summaryrefslogtreecommitdiff
path: root/doc/rfc/rfc7014.txt
diff options
context:
space:
mode:
Diffstat (limited to 'doc/rfc/rfc7014.txt')
-rw-r--r--doc/rfc/rfc7014.txt1851
1 files changed, 1851 insertions, 0 deletions
diff --git a/doc/rfc/rfc7014.txt b/doc/rfc/rfc7014.txt
new file mode 100644
index 0000000..3ad114f
--- /dev/null
+++ b/doc/rfc/rfc7014.txt
@@ -0,0 +1,1851 @@
+
+
+
+
+
+
+Internet Engineering Task Force (IETF) S. D'Antonio
+Request for Comments: 7014 Univ. of Napoli "Parthenope"
+Category: Standards Track T. Zseby
+ISSN: 2070-1721 CAIDA/FhG FOKUS
+ C. Henke
+ Tektronix Communications Berlin
+ L. Peluso
+ University of Napoli
+ September 2013
+
+
+ Flow Selection Techniques
+
+Abstract
+
+ The Intermediate Flow Selection Process is the process of selecting a
+ subset of Flows from all observed Flows. The Intermediate Flow
+ Selection Process may be located at an IP Flow Information Export
+ (IPFIX) Exporter or Collector, or within an IPFIX Mediator. It
+ reduces the effort of post-processing Flow data and transferring Flow
+ Records. This document describes motivations for using the
+ Intermediate Flow Selection process and presents Intermediate Flow
+ Selection techniques. It provides an information model for
+ configuring Intermediate Flow Selection Process techniques and
+ discusses what information about an Intermediate Flow Selection
+ Process should be exported.
+
+Status of This Memo
+
+ This is an Internet Standards Track document.
+
+ This document is a product of the Internet Engineering Task Force
+ (IETF). It represents the consensus of the IETF community. It has
+ received public review and has been approved for publication by the
+ Internet Engineering Steering Group (IESG). Further information on
+ Internet Standards is available in Section 2 of RFC 5741.
+
+ Information about the current status of this document, any errata,
+ and how to provide feedback on it may be obtained at
+ http://www.rfc-editor.org/info/rfc7014.
+
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 1]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+Copyright Notice
+
+ Copyright (c) 2013 IETF Trust and the persons identified as the
+ document authors. All rights reserved.
+
+ This document is subject to BCP 78 and the IETF Trust's Legal
+ Provisions Relating to IETF Documents
+ (http://trustee.ietf.org/license-info) in effect on the date of
+ publication of this document. Please review these documents
+ carefully, as they describe your rights and restrictions with respect
+ to this document. Code Components extracted from this document must
+ include Simplified BSD License text as described in Section 4.e of
+ the Trust Legal Provisions and are provided without warranty as
+ described in the Simplified BSD License.
+
+ This document may contain material from IETF Documents or IETF
+ Contributions published or made publicly available before November
+ 10, 2008. The person(s) controlling the copyright in some of this
+ material may not have granted the IETF Trust the right to allow
+ modifications of such material outside the IETF Standards Process.
+ Without obtaining an adequate license from the person(s) controlling
+ the copyright in such materials, this document may not be modified
+ outside the IETF Standards Process, and derivative works of it may
+ not be created outside the IETF Standards Process, except to format
+ it for publication as an RFC or to translate it into languages other
+ than English.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 2]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+Table of Contents
+
+ 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
+ 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 4
+ 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
+ 3. Difference between Intermediate Flow Selection Process and
+ Packet Selection . . . . . . . . . . . . . . . . . . . . . . . 7
+ 4. Difference between Intermediate Flow Selection Process and
+ Intermediate Selection Process . . . . . . . . . . . . . . . . 9
+ 5. Intermediate Flow Selection Process within the IPFIX
+ Architecture . . . . . . . . . . . . . . . . . . . . . . . . . 9
+ 5.1. Intermediate Flow Selection Process in the Metering
+ Process . . . . . . . . . . . . . . . . . . . . . . . . . 11
+ 5.2. Intermediate Flow Selection Process in the Exporting
+ Process . . . . . . . . . . . . . . . . . . . . . . . . . 11
+ 5.3. Intermediate Flow Selection Process as a Function of
+ the IPFIX Mediator . . . . . . . . . . . . . . . . . . . . 11
+ 6. Intermediate Flow Selection Process Techniques . . . . . . . . 12
+ 6.1. Flow Filtering . . . . . . . . . . . . . . . . . . . . . . 12
+ 6.1.1. Property Match Filtering . . . . . . . . . . . . . . . 12
+ 6.1.2. Hash-Based Flow Filtering . . . . . . . . . . . . . . 13
+ 6.2. Flow Sampling . . . . . . . . . . . . . . . . . . . . . . 13
+ 6.2.1. Systematic Sampling . . . . . . . . . . . . . . . . . 13
+ 6.2.2. Random Sampling . . . . . . . . . . . . . . . . . . . 14
+ 6.3. Flow-State Dependent Intermediate Flow Selection
+ Process . . . . . . . . . . . . . . . . . . . . . . . . . 14
+ 6.4. Flow-State Dependent Packet Selection . . . . . . . . . . 15
+ 7. Configuration of Intermediate Flow Selection Process
+ Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . 16
+ 7.1. Intermediate Flow Selection Process Parameters . . . . . . 17
+ 7.2. Description of Flow-State Dependent Packet Selection . . . 19
+ 8. Information Model for Intermediate Flow Selection Process
+ Configuration and Reporting . . . . . . . . . . . . . . . . . 20
+ 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22
+ 9.1. Registration of Information Elements . . . . . . . . . . . 22
+ 9.1.1. flowSelectorAlgorithm . . . . . . . . . . . . . . . . 22
+ 9.1.2. flowSelectedOctetDeltaCount . . . . . . . . . . . . . 24
+ 9.1.3. flowSelectedPacketDeltaCount . . . . . . . . . . . . . 24
+ 9.1.4. flowSelectedFlowDeltaCount . . . . . . . . . . . . . . 24
+ 9.1.5. selectorIDTotalFlowsObserved . . . . . . . . . . . . . 25
+ 9.1.6. selectorIDTotalFlowsSelected . . . . . . . . . . . . . 25
+ 9.1.7. samplingFlowInterval . . . . . . . . . . . . . . . . . 26
+ 9.1.8. samplingFlowSpacing . . . . . . . . . . . . . . . . . 26
+ 9.1.9. flowSamplingTimeInterval . . . . . . . . . . . . . . . 27
+ 9.1.10. flowSamplingTimeSpacing . . . . . . . . . . . . . . . 27
+ 9.1.11. hashFlowDomain . . . . . . . . . . . . . . . . . . . . 28
+ 9.2. Registration of Object Identifier . . . . . . . . . . . . 28
+ 10. Security and Privacy Considerations . . . . . . . . . . . . . 28
+
+
+
+D'Antonio, et al. Standards Track [Page 3]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ 11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 30
+ 12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 30
+ 12.1. Normative References . . . . . . . . . . . . . . . . . . . 30
+ 12.2. Informative References . . . . . . . . . . . . . . . . . . 31
+
+1. Introduction
+
+ This document describes Intermediate Flow Selection Process
+ techniques for network traffic measurements. A Flow is defined as a
+ set of packets with common properties, as described in [RFC7011]. An
+ Intermediate Flow Selection Process can be executed to limit the
+ resource demands for capturing, storing, exporting, and post-
+ processing Flow Records. It also can be used to select a particular
+ set of Flows that are of interest to a specific application. This
+ document provides a categorization of Intermediate Flow Selection
+ Process techniques and describes configuration and reporting
+ parameters for them.
