threshold and N 
       is the total number of packets. 

   The above list of parameters for Flow-state Dependent Flow Selection 
   techniques is suitable for the presented frequent item and lossy 
   counting algorithms.  Nevertheless a variety of techniques exist with 
   very specific parameters which are not defined here. 

   For Systematic time-based Flow Sampling: 

   -   Interval length (in usec) 
       Defines the length of the sampling interval during which flows 
       are selected. 

   -   Spacing (in usec) 
       The spacing parameter defines the spacing in usec between the end 
       of one sampling interval and the start of the next succeeding 
       interval. 

   For Systematic count-based Flow Sampling: 

   -   Interval length 
       Defines the number of flows that are selected within the sampling 
       interval. 

   -   Spacing 
       The spacing parameter defines the spacing in number of observed 
       flows between the end of one sampling interval and the start of 
       the next succeeding interval. 

   For random n-out-of-N Flow Sampling: 

   -   Population Size N 
       The Population Size N is the number of all flows in the 
       Population from which the sample is drawn. 






D'Antonio, et al.       Expires October 25, 2012               [Page 17] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   -   Sampling Size n 
       The sampling size n is the number of flows that are randomly 
       drawn from the population N. 

   For probabilistic Flow Sampling: 

   -   Sampling probability p 
       The sampling probability p defines the probability by which each 
       of the observed flows is selected. 

6.2.  Description of Flow-state Dependent Packet Selection 

   The configuration of Flow-state Dependent Packet Selection has not 
   been described in [RFC5475] therefore the parameters are defined 
   here: 

   For Flow-state Dependent Packet Selection: 

   -   packet selection probability per possible flow state interval 
       Defines multiple {flow interval, packet selection probability} 
       value pairs that configure the sampling probability depending on 
       the current flow state. 

   -   additional parameters 
       For the configuration of flow state dependent packet selection 
       additional parameters or packet properties may be required, e.g. 
       the packet size ([EsVa01]) 


7.  Information Model for Flow Selection Configuration and Reporting 

   In this section we describe Information Elements (IEs) that MUST be 

This section specifies ...



Modified.

 

   exported by a flow selection process in order to support the 

Flow Selection Process 

 

Done





   interpretation of measurement results from flow measurements where 
   only some flows are selected.  

"from flow measurements where only some flows are selected. "
Do you need that?  Isn't it by default what a Flow Selection Process does?

 

Right. The sentence has been removed.

 





The information is mainly used to 
   report how many packets and flows have been observed in total and how 
   many of them were selected.  This helps for instance to calculate the 
   Attained Selection Fraction (see also [RFC5476]), which is an 
   important parameter to provide an accuracy statement.  The IEs can 
   provide reporting information about Flow Records, packets or bytes. 
   The reported metrics are total number of elements and the number of 
   selected elements.  From this the number of dropped elements can be 
   derived.  All counters SHOULD be exported and reset when a new 
   measurement interval starts. 

I disagree here. It depends which IEs you use: deltaCounter or totalCounter
Search for those two terms in
http://www.iana.org/assignments/ipfix/ipfix.xml

In order to avoid ambiguity, this sentence has been removed.


   List of Flow Selection Information Elements: 





D'Antonio, et al.       Expires October 25, 2012               [Page 18] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   +------+-------------------------+-------+--------------------------+ 
   | ID   | Name                    | ID    | Name                     | 
   +------+-------------------------+-------+--------------------------+ 
   | 301  | selectionSequenceID     | 302   | selectorID               | 
   +------+-------------------------+-------+--------------------------+ 
   | TBD1 | flowSelectorAlgorithm   | 1     | octetDeltaCount          | 
   +------+-------------------------+-------+--------------------------+ 
   | TBD2 | flowSelectedOctetDeltaC | 2     | packetDeltaCount         | 
   |      | ount                    |       |                          | 
   +------+-------------------------+-------+--------------------------+ 
   | TBD3 | flowSelectedPacketDelta | 3     | originalFlowsPresent     | 
   |      | Count                   |       |                          | 
   +------+-------------------------+-------+--------------------------+ 
   | TBD4 | flowSelectedFlowDeltaCo | TBD5  | selectorIDTotalFlowsObse | 
   |      | unt                     |       | rved                     | 
   +------+-------------------------+-------+--------------------------+ 
   | TBD6 | selectorIDTotalFlowsSel | TBD7  | samplingFlowInterval     | 
   |      | ected                   |       |                          | 
   +------+-------------------------+-------+--------------------------+ 
   | TBD8 | samplingFlowSpace       | 309   | samplingSize             | 
   +------+-------------------------+-------+--------------------------+ 
   | 310  | samplingPopulation      | 311   | samplingProbability      | 
   +------+-------------------------+-------+--------------------------+ 
   | TBD9 | flowSamplingTimeInterva | TBD10 | flowSamplingTimeSpace    | 
   |      | l                       |       |                          | 
   +------+-------------------------+-------+--------------------------+ 
   | 326  | digestHashValue         | TBD11 | hashFlowOffset           | 
   +------+-------------------------+-------+--------------------------+ 
   | TBD1 | hashFlowSize            | 329   | hashOutputRangeMin       | 
   | 2    |                         |       |                          | 
   +------+-------------------------+-------+--------------------------+ 
   | 330  | hashOutputRangeMax      | 331   | hashSelectedRangeMin     | 
   +------+-------------------------+-------+--------------------------+ 
   | 332  | hashSelectedRangeMax    | 333   | hashDigestOutput         | 
   +------+-------------------------+-------+--------------------------+ 
   | 334  | hashInitialiserValue    | 320   | absoluteError            | 
   +------+-------------------------+-------+--------------------------+ 
   | 321  | relativeError           | 336   | upperCILimit             | 
   +------+-------------------------+-------+--------------------------+ 
   | 337  | lowerCILimit            | 338   | confidenceLevel          | 
   +------+-------------------------+-------+--------------------------+ 

