Re: [IPFIX] Fwd: [RFC 3917]Overload & Reliability requirements of Metering process

[sujay gupta <sujay.ietf at gmail.com>]

Hi Juergen,

I am assuming a control plane restart, with the forwarding plane
running in the while. This would be probably a planned restart,
And in the overload condition where i would throttle the monitoring &
other features to keep the
essentials (like forwarding/switching/hello exchange) alive.
Of course there may be platforms with coupled forwarding / control
plane where seperation is not possible.

BR,
-Sujay

On Thu, Oct 22, 2009 at 12:26 PM, Juergen Quittek <Quittek at nw.neclab.eu> wrote:
> Hi Paul,
>
> Certainly, you cannot make a precise estimation how many packets
> have been lost.
>
> But as consumer of the exported flow information I would be
> highly interested how long a router was restarting. Whether or
> noit I can use this information for an estimate depends a lot
> on the scenario.
>
> Sujay,
>
> Do you assume that the router is still forwarding packets
> while restarting ?
>
> Thanks,
>
>    Juergen
>
>
> On 21.10.09 20:52  "Paul Aitken" <paitken at cisco.com> wrote:
>
>> sujay,
>>
>>> So what I am proposing ( and is possible) is that under these
>>> conditions like O/L , soft restart the system (switch/router) can
>>> easily send to the collector  at least the "duration under which it
>>> was in the O/L/reset condition" . This information I am thinking would
>>> be useful as a rough estimate of monitoring lost, canbe converted in
>>> to number of packets not accounted for
>>
>> No, it can't.
>>
>> There are too many variables which the collecting process would have to
>> know. eg how many active monitoring processes are there on the exporting
>> device, and how much traffic are they each measuring on average?
>>
>> The delay between measuring and exporting, and the flow lifetime on the
>> switch will also be relevant, since you'll export some partially filled
>> flows for some period of time after the reset.
>>
>>
>>> or may be used as an unaccounted period by the collector.
>>
>> I think that's the only possibility. Let's not try to guess how much
>> traffic was lost.
>>
>> Cheers,
>> P.
>