+
+ This document also addresses configuration and reporting parameters
+ for Flow-state dependent packet selection as described in [RFC5475],
+ although this technique is categorized as packet selection. The
+ reason is that Flow-state dependent packet selection techniques often
+ aim at the reduction of resources for Flow capturing and Flow
+ processing. Furthermore, these techniques were only briefly
+ discussed in [RFC5475]. Therefore, configuration and reporting
+ considerations for Flow-state dependent packet selection techniques
+ have been included in this document.
+
+1.1. Requirements Language
+
+ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+ "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+ document are to be interpreted as described in RFC 2119 [RFC2119].
+
+2. Terminology
+
+ This document is consistent with the terminology introduced in
+ [RFC7011], [RFC5470], [RFC5475], and [RFC3917]. As in [RFC7011] and
+ [RFC5476], the first letter of each IPFIX specific and Packet
+ Sampling (PSAMP) specific term is capitalized, along with the
+ Intermediate Flow Selection Process specific terms defined here.
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 4]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ * Packet Classification
+
+ Packet Classification is a process by which packets are mapped to
+ specific Flow Records, based on packet properties or external
+ properties (e.g., interface). The properties (e.g., header
+ information, packet content, Autonomous System (AS) number) make
+ up the Flow Key. If a Flow Record for a specific Flow Key value
+ already exists, the Flow Record is updated; otherwise, a new Flow
+ Record is created.
+
+ * Intermediate Flow Selection Process
+
+ An Intermediate Flow Selection Process is an Intermediate Process,
+ as defined in [RFC6183] that takes Flow Records as its input and
+ selects a subset of this set as its output. The Intermediate Flow
+ Selection Process is a more general concept than the Intermediate
+ Selection Process as defined in [RFC6183]. While an Intermediate
+ Selection Process selects Flow Records from a sequence based upon
+ criteria-evaluated Flow Record values and only passes on those
+ Flow Records that match the criteria, an Intermediate Flow
+ Selection Process selects Flow Records using selection criteria
+ applicable to a larger set of Flow characteristics and
+ information.
+
+ * Flow Cache
+
+ A Flow Cache is the set of Flow Records.
+
+ * Flow Selection State
+
+ An Intermediate Flow Selection Process maintains state information
+ for use by the Flow Selector. At a given time, the Flow Selection
+ State may depend on Flows and packets observed at and before that
+ time, as well as other variables. Examples include:
+
+ (i) sequence number of packets and Flow Records;
+
+ (ii) number of selected Flows;
+
+ (iii) number of observed Flows;
+
+ (iv) current Flow Cache occupancy;
+
+ (v) Flow specific counters, lower and upper bounds;
+
+ (vi) Intermediate Flow Selection Process timeout intervals.
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 5]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ * Flow Selector
+
+ A Flow Selector defines the action of an Intermediate Flow
+ Selection Process on a single Flow of its input. The Flow
+ Selector can make use of the following information in order to
+ establish whether or not a Flow has to be selected:
+
+ (i) the content of the Flow Record;
+
+ (ii) any state information related to the Metering Process or
+ Exporting Process;
+
+ (iii) any Flow Selection State that may be maintained by the
+ Intermediate Flow Selection Process.
+
+ * Complete Flow
+
+ A Complete Flow consists of all the packets that enter the
+ Intermediate Flow Selection Process within the Flow timeout
+ interval and that belong to the same Flow, per the definition of
+ "Flow" in [RFC5470]. For this definition, only packets that
+ arrive at the Intermediate Flow Selection Process are considered.
+
+ * Flow Position
+
+ Flow Position is the position of a Flow Record within the Flow
+ Cache.
+
+ * Flow Filtering
+
+ Flow Filtering selects flows based on a deterministic function on
+ the Flow Record content, Flow Selection State, external properties
+ (e.g., ingress interface), or external events (e.g., violated
+ Access Control List). If the relevant parts of the Flow Record
+ content can already be observed at the packet level (e.g., Flow
+ Keys from packet header fields), Flow Filtering can be performed
+ at the packet level by Property Match Filtering, as described in
+ [RFC5475].
+
+ * Hash-based Flow Filtering
+
+ Hash-based Flow Filtering is a deterministic Flow filter function
+ that selects flows based on a hash function. The hash function is
+ calculated over parts of the Flow Record content or external
+ properties that are called the Hash Domain. If the hash value
+ falls into a predefined Hash Selection Range, the Flow is
+ selected.
+
+
+
+
+D'Antonio, et al. Standards Track [Page 6]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ * Flow-state Dependent Intermediate Flow Selection Process
+
+ The Flow-state dependent Intermediate Flow Selection Process is a
+ selection function that selects or drops Flows based on the
+ current Flow Selection State. The selection can be either
+ deterministic, random, or non-uniform random.
+
+ * Flow-state Dependent Packet Selection
+
+ Flow-state dependent packet selection is a selection function that
+ selects or drops packets based on the current Flow Selection
+ State. The selection can be either deterministic, random, or non-
+ uniform random. Flow-state dependent packet selection can be used
+ to implement a preference for the selection of packets belonging
+ to specific Flows. For example, the selection probability of
+ packets belonging to Flows that are already within the Flow Cache
+ may be higher than for packets that have not been recorded yet.
+
+ * Flow Sampling
+
+ Flow Sampling selects flows based on Flow Record sequence or
+ arrival times (e.g., entry in Flow Cache, arrival time at Exporter
+ or Mediator). The selection can be systematic (e.g., every n-th
+ Flow) or based on a random function (e.g., select each Flow Record
+ with probability p, or randomly select n out of N Flow Records).
+
+3. Difference between Intermediate Flow Selection Process and Packet
+ Selection
+
+ The Intermediate Flow Selection Process differs from packet selection
+ as described in [RFC5475]. Packet selection techniques consider
+ packets as the basic element, and the parent population consists of
+ all packets observed at an Observation Point. In contrast to this,
+ the basic elements in Flow selection are the Flows. The parent
+ population consists of all observed Flows, and the Intermediate Flow
+ Selection Process operates on the Flows. The major characteristics
+ of the Intermediate Flow Selection Process are the following:
+
+ - The Intermediate Flow Selection Process takes Flows as basic
+ elements. For packet selection, packets are considered as basic
+ elements.
+
+ - The Intermediate Flow Selection Process typically takes place
+ after Packet Classification, because the classification rules
+ determine to which Flow a packet belongs. The Intermediate Flow
+ Selection Process can be performed before Packet Classification.
+ In that case, the Intermediate Flow Selection Process is based on
+ the Flow Key (and also on a hash value over the Flow Key) but not
+
+
+
+D'Antonio, et al. Standards Track [Page 7]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ on characteristics that are only available after Packet
+ Classification (e.g., Flow size, Flow duration). Packet selection
+ can be applied before and after Packet Classification. As an
+ example, packet selection before Packet Classification can be
+ random packet selection, whereas packet selection after Packet
+ Classification can be Flow-state dependent packet selection (as
+ described in [RFC5475]).
+
+ - The Intermediate Flow Selection Process operates on Complete
+ Flows. That means that after the Intermediate Flow Selection
+ Process, either all packets of the Flow are kept or all packets of
+ the Flow are discarded. That means that if the Intermediate Flow
+ Selection Process is preceded by a packet selection process, the
+ Complete Flow consists only of the packets that were not discarded
+ during the packet selection.
