IPFIX Working Group B. Trammell Internet-Draft ETH Zurich Intended status: Standards Track July 26, 2010 Expires: January 27, 2011 Reserved Set IDs to Enable Boundary Finding in Mixed IPFIX Files draft-trammell-ipfix-set9hack-00.txt Abstract This document reserves the IPFIX Set IDs 9 and 10 to prevent them from being allocated in the future. The reason behind this is to ensure that heuristic methods for determining PDU boundaries in files containing NetFlow V9 PDUs and IPFIX Messages work in a standards- compliant way. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on January 27, 2011. Copyright Notice Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Trammell Expires January 27, 2011 [Page 1] Internet-Draft IPFIX Set 9 Hack July 2010 1. Rationale Although Cisco NetFlow V9 [RFC3954] was never designed to be used as a storage format, and [RFC5655] defines a simple method for storing NetFlow V9 data in IPFIX Files, serialized files containing NetFlow V9 PDUs are nevertheless in use for storage. NetFlow V9, unlike IPFIX, counts records as opposed to bytes in its Packet Header and as such does not provide a simple method for finding the boundaries of a Packet in a serialized stream. A reader searching for the next NetFlow V9 Packet in a file must either parse the entire Message and count records to match with the V9 Count header, or simply skip sets and assume that a "Set ID" of 9 is actually a NetFlow V9 Packet Header Version field, and that the "Set Header" in this case is actually a Packet Header. This works because Cisco NetFlow V9 will never export a Set with a Set ID of 9. However, if a file contains mixed NetFlow V9 and IPFIX messages, the fact that IPFIX could allocate a set ID of 9 for future use would cause any reader using this method to fail. Reserving Set ID 9 to keep it from being allocated in the future would solve this problem. Similarly, Set ID 10 could be used to recognize IPFIX Messages in a file containing a mix of NetFlow V9 and IPFIX data. "Future use" Set IDs (4-255) are not a particularly scarce resource, considering they require non-interoperable changes to the protocol to implement; therefore, reserving two to prevent future allocation presents no serious problem. 2. IANA Considerations IANA has added two entries to the IPFIX Set ID registry: Set ID 9 is now Reserved. Set ID 10 is now Reserved. 3. Normative References [RFC3954] Claise, B., "Cisco Systems NetFlow Services Export Version 9", RFC 3954, October 2004. [RFC5655] Trammell, B., Boschi, E., Mark, L., Zseby, T., and A. Wagner, "Specification of the IP Flow Information Export (IPFIX) File Format", RFC 5655, October 2009. Trammell Expires January 27, 2011 [Page 2] Internet-Draft IPFIX Set 9 Hack July 2010 Author's Address Brian Trammell Swiss Federal Institute of Technology Zurich Gloriastrasse 35 8092 Zurich Switzerland Phone: +41 44 632 70 13 Email: trammell@tik.ee.ethz.ch Trammell Expires January 27, 2011 [Page 3]