Re: [IPFIX] WG: I-D Action: draft-ietf-ipfix-flow-selection-tech-06.txt

[Paul Aitken <[e-mail]>]

Brian,

The flow count in field #3 follows the same semantics as the octet count 
in field #1 and the packet count in field #2.

We use it internally in our "top talkers" feature to count the number of 
aggregated flows, though we don't currently export it.

As to the terminology issue: a "flow" is the set of packets which are 
observed at the input to the metering process, while a "flow record" is 
the output from the metering process. I look forward to finding out what 
"Flow Entries" are :-)

P.


On 27/05/11 12:11, Brian Trammell wrote:
> Hi, Benoit,
>
> I disagree, I think, for two reasons.
>
> First, if IE3 is defined with parallel semantics to IE1 and IE2 (octet and packet delta count), it should provide _delta_ count, not _total_ count, semantics (i.e., subsequent exports are a delta from last export, not a replacement value).
>
> Second, this is an IE with a much more restricted semantic meaning; it refers to Flow Entries (a new bit of flow selection terminology, the difference between which and "Flow" and "Flow Record" is still a bit unclear to me) that are given as _input_ to a (undefined but I presume contextually resolvable) Flow Selection Process.
>
> This is somewhat different than the Flow analog of Packet and Octet Delta Count.
>
> (However, if IE3 was _not_ defined by Cisco with this in mind, and really means "the total number of flows seen at the (Metering Process or analogue) _before_ flow processing", objection withdrawn.)
>
> Best regards,
>
> Brian
>
> On May 27, 2011, at 12:38 PM, Benoit Claise wrote:
>
>> Dear Tanja,
>>
>> One quick remark (a thorough review should follow) regarding this I.E.
>>
>> 7.5.  fsFlowEntryTotalCount
>>
>>    Description:
>>
>>       This Information Element specifies the current number of all Flow
>>       Entries that form the parent population as input to the Flow
>>       Selection Process.
>>
>>    Abstract Data Type: unsigned64
>>
>>    ElementId: TBD5
>>
>>    Status: Proposed
>>
>>    Units: Flow Entries
>>
>>
>> In Cisco, years ago, we have defined the I.E. #3 with the same concept. It is used when we do router-based aggregation, which is exported with NetFlow version 8. It represents the number of flow that we're given as input to the router-based aggregation process.
>> See http://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9_ps6601_Products_White_Paper.html (which btw, we're busy updating)
>>
>> So this TBD5 should be 3.  Does it make sense?
>>
>> Regards, Benoit.
>>> Hi all,
>>>
>>> we worked on a major revision of the flow selection draft and just submitted a new version (see below). Among other changes we now provide a much improved classification of methods, which is more consistent with the PSAMP packet selection documents.
>>> Many thanks to all who provided comments.
>>>
>>> Changes:
>>>   - Flow recording process removed
>>>   - Clarification of difference between flow selection and packet selection
>>>   - Distinguished flow filtering and flow sampling similar to PSAMP
>>>   - Flow selection in the metering process either before aggregation or after aggregation
>>>   - Integrated Flow-state dependent packet selection
>>>   - Supporting arbitrary  key space subsets with property match flow filtering
>>>   - Removed timestamp IEs for reporting
>>>   - Mediator integrated in first picture
>>>   - Configuration parameters and IEs redefined and re-named
>>>   - Many rewording, shortened several paragraphs to improve readability
>>>
>>> Kind regards
>>> Tanja
>>>
>>>
>>> -----Ursprüngliche Nachricht-----
>>> Von: [e-mail] [mailto:[e-mail]] Im Auftrag von [e-mail]
>>> Gesendet: Montag, 23. Mai 2011 11:21
>>> An: [e-mail]
>>> Cc: [e-mail]
>>> Betreff: [IPFIX] I-D Action: draft-ietf-ipfix-flow-selection-tech-06.txt
>>>
>>> A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the IP Flow Information Export Working Group of the IETF.
>>>
>>> 	Title           : Flow Selection Techniques
>>> 	Author(s)       : Salvatore D'Antonio
>>>                            Tanja Zseby
>>>                            Christian Henke
>>>                            Lorenzo Peluso
>>> 	Filename        : draft-ietf-ipfix-flow-selection-tech-06.txt
>>> 	Pages           : 25
>>> 	Date            : 2011-05-23
>>>
>>>     Flow selection is the process of selecting a subset of flows from all
>>>     flows observed at an observation point.  Flow selection reduces the
>>>     effort of post-processing flow data and transferring flow records.
>>>     This document describes motivations for flow selection and presents
>>>     flow selection techniques.  It provides an information model for
>>>     configuring flow selection techniques and discusses what information
>>>     about a flow selection process should be exported.
>>>
>>>
>>>
>>> A URL for this Internet-Draft is:
>>> http://www.ietf.org/internet-drafts/draft-ietf-ipfix-flow-selection-tech-06.txt
>>>
>>> Internet-Drafts are also available by anonymous FTP at:
>>> ftp://ftp.ietf.org/internet-drafts/
>>>
>>> This Internet-Draft can be retrieved at:
>>> ftp://ftp.ietf.org/internet-drafts/draft-ietf-ipfix-flow-selection-tech-06.txt
>>> _______________________________________________
>>> IPFIX mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/ipfix
>>> _______________________________________________
>>> IPFIX mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/ipfix
>> _______________________________________________
>> IPFIX mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/ipfix
> _______________________________________________
> IPFIX mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ipfix