+
+ There are some techniques that are difficult to unambiguously
+ categorize into one of the categories. Here, some guidance is given
+ on how to categorize such techniques:
+
+ - Techniques that can be considered as both packet selection and an
+ Intermediate Flow Selection Process: some packet selection
+ techniques result in the selection of Complete Flows and therefore
+ can be considered as packet selection or as an Intermediate Flow
+ Selection Process at the same time. An example is Property Match
+ Filtering of all packets to a specific destination address. If
+ Flows are defined based on destination addresses, such a packet
+ selection also results in an Intermediate Flow Selection Process
+ and can be considered as packet selection or as an Intermediate
+ Flow Selection Process.
+
+ - Flow-state Dependent Packet Selection: there exist techniques that
+ select packets based on the Flow state, e.g., based on the number
+ of already observed packets belonging to the Flow. Examples of
+ these techniques from the literature include "Sample and Hold"
+ [EsVa01], "Fast Filtered Sampling" [MSZC10], and the "Sticky
+ Sampling" algorithm presented in [MaMo02]. Such techniques can be
+ used to influence which Flows are captured (e.g., increase the
+ selection of packets belonging to large Flows) and reduce the
+ number of Flows that need to be stored in the Flow Cache.
+ Nevertheless, such techniques do not necessarily select Complete
+ Flows, because they do not ensure that all packets of a selected
+ Flow are captured. Therefore, Flow-state dependent packet
+ selection techniques that do not ensure that either all or no
+ packets of a Flow are selected, strictly speaking, have to be
+ considered as packet selection techniques and not as Intermediate
+ Flow Selection Process techniques.
+
+
+
+
+D'Antonio, et al. Standards Track [Page 8]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+4. Difference between Intermediate Flow Selection Process and
+ Intermediate Selection Process
+
+ The Intermediate Flow Selection Process differs from the Intermediate
+ Selection Process, since the Intermediate Flow Selection Process uses
+ selection criteria that apply to a larger set of Flow information and
+ properties than those used by the Intermediate Selection Process.
+ The typical function of an Intermediate Selection Process is Property
+ Match Filtering, which selects a Flow Record if the value of a
+ specific field in the Flow Record matches a configured value or falls
+ within a configured range. This means that the selection criteria
+ used by an Intermediate Selection Process are evaluated only on Flow
+ Record values. An Intermediate Flow Selection Process makes its
+ decision on whether a Flow has to be selected or not by taking into
+ account not only information related to the content of the Flow
+ Record but also any Flow Selection State information or variable that
+ can be used to select Flows in order to meet application requirements
+ or resource constraints (e.g., Flow Cache occupancy, export link
+ capacity). Examples include flow counters, Intermediate Flow
+ Selection Process timeout intervals, and Flow Record time
+ information.
+
+5. Intermediate Flow Selection Process within the IPFIX Architecture
+
+ An Intermediate Flow Selection Process can be deployed at any of
+ three places within the IPFIX architecture. As shown in Figure 1,
+ the Intermediate Flow Selection Process can occur
+
+ 1. in the Metering Process at the IPFIX Exporter
+
+ 2. in the Exporting Process at the Collector
+
+ 3. within a Mediator
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 9]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ +===========================================+
+ | IPFIX Exporter +----------------+ |
+ | | Metering Proc. | |
+ | +-----------------+ +----------------+ |
+ | | Metering | | Intermediate | |
+ | | Process | or | Flow Selection | |
+ | | | | Process | |
+ | +-----------------+----+----------------+ |
+ | | Exporting Process | |
+ | +----|-------------------------------|--+ |
+ +======|===============================|====+
+ | |
+ | |
+ +======|========================+ |
+ | | Mediator | |
+ | +-V-------------------+ | |
+ | | Collecting Process | | |
+ | +---------------------+ | |
+ | | Intermediate Flow | | |
+ | | Selection Process | | |
+ | +---------------------+ | |
+ | | Exporting Process | | |
+ | +-|-------------------+ | |
+ +======|========================+ |
+ | |
+ | |
+ +======|===============================|=====+
+ | | Collector | |
+ | +----V-------------------------------V-+ |
+ | | Collecting Process | |
+ | +--------------------------------------+ |
+ | | Intermediate Flow Selection Process | |
+ | +--------------------------------------+ |
+ | | Exporting Process | |
+ | +------------------------------|-------+ |
+ +================================|===========+
+ |
+ |
+ V
+ +------------------+
+ | IPFIX |
+ +------------------+
+
+ Figure 1: Potential Intermediate Flow Selection Process Locations
+
+ In contrast to packet selection, the Intermediate Flow Selection
+ Process is always applied after the packets are classified into
+ Flows.
+
+
+
+D'Antonio, et al. Standards Track [Page 10]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+5.1. Intermediate Flow Selection Process in the Metering Process
+
+ An Intermediate Flow Selection Process in the Metering Process uses
+ packet information to update the Flow Records in the Flow Cache. The
+ Intermediate Flow Selection Process, before Packet Classification,
+ can be based on the Flow Key (and also on a hash value over the Flow
+ Key) but not on characteristics that are only available after Packet
+ Classification (e.g., Flow size, Flow duration). Here, an
+ Intermediate Flow Selection Process is applied to reduce resources
+ for all subsequent processes or to select specific Flows of interest
+ in cases where such Flow characteristics are already observable at
+ the packet level (e.g., Flows to specific IP addresses). In
+ contrast, Flow-state dependent packet selection is a packet selection
+ technique, because it does not necessarily select Complete Flows.
+
+5.2. Intermediate Flow Selection Process in the Exporting Process
+
+ An Intermediate Flow Selection Process in the Exporting Process works
+ on Flow Records and can therefore depend on Flow characteristics that
+ are only visible after the classification of packets, such as Flow
+ size and Flow duration. The Exporting Process may implement policies
+ for exporting only a subset of the Flow Records that have been stored
+ in the system's memory, in order to offload Flow export and Flow
+ post-processing. An Intermediate Flow Selection Process in the
+ Exporting Process may select only the subset of Flow Records that are
+ of interest to the user's application or select only as many Flow
+ Records as can be handled by the available resources (e.g., limited
+ export link capacity).
+
+5.3. Intermediate Flow Selection Process as a Function of the IPFIX
+ Mediator
+
+ As shown in Figure 1, the Intermediate Flow Selection Process can be
+ performed within an IPFIX Mediator [RFC6183]. The Intermediate Flow
+ Selection Process takes a Flow Record stream as its input and selects
+ Flow Records from a sequence based upon criteria-evaluated record
+ values. The Intermediate Flow Selection Process can again apply an
+ Intermediate Flow Selection Process technique to obtain Flows of
+ interest to the application. Further, the Intermediate Flow
+ Selection Process can base its selection decision on the correlation
+ of data from different IPFIX Exporters, e.g., by only selecting Flows
+ that were recorded on two or more IPFIX Exporters.
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 11]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+6. Intermediate Flow Selection Process Techniques
+
+ An Intermediate Flow Selection Process technique selects either all
+ or none of the packets of a Flow; otherwise, the technique has to be
+ considered as packet selection. A difference between Flow Filtering
+ and Flow sampling is recognized.