               Table 2: Flow Selection Information Elements 








D'Antonio, et al.       Expires October 25, 2012               [Page 19] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


7.1.  flowSelectorAlgorithm 

   Description: 

      This Information Element identifies the flow selection 
      method(e.g., Filtering, Sampling) that is applied by the Flow 
      Selection Process.  Most of these methods have parameters as 
      decribed in Section 6.  Further Information Elements are needed to 
      fully specify packet selection with these methods and all their 
      parameters.  

Why do you speak about "packet selection" in the flowSelectorAlgorithm? 

 

 

Fixed.

 

Further method identifiers may be added to the list 
      below.  It might be necessary to define new Information Elements 
      to specify their parameters.  The flowSelectorAlgorithm registry 
      is maintained by IANA.  New assignments for the registry will be 
      administered by IANA and are subject to Expert Review [RFC5226]. 
      The registry can be updated when specifications of the new 
      method(s) and any new Information Elements are provided. 


   +----+------------------------+--------------------------+ 
   | ID |        Method          |      Parameters          | 
   +----+------------------------+--------------------------+ 
   | 1  | Systematic count-based | flowSamplingInterval     | 
   |    | Sampling               | flowSamplingSpace        | 
   +----+------------------------+--------------------------+ 
   | 2  | Systematic time-based  | flowSamplingTimeInterval | 
   |    | Sampling               | flowSamplingTimeSpace    | 
   +----+------------------------+--------------------------+ 
   | 3  | Random n-out-of-N      | samplingSize             | 
   |    | Sampling               | samplingPopulation       | 
   +----+------------------------+--------------------------+ 
   | 4  | Uniform probabilistic  | samplingProbability      | 
   |    | Sampling               |                          | 
   +----+------------------------+--------------------------+ 
   | 5  | Property Match         | Information Element      | 
   |    | Filtering              | Value Range              | 
   +----+------------------------+--------------------------+ 
   |   Hash-based Filtering      | hashInitialiserValue     | 
   +----+------------------------+ hashFlowDomain           | 
   | 6  | using BOB              | hashSelectedRangeMin     | 
   +----+------------------------+ hashSelectedRangeMax     | 
   | 7  | using IPSX             | hashOutputRangeMin       | 
   +----+------------------------+ hashOutputRangeMax       | 
   | 8  | using CRC              |                          | 
   +----+------------------------+--------------------------+ 
   | 9  | Flow State Dependent   | No agreed Parameters     | 
   |    | Flow Selection         |                          | 
   +----+------------------------+--------------------------+ 




D'Antonio, et al.       Expires October 25, 2012               [Page 20] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   Abstract Data Type: unsigned16 

   ElementId: TBD1 

   Data Type Semantics: identifier 

   Status: Proposed 

7.2.  flowSelectedOctetDeltaCount 

   Description: 

      This Information Element specifies the volume in octets of all 
      flows that are selected during the Flow Selection Process since 
      the previous report. 

   Abstract Data Type: unsigned64 

   ElementId: TBD2 

   Units: Octets 

   Status: Proposed 

7.3.  flowSelectedPacketDeltaCount 

   Description: 

      This Information Element specifies the volume in packets of all 
      flows that were selected during the Flow Selection Process since 
      the previous report. 

   Abstract Data Type: unsigned64 

   ElementId: TBD3 

   Units: Packets 

   Status: Proposed 

7.4.  flowSelectedFlowDeltaCount 

   Description: 

      This Information Element specifies the number of Flows that were 
      selected during the Flow Selection Process since the last report. 

