summaryrefslogtreecommitdiff
path: root/doc/rfc/rfc5476.txt
diff options
context:
space:
mode:
Diffstat (limited to 'doc/rfc/rfc5476.txt')
-rw-r--r--doc/rfc/rfc5476.txt2523
1 files changed, 2523 insertions, 0 deletions
diff --git a/doc/rfc/rfc5476.txt b/doc/rfc/rfc5476.txt
new file mode 100644
index 0000000..c5c2d2d
--- /dev/null
+++ b/doc/rfc/rfc5476.txt
@@ -0,0 +1,2523 @@
+
+
+
+
+
+
+Network Working Group B. Claise, Ed.
+Request for Comments: 5476 A. Johnson
+Category: Standards Track Cisco Systems, Inc.
+ J. Quittek
+ NEC Europe Ltd.
+ March 2009
+
+
+ Packet Sampling (PSAMP) Protocol Specifications
+
+Status of This Memo
+
+ This document specifies an Internet standards track protocol for the
+ Internet community, and requests discussion and suggestions for
+ improvements. Please refer to the current edition of the "Internet
+ Official Protocol Standards" (STD 1) for the standardization state
+ and status of this protocol. Distribution of this memo is unlimited.
+
+Copyright Notice
+
+ Copyright (c) 2009 IETF Trust and the persons identified as the
+ document authors. All rights reserved.
+
+ This document is subject to BCP 78 and the IETF Trust's Legal
+ Provisions Relating to IETF Documents in effect on the date of
+ publication of this document (http://trustee.ietf.org/license-info).
+ Please review these documents carefully, as they describe your rights
+ and restrictions with respect to this document.
+
+ This document may contain material from IETF Documents or IETF
+ Contributions published or made publicly available before November
+ 10, 2008. The person(s) controlling the copyright in some of this
+ material may not have granted the IETF Trust the right to allow
+ modifications of such material outside the IETF Standards Process.
+ Without obtaining an adequate license from the person(s) controlling
+ the copyright in such materials, this document may not be modified
+ outside the IETF Standards Process, and derivative works of it may
+ not be created outside the IETF Standards Process, except to format
+ it for publication as an RFC or to translate it into languages other
+ than English.
+
+
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 1]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+Abstract
+
+ This document specifies the export of packet information from a
+ Packet SAMPling (PSAMP) Exporting Process to a PSAMP Collecting
+ Process. For export of packet information, the IP Flow Information
+ eXport (IPFIX) protocol is used, as both the IPFIX and PSAMP
+ architecture match very well, and the means provided by the IPFIX
+ protocol are sufficient. The document specifies in detail how the
+ IPFIX protocol is used for PSAMP export of packet information.
+
+Table of Contents
+
+ 1. Introduction ....................................................3
+ 1.1. Conventions Used in This Document ..........................3
+ 2. PSAMP Documents Overview ........................................4
+ 3. Terminology .....................................................4
+ 3.1. IPFIX Terminology ..........................................4
+ 3.2. PSAMP Terminology ..........................................5
+ 3.2.1. Packet Streams and Packet Content ...................5
+ 3.2.2. Selection Process ...................................6
+ 3.2.3. Reporting ...........................................7
+ 3.2.4. Metering Process ....................................8
+ 3.2.5. Exporting Process ...................................8
+ 3.2.6. PSAMP Device ........................................8
+ 3.2.7. Collector ...........................................8
+ 3.2.8. Selection Methods ...................................9
+ 3.3. IPFIX and PSAMP Terminology Comparison ....................11
+ 3.3.1. IPFIX and PSAMP Processes ..........................11
+ 3.3.2. Packet Report, Packet Interpretation, and
+ Data Record ........................................12
+ 4. Differences between PSAMP and IPFIX ............................12
+ 4.1. Architecture Point of View ................................12
+ 4.2. Protocol Point of View ....................................14
+ 4.3. Information Model Point of View ...........................14
+ 5. PSAMP Requirements versus the IPFIX Solution ...................14
+ 5.1. High-Level View of the Integration ........................15
+ 6. Using the IPFIX Protocol for PSAMP .............................16
+ 6.1. Selector ID ...............................................17
+ 6.2. The Selection Sequence ID .................................17
+ 6.3. The Exporting Process .....................................17
+ 6.4. Packet Report .............................................17
+ 6.4.1. Basic Packet Report ................................17
+ 6.4.2. Extended Packet Report .............................21
+ 6.5. Report Interpretation .....................................22
+ 6.5.1. Selection Sequence Report Interpretation ...........23
+ 6.5.2. Selector Report Interpretation .....................25
+ 6.5.2.1. Systematic Count-Based Sampling ...........25
+ 6.5.2.2. Systematic Time-Based Sampling ............27
+
+
+
+Claise, et al. Standards Track [Page 2]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ 6.5.2.3. Random n-out-of-N Sampling ................28
+ 6.5.2.4. Uniform Probabilistic Sampling ............29
+ 6.5.2.5. Property Match Filtering ..................31
+ 6.5.2.6. Hash-Based Filtering ......................33
+ 6.5.2.7. Other Selection Methods ...................36
+ 6.5.3. Selection Sequence Statistics Report
+ Interpretation .....................................37
+ 6.5.4. Accuracy Report Interpretation .....................39
+ 7. Security Considerations ........................................43
+ 8. IANA Considerations ............................................43
+ 8.1. IPFIX-Related Considerations ..............................43
+ 8.2. PSAMP-Related Considerations ..............................43
+ 9. References .....................................................44
+ 9.1. Normative References ......................................44
+ 9.2. Informative References ....................................44
+ 10. Acknowledgments ...............................................45
+
+1. Introduction
+
+ The name PSAMP is a contraction of the phrase "Packet Sampling". The
+ word "Sampling" captures the idea that only a subset of all packets
+ passing a network element will be selected for reporting. PSAMP
+ selection operations include random selection, deterministic
+ selection, and deterministic approximations to random selection
+ (Hash-based Selection).
+
+ The IP Flow Information eXport (IPFIX) protocol specified in
+ [RFC5101] exports IP traffic information [RFC5102] observed at
+ network devices. This matches the general protocol requirements
+ outlined in the PSAMP framework [RFC5474]. However, there are some
+ architectural differences between IPFIX and PSAMP in the requirements
+ for an export protocol. While the IPFIX architecture [RFC5470] is
+ focused on gathering and exporting IP traffic flow information, the
+ focus of the PSAMP framework [RFC5474] is on exporting information on
+ individual packets. This basic difference and a set of derived
+ differences in protocol requirements are outlined in Section 4.
+ Despite these differences, the IPFIX protocol is well suited for the
+ PSAMP protocol. Section 5 specifies how the IPFIX protocol is used
+ for the export of packet samples. Required extensions of the IPFIX
+ information model are specified in the PSAMP information model
+ [RFC5477].
+
+1.1. Conventions Used in This Document
+
+ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+ "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+ document are to be interpreted as described in RFC 2119 [RFC2119].
+
+
+
+
+Claise, et al. Standards Track [Page 3]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+2. PSAMP Documents Overview
+
+ This document is one out of a series of documents from the PSAMP
+ group.
+
+ [RFC5474]: "A Framework for Packet Selection and Reporting" describes
+ the PSAMP framework for network elements to select subsets of packets
+ by statistical and other methods, and to export a stream of reports
+ on the selected packets to a Collector.
+
+ [RFC5475]: "Sampling and Filtering Techniques for IP Packet
+ Selection" describes the set of packet selection techniques supported
+ by PSAMP.
+
+ RFC 5476 (this document): "Packet Sampling (PSAMP) Protocol
+ Specifications" specifies the export of packet information from a
+ PSAMP Exporting Process to a PSAMP Collecting Process.
+
+ [RFC5477]: "Information Model for Packet Sampling Exports" defines an
+ information and data model for PSAMP.
+
+3. Terminology
+
+ As the IPFIX export protocol is used to export the PSAMP information,
+ the relevant IPFIX terminology from [RFC5101] is copied over in this
+ document. All terms defined in this section have their first letter
+ capitalized when used in this document. The terminology summary
+ table in Section 3.1 gives a quick overview of the relationships
+ between the different IPFIX terms. The PSAMP terminology defined
+ here is fully consistent with all terms listed in [RFC5475] and
+ [RFC5474], but only definitions that are relevant to the PSAMP
+ protocol appear here. Section 3.3 applies the PSAMP terminology to
+ the IPFIX protocol terminology.
