[IPFIX] multiple export streams

Paul Aitken <paitken@cisco.com> Mon, 26 September 2011 12:07 UTC

Message-ID: <4E806B91.7000301@cisco.com>
Date: Mon, 26 Sep 2011 13:09:53 +0100
From: Paul Aitken <paitken@cisco.com>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.21) Gecko/20110831 Lightning/1.0b2 Thunderbird/3.1.13
MIME-Version: 1.0
To: "Benoit Claise (bclaise)" <bclaise@cisco.com>
Content-Type: multipart/alternative; boundary="------------030104020901030105080308"
Cc: IETF IPFIX Working Group <ipfix@ietf.org>
Subject: [IPFIX] multiple export streams
Precedence: list

Benoit, All,

I just submitted a new errata for NFv9 (RFC 3954), to clarify that the 
source port should be used to differentiate between multiple export 
streams coming from a single device:

http://www.rfc-editor.org/errata_search.php?rfc=3954&eid=2979


While doing this, I noticed another subtle difference between NFv9 and 
IPFIX:

3954 says that these fields should be used to separate multiple streams 
from the same Exporter:

          NetFlow Collectors SHOULD use the combination of the source IP
          address and the Source ID field to separate different export
          streams originatingfrom the same Exporter.


(NB Exporter = "A device ... with the NetFlow services enabled".)

Whereas 5101 limits to multiple streams from the same Exporting Process:

       Collecting Processes SHOULD use the Transport Session and the
       Observation Domain ID field to separate different export streams
       originatingfrom the same Exporting Process.


- which fails to explain how to differentiate export streams from 
multiple EPs in a single device.

I think 5101 should also say, "from the same Exporter.", which in 5101 
is defined as:

       A device that hosts one or more Exporting Processes is termed an Exporter.


Can you take care of this in 5101bis? Shall I open another errata?

Thanks,
P.

[IPFIX] multiple export streams Paul Aitken
Re: [IPFIX] multiple export streams Benoit Claise