   Abstract Data Type: unsigned64 



D'Antonio, et al.       Expires October 25, 2012               [Page 21] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   ElementId: TBD4 

   Units: Flows 

   Status: Proposed 

7.5.  selectorIDTotalFlowsObserved 

   Description: 

      This Information Element specifies the total number of flows 
      observed by a Selector, for a specific value of SelectorId.  This 
      Information Element should be used in an Options Template scoped 
      to the observation to which it refers.  See Section 3.4.2.1 of the 
      IPFIX protocol document [RFC5101] . 

   Abstract Data Type: unsigned64 

   ElementId: TBD5 

   Units: Flows 

   Status: Proposed 

7.6.  selectorIDTotalFlowsSelected 

   Description: 

      This Information Element specifies the total number of flows 
      selected by a Selector, for a specific value of SelectorId.  This 
      Information Element should be used in an Options Template scoped 
      to the observation to which it refers.  See Section 3.4.2.1 of the 
      IPFIX protocol document [RFC5101]. 

   Abstract Data Type: unsigned64 

   ElementId: TBD6 

   Units: Flows 

   Status: Proposed 

7.7.  samplingFlowInterval 

   Description: 

      This Information Element specifies the number of flows that are 
      consecutively sampled.  A value of 100 means that 100 consecutive 



D'Antonio, et al.       Expires October 25, 2012               [Page 22] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


      flows are sampled.  For example, this Information Element may be 
      used to describe the configuration of a systematic count-based 
      Sampling Selector. 

   Abstract Data Type: unsigned64 

   ElementId: TBD7 

   Units: Flows 

   Status: Proposed 

7.8.  samplingFlowSpace 

   Description: 

      This Information Element specifies the number of flows between two 
      "samplingFlowInterval"s.  A value of 100 means that the next 
      interval starts 100 flows (which are not sampled) after the 
      current "samplingFlowInterval" is over.  For example, this 
      Information Element may be used to describe the configuration of a 
      systematic count-based Sampling Selector. 

The text above mentions:

   For Systematic count-based Flow Sampling: 

   -   Interval length 
       Defines the number of flows that are selected within the sampling 
       interval. 

   -   Spacing 
       The spacing parameter defines the spacing in number of observed 
       flows between the end of one sampling interval and the start of 
       the next succeeding interval.

So be consistent between "Space", "Spacing", and position (see one of my
previous comments"

Space has been replaced with Spacing in samplingFlowSpace and in
flowSamplingTimeSpace.




   Abstract Data Type: unsigned64 

   ElementId: TBD8 

   Units: Flows 

   Status: Proposed 

7.9.  flowSamplingTimeInterval 

   Description: 

      This Information Element specifies the time interval in 
      microseconds during which all arriving flows are sampled.  For 
      example, this Information Element may be used to describe the 
      configuration of a systematic time-based Sampling Selector. 

The text above mentions:
   For Systematic time-based Flow Sampling: 

   -   Interval length (in usec) 
       Defines the length of the sampling interval during which flows 
       are selected. 

   -   Spacing (in usec) 
       The spacing parameter defines the spacing in usec between the end 
       of one sampling interval and the start of the next succeeding 
       interval. 

So be consistent between "Space", "Spacing", and position (see one of my
previous comments"




   Abstract Data Type: unsigned64 

   ElementId: TBD9 

   Units: microseconds 

   Status: Proposed 




D'Antonio, et al.       Expires October 25, 2012               [Page 23] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


7.10.  flowSamplingTimeSpace 

   Description: 

      This Information Element specifies the time interval in 
      microseconds between two "flowSamplingTimeInterval"s.  A value of 
      100 means that the next interval starts 100 microseconds (during 
      which no flows are sampled) after the current 
      "flowsamplingTimeInterval" is over.  For example, this Information 
      Element may used to describe the configuration of a systematic 
      time-based Sampling Selector. 

Same remark.




   Abstract Data Type: unsigned64 

   ElementId: TBD10 

   Units: microseconds 

   Status: Proposed 

7.11.  hashFlowDomain 

   Description: 

      This Information Element specifies the Information Elements that 
      are used by the Hash-based flow Selection Selector as the Hash 
      Domain. 