+
+3.1. IPFIX Terminology
+
+ IPFIX-specific terminology used in this document is defined in
+ Section 2 of [RFC5101]. The only exceptions are the Metering
+ Process, Exporting Process, and the Collector terms, which are
+ defined more precisely in the PSAMP terminology section. In this
+ document, as in [RFC5101], the first letter of each IPFIX-specific
+ term is capitalized.
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 4]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ +------------------+---------------------------------------------+
+ | | contents |
+ | +--------------------+------------------------+
+ | Set | Template | record |
+ +------------------+--------------------+------------------------+
+ | Data Set | / | Data Record(s) |
+ +------------------+--------------------+------------------------+
+ | Template Set | Template Record(s) | / |
+ +------------------+--------------------+------------------------+
+ | Options Template | Options Template | / |
+ | Set | Record(s) | |
+ +------------------+--------------------+------------------------+
+
+ Figure A: Terminology Summary Table
+
+3.2. PSAMP Terminology
+
+ The PSAMP terminology section has been copied from [RFC5475].
+
+3.2.1. Packet Streams and Packet Content
+
+ * Observed Packet Stream
+
+ The Observed Packet Stream is the set of all packets observed at
+ the Observation Point.
+
+ * Packet Stream
+
+ A Packet Stream denotes a set of packets from the Observed Packet
+ Stream that flows past some specified point within the Metering
+ Process. An example of a Packet Stream is the output of the
+ Selection Process. Note that packets selected from a stream,
+ e.g., by Sampling, do not necessarily possess a property by which
+ they can be distinguished from packets that have not been
+ selected. For this reason, the term "stream" is favored over
+ "flow", which is defined as a set of packets with common
+ properties [RFC3917].
+
+ * Packet Content
+
+ The Packet Content denotes the union of the packet header (which
+ includes link layer, network layer, and other encapsulation
+ headers) and the packet payload. Note that, depending on the
+ Observation Point, the link layer information might not be
+ available.
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 5]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+3.2.2. Selection Process
+
+ * Selection Process
+
+ A Selection Process takes the Observed Packet Stream as its input
+ and selects a subset of that stream as its output.
+
+ * Selection State
+
+ A Selection Process may maintain state information for use by the
+ Selection Process. At a given time, the Selection State may
+ depend on packets observed at and before that time, and other
+ variables. Examples include:
+
+ (i) sequence numbers of packets at the input of Selectors;
+
+ (ii) a timestamp of observation of the packet at the Observation
+ Point;
+
+ (iii) iterators for pseudorandom number generators;
+
+ (iv) hash values calculated during selection;
+
+ (v) indicators of whether the packet was selected by a given
+ Selector.
+
+ Selection Processes may change portions of the Selection State as
+ a result of processing a packet. Selection state for a packet is
+ to reflect the state after processing the packet.
+
+ * Selector
+
+ A Selector defines the action of a Selection Process on a single
+ packet of its input. If selected, the packet becomes an element
+ of the output Packet Stream.
+
+ The Selector can make use of the following information in
+ determining whether a packet is selected:
+
+ (i) the Packet Content;
+
+ (ii) information derived from the packet's treatment at the
+ Observation Point;
+
+ (iii) any selection state that may be maintained by the Selection
+ Process.
+
+
+
+
+
+Claise, et al. Standards Track [Page 6]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ * Composite Selector
+
+ A Composite Selector is an ordered composition of Selectors, in
+ which the output Packet Stream issuing from one Selector forms the
+ input Packet Stream to the succeeding Selector.
+
+ * Primitive Selector
+
+ A Selector is primitive if it is not a Composite Selector.
+
+ * Selector ID
+
+ The Selector ID is the unique ID identifying a Primitive Selector.
+ The ID is unique within the Observation Domain.
+
+ * Selection Sequence
+
+ From all the packets observed at an Observation Point, only a few
+ packets are selected by one or more Selectors. The Selection
+ Sequence is a unique value per Observation Domain describing the
+ Observation Point and the Selector IDs through which the packets
+ are selected.
+
+3.2.3. Reporting
+
+ * Packet Reports
+
+ Packet Reports comprise a configurable subset of a packet's input
+ to the Selection Process, including the Packet Content,
+ information relating to its treatment (for example, the output
+ interface), and its associated selection state (for example, a
+ hash of the Packet Content).
+
+ * Report Interpretation
+
+ Report Interpretation comprises subsidiary information, relating
+ to one or more packets, that is used for interpretation of their
+ Packet Reports. Examples include configuration parameters of the
+ Selection Process.
+
+ * Report Stream
+
+ The Report Stream is the output of a Metering Process, comprising
+ two distinguished types of information: Packet Reports and Report
+ Interpretation.
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 7]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+3.2.4. Metering Process
+
+ * Metering Process
+
+ A Metering Process selects packets from the Observed Packet Stream
+ using a Selection Process, and produces as output a Report Stream
+ concerning the selected packets.
+
+ The PSAMP Metering Process can be viewed as analogous to the IPFIX
+ Metering Process [RFC5101], which produces Flow Records as its
+ output, with the difference that the PSAMP Metering Process always
+ contains a Selection Process. The relationship between PSAMP and
+ IPFIX is further described in [RFC5477] and [RFC5474].
+
+3.2.5. Exporting Process
+
+ * Exporting Process
+
+ An Exporting Process sends, in the form of Export Packets, the
+ output of one or more Metering Processes to one or more
+ Collectors.
+
+ * Export Packet
+
+ An Export Packet is a combination of Report Interpretation(s)
+ and/or one or more Packet Reports that are bundled by the
+ Exporting Process into an Export Packet for exporting to a
+ Collector.
+
+3.2.6. PSAMP Device
+
+ * PSAMP Device
+
+ A PSAMP Device is a device hosting at least an Observation Point,
+ a Selection Process, and an Exporting Process. Typically,
+ corresponding Observation Point(s), Selection Process(es), and
+ Exporting Process(es) are co-located at this device, for example,
+ at a router.
+
+3.2.7. Collector
+
+ * Collector
+
+ A Collector receives a Report Stream exported by one or more
+ Exporting Processes. In some cases, the host of the Metering
+ and/or Exporting Processes may also serve as the Collector.
+
+
+
+
+
+Claise, et al. Standards Track [Page 8]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+3.2.8. Selection Methods
+
+ * Filtering
+
+ A filter is a Selector that selects a packet deterministically
+ based on the Packet Content, or its treatment, or functions of
+ these occurring in the Selection State. Two examples are:
+
+ (i) Property Match Filtering: A packet is selected if a
+ specific field in the packet equals a predefined value.
+
+ (ii) Hash-based Selection: A Hash Function is applied to the
+ Packet Content, and the packet is selected if the result
+ falls in a specified range.
+
+ * Sampling
+
+ A Selector that is not a filter is called a Sampling
+ operation. This reflects the intuitive notion that if the
+ selection of a packet cannot be determined from its content
+ alone, there must be some type of Sampling taking place.
+
+ * Content-Independent Sampling
+
+ A Sampling operation that does not use Packet Content (or
+ quantities derived from it) as the basis for selection is
+ called a Content-independent Sampling operation. Examples
+ include systematic Sampling, and uniform pseudorandom
+ Sampling driven by a pseudorandom number whose generation
+ is independent of Packet Content. Note that in Content-
+ independent Sampling, it is not necessary to access the
+ Packet Content in order to make the selection decision.
+
+ * Content-Dependent Sampling
+
+ A Sampling operation where selection is dependent on Packet
+ Content is called a Content-dependent Sampling operation.
+ An example is pseudorandom selection according to a
+ probability that depends on the contents of a packet field.
+ Note that this is not a filter, because the selection is
+ not deterministic.
+
+ * Hash Domain
+
+ A Hash Domain is a subset of the Packet Content and the
+ packet treatment, viewed as an N-bit string for some
+ positive integer N.
+
+
+
+
+Claise, et al. Standards Track [Page 9]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ * Hash Range
+
+ A Hash Range is a set of M-bit strings for some positive
+ integer M that define the range of values the result of the
+ hash operation can take.