+
+6.1. Flow Filtering
+
+ Flow Filtering is a deterministic function on the IPFIX Flow Record
+ content. If the relevant Flow characteristics are already observable
+ at the packet level (e.g., Flow Keys), Flow Filtering can be applied
+ before aggregation at the packet level. In order to be compliant
+ with IPFIX, at least one of this document's Flow Filtering schemes
+ MUST be implemented.
+
+6.1.1. Property Match Filtering
+
+ Property Match Filtering is performed similarly to Property Match
+ Filtering for packet selection as described in [RFC5475]. The
+ difference is that Flow Record fields are used here, instead of
+ packet fields, to derive the selection decision. Property Match
+ Filtering is used to select a specific subset of the Flows that are
+ of interest to a particular application (e.g., all Flows to a
+ specific destination, all large Flows, etc.). Properties on which
+ the filtering is based can be Flow Keys, Flow Timestamps, or Per-Flow
+ Counters as described in [RFC7012]. Examples include the Flow size
+ in bytes, the number of packets in the Flow, the observation time of
+ the first or last packet, and the maximum packet length. An example
+ of Property Match Filtering is to select Flows with more than a
+ threshold number of observed octets. The selection criteria can be a
+ specific value, a set of specific values, or an interval. For
+ example, a Flow is selected if destinationIPv4Address and the total
+ number of packets of the Flow equal two predefined values. An
+ Intermediate Flow Selection Process using Property Match Filtering in
+ the Metering Process relies on properties that are observable at the
+ packet level (e.g., Flow Key). For example, a Flow is selected if
+ sourceIPv4Address and sourceIPv4PrefixLength equal, respectively, two
+ specific values.
+
+ An Intermediate Flow Selection Process using Property Match Filtering
+ in the Exporting Process is based on properties that are only visible
+ after Packet Classification, such as Flow size and Flow duration. An
+ example is the selection of the largest Flows or a percentage of
+ Flows with the longest lifetime. Another example is to select and
+ remove from the Flow Cache the Flow Record with the lowest Flow
+ volume per current Flow lifetime if the Flow Cache is full.
+
+
+
+
+D'Antonio, et al. Standards Track [Page 12]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ An Intermediate Flow Selection Process using Property Match Filtering
+ within an IPFIX Mediator selects a Flow Record if the value of a
+ specific field in the Flow Record equals a configured value or falls
+ within a configured range [RFC6183].
+
+6.1.2. Hash-Based Flow Filtering
+
+ Hash-based Flow Filtering uses a hash function h to map the Flow Key
+ c onto a Hash Range R. A Flow is selected if the hash value h(c) is
+ within the Hash Selection Range S, which is a subset of R. Hash-
+ based Flow Filtering can be used to emulate a random sampling process
+ but still enable the correlation between selected Flow subsets at
+ different Observation Points. Hash-based Flow Filtering is similar
+ to Hash-based packet selection and is in fact identical when Hash-
+ based packet selection uses the Flow Key that defines the Flow as the
+ hash input. Nevertheless, there may be the incentive to apply Hash-
+ based Flow Filtering, but not at the packet level, in the Metering
+ Process, for example, when the size of the selection range, and
+ therefore the sampling probability, are dependent on the number of
+ observed Flows. If Hash-based Flow Filtering is used to select the
+ same subset of flows at different Observation Points, the Hash Domain
+ MUST only include parts of the Flow Record content that are invariant
+ on the Flow path. Refer also to the Trajectory Sampling application
+ example of coordinated packet selection [RFC5475], which explains the
+ hash-based filtering approach at the packet level.
+
+6.2. Flow Sampling
+
+ Flow sampling operates on Flow Record sequence or arrival times. It
+ can use either a systematic or a random function for the Intermediate
+ Flow Selection Process. Flow sampling usually aims at the selection
+ of a representative subset of all Flows in order to estimate
+ characteristics of the whole set (e.g., mean Flow size in the
+ network).
+
+6.2.1. Systematic Sampling
+
+ Systematic sampling is a deterministic selection function. It may be
+ a periodic selection of the N-th Flow Record that arrives at the
+ Intermediate Flow Selection Process. Systematic sampling MAY be
+ applied in the Metering Process. An example would be to create,
+ besides the Flow Cache of selected Flows, an additional data
+ structure that saves the Flow Key values of the Flows that are not
+ selected. The selection of a Flow would then be based on the first
+ packet of a Flow. Every time a packet belonging to a new Flow (which
+ is not in the data structure of either the selected or non-selected
+ Flows) arrives at the Observation Point, a counter is increased. If
+
+
+
+
+D'Antonio, et al. Standards Track [Page 13]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ the counter is increased to a multiple of N, a new Flow Cache entry
+ is created; if the counter is not a multiple of N, the Flow Key value
+ is added to the data structure for non-selected Flows.
+
+ Systematic sampling can also be time-based. Time-based systematic
+ sampling is applied by only creating Flows that are observed between
+ time-based start and stop triggers. The time interval may be applied
+ at the packet level in the Metering Process or after aggregation at
+ the Flow level, e.g., by selecting a Flow arriving at the Exporting
+ Process every n seconds.
+
+6.2.2. Random Sampling
+
+ Random Flow sampling is based on a random process that requires the
+ calculation of random numbers. One can differentiate between n-out-
+ of-N and probabilistic Flow sampling.
+
+6.2.2.1. n-out-of-N Flow Sampling
+
+ In n-out-of-N Sampling, n elements are selected out of the parent
+ population, which consists of N elements. One example would be to
+ generate n different random numbers in the range [1,N] and select all
+ Flows that have a Flow Position equal to one of the random numbers.
+
+6.2.2.2. Probabilistic Flow Sampling
+
+ In probabilistic Sampling, the decision of whether or not a Flow is
+ selected is made in accordance with a predefined selection
+ probability. For probabilistic Sampling, the Sample Size can vary
+ for different trials. The selection probability does not necessarily
+ have to be the same for each Flow. Therefore, a difference between
+ uniform probabilistic sampling (with the same selection probability
+ for all Flows) and non-uniform probabilistic sampling (where the
+ selection probability can vary for different Flows) is recognized.
+ For non-uniform probabilistic Flow sampling, the sampling probability
+ may be adjusted according to the Flow Record content. An example
+ would be to increase the selection probability of large-volume Flows
+ over small-volume Flows, as described in [DuLT01].
+
+6.3. Flow-State Dependent Intermediate Flow Selection Process
+
+ The Flow-state dependent Intermediate Flow Selection Process can be a
+ deterministic or random Intermediate Flow Selection Process, based on
+ the Flow Record content and the Flow state that may be kept
+ additionally for each of the Flows. External processes may update
+ counters, bounds, and timers for each of the Flow Records, and the
+ Intermediate Flow Selection Process utilizes this information for the
+ selection decision. A review of Flow-state dependent Intermediate
+
+
+
+D'Antonio, et al. Standards Track [Page 14]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ Flow Selection Process techniques that aim at the selection of the
+ most frequent items by keeping additional Flow state information can
+ be found in [CoHa08]. The Flow-state dependent Intermediate Flow
+ Selection Process can only be applied after packet aggregation, when
+ a packet has been assigned to a Flow. The Intermediate Flow
+ Selection Process then decides, based on the Flow state for each
+ Flow, whether it is kept in the Flow Cache or not. Two Flow-state
+ dependent Intermediate Flow Selection Process Algorithms are
+ described here:
+
+ The Frequent algorithm [KaPS03] is a technique that aims at the
+ selection of all flows that at least exceed a 1/k fraction of the
+ Observed Packet Stream. The algorithm has only a Flow Cache of size
+ k-1, and each Flow in the Flow Cache has an additional counter. The
+ counter is incremented each time a packet belonging to the Flow in
+ the Flow Cache is observed. If the observed packet does not belong
+ to any Flow, all counters are decremented; if any of the Flow
+ counters has a value of zero, the Flow is replaced with a Flow formed
+ from the new packet.