   Abstract Data Type: unsigned16 

   ElementId: TBD11 

   Data Type Semantics: identifier 

   Status: Proposed 


8.  IANA Considerations 

8.1.  Registration of Information Elements 

   IANA will register the following IEs in the IPFIX Information 
   Elements registry at http://www.iana.org/assignments/ipfix/ipfix.xml: 








D'Antonio, et al.       Expires October 25, 2012               [Page 24] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   +-----+----------------+--------+---------+-------+-----------------+ 
   | Val | Name           | Data   | Data    | Statu | Description     | 
   | ue  |                | Type   | Type    | s     |                 | 
   |     |                |        | Semanti |       |                 | 
   |     |                |        | cs      |       |                 | 
   +-----+----------------+--------+---------+-------+-----------------+ 
   | 1   | flowSelectorAl | unsign | identif | Propo | This            | 
   |     | gorithm        | ed16   | ier     | sed   | Information     | 
   |     |                |        |         |       | Element         | 
   |     |                |        |         |       | identifies the  | 
   |     |                |        |         |       | flow selection  | 
   |     |                |        |         |       | method(e.g.,    | 
   |     |                |        |         |       | Filtering,      | 
   |     |                |        |         |       | Sampling) that  | 
   |     |                |        |         |       | is applied by   | 
   |     |                |        |         |       | the Flow        | 
   |     |                |        |         |       | Selection       | 
   |     |                |        |         |       | Process         | 
   +-----+----------------+--------+---------+-------+-----------------+ 
   | 2   | flowSelectedOc | unsign | Octets  | Propo | This            | 
   |     | tetDeltaCount  | ed64   |         | sed   | Information     | 
   |     |                |        |         |       | Element         | 
   |     |                |        |         |       | specifies the   | 
   |     |                |        |         |       | volume in       | 
   |     |                |        |         |       | octets of all   | 
   |     |                |        |         |       | flows that are  | 
   |     |                |        |         |       | selected during | 
   |     |                |        |         |       | the Flow        | 
   |     |                |        |         |       | Selection       | 
   |     |                |        |         |       | Process since   | 
   |     |                |        |         |       | the previous    | 
   |     |                |        |         |       | report.         | 
   +-----+----------------+--------+---------+-------+-----------------+ 
   | 3   | flowSelectedPa | unsign | Packets | Propo | This            | 
   |     | cketDeltaCount | ed64   |         | sed   | Information     | 
   |     |                |        |         |       | Element         | 
   |     |                |        |         |       | specifies the   | 
   |     |                |        |         |       | volume in       | 
   |     |                |        |         |       | packets of all  | 
   |     |                |        |         |       | flows that were | 
   |     |                |        |         |       | selected during | 
   |     |                |        |         |       | the Flow        | 
   |     |                |        |         |       | Selection       | 
   |     |                |        |         |       | Process since   | 
   |     |                |        |         |       | the previous    | 
   |     |                |        |         |       | report.         | 
   +-----+----------------+--------+---------+-------+-----------------+ 




D'Antonio, et al.       Expires October 25, 2012               [Page 25] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   +-----+----------------+--------+---------+-------+-----------------+ 
   | 4   | flowSelectedFl | unsign | Flows   | Propo | This            | 
   |     | owDeltaCount   | ed64   |         | sed   | Information     | 
   |     |                |        |         |       | Element         | 
   |     |                |        |         |       | specifies the   | 
   |     |                |        |         |       | number of Flows | 
   |     |                |        |         |       | that were       | 
   |     |                |        |         |       | selected during | 
   |     |                |        |         |       | the Flow        | 
   |     |                |        |         |       | Selection       | 
   |     |                |        |         |       | Process since   | 
   |     |                |        |         |       | the last        | 
   |     |                |        |         |       | report.         | 
   +-----+----------------+--------+---------+-------+-----------------+ 
   | 5   | selectorIDTota | unsign | Flows   | Propo | This            | 
   |     | lFlowsObserved | ed64   |         | sed   | Information     | 
   |     |                |        |         |       | Element         | 
   |     |                |        |         |       | specifies the   | 
   |     |                |        |         |       | total number of | 
   |     |                |        |         |       | flows observed  | 
   |     |                |        |         |       | by a Selector,  | 
   |     |                |        |         |       | for a specific  | 
   |     |                |        |         |       | value of        | 
   |     |                |        |         |       | SelectorId.     | 
   |     |                |        |         |       | This            | 
   |     |                |        |         |       | Information     | 
   |     |                |        |         |       | Element should  | 
   |     |                |        |         |       | be used in an   | 
   |     |                |        |         |       | Options         | 
   |     |                |        |         |       | Template scoped | 
   |     |                |        |         |       | to the          | 
   |     |                |        |         |       | observation to  | 
   |     |                |        |         |       | which it        | 
   |     |                |        |         |       | refers.  See    | 
   |     |                |        |         |       | Section 3.4.2.1 | 
   |     |                |        |         |       | of the IPFIX    | 
   |     |                |        |         |       | protocol        | 
   |     |                |        |         |       | document        | 
   |     |                |        |         |       | [RFC5101]       | 
   +-----+----------------+--------+---------+-------+-----------------+ 