+
+ * Hash Function
+
+ A Hash Function defines a deterministic map from the Hash
+ Domain into the Hash Range.
+
+ * Hash Selection Range
+
+ A Hash Selection Range is a subset of the Hash Range. The
+ packet is selected if the action of the Hash Function on
+ the Hash Domain for the packet yields a result in the Hash
+ Selection Range.
+
+ * Hash-based Selection
+
+ A Hash-based Selection is Filtering specified by a Hash
+ Domain, a Hash Function, a Hash Range, and a Hash Selection
+ Range.
+
+ * Approximative Selection
+
+ Selectors in any of the above categories may be
+ approximated by operations in the same or another category
+ for the purposes of implementation. For example, uniform
+ pseudorandom Sampling may be approximated by Hash-based
+ Selection, using a suitable Hash Function and Hash Domain.
+ In this case, the closeness of the approximation depends on
+ the choice of Hash Function and Hash Domain.
+
+ * Population
+
+ A Population is a Packet Stream, or a subset of a Packet
+ Stream. A Population can be considered as a base set from
+ which packets are selected. An example is all packets in
+ the Observed Packet Stream that are observed within some
+ specified time interval.
+
+ * Population Size
+
+ The Population Size is the number of all packets in the
+ Population.
+
+
+
+
+
+Claise, et al. Standards Track [Page 10]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ * Sample Size
+
+ The Sample Size is the number of packets selected from the
+ Population by a Selector.
+
+ * Configured Selection Fraction
+
+ The Configured Selection Fraction is the expected ratio of
+ the Sample Size to the Population Size, as based on the
+ configured selection parameters.
+
+ * Attained Selection Fraction
+
+ The Attained Selection Fraction is the ratio of the actual
+ Sample Size to the Population Size. For some Sampling
+ methods, the Attained Selection Fraction can differ from
+ the Configured Selection Fraction due to, for example, the
+ inherent statistical variability in Sampling decisions of
+ probabilistic Sampling and Hash-based Selection.
+ Nevertheless, for large Population Sizes and properly
+ configured Selectors, the Attained Selection Fraction
+ usually approaches the Configured Selection Fraction.
+
+3.3. IPFIX and PSAMP Terminology Comparison
+
+ The PSAMP terminology has been specified with an IPFIX background, as
+ PSAMP and IPFIX have similar terms. However, this section clarifies
+ the terms between the IPFIX and PSAMP terminology.
+
+3.3.1. IPFIX and PSAMP Processes
+
+ Figure B indicates the sequence of the IPFIX processes (Metering and
+ Exporting) within the PSAMP Device.
+
+ +------------------+
+ | Metering Process |
+ | +-----------+ | +-----------+
+ Observed | | Selection | | | Exporting |
+ Packet--->| | Process |--------->| Process |--->Collector
+ Stream | +-----------+ | +-----------+
+ +------------------+
+
+ Figure B: PSAMP Processes
+
+ The Selection Process, which takes an Observed Packet Stream as its
+ input, is an integral part of the Metering Process. The Selection
+ Process chooses which packets from its input Packet Stream will be
+
+
+
+
+Claise, et al. Standards Track [Page 11]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ reported on by the rest of the Metering Process. Note that a
+ "Process" is not necessarily implemented as a separate CPU thread.
+
+3.3.2. Packet Report, Packet Interpretation, and Data Record
+
+ The PSAMP terminology speaks of Packet Report and Packet
+ Interpretation, while the IPFIX terminology speaks of Data Record and
+ (Options) Template Record. The PSAMP Packet Report, which comprises
+ information about the observed packet, can be viewed as analogous to
+ the IPFIX Data Record defined by a Template Record. The PSAMP Report
+ Interpretation, which comprises subsidiary information used for the
+ interpretation of the Packet Reports, can be viewed as analogous to
+ the IPFIX Data Record defined by an Options Template Record. This
+ Options Template Record contains subsidiary information, applicable
+ to the observed packet sent into the PSAMP Packet Report.
+
+4. Differences between PSAMP and IPFIX
+
+ The output of the IPFIX working group relevant for this document is
+ structured into three documents:
+
+ - IP Flow information architecture [RFC5470]
+
+ - IPFIX protocol specifications [RFC5101]
+
+ - IP Flow information export information model [RFC5102]
+
+ In the following sections, we investigate the differences between
+ IPFIX and PSAMP for each of those aspects.
+
+4.1. Architecture Point of View
+
+ Traffic Flow measurement as described in the IPFIX requirements
+ [RFC3917] and the IPFIX architecture [RFC5470] can be separated into
+ two stages: packet processing and Flow processing. Figure C
+ illustrates these stages.
+
+ In stage 1, all processing steps act on packets. Packets are
+ captured, timestamped, selected by one or more selection steps, and
+ finally forwarded to packet classification that maps packets to
+ Flows. The packets' selection steps may include Filtering and
+ Sampling functions.
+
+ In stage 2, all processing steps act on Flows. After packets are
+ classified (mapped to Flows), Flows are generated (or updated if they
+ exist already). Flow generation and update steps may be performed
+ repeatedly for aggregating Flows. Finally, Flows are exported.
+
+
+
+
+Claise, et al. Standards Track [Page 12]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ Packet Sampling as described in the PSAMP framework [RFC5474] covers
+ only stage 1 of the IPFIX architecture with the packet classification
+ replaced by Packet Report export, while IPFIX covers stage 2 also, as
+ it generates Flow Records out of the selected packets.
+
+ IPFIX architecture PSAMP framework
+
+ packet header packet header
+ capturing \ capturing
+ | | |
+ timestamping | timestamping
+ | | |
+ v | v
+ +------>+ | stage 1: +------>+
+ | | > packet | |
+ | packet | processing | packet
+ | selection | | selection
+ | | | | |
+ +-------+ | +-------+
+ | | |
+ v | v
+ packet / Packet Report
+ classification \ export
+ | |
+ v |
+ +------>+ |
+ | | |
+ | Flow generation |
+ | and update | stage 2:
+ | | > Flow
+ | v | processing
+ | Flow |
+ | selection |
+ | | |
+ +-------+ |
+ | |
+ v |
+ Flow Record /
+ export
+
+ Figure C: Comparison of IPFIX Architecture and PSAMP Framework
+
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 13]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+4.2. Protocol Point of View
+
+ Concerning the protocol, the major difference between IPFIX and PSAMP
+ is that the IPFIX protocol exports Flow Records while the PSAMP
+ protocol exports Packet Reports. From a pure export point of view,
+ IPFIX will not distinguish a Flow Record composed of several packets
+ aggregated together from a Flow Record composed of a single packet.
+
+ So the PSAMP export can be seen as a special IPFIX Flow Record
+ containing information about a single packet.
+
+ All extensions of the IPFIX protocol that are required to satisfy the
+ PSAMP requirements have already been incorporated in the IPFIX
+ protocol [RFC5101], which was developed in parallel with the PSAMP
+ protocol. An example is the need for a data type for protocol fields
+ that have flexible length, such as an octet array. This was added to
+ the IPFIX protocol specification in order to meet the requirement of
+ the PSAMP protocol to report content of captured packets, for
+ example, the first octets of a packet.
+
+4.3. Information Model Point of View
+
+ From the information model point of view, the overlap between both
+ the IPFIX and PSAMP protocols is quite large. Most of the
+ Information Elements in the IPFIX protocol are also relevant for
+ exporting packet information, for example, all fields reporting
+ packet header properties. Only a few Information Elements, such as
+ observedFlowTotalCount (whose value will always be 1 for PSAMP),
+ etc., cannot be used in a meaningful way by the PSAMP protocol.
+ Also, IPFIX protocol requirements concerning stage 2 of Figure C do
+ not apply to the PSAMP Metering Process.
+
+ Further required extensions apply to the information model. Even if
+ the IPFIX charter speaks of Sampling, no Sampling-related Information
+ Elements are specified in [RFC5102]. The task of specifying them was
+ intentionally left for the PSAMP information model [RFC5477]. A set
+ of several additional fields is required for satisfying the
+ requirements for the PSAMP information model [RFC5475].
+
+ Exploiting the extensibility of the IPFIX information model, the
+ required extension is covered by the PSAMP information model
+ specified in [RFC5477].