+
+ Lossy counting is a selection technique that identifies all Flows
+ whose packet count exceeds a certain percentage of the whole observed
+ packet stream (e.g., 5% of all packets) with a certain estimation
+ error e. Lossy counting separates the observed packet stream in
+ windows of size N=1/e, where N is an amount of consecutive packets.
+ For each observed Flow, an additional counter will be held in the
+ Flow state. The counter is incremented each time a packet belonging
+ to the Flow is observed, and all counters are decremented at the end
+ of each window. Also, all Flows with a counter of zero are removed
+ from the Flow Cache.
+
+6.4. Flow-State Dependent Packet Selection
+
+ Flow-state dependent packet selection is not an Intermediate Flow
+ Selection Process technique but a packet selection technique.
+ Nevertheless, configuration and reporting parameters for this
+ technique will be described in this document. An example is the
+ "Sample and Hold" algorithm [EsVa01], which tries to implement a
+ preference for large-volume Flows in the selection. When a packet
+ arrives, it is selected when a Flow Record for this packet already
+ exists. If there is no Flow Record, the packet is selected according
+ to a certain probability that is dependent on the packet size.
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 15]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+7. Configuration of Intermediate Flow Selection Process Techniques
+
+ This section describes the configuration parameters of the Flow
+ selection techniques presented above. It provides the basis for an
+ information model to be adopted in order to configure the
+ Intermediate Flow Selection Process within an IPFIX Device. The
+ information model with the Information Elements (IEs) for
+ Intermediate Flow Selection Process configuration is described
+ together with the reporting IEs in Section 8. Table 1 gives an
+ overview of the defined Intermediate Flow Selection Process
+ techniques, where they can be applied, and what their input
+ parameters are. Depending on where the Flow selection techniques are
+ applied, different input parameters can be configured.
+
+ +-------------------+--------------------+--------------------------+
+ | Location | Selection | Selection Input |
+ | | Technique | |
+ +-------------------+--------------------+--------------------------+
+ | In the Metering | Flow-state | packet sampling |
+ | Process | Dependent Packet | probabilities, Flow |
+ | | Selection | Selection State, packet |
+ | | | properties |
+ | | | |
+ | In the Metering | Property Match | Flow Record IEs, |
+ | Process | Flow Filtering | Selection Interval |
+ | | | |
+ | In the Metering | Hash-based Flow | selection range, hash |
+ | Process | Filtering | function, Flow Key, seed |
+ | | | (optional) |
+ | | | |
+ | In the Metering | Time-based | Flow Position (derived |
+ | Process | Systematic Flow | from arrival time of |
+ | | sampling | packets), Flow Selection |
+ | | | State |
+ | | | |
+ | In the Metering | Sequence-based | Flow Position (derived |
+ | Process | Systematic Flow | from packet position), |
+ | | sampling | Flow Selection State |
+ | | | |
+ | In the Metering | Random Flow | random number generator |
+ | Process | sampling | or list and packet |
+ | | | position, Flow state |
+ | | | |
+ | In the Exporting | Property Match | Flow Record content, |
+ | Process/ within | Flow Filtering | filter function |
+ | the IPFIX | | |
+ | Mediator | | |
+ | | | |
+
+
+
+D'Antonio, et al. Standards Track [Page 16]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ | In the Exporting | Hash-based Flow | selection range, hash |
+ | Process/ within | Filtering | function, hash input |
+ | the IPFIX | | (Flow Keys and other |
+ | Mediator | | Flow properties) |
+ | | | |
+ | In the Exporting | Flow-state | Flow state parameters, |
+ | Process/ within | Dependent | random number generator |
+ | the IPFIX | Intermediate Flow | or list |
+ | Mediator | Selection Process | |
+ | | | |
+ | In the Exporting | Time-based | Flow arrival time, Flow |
+ | Process/ within | Systematic Flow | state |
+ | the IPFIX | sampling | |
+ | Mediator | | |
+ | | | |
+ | In the Exporting | Sequence-based | Flow Position, Flow |
+ | Process/ within | Systematic Flow | state |
+ | the IPFIX | sampling | |
+ | Mediator | | |
+ | | | |
+ | In the Exporting | Random Flow | random number generator |
+ | Process/ within | sampling | or list and Flow |
+ | the IPFIX | | Position, Flow state |
+ | Mediator | | |
+ +-------------------+--------------------+--------------------------+
+
+ Table 1: Overview of Intermediate Flow Selection Process Techniques
+
+7.1. Intermediate Flow Selection Process Parameters
+
+ This section defines what parameters are required to describe the
+ most common Intermediate Flow Selection Process techniques.
+
+ Intermediate Flow Selection Process Parameters:
+
+ For Property Match Filtering:
+
+ - Information Element as specified in [IANA-IPFIX]):
+ Specifies the Information Element that is used as the property in
+ the filter expression. Section 8 specifies the Information
+ Elements that MUST be exported by an Intermediate Flow Selection
+ Process using Property Match Filtering.
+
+ - Selection Value or Value Interval:
+ Specifies the value or interval of the filter expression. Packets
+ and Flow Records that have a value equal to the Selection Value or
+ within the Interval will be selected.
+
+
+
+
+D'Antonio, et al. Standards Track [Page 17]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ For Hash-based Flow Filtering:
+
+ - Hash Domain:
+ Specifies the bits from the packet or Flow that are taken as the
+ hash input to the hash function.
+
+ - Hash Function:
+ Specifies the name of the hash function that is used to calculate
+ the hash value. Possible hash functions are BOB [RFC5475], IP
+ Shift-XOR (IPSX) [RFC5475], and CRC-32 [Bra75].
+
+ - Hash Selection Range:
+ Flows that have a hash value within the Hash Selection Range are
+ selected. The Hash Selection Range can be a value interval or
+ arbitrary hash values within the Hash Range of the hash function.
+
+ - Random Seed or Initializer Value:
+ Some hash functions require an initializing value. In order to
+ make the selection decision more secure, one can choose a random
+ seed that configures the hash function.
+
+ For Flow-state Dependent Intermediate Flow Selection Process:
+
+ - Frequency threshold:
+ Specifies the frequency threshold s for Flow-state dependent Flow
+ Selection techniques that try to find the most frequent items
+ within a dataset. All Flows that exceed the defined threshold
+ will be selected.
+
+ - Accuracy parameter:
+ Specifies the accuracy parameter e for techniques that deal with
+ the issue of mining frequent items in a dataset. The accuracy
+ parameter defines the maximum error, i.e., no Flows that have a
+ true frequency less than (s - e) N are selected, where s is the
+ frequency threshold and N is the total number of packets.
+
+ The above list of parameters for Flow-state dependent Flow Selection
+ techniques is suitable for the presented frequent item and lossy
+ counting algorithms. Nevertheless, a variety of techniques exist
+ with very specific parameters not defined here.
+
+ For Systematic time-based Flow sampling:
+
+ - Interval length (in usec):
+ Defines the length of the sampling interval during which Flows are
+ selected.
