IP Flow Information Export S. Kashima Internet-Draft NTT Intended status: Standards Track October 11, 2010 Expires: April 14, 2011 Information Elements for Short Timer draft-kashima-ipfix-short-timer-00 Abstract This document describes Information Elements related to short timer. They are used by the IP Flow Information Export (IPFIX) protocol for encoding timer paramerters required for traffic measurment of volume change in a short time. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on April 14, 2011. Copyright Notice Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Kashima Expires April 14, 2011 [Page 1] Internet-Draft Short Timer Information Elements October 2010 This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The person(s) controlling the copyright in some of this material may not have granted the IETF Trust the right to allow modifications of such material outside the IETF Standards Process. Without obtaining an adequate license from the person(s) controlling the copyright in such materials, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process, except to format it for publication as an RFC or to translate it into languages other than English. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2.1. IPFIX Documents Overview . . . . . . . . . . . . . . . . . 3 2.2. PSAMP Documents Overview . . . . . . . . . . . . . . . . . 4 3. Existing Information Elements . . . . . . . . . . . . . . . . . 4 4. New Information Elements . . . . . . . . . . . . . . . . . . . 6 4.1. flowActiveTimeoutMilliseconds . . . . . . . . . . . . . . . 6 4.2. flowIdleTimeoutMilliseconds . . . . . . . . . . . . . . . . 6 5. Security Considerations . . . . . . . . . . . . . . . . . . . . 6 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 7 7. References . . . . . . . . . . . . . . . . . . . . . . . . . . 7 7.1. Normative References . . . . . . . . . . . . . . . . . . . 7 7.2. Informative References . . . . . . . . . . . . . . . . . . 7 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 8 Kashima Expires April 14, 2011 [Page 2] Internet-Draft Short Timer Information Elements October 2010 1. Introduction The IPFIX Information Model [RFC5102] defines an extensible list of Information Elements which may be transmitted by the IPFIX protocol [RFC5102]. This document lists a series of new Information Elements to update the IPFIX Information Model, and acts as the persistent publication medium requested in the IANA considerations section of the IPFIX Information Model [RFC5102] ("The specification of new IPFIX Information Elements MUST use the template specified in section 2.1 and MUST be published using a well established and persistent publication medium"). 2. Terminology IPFIX-specific terminology used in this document is defined in section 2 of the IPFIX Protocol [RFC5101]. As in the IPFIX Protocol [RFC5101], these IPFIX-specific terms have the first letter of a word capitalized when used in this document. 2.1. IPFIX Documents Overview The IPFIX Protocol [RFC5101] provides network administrators with access to IP flow information. The architecture for the export of measured IP flow information out of an IPFIX exporting process to a collecting process is defined in the IPFIX Architecture [RFC5470], per the requirements defined in RFC 3917 [RFC3917]. The IPFIX Architecture [RFC5470] specifies how IPFIX Data Records and Templates are carried via a congestion-aware transport protocol from IPFIX Exporting Processes to IPFIX Collecting Processes. IPFIX has a formal description of IPFIX Information Elements, their name, type and additional semantic information, as specified in the IPFIX Information Model [RFC5102]. Finally the IPFIX Applicability Statement [RFC5472] describes what type of applications can use the IPFIX protocol and how they can use the information provided. It furthermore shows how the IPFIX framework relates to other architectures and frameworks. Kashima Expires April 14, 2011 [Page 3] Internet-Draft Short Timer Information Elements October 2010 2.2. PSAMP Documents Overview The document "A Framework for Packet Selection and Reporting" [RFC5474], describes the PSAMP framework for network elements to selectsubsets of packets by statistical and other methods, and to export a stream of reports on the selected packets to a collector. The set of packet selection techniques (sampling, filtering, and hashing) supported by PSAMP are described in "Sampling and Filtering Techniques for IP Packet Selection" [RFC5475]. The PSAMP protocol [RFC5476] specifies the export of packet information from a PSAMP Exporting Process to a PSAMP Collecting Process. Like IPFIX, PSAMP has a formal description of its information elements, their name, type and additional semantic information. The PSAMP information model is defined in [RFC5477]. Finally [I-D.ietf-ipfix-psamp-mib] describes the PSAMP Management Information Base. 3. Existing Information Elements The following are existing Information Elements related to time stamp or time duration. Becasue one Application of IPFIX is QoS (Quality of service) monitoring, they support units smaller than seconds. For example, we can use observationTimeMilliseconds for delay measurements. Kashima Expires April 14, 2011 [Page 4] Internet-Draft Short Timer Information