+
+5. PSAMP Requirements versus the IPFIX Solution
+
+ The [RFC5474] contains PSAMP protocol requirements throughout the
+ document, with a special focus in Section 4, "Generic Requirements
+ for PSAMP", and its subsections.
+
+
+
+Claise, et al. Standards Track [Page 14]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ Section 4 of [RFC5474] describes one requirement that, if not
+ directly related to the export protocol, will put some constraints on
+ it. Parallel Measurements: multiple independent Selection Processes
+ at the same entity.
+
+ [RFC5474] also describes a series of requirements specifying the
+ different Information Elements that MUST and SHOULD be reported to
+ the Collector. Nevertheless, IPFIX, being a generic export protocol,
+ can export any Information Elements as long as they are described in
+ the information model. So these requirements are mainly targeted for
+ [RFC5477].
+
+ The PSAMP protocol specification meets almost all the protocol
+ requirements stated in the PSAMP framework document [RFC5474]:
+
+ * Extensibility
+
+ * Parallel selection processes
+
+ * Encrypted packets
+
+ * Indication of information loss
+
+ * Accuracy
+
+ * Privacy
+
+ * Timeliness
+
+ * Congestion avoidance
+
+ * Secure export
+
+ * Export rate limit
+
+ * Microsecond timestamp resolution
+
+ The only requirement that is not met is Export Packet compression.
+ With the choice of IPFIX as the PSAMP export protocol, the Export
+ Packet compression option mentioned in the Section 8.5 of the
+ framework document [RFC5474] is not addressed.
+
+5.1. High-Level View of the Integration
+
+ The Template Record in the Template Set is used to describe the
+ different PSAMP Information Elements that will be exported to the
+ Collector. The Collector decodes the Template Record in the Template
+ Set and knows which Information Elements to expect when it receives
+
+
+
+Claise, et al. Standards Track [Page 15]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ the Data Records in the PSAMP Packet Report Data Set. Typically, in
+ the base level of the PSAMP functionality, the Template Set will
+ contain the input sequence number, the packet fragment (some number
+ of contiguous bytes from the start of the packet or from the start of
+ the payload), and the Selection Sequence.
+
+ The Options Template Record in the Options Template Set is used to
+ describe the different PSAMP Information Elements that concern the
+ Metering Process itself: Sampling and/or Filtering functions, and the
+ associated parameters. The Collector decodes the Options Template
+ Records in the Options Template Set and knows which Information
+ Elements to expect when it receives the Data Records in the PSAMP
+ Report Interpretation Data Set. Typically, the Options Template
+ would contain the Selection Sequence, the Sampling or Filtering
+ functions, and the Sampling or Filtering associated parameters.
+
+ PSAMP requires all the different possibilities of the IPFIX protocol
+ specifications [RFC5101], that is, the three types of Sets (Data Set,
+ Template Set, and Options Templates Set) with the two types of
+ Template Records (Template Record and Options Template Record), as
+ described in Figure A. As a consequence, PSAMP can't rely on a
+ subset of the IPFIX protocol specifications described in [RFC5101].
+ The entire IPFIX protocol specifications [RFC5101] MUST be
+ implemented for the PSAMP protocol.
+
+6. Using the IPFIX Protocol for PSAMP
+
+ In this section, we describe the usage of the IPFIX protocol for
+ PSAMP. We describe the record formats and the additional
+ requirements that must be met. PSAMP uses two different types of
+ messages:
+
+ - Packet Reports
+
+ - Report Interpretation
+
+ The format of Packet Reports is defined in IPFIX Template Records.
+ The PSAMP data is transferred as Information Elements in IPFIX Data
+ Records as described by the Template Record. There are two different
+ types of Packet Reports. Basic Packet Reports contain only the basic
+ Information Elements required for PSAMP reporting. Extended Packet
+ Reports MAY contain other Information Elements, and do not
+ necessarily include Packet Content (See section 6.4.2).
+
+ The format of Report Interpretations is defined in the IPFIX Options
+ Template Record. The Information Elements are transferred in IPFIX
+ Data Records as described by the Options Template Record. There are
+ four different types of Report Interpretation messages:
+
+
+
+Claise, et al. Standards Track [Page 16]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ - Selection Sequence Report Interpretation
+
+ - Selector Report Interpretation
+
+ - Selection Sequence Statistics Report Interpretation
+
+ - Accuracy Report Interpretation
+
+ A description and examples about the usage of those reports are given
+ below.
+
+6.1. Selector ID
+
+ The Selector ID is the unique ID identifying a Primitive Selector.
+ Each Primitive Selector MUST have a unique ID within the Observation
+ Domain. The Selector ID is represented by the selectorId Information
+ Element [RFC5477].
+
+6.2. The Selection Sequence ID
+
+ From all the packets observed at an Observation Point, a subset of
+ packets is selected by one or more Selectors. The Selection Sequence
+ is the combination of an Observation Point and one or more
+ Selector(s) through which the packets are selected. The Selection
+ Sequence ID is a unique value representing that combination. The
+ Selection Sequence ID is represented by the selectionSequenceId
+ Information Element [RFC5477].
+
+6.3. The Exporting Process
+
+ An Exporting Process MUST be able to limit the export rate according
+ to a configurable value. The Exporting Process MAY limit the export
+ rate on a per Collecting Process basis.
+
+6.4. Packet Report
+
+ For each Selection Sequence, for each selected packet, a Packet
+ Report MUST be created. The format of the Packet Report is specified
+ in a Template Record contained in a Template Set.
+
+ There are two types of Packet Report, as described in [RFC5474]: the
+ basic Packet Report and the extended Packet Report.
+
+6.4.1. Basic Packet Report
+
+ For each selected packet, the Packet Report MUST contain the
+ following information:
+
+
+
+
+Claise, et al. Standards Track [Page 17]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ - The selectionSequenceId Information Element
+ If there is a digest function in the Selection Sequence, the Packet
+ Report MUST contain the hash value (digestHashValue Information
+ Element) generated by the digest Hash Function for each selected
+ packet. If there is more than one digest function, then each hash
+ value MUST be included in the same order as they appear in the
+ Selection Sequence. If there are no digest functions in the
+ Selection Sequence, no element for the digest needs to be sent.
+
+ - Some number of contiguous bytes from the start of the packet,
+ including the packet header (which includes link layer, network
+ layer, and other encapsulation headers) and some subsequent bytes
+ of the packet payload. Alternatively, the number of contiguous
+ bytes may start at the beginning of the payload. The
+ dataLinkFrameSection, mplsLabelStackSection,
+ mplsPayloadPacketSection, ipPacketSection, and
+ ipPayloadPacketSection PSAMP Information Elements are available for
+ this use.
+
+ For each selected packet, the Packet Report SHOULD contain a time-
+ related Information Element that matches the Metering Process time
+ accuracy. Typically, the observationTimeMicroseconds Information
+ Element. Other possible Information Elements are the
+ observationTimeSeconds, the observationTimeMilliseconds, or the
+ observationTimeNanoseconds.
+
+ In the Packet Report, the PSAMP Device MUST be capable of exporting
+ the number of observed packets and the number of packets selected by
+ each instance of its Primitive Selectors (as described by the
+ non-scope Information Elements of the Selection Sequence Statistics
+ Report Interpretation), although it MAY be a configurable option not
+ to include them. If exported, the Attained Selection Fraction may be
+ calculated precisely for the Observed Packet Stream. The Packet
+ Report MAY include only the final selector packetSelected, to act as
+ an index for that Selection Sequence in the Selection Sequence
+ Statistics Report Interpretation, which also allows the calculation
+ of the Attained Selection Fraction.
+
+ The contiguous Information Elements (dataLinkFrameSection,
+ mplsLabelStackSection, mplsPayloadPacketSection, ipPacketSection, and
+ ipPayloadPacketSection) MAY be encoded with a fixed-length field or
+ with a variable-sized field. If one of these Information Elements is
+ encoded with a fixed-length field whose length is too long for the
+ number of contiguous bytes in the selected packet, padding MUST NOT
+ be used. In this case, the Exporting Process MUST export the
+ information either in a new Template Record with the correct fixed-
+ length field or in a new Template Record with a variable-length
+ field.
