I have been selected as the Applications Area Review Team reviewer for
this draft (for background on apps-review, please see
http://www.apps.ietf.org/content/applications-area-review-team).
Please resolve these comments along with any other Last Call comments
you may receive. Please wait for direction from your document shepherd
or AD before posting a new version of the draft.

Document: draft-ietf-ipfix-mediators-framework-09
Title: IPFIX Mediation: Framework
Reviewer: Aaron Stone
Review Date: 2010-12-18
IETF Last Call Date: unknown
IESG Telechat Date: unknown
Summary: This is a very well-written document, with truly excellent
ASCII art, that appears ready for publication. Its intended status as
Informational seems mandatory, given that the document does not use
RFC 2119 keywords to directly specify behaviors.

Major issues:

I would say not using RFC 2119 is a major issue, but since the
intended status is Informational, I don't see a problem.

Minor issues:

Section 2: -- I suggest making three subsections, at the paragraphs that begin:
"The following terms are used in this document to describe the
architectural entities used by IPFIX Mediation."
"Specific Intermediate Processes are described below."
Section 2: -- The definition of "IPFIX Mediator" is core to this
document, so it seems like it should be at the top of the section, and
probably in the introduction.

Section 3: -- Is the term "documents" understood in a particular way
in IPFIX that a familiar reader would understand that you don't mean
"RFC document"? Or do you actually mean RFC documents, and you're
listing off which other RFCs one should read in order to better
understand what's going on here? If the latter, consider a text change
to directly state that you are listing other RFCs that the reader
should also read.

Section 5.3.2.3: -- under "Temporal composition", perhaps replace
"Flow duration" with simply "duration"? If "Flow Duration" is a
specific term, it should be defined earlier.

Section 6: -- should "Collector input" be "Collector Input"? Or is it
maybe "Collector's input"? I found the complex string of terms to be
confusing.

Section 9: -- Please flip the first sentence around: "As IPFIX
Mediators act as both IPFIX Collection Processes and Exporting
Processes, the Security Considerations for IPFIX Files [RFC5655] apply
to IPFix Mediators that write IPFIX Files or use them for internal
storage."
-- What are the specific considerations? Is that what the next
paragraph is about? ...oh, I see, the third paragraph / sentence by
itself here. Consider rephrasing this so that the reader is not
confused for a few minutes, as this reviewer has been :)

Section 9.4: -- Why is this a security consideration and not a
fundamental part of the specification, and explained in Section 3 or
4?

Nits:

Section 5.1: -- Should "Sampling parameters" be "Sampling Parameters"?
Section 5.2: -- add a colon after "following" before the list.
Section 5.2: -- rewrite the last sentence of the first bullet item as
"...become invalid (e.g., due to incoming session failure)."
Section 5.3.2.1: -- second to last paragraph, last sentence, remove
the comma in "outgoing side, only".
Section 5.3.2.4: -- add a colon after "following" before the list.
Section 5.3.2.5: -- In "Correlation between Data Record and other meta
data", use either a single word, "metadata" or a hyphenated word,
"meta-data" (the RFC Editor probably has a preferred usage).
Section 6: -- add a color after "ways" before the list.

Cheers,
Aaron