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 18]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ - Spacing (in usec):
+ Defines the spacing in usec between the end of one sampling
+ interval and the start of the next interval.
+
+ For Systematic count-based Flow sampling:
+
+ - Interval length:
+ Defines the number of Flows that are selected within the sampling
+ interval.
+
+ - Spacing:
+ Defines the spacing, in number of observed Flows, between the end
+ of one sampling interval and the start of the next interval.
+
+ For random n-out-of-N Flow sampling:
+
+ - Population Size N:
+ The number of all Flows in the Population from which the sample is
+ drawn.
+
+ - Sampling Size n:
+ The number of Flows that are randomly drawn from the population N.
+
+ For probabilistic Flow sampling:
+
+ - Sampling probability p:
+ Defines the probability by which each of the observed Flows is
+ selected.
+
+7.2. Description of Flow-State Dependent Packet Selection
+
+ The configuration of Flow-state dependent packet selection has not
+ been described in [RFC5475]; therefore, the parameters are defined
+ here:
+
+ For Flow-state Dependent Packet Selection:
+
+ - Packet selection probability per possible Flow state interval:
+ Defines multiple {Flow interval, packet selection probability}
+ value pairs that configure the sampling probability, depending on
+ the current Flow state.
+
+ - Additional parameters:
+ For the configuration of Flow-state dependent packet selection,
+ additional parameters or packet properties may be required, e.g.,
+ the packet size [EsVa01].
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 19]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+8. Information Model for Intermediate Flow Selection Process
+ Configuration and Reporting
+
+ This section specifies the Information Elements that MUST be exported
+ by an Intermediate Flow Selection Process in order to support the
+ interpretation of measurement results from Flow measurements. The
+ information is mainly used to report how many packets and Flows have
+ been observed in total and how many of them were selected. This
+ helps, for instance, to calculate the Attained Selection Fraction
+ (see also [RFC5476]), which is an important parameter for providing
+ an accuracy statement. The IEs can provide reporting information
+ about Flow Records, packets, or bytes. The reported metrics are the
+ total number of elements and the number of selected elements. The
+ number of dropped elements can be derived from this information.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 20]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ Table 2 shows a list of Intermediate Flow Selection Process
+ Information Elements:
+
+ ID Name | ID Name
+ ----------------------------------+----------------------------------
+ 301 selectionSequenceID | 302 selectorID
+ |
+ 390 flowSelectorAlgorithm | 1 octetDeltaCount
+ |
+ 391 flowSelectedOctetDeltaCount | 2 packetDeltaCount
+ |
+ 392 flowSelectedPacketDeltaCount | 3 originalFlowsPresent
+ |
+ 393 flowSelectedFlowDeltaCount | 394 selectorIDTotalFlowsObserved
+ |
+ 395 selectorIDTotalFlowsSelected | 396 samplingFlowInterval
+ |
+ 397 samplingFlowSpacing | 309 samplingSize
+ |
+ 310 samplingPopulation | 311 samplingProbability
+ |
+ 398 flowSamplingTimeInterval | 399 flowSamplingTimeSpacing
+ |
+ 326 digestHashValue | 400 hashFlowDomain
+ |
+ 329 hashOutputRangeMin | 330 hashOutputRangeMax
+ |
+ 331 hashSelectedRangeMin | 332 hashSelectedRangeMax
+ |
+ 333 hashDigestOutput | 334 hashInitialiserValue
+ |
+ 320 absoluteError | 321 relativeError
+ |
+ 336 upperCILimit | 337 lowerCILimit
+ |
+ 338 confidenceLevel |
+
+ Table 2: Intermediate Flow Selection Process Information Elements
+
+
+
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 21]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+9. IANA Considerations
+
+9.1. Registration of Information Elements
+
+ IANA has registered the following IEs in the "IPFIX Information
+ Elements" registry at http://www.iana.org/assignments/ipfix/.
+
+9.1.1. flowSelectorAlgorithm
+
+ Description:
+
+ This Information Element identifies the Intermediate Flow
+ Selection Process technique (e.g., Filtering, Sampling) that is
+ applied by the Intermediate Flow Selection Process. Most of these
+ techniques have parameters; configuration parameter(s) MUST be
+ clearly specified. Further Information Elements are needed to
+ fully specify packet selection with these methods and all their
+ parameters. Further method identifiers may be added to the list
+ below. It might be necessary to define new Information Elements
+ to specify their parameters. The flowSelectorAlgorithm registry
+ is maintained by IANA. New assignments for the registry will be
+ administered by IANA, on a First Come First Served basis
+ [RFC5226], subject to Expert Review [RFC5226]. Please note that
+ the purpose of the flow selection techniques described in this
+ document is the improvement of measurement functions as defined in
+ the Introduction (Section 1). Before adding new flow selector
+ algorithms, their intended purposes should be determined,
+ especially if those purposes contradict any policies defined in
+ [RFC2804]. The designated expert(s) should consult with the
+ community if a request that runs counter to [RFC2804] is received.
+ The registry can be updated when specifications of the new
+ method(s) and any new Information Elements are provided. The
+ group of experts must double-check the flowSelectorAlgorithm
+ definitions and Information Elements with already-defined
+ flowSelectorAlgorithm definitions and Information Elements for
+ completeness, accuracy, and redundancy. Those experts will
+ initially be drawn from the Working Group Chairs and document
+ editors of the IPFIX and PSAMP Working Groups. The following
+ identifiers for Intermediate Flow Selection Process Techniques are
+ defined here:
+
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 22]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ +----+------------------------+--------------------------+
+ | ID | Technique | Parameters |
+ +----+------------------------+--------------------------+
+ | 1 | Systematic count-based | flowSamplingInterval |
+ | | Sampling | flowSamplingSpacing |
+ +----+------------------------+--------------------------+
+ | 2 | Systematic time-based | flowSamplingTimeInterval |
+ | | Sampling | flowSamplingTimeSpacing |
+ +----+------------------------+--------------------------+
+ | 3 | Random n-out-of-N | samplingSize |
+ | | Sampling | samplingPopulation |
+ +----+------------------------+--------------------------+
+ | 4 | Uniform probabilistic | samplingProbability |
+ | | Sampling | |
+ +----+------------------------+--------------------------+
+ | 5 | Property Match | Information Element |
+ | | Filtering | Value Range |
+ +----+------------------------+--------------------------+
+ | Hash-based Filtering | hashInitialiserValue |
+ +----+------------------------+ hashFlowDomain |
+ | 6 | using BOB | hashSelectedRangeMin |
+ +----+------------------------+ hashSelectedRangeMax |
+ | 7 | using IPSX | hashOutputRangeMin |
+ +----+------------------------+ hashOutputRangeMax |
+ | 8 | using CRC | |
+ +----+------------------------+--------------------------+
+ | 9 | Flow-state Dependent |No agreed Parameters |
+ | | Intermediate Flow | |
+ | | Selection Process | |
+ +----+------------------------+--------------------------+
+
+ Table 3: Intermediate Flow Selection Process Techniques
+
+ Abstract Data Type: unsigned16
+
+ ElementId: 390
+
+ Data Type Semantics: identifier
+
+ Status: current
+
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 23]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+9.1.2. flowSelectedOctetDeltaCount
+
+ Description:
+
+ This Information Element specifies the volume in octets of all
+ Flows that are selected in the Intermediate Flow Selection Process
+ since the previous report.