+
+
+
+Claise, et al. Standards Track [Page 18]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ Here is an example of a basic Packet Report, with a
+ SelectionSequenceId value of 9 and dataLinkFrameSection Information
+ Element of 12 bytes, 0x4500 005B A174 0000 FF11 832E, encoded with a
+ fixed-length field.
+
+ IPFIX Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 2 | Length = 24 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 260 | Field Count = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | selectionSequenceId = 301 | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | digestHashValue = 326 | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | dataLinkFrameSection = 315 | Field Length = 12 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ |observationTimeMicroseconds=324| Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ The associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 260 | Length = 32 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 9 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 0x9123 0613 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 0x4500 005B |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 0xA174 0000 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 0xFF11 832E |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | observation time ... |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... encoded as dateTimeMicroSeconds [RFC5101] |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Figure D: Example of a Basic Packet Report
+
+
+
+
+
+Claise, et al. Standards Track [Page 19]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ Here is an example of a basic Packet Report, with a
+ SelectionSequenceId value of 9 and ipHeaderPacketSection Information
+ Element of 12 bytes, 0x4500 005B A174 0000 FF11 832E, encoded with a
+ variable-sized field.
+
+ IPFIX Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 2 | Length = 16 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 261 | Field Count = 2 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | selectionSequenceId = 301 | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ipHeaderPacketSection = 313 | Field Length = 65535 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ The associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 261 | Length = 21 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 9 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Length = 12 | 0x4500 ... |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... 005B | 0xA174 ... |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... 0000 | 0xFF11 ... |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... 832E |
+ +-+-+-+-+-+-+-+-+
+
+ Figure E: Example of a Basic Packet Report
+ with a Variable-Sized Field
+
+
+
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 20]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+6.4.2. Extended Packet Report
+
+ Alternatively to the basic Packet Report, the extended Packet Report
+ MAY contain other Information Elements related to the protocols used
+ in the packet (such as source and destination IP addresses), related
+ to the packet treatment (such as output interface, destination BGP
+ autonomous system [RFC4271]), or related to the Selection State
+ associated with the packet (such as timestamp, hash value).
+
+ It is envisaged that selection of fields for extended Packet Reports
+ may be used to reduce reporting bandwidth, in which case the option
+ to report some number of contiguous bytes from the start of the
+ packet, mandatory in the basic Packet Report, may not be exercised.
+ In this case, the Packet Content MAY be omitted. Note this
+ configuration is quite similar to an IPFIX Device for which a
+ Template Record containing information about a single packet is
+ reported.
+
+ Example of a detailed Extended Packet Report:
+
+ IPFIX Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 2 | Length = 32 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 261 | Field Count = 6 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ |0| selectionSequenceId = 301 | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ |0| sourceIPv4Address = 8 | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ |0| destinationIPv4Address = 12 | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ |0| totalLengthIPv4 = 190 | Field Length = 2 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ |0| tcpSourcePort = 182 | Field Length = 2 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ |0| tcpDestinationPort = 183 | Field Length = 2 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 21]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ The associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 261 | Length = 20 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 9 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 192.0.2.1 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 192.0.2.106 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 72 | 1372 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 80 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Figure F: Example of an Extended Packet Report
+
+6.5. Report Interpretation
+
+ To make full sense of the Packet Reports, there are a number of
+ additional pieces of information that must be communicated to the
+ Collector:
+
+ - The details about which Selectors and Observation Points are being
+ used within a Selection Sequence MUST be provided using the
+ Selection Sequence Report Interpretation.
+
+ - The configuration details of each Selector MUST be provided using
+ the Selector Report Interpretation.
+
+ - The Selector ID statistics MUST be provided using the Selection
+ Sequence Statistics Report Interpretation.
+
+ - The accuracies of the reported fields MUST be provided using the
+ Accuracy Report Interpretation.
+
+
+
+
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 22]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+6.5.1. Selection Sequence Report Interpretation
+
+ Each Packet Report contains a selectionSequenceId Information Element
+ that identifies the particular combination of Observation Point and
+ Selector(s) used for its selection. For every selectionSequenceId
+ Information Element in use, the PSAMP Device MUST export a Selection
+ Sequence Report Interpretation using an Options Template with the
+ following Information Elements:
+
+ Scope: selectionSequenceId
+ Non-Scope: one Information Element mapping the Observation Point
+ selectorId (one or more)
+
+ An Information Element representing the Observation Point would
+ typically be taken from the ingressInterface, egressInterface,
+ lineCardId, exporterIPv4Address, or exporterIPv6Address Information
+ Elements (specified in [RFC5102]), but is not limited to those: any
+ Information Element specified in [RFC5102] or [RFC5477] can
+ potentially be used. In case of more complex Observation Points
+ (such as a list of interfaces, a bus, etc.), a new Information
+ Element describing the new type of Observation Point must be
+ specified, along with an Options Template Record describing it in
+ more detail (if necessary).
+
+ If the packets are selected by a Composite Selector, the Selection
+ Sequence is composed of several Primitive Selectors. In such a case,
+ the Selection Sequence Report Interpretation MUST contain the list of
+ all the Primitive Selector IDs in the Selection Sequence. If
+ multiple Selectors are contained in the Selection Sequence Report
+ Interpretation, the selectorId's MUST be identified in the order they
+ are used.
+
+ Example of two Selection Sequences:
+
+ Selection Sequence 7 (Filter->Sampling):
+ ingressInterface 5
+ selectorId 5 (Filter, match IPV4SourceAddress 192.0.2.1)
+ selectorId 10 (Sampler, Random 1 out-of ten)
+
+ Selection Sequence 9 (Sampling->Filtering):
+ ingressInterface 5
+ selectorId 10 (Sampler, Random 1 out-of ten)
+ selectorId 5 (Filter, match IPV4SourceAddress 192.0.2.1)
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 23]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ IPFIX Options Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 3 | Length = 26 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 262 | Field Count = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope Field Count = 1 |0| selectionSequenceId = 301 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope 1 Length = 4 |0| ingressInterface = 10 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| selectorId = 302 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| selectorId = 302 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ The associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 262 | Length = 36 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 7 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 5 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 5 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 10 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 9 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 5 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 10 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 5 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Figure G: Example of a Selection Sequence Report Interpretation
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 24]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ Notes:
+
+ * There are two Records here in the same Data Set. Each record
+ defines a different Selection Sequence.
+
+ * If, for example, a different Selection Sequence is composed of
+ three Selectors, then a different Options Template with three
+ selectorId Information Elements (instead of two) must be used.
+
+6.5.2. Selector Report Interpretation
+
+ An IPFIX Data Record, defined by an Options Template Record, MUST be
+ used to send the configuration details of every Selector in use. The
+ Options Template Record MUST contain the selectorId Information
+ Element as the Scope field and the SelectorAlgorithm Information
+ Element followed by some specific configuration parameters:
+
+ Scope: selectorId
+ Non-scope: selectorAlgorithm
+ algorithm-specific Information Elements
+
+ The algorithm-specific Information Elements are specified in the
+ following subsections, depending on the selection method represented
+ by the value of the selectorAlgorithm [RFC5477].
+
+6.5.2.1. Systematic Count-Based Sampling
+
+ In systematic count-based Sampling, the start and stop triggers for
+ the Sampling interval are defined in accordance with the spatial
+ packet position (packet count) [RFC5475].
+
+ The REQUIRED algorithm-specific Information Elements in the case of
+ systematic count-based Sampling are:
+
+ samplingPacketInterval: number of packets selected in a row
+ samplingPacketSpace: number of packets between selections
+
+ Example of a simple 1 out-of 10 systematic count-based Selector
+ definition, where the samplingPacketInterval is 1 and the
+ samplingPacketSpace is 9.
+
+
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 25]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ IPFIX Options Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 3 | Length = 26 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 263 | Field Count = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope Field Count = 1 |0| selectorId = 302 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope 1 Length = 4 |0| selectorAlgorithm = 304 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 1 |0|samplingPacketInterval = 305 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 1 |0| samplingPacketSpace = 306 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 1 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 263 | Length = 11 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 15 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 1 | 1 | 9 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Figure H: Example of the Selector Report Interpretation
+ for Systematic Count-Based Sampling
+
+ Notes:
+
+ * A selectorAlgorithm value of 1 represents systematic count-based
+ Sampling.