D'Antonio, et al.       Expires October 25, 2012               [Page 26] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   +-----+----------------+--------+---------+-------+-----------------+ 
   | 6   | selectorIDTota | unsign | Flows   | Propo | This            | 
   |     | lFlowsSelected | ed64   |         | sed   | Information     | 
   |     |                |        |         |       | Element         | 
   |     |                |        |         |       | specifies the   | 
   |     |                |        |         |       | total number of | 
   |     |                |        |         |       | flows selected  | 
   |     |                |        |         |       | by a Selector,  | 
   |     |                |        |         |       | for a specific  | 
   |     |                |        |         |       | value of        | 
   |     |                |        |         |       | SelectorId.     | 
   |     |                |        |         |       | This            | 
   |     |                |        |         |       | Information     | 
   |     |                |        |         |       | Element should  | 
   |     |                |        |         |       | be used in an   | 
   |     |                |        |         |       | Options         | 
   |     |                |        |         |       | Template scoped | 
   |     |                |        |         |       | to the          | 
   |     |                |        |         |       | observation to  | 
   |     |                |        |         |       | which it        | 
   |     |                |        |         |       | refers.  See    | 
   |     |                |        |         |       | Section 3.4.2.1 | 
   |     |                |        |         |       | of the IPFIX    | 
   |     |                |        |         |       | protocol        | 
   |     |                |        |         |       | document        | 
   |     |                |        |         |       | [RFC5101].      | 
   +-----+----------------+--------+---------+-------+-----------------+ 
























D'Antonio, et al.       Expires October 25, 2012               [Page 27] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   +-----+----------------+--------+---------+-------+-----------------+ 
   | 7   | samplingFlowIn | unsign | Flows   | Propo | This            | 
   |     | terval         | ed64   |         | sed   | Information     | 
   |     |                |        |         |       | Element         | 
   |     |                |        |         |       | specifies the   | 
   |     |                |        |         |       | number of flows | 
   |     |                |        |         |       | that are        | 
   |     |                |        |         |       | consecutively   | 
   |     |                |        |         |       | sampled.  A     | 
   |     |                |        |         |       | value of 100    | 
   |     |                |        |         |       | means that 100  | 
   |     |                |        |         |       | consecutive     | 
   |     |                |        |         |       | flows are       | 
   |     |                |        |         |       | sampled.  For   | 
   |     |                |        |         |       | example, this   | 
   |     |                |        |         |       | Information     | 
   |     |                |        |         |       | Element may be  | 
   |     |                |        |         |       | used to         | 
   |     |                |        |         |       | describe the    | 
   |     |                |        |         |       | configuration   | 
   |     |                |        |         |       | of a systematic | 
   |     |                |        |         |       | count-based     | 
   |     |                |        |         |       | Sampling        | 
   |     |                |        |         |       | Selector.       | 
   +-----+----------------+--------+---------+-------+-----------------+ 


























D'Antonio, et al.       Expires October 25, 2012               [Page 28] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   +-----+----------------+--------+---------+-------+-----------------+ 
   | 8   | samplingFlowSp | unsign | Flows   | Propo | This            | 
   |     | ace            | ed64   |         | sed   | Information     | 
   |     |                |        |         |       | Element         | 
   |     |                |        |         |       | specifies the   | 
   |     |                |        |         |       | number of flows | 
   |     |                |        |         |       | between two     | 
   |     |                |        |         |       | "samplingFlowIn | 
   |     |                |        |         |       | terval"s.  A    | 
   |     |                |        |         |       |  value of 100   | 
   |     |                |        |         |       |  means that the | 
   |     |                |        |         |       |  next interval  | 
   |     |                |        |         |       |  starts 100     | 
   |     |                |        |         |       |  flows (which   | 
   |     |                |        |         |       |  are not        | 
   |     |                |        |         |       |  sampled) after | 
   |     |                |        |         |       |  the current    | 
   |     |                |        |         |       |  "samplingFlowI | 
   |     |                |        |         |       | nterval" is ove | 
   |     |                |        |         |       | r.For example,  | 
   |     |                |        |         |       |   this          | 
   |     |                |        |         |       |   Information   | 
   |     |                |        |         |       |   Element may b | 
   |     |                |        |         |       | e used to       | 
   |     |                |        |         |       |   describe the  | 
   |     |                |        |         |       |   configuration | 
   |     |                |        |         |       |   of a systemat | 
   |     |                |        |         |       | iccount-based   | 
   |     |                |        |         |       |   Sampling      | 
   |     |                |        |         |       |   Selector.     | 
   +-----+----------------+--------+---------+-------+-----------------+ 




