+
+ Abstract Data Type: unsigned64
+
+ ElementId: 391
+
+ Units: octets
+
+ Status: current
+
+9.1.3. flowSelectedPacketDeltaCount
+
+ Description:
+
+ This Information Element specifies the volume in packets of all
+ Flows that were selected in the Intermediate Flow Selection
+ Process since the previous report.
+
+ Abstract Data Type: unsigned64
+
+ ElementId: 392
+
+ Units: packets
+
+ Status: current
+
+9.1.4. flowSelectedFlowDeltaCount
+
+ Description:
+
+ This Information Element specifies the number of Flows that were
+ selected in the Intermediate Flow Selection Process since the last
+ report.
+
+ Abstract Data Type: unsigned64
+
+ ElementId: 393
+
+ Units: flows
+
+ Status: current
+
+
+
+
+D'Antonio, et al. Standards Track [Page 24]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+9.1.5. selectorIDTotalFlowsObserved
+
+ Description:
+
+ This Information Element specifies the total number of Flows
+ observed by a Selector, for a specific value of SelectorID. This
+ Information Element should be used in an Options Template scoped
+ to the observation to which it refers. See Section 3.4.2.1 of the
+ IPFIX protocol document [RFC7011].
+
+ Abstract Data Type: unsigned64
+
+ ElementId: 394
+
+ Units: flows
+
+ Status: current
+
+9.1.6. selectorIDTotalFlowsSelected
+
+ Description:
+
+ This Information Element specifies the total number of Flows
+ selected by a Selector, for a specific value of SelectorID. This
+ Information Element should be used in an Options Template scoped
+ to the observation to which it refers. See Section 3.4.2.1 of the
+ IPFIX protocol document [RFC7011].
+
+ Abstract Data Type: unsigned64
+
+ ElementId: 395
+
+ Units: flows
+
+ Status: current
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 25]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+9.1.7. samplingFlowInterval
+
+ Description:
+
+ This Information Element specifies the number of Flows that are
+ consecutively sampled. A value of 100 means that 100 consecutive
+ Flows are sampled. For example, this Information Element may be
+ used to describe the configuration of a systematic count-based
+ Sampling Selector.
+
+ Abstract Data Type: unsigned64
+
+ ElementId: 396
+
+ Units: flows
+
+ Status: current
+
+9.1.8. samplingFlowSpacing
+
+ Description:
+
+ This Information Element specifies the number of Flows between two
+ "samplingFlowInterval"s. A value of 100 means that the next
+ interval starts 100 Flows (which are not sampled) after the
+ current "samplingFlowInterval" is over. For example, this
+ Information Element may be used to describe the configuration of a
+ systematic count-based Sampling Selector.
+
+ Abstract Data Type: unsigned64
+
+ ElementId: 397
+
+ Units: flows
+
+ Status: current
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 26]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+9.1.9. flowSamplingTimeInterval
+
+ Description:
+
+ This Information Element specifies the time interval in
+ microseconds during which all arriving Flows are sampled. For
+ example, this Information Element may be used to describe the
+ configuration of a systematic time-based Sampling Selector.
+
+ Abstract Data Type: unsigned64
+
+ ElementId: 398
+
+ Units: microseconds
+
+ Status: current
+
+9.1.10. flowSamplingTimeSpacing
+
+ Description:
+
+ This Information Element specifies the time interval in
+ microseconds between two "flowSamplingTimeInterval"s. A value of
+ 100 means that the next interval starts 100 microseconds (during
+ which no Flows are sampled) after the current
+ "flowsamplingTimeInterval" is over. For example, this Information
+ Element may be used to describe the configuration of a systematic
+ time-based Sampling Selector.
+
+ Abstract Data Type: unsigned64
+
+ ElementId: 399
+
+ Units: microseconds
+
+ Status: current
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 27]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+9.1.11. hashFlowDomain
+
+ Description:
+
+ This Information Element specifies the Information Elements that
+ are used by the Hash-based Flow Selector as the Hash Domain.
+
+ Abstract Data Type: unsigned16
+
+ ElementId: 400
+
+ Data Type Semantics: identifier
+
+ Status: Current
+
+9.2. Registration of Object Identifier
+
+ IANA has registered the following OID in the IPFIX-SELECTOR-MIB
+ Functions subregistry at http://www.iana.org/assignments/smi-numbers
+ according to the procedures set forth in [RFC6615].
+
+ +---------+-----------------------+---------------------+-----------+
+ | Decimal | Name | Description | Reference |
+ +---------+-----------------------+---------------------+-----------+
+ | 8 | flowSelectorAlgorithm | This Object | [RFC7014] |
+ | | | Identifier | |
+ | | | identifies the | |
+ | | | Intermediate Flow | |
+ | | | Selection Process | |
+ | | | technique (e.g., | |
+ | | | Filtering, | |
+ | | | Sampling) that is | |
+ | | | applied by the | |
+ | | | Intermediate Flow | |
+ | | | Selection Process | |
+ +---------+-----------------------+---------------------+-----------+
+
+ Table 4: Object Identifiers to Be Registered
+
+10. Security and Privacy Considerations
+
+ Flow data exported by Exporting Processes, and collected by
+ Collecting Processes, can be sensitive for privacy reasons and need
+ to be protected. Privacy considerations for collected data are
+ provided in [RFC7011].
+
+ Some of the described Intermediate Flow Selection Process techniques
+ (e.g., Flow sampling, hash-based Flow Filtering) aim at the selection
+
+
+
+D'Antonio, et al. Standards Track [Page 28]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ of a representative subset of flows in order to estimate parameters
+ of the population. An adversary may have incentives to influence the
+ selection of flows, for example, to circumvent accounting or to avoid
+ the detection of packets that are part of an attack.
+
+ Security considerations concerning the choice of a hash function for
+ Hash-based packet selection have been discussed in Section 6.2.3 of
+ [RFC5475] and are also appropriate for Hash-based Flow Selection.
+ [RFC5475] discusses the possibility of crafting Packet Streams that
+ are disproportionately selected or can be used to discover hash
+ function parameters. It also describes vulnerabilities of different
+ hash functions to these attacks and discusses practices to minimize
+ these vulnerabilities.
+
+ For other sampling approaches, an adversary can gain knowledge about
+ the start and stop triggers in time-based systematic Sampling, e.g.,
+ by sending test packets. This knowledge might allow adversaries to
+ modify their send schedule in such a way that their packets are
+ disproportionately selected or not selected. For random Sampling, an
+ input to the encryption process, like the Initialization Vector of
+ the CBC (Cipher Block Chaining) mode, should be used to prevent an
+ adversary from predicting the selection decision [Dw01].
+
+ Further security threats can occur when Intermediate Flow Selection
+ Process parameters are configured or communicated to other entities.
+ The protocol(s) for the configuration and reporting of Intermediate
+ Flow Selection Process parameters are out of scope for this document.
+ Nevertheless, a set of initial requirements for future configuration
+ and reporting protocols are stated below:
+
+ 1. Protection against disclosure of configuration information:
+ Intermediate Flow Selection Process configuration information
+ describes the Intermediate Flow Selection Process and its
+ parameters. This information can be useful to attackers.
+ Attackers may craft packets that never fit the selection criteria
+ in order to prevent Flows from being seen by the Intermediate
+ Flow Selection Process. They can also craft a lot of packets
+ that fit the selection criteria and overload or bias subsequent
+ processes. Therefore, any transmission of configuration data
+ (e.g., to configure a process or to report its actual status)
+ should be protected by encryption.