+
+ * samplingPacketInterval and samplingPacketSpace are of type
+ unsigned32 but are compressed down to one octet here, as allowed by
+ the IPFIX protocol specifications [RFC5101].
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 26]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+6.5.2.2. Systematic Time-Based Sampling
+
+ In systematic time-based Sampling, the start and stop triggers are
+ used to define the Sampling intervals [RFC5475]. The REQUIRED
+ algorithm-specific Information Elements in the case of systematic
+ time-based Sampling are:
+
+ samplingTimeInterval: time (in microseconds) when packets are
+ selected
+ samplingTimeSpace: time (in microseconds) between selections
+
+ Example of a 100 microsecond out-of 1000 microsecond systematic
+ time-based Selector definition, where the samplingTimeInterval is 100
+ and the samplingTimeSpace is 900.
+
+ IPFIX Options Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 3 | Length = 26 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 264 | Field Count = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope Field Count = 1 |0| selectorId = 302 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope 1 Length = 4 |0| selectorAlgorithm = 304 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 1 |0| samplingTimeInterval = 307 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 1 |0| samplingTimeSpace = 308 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 2 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 264 | Length = 12 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 16 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 2 | 100 | 900 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Figure I: Example of the Selector Report Interpretation
+
+
+
+Claise, et al. Standards Track [Page 27]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ for Systematic Time-Based Sampling
+
+ Notes:
+
+ * A selectorAlgorithm value of 2 represents systematic time-based
+ Sampling.
+
+ * samplingTimeInterval and samplingTimeSpace are of type unsigned32
+ but are compressed down here.
+
+6.5.2.3. Random n-out-of-N Sampling
+
+ In random n-out-of-N Sampling, n elements are selected out of the
+ parent Population that consists of N elements [RFC5475]. The
+ REQUIRED algorithm-specific Information Elements in case of random
+ n-out-of-N Sampling are:
+
+ samplingSize: number of packets selected
+ samplingPopulation: number of packets in selection Population
+
+ Example of a 1 out-of 10 random n-out-of-N Sampling Selector:
+
+ IPFIX Options Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 3 | Length = 26 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 265 | Field Count = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope Field Count = 1 |0| selectorId = 302 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope 1 Length = 4 |0| selectorAlgorithm = 304 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 1 |0| samplingSize = 309 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 1 |0| samplingPopulation = 310 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 1 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 28]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ Associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 265 | Length = 11 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 17 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 3 | 1 | 10 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Figure J: Example of the Selector Report Interpretation
+ for Random n-out-of-N Sampling
+
+ Notes:
+
+ * A selectorAlgorithm value of 3 represents Random n-out-of-N
+ Sampling.
+
+ * samplingSize and samplingPopulation are of type unsigned32 but are
+ compressed down to one octet here.
+
+6.5.2.4. Uniform Probabilistic Sampling
+
+ In uniform probabilistic Sampling, each element has the same
+ probability p of being selected from the parent Population [RFC5475].
+ The algorithm-specific Information Element in case of uniform
+ probabilistic Sampling is:
+
+ samplingProbability: a floating point number for the Sampling
+ probability.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 29]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ Example of a 15% uniform probability Sampling Selector:
+
+ IPFIX Options Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 3 | Length = 22 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 271 | Field Count = 3 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope Field Count = 1 |0| selectorId = 302 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| selectorAlgorithm = 304 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 1 |0| samplingProbability = 311 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 271 | Length = 11 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 20 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 4 | 0.15 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | |
+ +-+-+-+-+-+-+-+-+
+
+ Figure K: Example of the Selector Report Interpretation
+ for Uniform Probabilistic Sampling
+
+ Notes:
+
+ * A selectorAlgorithm value of 4 represents Uniform Probabilistic
+ Sampling.
+
+ * samplingProbability is of type float64 but is compressed down to a
+ float32 here.
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 30]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+6.5.2.5. Property Match Filtering
+
+ This classification includes match(es) on field(s) within a packet
+ and/or on properties of the router state. With this method, a packet
+ is selected if a specific field in the packet equals a predefined
+ value.
+
+ The algorithm-specific Information Elements defining configuration
+ parameters for Property Match Filtering are taken from the full range
+ of available Information Elements.
+
+ When multiple different Information Elements are defined, the filter
+ acts as a logical AND. Note that the logical OR is not covered by
+ these PSAMP specifications. The Property Match Filtering Options
+ Template Record MUST NOT have multiple identical Information
+ Elements. The result of the filter is independent from the order of
+ the Information Elements in the Options Template Record, but the
+ order may be important for implementation purposes, as the first
+ filter will have to work at a higher rate. In any case, an
+ implementation is not constrained to respect the filter ordering as
+ long as the result is the same, and it may even implement the
+ composite Filtering in one single step.
+
+ Since encryption alters the meaning of encrypted fields, when the
+ Property Match Filtering classification is based on the encrypted
+ field(s) in the packet, it MUST be able to recognize that the
+ field(s) are not available and MUST NOT select those packets unless
+ specifically directed by the Information Element description. Even
+ if they are ignored, the encrypted packets MUST be accounted for in
+ the Selector packetsObserved Information Element [RFC5477], part of
+ the Selection Sequence Statistics Report Interpretation.
+
+ Example of a match-based filter Selector, whose rules are:
+ IPv4 Source Address = 192.0.2.1
+ IPv4 Next-Hop Address = 192.0.2.129
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 31]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ IPFIX Options Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 3 | Length = 26 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 266 | Field Count = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope Field Count = 1 |0| selectorId = 302 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope 1 Length = 4 |0| selectorAlgorithm = 304 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 1 |0| sourceIPv4Address = 8 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| ipNextHopIPv4Address = 15 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 266 | Length = 11 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 21 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 5 | 192.0.2 ... |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... .1 | 192.0.2 ... |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... .129 |
+ +-+-+-+-+-+-+-+-+
+
+ Figure L: Example of the Selector Report Interpretation
+ for Match-Based and Router State Filtering
+
+ Notes:
+
+ * A selectorAlgorithm value of 5 represents Property Match Filtering.
+
+ * In this filter, there is a mix of information from the packet and
+ information from the router.
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 32]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+6.5.2.6. Hash-Based Filtering
+
+ In Hash-based Selection, a Hash Function is run on IPv4 traffic. The
+ following fields MUST be used as input to that Hash Function:
+
+ - IP identification field
+
+ - Flags field
+
+ - Fragment offset
+
+ - Source IP address
+
+ - Destination IP address
+
+ - A number of bytes from the IP payload. The number of bytes and
+ starting offset MUST be configurable if the Hash Function
+ supports it.
+
+ For the bytes taken from the IP payload, IPSX has a fixed offset of 0
+ bytes and a fixed size of 8 bytes. The number and offset of payload
+ bytes in the BOB function MUST be configurable.
+
+ The minimum configuration ranges MUST be as follows:
+
+ Number of bytes: from 8 to 32
+ Offset: from 0 to 64
+
+ If the selected payload bytes are not available and the Hash Function
+ can take a variable-sized input, then the Hash Function MUST be run
+ with the information that is available and a shorter size. Passing 0
+ as a substitute for missing payload bytes is only acceptable if the
+ Hash Function takes a fixed size as is the case with IPSX.
+
+ If the Hash Function can take an initialization value, then this
+ value MUST be configurable.
+
+ A Hash-based Selection function MAY be configurable as a digest
+ function. Any Selection Process that is configured as a digest
+ function MUST have the output value included in the basic Packet
+ Report for any selected packet.
+
+ Each Hash Function used as a Hash-based Selection Selector requires
+ its own value for the selectorAlgorithm. Currently, we have BOB (6),
+ IPSX (7), and CRC (8) defined and any MAY be used for either
+ Filtering or creating a Packet Digest. Only BOB is recommended
+ though and SHOULD be used.
+
+
+
+
+Claise, et al. Standards Track [Page 33]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ The REQUIRED algorithm-specific Information Elements in case of
+ Hash-based Selection are:
+
+ hashIPPayloadOffset - The payload offset used by a Hash-based
+ Selection Selector
+
+ hashIPPayloadSize - The payload size used by a Hash-based
+ Selection Selector
+
+ hashOutputRangeMin - One or more values for the beginning of each
+ potential output range.