D'Antonio, et al.       Expires October 25, 2012               [Page 29] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   +-----+----------------+--------+---------+-------+-----------------+ 
   | 9   | flowSamplingTi | unsign | microse | Propo | This            | 
   |     | meInterval     | ed64   | conds   | sed   | Information     | 
   |     |                |        |         |       | Element         | 
   |     |                |        |         |       | specifies the   | 
   |     |                |        |         |       | time interval   | 
   |     |                |        |         |       | in microseconds | 
   |     |                |        |         |       | during which    | 
   |     |                |        |         |       | all arriving    | 
   |     |                |        |         |       | flows are       | 
   |     |                |        |         |       | sampled.  For   | 
   |     |                |        |         |       | example, this   | 
   |     |                |        |         |       | Information     | 
   |     |                |        |         |       | Element may be  | 
   |     |                |        |         |       | used to         | 
   |     |                |        |         |       | describe the    | 
   |     |                |        |         |       | configuration   | 
   |     |                |        |         |       | of a systematic | 
   |     |                |        |         |       | time-based      | 
   |     |                |        |         |       | Sampling        | 
   |     |                |        |         |       | Selector.       | 
   +-----+----------------+--------+---------+-------+-----------------+ 





























D'Antonio, et al.       Expires October 25, 2012               [Page 30] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   +-----+----------------+--------+---------+-------+-----------------+ 
   | 10  | flowSamplingTi | unsign | microse | Propo | This            | 
   |     | meSpace        | ed64   | conds   | sed   | Information     | 
   |     |                |        |         |       | Element         | 
   |     |                |        |         |       | specifies the   | 
   |     |                |        |         |       | time interval   | 
   |     |                |        |         |       | in microseconds | 
   |     |                |        |         |       | between two     | 
   |     |                |        |         |       | "flowSamplingTi | 
   |     |                |        |         |       | meInterval"s.   | 
   |     |                |        |         |       | Avalue of 100   | 
   |     |                |        |         |       |  means that the | 
   |     |                |        |         |       |  next interval  | 
   |     |                |        |         |       |  starts 100     | 
   |     |                |        |         |       |  microseconds   | 
   |     |                |        |         |       |  (during which  | 
   |     |                |        |         |       |  no flows are   | 
   |     |                |        |         |       |  sampled) after | 
   |     |                |        |         |       |  the current    | 
   |     |                |        |         |       |  "flowsamplingT | 
   |     |                |        |         |       | imeInterval" is | 
   |     |                |        |         |       |   over.  For    | 
   |     |                |        |         |       |   example, this | 
   |     |                |        |         |       |   Information   | 
   |     |                |        |         |       |   Element may   | 
   |     |                |        |         |       |   used to       | 
   |     |                |        |         |       |   describe the  | 
   |     |                |        |         |       |   configuration | 
   |     |                |        |         |       |   of a systemat | 
   |     |                |        |         |       | ictime-based    | 
   |     |                |        |         |       |   Sampling      | 
   |     |                |        |         |       |   Selector.     | 
   +-----+----------------+--------+---------+-------+-----------------+ 
   | 11  | hashFlowDomain | unsign | identif | Propo | This            | 
   |     |                | ed16   | ier     | sed   | Information     | 
   |     |                |        |         |       | Element         | 
   |     |                |        |         |       | specifies the   | 
   |     |                |        |         |       | Information     | 
   |     |                |        |         |       | Elements that   | 
   |     |                |        |         |       | are used by the | 
   |     |                |        |         |       | Hash-based flow | 
   |     |                |        |         |       | Selection       | 
   |     |                |        |         |       | Selector as the | 
   |     |                |        |         |       | Hash Domain.    | 
   +-----+----------------+--------+---------+-------+-----------------+ 

                      Table 3: Flow Selection methods 




D'Antonio, et al.       Expires October 25, 2012               [Page 31] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


8.2.  Registration of Object Identifier 

   IANA will register the following OID in the IPFIX-SELECTOR-MIB 
   Functions sub-registry at http://www.iana.org/assignments/smi-numbers 
   according to the procedures set forth in [I-D.dkcm-ipfix-rfc5815bis] 

Should be http://tools.ietf.org/html/draft-ietf-ipfix-rfc5815bis-03
Btw, this draft is right now in AUTH48
See http://www.rfc-editor.org/authors/rfc6632.txt
http://www.rfc-editor.org/authors/rfc6615.txt

Btw,  you must  mention that you want a new entry under 

Sub-registry Name: IPFIX-SELECTOR-MIB Functions
See http://tools.ietf.org/html/draft-ietf-ipfix-psamp-mib-04#section-8 for
an example


The text has been modified.