Elements October 2010 +------+-------------------------------+--------------+ | ID | Name | Units | +------+-------------------------------+--------------+ | 21 | flowEndSysUpTime | milliseconds | | 22 | flowStartSysUpTime | milliseconds | | 36 | flowActiveTimeout | seconds | | 37 | flowIdleTimeout | seconds | | 150 | flowStartSeconds | seconds | | 151 | flowEndSeconds | seconds | | 152 | flowStartMilliseconds | milliseconds | | 153 | flowEndMilliseconds | milliseconds | | 154 | flowStartMicroseconds | microseconds | | 155 | flowEndMicroseconds | microseconds | | 156 | flowStartNanoseconds | nanoseconds | | 157 | flowEndNanoseconds | nanoseconds | | 158 | flowStartDeltaMicroseconds | microseconds | | 159 | flowEndDeltaMicroseconds | microseconds | | 160 | systemInitTimeMilliseconds | milliseconds | | 161 | flowDurationMilliseconds | milliseconds | | 162 | flowDurationMicroseconds | microseconds | | 258 | collectionTimeMilliseconds | milliseconds | | 260 | maxExportSeconds | seconds | | 261 | maxFlowEndSeconds | seconds | | 264 | minExportSeconds | seconds | | 265 | minFlowStartSeconds | seconds | | 268 | maxFlowEndMicroseconds | microseconds | | 269 | maxFlowEndMilliseconds | milliseconds | | 270 | maxFlowEndNanoseconds | nanoseconds | | 271 | minFlowStartMicroseconds | microseconds | | 272 | minFlowStartMilliseconds | milliseconds | | 273 | minFlowStartNanoseconds | nanoseconds | | 305 | samplingTimeInterval | microseconds | | 306 | samplingTimeSpace | microseconds | | 322 | observationTimeSeconds | seconds | | 323 | observationTimeMilliseconds | milliseconds | | 324 | observationTimeMicroseconds | microseconds | | 325 | observationTimeNanoseconds | nanoseconds | +------+-------------------------------+--------------+ According to a diversification of multimedia application and an aggregation of server in data center, we are facing to measure bursty traffic that causes packets loss and delay jitter. In order to measure bursty traffic with IPFIX/PSAMP, timers shorter than one second are required. Kashima Expires April 14, 2011 [Page 5] Internet-Draft Short Timer Information Elements October 2010 4. New Information Elements The following Information Elements are necessary for enabling the IPFIX/PSAMP traffic measurment of volume change in a short time. +------+-------------------------------+--------------+ | ID | Name | Units | +------+-------------------------------+--------------+ | TBD1 | flowActiveTimeoutMilliseconds | milliseconds | | TBD2 | flowIdleTimeoutMilliseconds | milliseconds | +------+-------------------------------+--------------+ 4.1. flowActiveTimeoutMilliseconds Description: The number of milliseconds after which an active Flow is timed out anyway, even if there is still a continuous flow of packets. Abstract Data Type: unsigned16 ElementId: TDB1 Status: current Units: milliseconds 4.2. flowIdleTimeoutMilliseconds Description: A Flow is considered to be timed out if no packets belonging to the Flow have been observed for the number of seconds specified by this field. Abstract Data Type: unsigned16 ElementId: TDB1 Status: current Units: milliseconds 5. Security Considerations The recommendations in this document do not introduce any additional Kashima Expires April 14, 2011 [Page 6] Internet-Draft Short Timer Information Elements October 2010 security issues to those already mentioned in [RFC5101] and [RFC5477]. 6. IANA Considerations This document requires an ElementId assignment to be made by IANA. 7. References 7.1. Normative References 7.2. Informative References [I-D.ietf-ipfix-psamp-mib] Dietz, T., Claise, B., and J. Quittek, "Definitions of Managed Objects for Packet Sampling", draft-ietf-ipfix-psamp-mib-01 (work in progress), July 2010. [RFC3917] Quittek, J., Zseby, T., Claise, B., and S. Zander, "Requirements for IP Flow Information Export (IPFIX)", RFC 3917, October 2004. [RFC5101] Claise, B., "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information", RFC 5101, January 2008. [RFC5102] Quittek, J., Bryant, S., Claise, B., Aitken, P., and J. Meyer, "Information Model for IP Flow Information Export", RFC 5102, January 2008. [RFC5470] Sadasivan, G., Brownlee, N., Claise, B., and J. Quittek, "Architecture for IP Flow Information Export", RFC 5470, March 2009. [RFC5472] Zseby, T., Boschi, E., Brownlee, N., and B. Claise, "IP Flow Information Export (IPFIX) Applicability", RFC 5472, March 2009. [RFC5474] Duffield, N., Chiou, D., Claise, B., Greenberg, A., Grossglauser, M., and J. Rexford, "A Framework for Packet Selection and Reporting", RFC 5474, March 2009. [RFC5475] Zseby, T., Molina, M., Duffield, N., Niccolini, S., and F. Raspall, "Sampling and Filtering Techniques for IP Packet Selection", RFC 5475, March 2009. Kashima Expires April 14, 2011 [Page 7] Internet-Draft Short Timer Information Elements October 2010 [RFC5476] Claise, B., Johnson, A., and J. Quittek, "Packet Sampling (PSAMP) Protocol Specifications", RFC 5476, March 2009. [RFC5477] Dietz, T., Claise, B., Aitken, P., Dressler, F., and G. Carle, "Information Model for Packet Sampling Exports", RFC 5477, March 2009. Author's Address Shingo Kashima NTT PF Lab. Midori-Cho 3-9-11 Musashino-shi, Tokyo 180-8585 Japan Phone: +81 422 59 3894 Email: kashima@nttv6.net Kashima Expires April 14, 2011 [Page 8]