+
+ hashOutputRangeMax - One or more values for the end of each
+ potential output range.
+
+ hashSelectedRangeMin - One or more values for the beginning of each
+ selected range.
+
+ hashSelectedRangeMax - One or more values for the end of each
+ selected range.
+
+ hashDigestOutput - A boolean value, TRUE if the output from this
+ Selector has been configured to be included
+ in the Packet Report as a packet digest.
+
+ Note: If more than one selection or output range needs to be sent,
+ then the minimum and maximum elements may be repeated as needed.
+ These MUST make one or more non-overlapping ranges. The elements
+ SHOULD be sent as pairs of minimum and maximum in ascending order;
+ however, if they are sent out of order, then there will only be one
+ way to interpret the ranges to produce a non-overlapping range and
+ the Collecting Process MUST be prepared to accept and decode this.
+
+ The following algorithm-specific Information Element MAY be sent, but
+ is optional for security considerations:
+
+ hashInitialiserValue - The initialiser value to the Hash Function.
+
+ Since encryption alters the meaning of encrypted fields, when the
+ Hash-based Filtering classification is based on the encrypted
+ field(s) in the packet, it MUST be able to recognize that the
+ field(s) are not available and MUST NOT select those packets. Even
+ if they are ignored, the encrypted packets MUST be accounted for in
+ the Selector packetsObserved Information Element [RFC5477], which is
+ part of the Selection Sequence Statistics Report Interpretation.
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 34]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ Example of a Hash-based Filter Selector, whose configuration is:
+ Hash Function = BOB
+ Hash IP Payload Offset = 0
+ Hash IP Payload Size = 16
+ Hash Initialiser Value = 0x9A3F9A3F
+ Hash Output Range = 0 to 0xFFFFFFFF
+ Hash Selected Range = 100 to 200 and 400 to 500
+
+ IPFIX Options Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 3 | Length = 50 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 269 | Field Count = 8 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope Field Count = 1 |0| selectorId = 302 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope 1 Length = 4 |0| selectorAlgorithm = 302 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 1 |0| hashIPpayloadOffset = 327 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| hashIPpayloadSize = 328 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| hashInitialiserValue = 329 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| hashOutputRangeMin = 330 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| hashOutputRangeMax = 331 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| hashSeletionRangeMin = 332 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| hashSeletionRangeMax = 333 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| hashSeletionRangeMin = 332 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| hashSeletionRangeMax = 333 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 35]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ Associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 266 | Length = 45 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 22 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 6 | ... |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... 0 | ... |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... 16 | 0x9A3F9A ... |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... 3F | ... |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... 0 | 0xFFFFFF ... |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... FF | ... 100 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... | ... 200 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... | ... 400 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... | ... 500 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ... |
+ +-+-+-+-+-+-+-+-+
+
+ Figure M: Example of the Selector Report Interpretation
+ for Hash-based Filtering
+
+ Notes:
+
+ * A selectorAlgorithm value of 6 represents Hash-based Filtering
+ using the BOB algorithm.
+
+6.5.2.7. Other Selection Methods
+
+ Some potential new selection methods MAY be added. Some of the new
+ selection methods, such as non-uniform probabilistic Sampling and
+ flow-state-dependent Sampling, are described in [RFC5475], with
+ further references.
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 36]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ Each new selection method MUST be assigned a unique value for the
+ selectorAlgorithm Information Element. Its configuration
+ parameter(s), along with the way to report it/them with an Options
+ Template, MUST be clearly specified.
+
+6.5.3. Selection Sequence Statistics Report Interpretation
+
+ A Selector MAY be used in multiple Selection Sequences. However,
+ each use of a Selector must be independent, so each separate logical
+ instance of a Selector MUST maintain its own individual Selection
+ State and statistics.
+
+ The Selection Sequence Statistics Report Interpretation MUST include
+ the number of observed packets (Population Size) and the number of
+ packets selected (Sample Size) by each instance of its Primitive
+ Selectors.
+
+ Within a Selection Sequence composed of several Primitive Selectors,
+ the number of packets selected for one Selector is equal to the
+ number of packets seen by the next Selector. The order of the
+ Selectors in the Selection Sequence Statistics Report Interpretation
+ MUST match the order of the Selectors in the Selection Sequence.
+
+ If the full set of statistics is not sent as part of the Basic Packet
+ Reports, the PSAMP Device MUST export a Selection Sequence Statistics
+ Report Interpretation for every Selection Sequence, using an Options
+ Template containing the following Information Elements:
+
+ Scope: selectionSequenceId
+ Non-scope: packetsObserved
+ packetsSelected (first Selector)
+ ...
+ packetsSelected (last Selector)
+
+ The packetsObserved Information Element [RFC5477] MUST contain the
+ number of packets seen at the Observation Point, and as a consequence
+ passed to the first Selector in the Selection Sequence. The
+ packetsSelected Information Element [RFC5477] contains the number of
+ packets selected by a Selector in the Selection Sequence.
+
+ The Attained Selection Fraction for the Selection Sequence is
+ calculated by dividing the number of selected packets
+ (packetsSelected Information Element) for the last Selector by the
+ number of observed packets (packetsObserved Information Element).
+ The Attained Selection Fraction can be calculated for each Selector
+ by dividing the number of packets selected for that Selector by the
+ value for the previous Selector.
+
+
+
+
+Claise, et al. Standards Track [Page 37]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ The statistics for the whole sequence SHOULD be taken at a single
+ logical point in time; the input value for a Selector MUST equal the
+ output value of the previous Selector.
+
+ The Selection Sequence Statistics Report Interpretation MUST be
+ exported periodically.
+
+ Example of Selection Sequence Statistics Report Interpretation:
+
+ Selection Sequence 7 (Filter->Sampling):
+
+ Observed 100 (observationPointId 1, Interface 5)
+ Selected 50 (selectorId 5, match IPV4SourceAddress 192.0.2.1)
+ Selected 6 (selectorId 10, Sampler: Random one out-of ten)
+
+ Selection Sequence 9 (Sampling->Filtering):
+
+ Observed 100 (observationPointId 1, Interface 5)
+ Selected 10 (selectorId 10, Sampler: Random one out-of ten)
+ Selected 3 (selectorId 5, match IPV4SourceAddress 192.0.2.1)
+
+ IPFIX Options Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 3 | Length = 26 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 267 | Field Count = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope Field Count = 1 |0| selectionSequenceId = 301 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope 1 Length = 4 |0| packetsObserved = 318 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| packetsSelected = 319 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |0| packetsSelected = 319 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 38]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ The associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 267 | Length = 36 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 7 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 100 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 50 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 6 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 9 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 100 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 10 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 3 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Figure N: Example of the Selection Sequence Statistics
+ Report Interpretation
+
+ Notes:
+
+ * The Attained Selection Fractions for Selection Sequence 7 are:
+ Filter 10: 50/100
+ Sampler 5: 6/50
+ Number of samples selected: 6
+
+ * The Attained Selection Fractions for Selection Sequence 9 are:
+ Sampler 5: 10/100
+ Filter 10: 3/10
+ Number of samples selected: 3
+
+6.5.4. Accuracy Report Interpretation
+
+ In order for the Collecting Process to determine the inherent
+ accuracy of the reported quantities (for example, timestamps), the
+ PSAMP Device SHOULD send an Accuracy Report Interpretation.
+
+ The Accuracy Report Interpretation MUST be exported by an Options
+ Template Record with a scope that contains the Information Element
+ for which the accuracy is required. In case the accuracy is specific
+
+
+
+Claise, et al. Standards Track [Page 39]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ to a template, a second scope containing the templateId value MUST be
+ added to the Options Template Record. The accuracy SHOULD be
+ reported either with the absoluteError Information Element [RFC5477]
+ or with the relativeError Information Element [RFC5477].