   +---------+-----------------------+---------------------+-----------+ 
   | Decimal | Name                  | Description         | Reference | 
   +---------+-----------------------+---------------------+-----------+ 
   | 1       | flowSelectorAlgorithm | This Object         | [RFCyyyy] | 
   |         |                       | Identifier          |           | 
   |         |                       | identifies the flow |           | 
   |         |                       | selection method    |           | 
   |         |                       | (e.g., Filtering,   |           | 
   |         |                       | Sampling) that is   |           | 
   |         |                       | applied by the Flow |           | 
   |         |                       | Selection Process   |           | 
   +---------+-----------------------+---------------------+-----------+ 

              Table 4: Information Elements to be registered 

You can't use the value 1. IANA will decide what is the next available
value.



Right. The value has been removed.


   Editor's Note (to be removed prior to publication): the RFC editor is 
   asked to replace "yyyy" in this document by the number of the RFC 
   when the assignment has been made. 


9.  Security Considerations 

   The described flow sampling techniques and the hash-based flow 
   filtering technique aim at the selection of a representative subset 
   of flows in order to make an accurate estimation of the population. 

Not always, right?  For example, it's not the goal of "Property Match
Filtering"



Section on Security Considerations has been rewritten.

 

   An adversary may have incentives to influence the selection of flows, 
   for example to circumvent accounting. 

   Security considerations concerning the choice of a Hash Function for 
   Hash-based Packet Selection have been discussed in Section 6.2.3 of 
   [RFC5475] and are also appropriate for Hash-Based Flow Selection. 
   This section discussed a number of potential attacks to craft Streams 

I see Observed Packet Stream and Packet Stream in RFC5475,  I see Data
Stream in RFC5470, but not Stream alone. 
I guess you want to say Packet Stream



   that are disproportionately detected and/or discover the Hash 
   Function parameters, the vulnerabilities of different Hash Functions 
   to these attacks, and practices to minimize these vulnerabilities. 

   For other sampling approaches a user can gain knowledge about the 
   start and stop triggers in time-based systematic Sampling, e.g., by 
   sending test packets.  This knowledge might allow users to modify 
   their send schedule in a way that their packets are 
   disproportionately selected or not selected.  For random Sampling, a 
   cryptographically strong random number generator should be used in 



D'Antonio, et al.       Expires October 25, 2012               [Page 32] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   order to prevent that an advisory can predict the selection decision 
   [GoRe07]. 

   Further security threats can occur when Sampling parameters are 
   configured or communicated to other entities.  The protocol(s) for 
   the configuration and reporting of Sampling parameters are out of 
   scope of this document.  Nevertheless, a set of initial requirements 
   for future configuration and reporting protocols are stated below: 

   1.  Protection against disclosure of configuration information: Flow 

Flow -> Flow Sampling



       selection configuration information describes the selection 
       process and its parameters.  This information can be useful to 
       attackers.  Attackers may craft packets that never fit the 
       selection criteria in order to prevent flows to be seen by the 
       selection process.  They can also craft a lot of packets that fit 
       the selection criteria and overload or bias subsequent processes. 
       Therefore any transmission of configuration data (e.g., to 
       configure a process or to report its actual status) should be 
       protected by encryption. 

   2.  Protection against modification of configuration information: If 
       wrong configuration information is sent to the flow selection 
       process, it can lead to a malfunction of the selection process. 
       Also if wrong configuration information is reported from the 
       selection process to other processes it can lead to wrong 
       estimations at subsequent processes.  Therefore any protocol that 
       transmits configuration information should prevent that an 
       attacker can modify configuration information.  Data integrity 
       can be achieved by authenticating the data. 

   3.  Protection against malicious nodes sending configuration 
       information: The remote configuration of flow selection methods 
       should be protected against access by unauthorized nodes.  This 
       can be achieved by access control lists at the selection devices 

selection devices? Do you mean IPFIX Exporter?



       and source authentication.  The reporting of configuration data 
       from a selection process has to be protected in the same way. 
       That means that also protocols that report configuration data 
       from the selection process to other processes need to protect 
       against unauthorized nodes reporting configuration information. 

   The security threats that originate from communicating configuration 
   information to and from selection processes cannot be assessed solely 
   with the information given in this document.  A further more detailed 
   assessment of security threats is necessary when a specific protocol 
   for the configuration or reporting configuration data is proposed. 






D'Antonio, et al.       Expires October 25, 2012               [Page 33] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


10.  Acknowledgments 

   We would like to thank the IPFIX group, especially Brian Trammell, 
   Paul Aitken and Benoit Claise for fruitful discussions and for 
   proofreading the document. 


11.  References 

11.1.  Normative References 

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate 
              Requirement Levels", BCP 14, RFC 2119, March 1997. 

   [RFC5101]  Claise, B., "Specification of the IP Flow Information 
              Export (IPFIX) Protocol for the Exchange of IP Traffic 
              Flow Information", RFC 5101, January 2008. 

   [RFC5102]  Quittek, J., Bryant, S., Claise, B., Aitken, P., and J. 
              Meyer, "Information Model for IP Flow Information Export", 
              RFC 5102, January 2008. 

