Re: [IPFIX] IPFIX export: SNMP versus physical Interface

Andrew Feren <andrewf@plixer.com> Tue, 26 July 2011 14:54 UTC

Return-Path: <andrewf@plixer.com>
X-Original-To: ipfix@ietfa.amsl.com
Delivered-To: ipfix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF7E511E80AD for <ipfix@ietfa.amsl.com>; Tue, 26 Jul 2011 07:54:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uTeMlWy-1mNc for <ipfix@ietfa.amsl.com>; Tue, 26 Jul 2011 07:54:54 -0700 (PDT)
Received: from smtp.plixer.com (smtp.plixer.com [66.186.184.193]) by ietfa.amsl.com (Postfix) with ESMTP id F01B011E80A3 for <ipfix@ietf.org>; Tue, 26 Jul 2011 07:54:53 -0700 (PDT)
Received: from [130.129.17.159] ([130.129.17.159]) by smtp.plixer.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Tue, 26 Jul 2011 10:54:53 -0400
Message-ID: <4E2ED53C.6070803@plixer.com>
Date: Tue, 26 Jul 2011 10:54:52 -0400
From: Andrew Feren <andrewf@plixer.com>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.18) Gecko/20110617 Lightning/1.0b2 Thunderbird/3.1.11
MIME-Version: 1.0
To: ipfix@ietf.org
References: <4E2EB359.8070309@cisco.com> <20110726131514.GA6421@elstar.local> <4E2EBFEA.7080109@cisco.com>
In-Reply-To: <4E2EBFEA.7080109@cisco.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-OriginalArrivalTime: 26 Jul 2011 14:54:53.0404 (UTC) FILETIME=[FA1081C0:01CC4BA3]
Subject: Re: [IPFIX] IPFIX export: SNMP versus physical Interface
X-BeenThere: ipfix@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: IPFIX WG discussion list <ipfix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipfix>, <mailto:ipfix-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipfix>
List-Post: <mailto:ipfix@ietf.org>
List-Help: <mailto:ipfix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipfix>, <mailto:ipfix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Jul 2011 14:54:54 -0000

On 07/26/2011 09:23 AM, Paul Aitken wrote:
> Juergen,
>
>> On Tue, Jul 26, 2011 at 01:30:17PM +0100, Paul Aitken wrote:
>>> Dear IPFIXers,
>>>
>>> I noticed that the definitions of fields 10 and 14, and fields 252
>>> and 253 are confusingly similar. See below.
>>>
>>> Cisco uses fields 10 and 14 to export the logical or virtual
>>> interface (eg. SVI, tunnel), while fields 252 and 253 export the
>>> actual physical interface.
>>>
>>> For example, if we have an SVI configured on a VLAN, the SNMP index
>>> of the SVI would be exported using fields 10 and 14, while the SNMP
>>> index of the physical port in that VLAN would be exported with
>>> fields 252 and 253.
>>>
>>> So I propose to update fields 10 and 11 to say, "the index of the
>>> logical or virtual interface ...", to contrast with 252 and 253
>>> which say, "The index of a networking device's physical interface
>>> ...".
>> Not sure this is right because if I only have a physical interface and
>> no logical/virtual interfaces, I think I still want to report the
>> physical interface in fields 10 and 11, no? I am not sure why there is
>> actually a need to change something here.
>
> In this case, physical == logical, so either 10/14 or 252/253 would be
> correct.
>
> We've always used 10/14 in this case.
>
> P.
>
>From a collection and reporting perspective the important difference for
me in these two sets of definitions isn't physical vs maybe not
physical, but that "The value matches the value of managed object
'ifIndex' as defined in RFC 2863 ..." and everything that implies for
elements 10/14.

So I agree with Paul's approach.  There are situations where either
10/14 or 252/253 could be used, but if RFC 2863 applies to your
interface use 10/14.

Maybe rather than replacing "IP interface" with "logical or virtual
interface" it could just be "interface" or "network interface".

On a related not I'm not sure the references for 252/253 need to refer
readers to "[RFC2863] for the definition of the ifIndex object."

-Andrew