+
+ 2. Protection against modification of configuration information:
+ Sending incorrect configuration information to the Intermediate
+ Flow Selection Process can lead to a malfunction of the
+ Intermediate Flow Selection Process. Additionally, reporting
+ incorrect configuration information from the Intermediate Flow
+ Selection Process to other processes can lead to incorrect
+
+
+
+D'Antonio, et al. Standards Track [Page 29]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ estimations at subsequent processes. Therefore, any protocol
+ that transmits configuration information should prevent an
+ attacker from modifying configuration information. Data
+ integrity can be achieved by authenticating the data.
+
+ 3. Protection against malicious nodes sending configuration
+ information:
+ The remote configuration of Intermediate Flow Selection Process
+ techniques should be protected against access by unauthorized
+ nodes. This can be achieved by access control lists at the
+ device that hosts the Intermediate Flow Selection Process (e.g.,
+ IPFIX Exporter, IPFIX Mediator, or IPFIX Collector) and by source
+ authentication. The reporting of configuration data from an
+ Intermediate Flow Selection Process has to be protected in the
+ same way. That means that protocols that report configuration
+ data from the Intermediate Flow Selection Process to other
+ processes also need to protect against unauthorized nodes
+ reporting configuration information.
+
+ The security threats that originate from communicating configuration
+ information to and from Intermediate Flow Selection Processes cannot
+ be assessed solely with the information given in this document. A
+ further and more detailed assessment of security threats is necessary
+ when a specific protocol for the configuration or reporting
+ configuration data is proposed.
+
+11. Acknowledgments
+
+ We would like to thank the IPFIX group, especially Brian Trammell,
+ Paul Aitken, and Benoit Claise, for fruitful discussions and for
+ proofreading the document.
+
+12. References
+
+12.1. Normative References
+
+ [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
+ Requirement Levels", BCP 14, RFC 2119, March 1997.
+
+ [RFC5475] Zseby, T., Molina, M., Duffield, N., Niccolini, S., and
+ F. Raspall, "Sampling and Filtering Techniques for IP
+ Packet Selection", RFC 5475, March 2009.
+
+ [RFC5476] Claise, B., Johnson, A., and J. Quittek, "Packet
+ Sampling (PSAMP) Protocol Specifications", RFC 5476,
+ March 2009.
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 30]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ [RFC6615] Dietz, T., Kobayashi, A., Claise, B., and G. Muenz,
+ "Definitions of Managed Objects for IP Flow Information
+ Export", RFC 6615, June 2012.
+
+ [RFC7011] Claise, B., Ed., Trammell, B., Ed., and P. Aitken,
+ "Specification of the IP Flow Information Export
+ (IPFIX) Protocol for the Exchange of Flow Information",
+ STD 77, RFC 7011, September 2013.
+
+ [RFC7012] Claise, B., Ed. and B. Trammell, Ed., "Information
+ Model for IP Flow Information Export (IPFIX)",
+ RFC 7012, September 2013.
+
+12.2. Informative References
+
+ [Bra75] Brayer, K., "Evaluation of 32 Degree Polynomials in
+ Error Detection on the SATIN IV Autovon Error
+ Patterns", National Technical Information Service,
+ August 1975.
+
+ [CoHa08] Cormode, G. and M. Hadjieleftheriou, "Finding Frequent
+ Items in Data Streams", Proceedings of the 34th
+ International Conference on Very Large DataBases
+ (VLDB), Auckland, New Zealand, Volume 1, Issue 2, pages
+ 1530-1541, August 2008.
+
+ [DuLT01] Duffield, N., Lund, C., and M. Thorup, "Charging from
+ Sampled Network Usage", ACM SIGCOMM Internet
+ Measurement Workshop (IMW) 2001, pages 245-256, San
+ Francisco, CA, USA, November 2001.
+
+ [Dw01] Dworkin, M., "Recommendation for Block Cipher Modes of
+ Operation - Methods and Techniques", NIST Special
+ Publication 800-38A, December 2001.
+
+ [EsVa01] Estan, C. and G,. Varghese, "New Directions in Traffic
+ Measurement and Accounting: Focusing on the Elephants,
+ Ignoring the Mice", ACM SIGCOMM Internet Measurement
+ Workshop (IMW) 2001, San Francisco, CA, USA,
+ November 2001.
+
+ [IANA-IPFIX] IANA, "IP Flow Information Export (IPFIX) Entities
+ Registry", <http://www.iana.org/assignments/ipfix/>.
+
+ [KaPS03] Karp, R., Papadimitriou, C., and S. Shenker, "A simple
+ algorithm for finding frequent elements in sets and
+ bags", ACM Transactions on Database Systems, Volume 28,
+ pages 51-55, March 2003.
+
+
+
+D'Antonio, et al. Standards Track [Page 31]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+ [MSZC10] Mai, J., Sridharan, A., Zang, H., and C. Chuah, "Fast
+ Filtered Sampling", Computer Networks Volume 54, Issue
+ 11, pages 1885-1898, ISSN 1389-1286, August 2010.
+
+ [MaMo02] Manku, G. and R. Motwani, "Approximate Frequency Counts
+ over Data Streams", Proceedings of the 28th
+ International Conference on Very Large DataBases
+ (VLDB), Hong Kong, China, pages 346-357, August 2002.
+
+ [RFC2804] IAB and IESG, "IETF Policy on Wiretapping", RFC 2804,
+ May 2000.
+
+ [RFC3917] Quittek, J., Zseby, T., Claise, B., and S. Zander,
+ "Requirements for IP Flow Information Export (IPFIX)",
+ RFC 3917, October 2004.
+
+ [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing
+ an IANA Considerations Section in RFCs", BCP 26,
+ RFC 5226, May 2008.
+
+ [RFC5470] Sadasivan, G., Brownlee, N., Claise, B., and J.
+ Quittek, "Architecture for IP Flow Information Export",
+ RFC 5470, March 2009.
+
+ [RFC6183] Kobayashi, A., Claise, B., Muenz, G., and K. Ishibashi,
+ "IP Flow Information Export (IPFIX) Mediation:
+ Framework", RFC 6183, April 2011.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 32]
+
+RFC 7014 Flow Selection Techniques September 2013
+
+
+Authors' Addresses
+
+ Salvatore D'Antonio
+ University of Napoli "Parthenope"
+ Centro Direzionale di Napoli Is. C4
+ Naples 80143
+ Italy
+
+ Phone: +39 081 5476766
+ EMail: salvatore.dantonio@uniparthenope.it
+
+
+ Tanja Zseby
+ CAIDA/FhG FOKUS
+ San Diego Supercomputer Center (SDSC)
+ University of California, San Diego (UCSD)
+ 9500 Gilman Drive
+ La Jolla, CA 92093-0505
+ USA
+
+ EMail: tanja.zseby@tuwien.ac.at
+
+
+ Christian Henke
+ Tektronix Communications Berlin
+ Wohlrabedamm 32
+ Berlin 13629
+ Germany
+
+ Phone: +49 17 2323 8717
+ EMail: christian.henke@tektronix.com
+
+
+ Lorenzo Peluso
+ University of Napoli
+ Via Claudio 21
+ Napoli 80125
+ Italy
+
+ Phone: +39 081 7683821
+ EMail: lorenzo.peluso@unina.it
+
+
+
+
+
+
+
+
+
+
+D'Antonio, et al. Standards Track [Page 33]
+