   [RFC5475]  Zseby, T., Molina, M., Duffield, N., Niccolini, S., and F. 
              Raspall, "Sampling and Filtering Techniques for IP Packet 
              Selection", RFC 5475, March 2009. 

   [RFC5476]  Claise, B., Johnson, A., and J. Quittek, "Packet Sampling 
              (PSAMP) Protocol Specifications", RFC 5476, March 2009. 

11.2.  Informative References 

   [Bra75]    Brayer, K., "Evaluation of 32 Degree Polynomials in Error 
              Detection on the SATIN IV Autovon Error Patterns", 
              National Technical Information Service p.74, August 1975. 

   [CoHa08]   Cormode, G. and M. Hadjieleftheriou, "Finding frequent 
              items in data streams", Journal, Proceedings of the Very 
              Large DataBase Endowment VLDB Endowment, Volume 1 Issue 2, 
              August 2008, August 2008. 

   [DuLT01]   Duffield, N., Lund, C., and M. Thorup, "Charging from 
              Sampled Network Usage", ACM Internet Measurement Workshop 
              IMW 2001, San Francisco, USA, November 2001. 

   [EsVa01]   Estan, C. and G,. Varghese, "New Directions in Traffic 
              Measurement and Accounting: Focusing on the Elephants, 
              Ignoring the Mice", ACM SIGCOMM Internet Measurement 
              Workshop 2001, San Francisco (CA), November 2001. 



D'Antonio, et al.       Expires October 25, 2012               [Page 34] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   [KaPS03]   Karp, R., Papadimitriou, C., and S. S. Shenker, "A simple 
              algorithm for finding frequent elements in sets and 
              bags.", ACM Transactions on Database Systems, Volume 28, 
              51-55, 2003, March 2003. 

   [MSZC10]   Mai, J., Sridharan, A., Zang, H., and C. Chuah, "Fast 
              Filtered Sampling", Computer Networks Volume 54, Issue 11, 
              Pages 1885-1898, ISSN 1389-1286, January 2010. 

   [MaMo02]   Manku, G. and R. Motwani, "Approximate Frequency Counts 
              over Data Streams", Proceedings of the International 
              Conference on Very large DataBases (VLDB) pages 346--357, 
              2002, Hong Kong, China, 2002. 

   [RFC3917]  Quittek, J., Zseby, T., Claise, B., and S. Zander, 
              "Requirements for IP Flow Information Export (IPFIX)", 
              RFC 3917, October 2004. 

   [RFC5226]  Narten, T. and H. Alvestrand, "Guidelines for Writing an 
              IANA Considerations Section in RFCs", BCP 26, RFC 5226, 
              May 2008. 

   [RFC5470]  Sadasivan, G., Brownlee, N., Claise, B., and J. Quittek, 
              "Architecture for IP Flow Information Export", RFC 5470, 
              March 2009. 

   [RFC6183]  Kobayashi, A., Claise, B., Muenz, G., and K. Ishibashi, 
              "IP Flow Information Export (IPFIX) Mediation: Framework", 
              RFC 6183, April 2011. 

   [iana-ipfix-assignments] 
              "IP Flow Information Export Information Elements", 2007, 
               <http://www.iana.org/assignments/ipfix/ipfix.xml>
<http://www.iana.org/assignments/ipfix/ipfix.xml>. 


Authors' Addresses 

   Salvatore D'Antonio 
   University of Napoli "Parthenope" 
   Centro Direzionale di Napoli Is. C4 
   Naples  80143 
   Italy 

   Phone: [phone] 
   Email: [e-mail] 






D'Antonio, et al.       Expires October 25, 2012               [Page 35] 
 
Internet-Draft          Flow Selection Techniques             April 2012 


   Tanja Zseby 
   CAIDA/FhG FOKUS 
   San Diego Supercomputer Center (SDSC) 
   University of California, San Diego (UCSD) 
   9500 Gilman Drive 
   La Jolla  CA 92093-0505 
   USA 

   Email: [e-mail] 


   Christian Henke 
   Tektronix Communication Berlin 
   Wohlrabedamm 32 
   Berlin  13629 
   Germany 

   Phone: [phone] 
   Email: [e-mail] 


   Lorenzo Peluso 
   University of Napoli 
   Via Claudio 21 
   Napoli  80125 
   Italy 

   Phone: [phone] 
   Email: [e-mail] 






















D'Antonio, et al.       Expires October 25, 2012               [Page 36] 



 

  _____  

Nessun virus nel messaggio.
Controllato da AVG - www.avg.com
Versione: 2012.0.1913 / Database dei virus: 2425/5036 - Data di rilascio:
31/05/2012