Transcript PPT Version
Flow sampling in IPFIX: Status and suggestion for its support Maurizio Molina, <[email protected]> Packet sampling • Packet sampling selects packets within flows – Several possible algorithms (1 out of N, random,…) – Done to reduce meter load – Most likely same algorithm is applied to all flows of an observation point • Information to be exported: sampling algorithm and parameters (all drafts say so….) • PROTO draft: “The Options Template Record….is used to supply information about the Metering process configuration….rather than supplying info about IP flows….for example the sample rate of an interface” • INFO draft: – SamplingAlgorithm – SamplingInterval © NEC Europe Ltd., 2002 Network Laboratories, Heidelberg 2 Flow sampling • Flow sampling selects entire flows – ARCH draft: “Selecting Flows for export” is a MAY funct. in the exporting process. • In this way, it can reduce export/collector load • Example: collect all, export the elephants: – http://www.research.att.com/~duffield/pubs/DLT02-optimal.pdf – BUT it would be also beneficial to allow this functionality in the meter, to deal with limited resources (e.g memory for the flow cache) • Example: keep flow records for the elephants only: – C. Estan, and G. Varghese: “New directions in traffic measurement and accouning”, SIGCOMM 2002 • F.S. can co-exist with pk sampling, even if pk sampling introduces a “natural” flow sampling (small flows out) • What info can/ needs to be exported? How? © NEC Europe Ltd., 2002 Network Laboratories, Heidelberg 3 Exporting flow sampling Info • It is Metering/exporting process Info, not single flows Info – As for packet sampling, use Option records: flow records contain an options record ID where this info is contained. “Scope” can be the interface, the cache, etc. • Info that can be known: – Flow sampling type and parameters • E.g. threshold based exporting, 1 out of N exporting? Elephant detection? – Unreported traffic because of flow sampling (packets, bytes) – Unreported flows (only if flow sampling is done in the exporter, if it’s in the meter we don’t know it…) • What is this info useful for? – Re-normalization (like for pk sampling) – Trust/re-adjustement of the metering process (e.g. “reported flows only account for 10% of the traffic….”) © NEC Europe Ltd., 2002 Network Laboratories, Heidelberg 4 Flow Sampling in IPFIX - Conclusions • Flow sampling in the exporter process is already considered (as a MAY) in IPFIX drafts. What information to export hasn’t been defined yet • Flow sampling in the meter is not explicitly considered, but may be a need if meter’s memory is limited • How to Export flow sampling info: it would be possible with Option records, like for pk sampling Suggested next steps: • Internet draft describing the flow sampling issue, what specific info to export and how. As a target, add these info in IPFIX information model • Comments? Questions? © NEC Europe Ltd., 2002 Network Laboratories, Heidelberg 5