+
+ Accuracy Report Interpretation using the absoluteError Information
+ Element:
+ Scope: informationElementId
+ Non-scope: absoluteError
+
+ Accuracy Report Interpretation using the absoluteError Information
+ Element and a double scope:
+ Scope: templateId
+ informationElementId
+ Non-scope: absoluteError
+
+ Accuracy Report Interpretation using the relativeError Information
+ Element:
+ Scope: informationElementId
+ Non-scope: relativeError
+
+ Accuracy Report Interpretation using the relativeError Information
+ Element and a double scope:
+ Scope: templateId
+ informationElementId
+ Non-scope: relativeError
+
+ For example, the accuracy of an Information Element whose Abstract
+ Data Type is dateTimeMilliseconds [RFC5102], for which the unit is
+ specified as milliseconds, can be specified with the absoluteError
+ Information Element with the milliseconds units. In this case, the
+ error interval is the Information Element value +/- the value
+ reported in the absoluteError.
+
+ For example, the accuracy of an Information Element to estimate the
+ accuracy of a sampled flow, for which the unit would be specified in
+ octets, can be specified with the relativeError Information Element
+ with the octet units. In this case, the error interval is the
+ Information Element value +/- the value reported in the relativeError
+ times the reported Information Element value.
+
+ An alternative to reporting either the absoluteError Information
+ Element or the relativeError Information Element in the Accuracy
+ Report Interpretation, is to report both. For this case whatever is
+ least accurate for the reported value should be used.
+
+ If the accuracy of a reported quantity changes on the Metering
+ Process, a new Accuracy Report Interpretation MUST be generated. The
+
+
+
+Claise, et al. Standards Track [Page 40]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ Collecting Process MUST keep the accuracy of the latest Accuracy
+ Report Interpretation.
+
+ Example of an Accuracy Report Interpretation using the absoluteError
+ Information Element and a double scope: the timeMicroseconds
+ contained in the Template 5 has an accuracy of +/- 2 ms, represented
+ by the absoluteError Information Element.
+
+ Scope: templateId = 6
+ informationElementId = timeMicroseconds
+ Non-scope: absoluteError = 2 ms
+
+ IPFIX Options Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 3 | Length = 22 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 267 | Field Count = 3 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope Field Count = 2 |0| templateId = 145 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope 1 Length = 2 |0| InformationElementId = 303 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope 2 Length = 2 |0| absoluteError = 320 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ The associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 267 | Length = 12 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 5 | 324 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 2 (encoded as a float32) |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Figure O: Example of the Selection Sequence
+ Statistics Report Interpretation
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 41]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+ Notes:
+
+ * absoluteError is of type float64 but is compressed down to a
+ float32 here.
+
+ The second example displays an Accuracy Report Interpretation using
+ the relativeError Information Element and a single scope: the
+ timeMicroseconds has an error of 5%, represented by the
+ proportionalAccuracy Information Element.
+
+ Scope: informationElementId = timeMicroseconds
+ Non-scope: relativeError = 0.05
+
+ IPFIX Options Template Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 3 | Length = 18 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Template ID = 268 | Field Count = 2 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope Field Count = 1 |0| InformationElementId = 303 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Scope 1 Length = 2 |0| relativeError= 321 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Field Length = 4 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ The associated IPFIX Data Record:
+
+ 0 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | Set ID = 267 | Length = 10 |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | 324 | 0.05 ... |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ | ...(encoded as a float32) |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+ Figure P: Example of the Selection Sequence
+ Statistics Report Interpretation
+
+ Notes:
+
+ * relativeError is of type float64 but is compressed down to a
+ float32 here.
+
+
+
+Claise, et al. Standards Track [Page 42]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+7. Security Considerations
+
+ As IPFIX has been selected as the PSAMP export protocol and as the
+ PSAMP security requirements are not stricter than the IPFIX security
+ requirements, refer to the IPFIX export protocol [RFC5101] for the
+ security considerations.
+
+ In the basic Packet Report, a PSAMP Device exports some number of
+ contiguous bytes from the start of the packet, including the packet
+ header (which includes link layer, network layer, and other
+ encapsulation headers) and some subsequent bytes of the packet
+ payload. The PSAMP Device SHOULD NOT export the full payload of
+ conversations, as this would mean wiretapping [RFC2804]. The PSAMP
+ Device MUST respect local privacy laws.
+
+8. IANA Considerations
+
+ The PSAMP protocol, as set out in this document, has two sets of
+ assigned numbers. Considerations for assigning them are discussed in
+ this section, using the example policies as set out in [RFC5226],
+ "Guidelines for IANA Considerations".
+
+8.1. IPFIX-Related Considerations
+
+ As the PSAMP protocol uses the IPFIX protocol, refer to the IANA
+ considerations section in [RFC5101] for the assignments of numbers
+ used in the protocol and for the numbers used in the information
+ model.
+
+8.2. PSAMP-Related Considerations
+
+ Each new selection method MUST be assigned a unique value for the
+ selectorAlgorithm Information Element [RFC5477]. Initial contents of
+ this registry are found in Section 8.2.1 in [RFC5477]. Its
+ configuration parameter(s), along with the way to report them with an
+ Options Template, MUST be clearly specified.
+
+ New assignments for the PSAMP selection method will be administered
+ by IANA, on a First Come First Served basis [RFC5226], subject to
+ Expert Review [RFC5226]. The group of experts must double check the
+ Information Elements definitions with already defined Information
+ Elements for completeness, accuracy, and redundancy. These experts
+ will initially be drawn from the Working Group Chairs and document
+ editors of the IPFIX and PSAMP Working Groups.
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 43]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+9. References
+
+9.1. Normative References
+
+ [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
+ Requirement Levels", BCP 14, RFC 2119, March 1997.
+
+ [RFC5101] Claise, B., Ed., "Specification of the IP Flow Information
+ Export (IPFIX) Protocol for the Exchange of IP Traffic Flow
+ Information", RFC 5101, January 2008.
+
+ [RFC5102] Quittek, J., Bryant, S., Claise, B., Aitken, P., and J.
+ Meyer, "Information Model for IP Flow Information Export",
+ RFC 5102, January 2008.
+
+ [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
+ IANA Considerations Section in RFCs", BCP 26, RFC 5226, May
+ 2008.
+
+ [RFC5475] Zseby, T., Molina, M., Duffield, N., Niccolini, S., and F.
+ Raspall, "Sampling and Filtering Techniques for IP Packet
+ Selection", RFC 5475, March 2009.
+
+ [RFC5477] Dietz, T., Claise, B., Aitken, P., Dressler, F., and G.
+ Carle, "Information Model for Packet Sampling Exports", RFC
+ 5477, March 2009.
+
+9.2. Informative References
+
+ [RFC2804] IAB and IESG, "IETF Policy on Wiretapping", RFC 2804, May
+ 2000.
+
+ [RFC3917] Quittek, J., Zseby, T., Claise, B., and S. Zander,
+ "Requirements for IP Flow Information Export (IPFIX)", RFC
+ 3917, October 2004.
+
+ [RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A Border
+ Gateway Protocol 4 (BGP-4)", RFC 4271, January 2006.
+
+ [RFC5470] Sadasivan, G., Brownlee, N., Claise, B., and J. Quittek,
+ "Architecture for IP Flow Information Export" RFC 5470,
+ March 2009.
+
+ [RFC5474] Duffield, N., Ed., "A Framework for Packet Selection and
+ Reporting", RFC 5474, March 2009.
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 44]
+
+RFC 5476 PSAMP Protocol Specification March 2009
+
+
+10. Acknowledgments
+
+ The authors would like to thank the PSAMP group, especially Paul
+ Aitken for fruitful discussions and for proofreading the document
+ several times.
+
+Authors' Addresses
+
+ Benoit Claise
+ Cisco Systems
+ De Kleetlaan 6a b1
+ 1831 Diegem
+ Belgium
+
+ Phone: +32 2 704 5622
+ EMail: bclaise@cisco.com
+
+
+ Juergen Quittek
+ NEC Europe Ltd.
+ Network Laboratories
+ Kurfuersten-Anlage 36
+ 69115 Heidelberg
+ Germany
+
+ Phone: +49 6221 90511-15
+ EMail: quittek@nw.neclab.eu
+
+
+ Andrew Johnson
+ Cisco Systems
+ 96 Commercial Quay
+ Edinburgh EH6 6LX
+ Scotland
+
+ Phone: +44 131 561 3641
+ EMail: andrjohn@cisco.com
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Claise, et al. Standards Track [Page 45]
+