Subject: [ipfix-info] Observation Point and Traffic Direction

From: [email-masked]
Date: Fri, 16 Sep 2005 20:32:28 -0400

Hi

I need a quick clarification regarding IPFIX terminology.

If the observation point is defined to be an interface such as

int Gig 1/1.

Does the metering process capture ingress packets, egress packets or 
both?

Or is the traffic direction explicitly specified.

Thanks in advance.
________________________________________________________________________
Check Out the new free AIM(R) Mail -- 2 GB of storage and 
industry-leading spam and email virus protection.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: "Ganesh Prasad .M" <[email-masked]>
Date: 19 Sep 2005 15:34:23 +0530

If you look at the Cisco implementation, user can configure the NetFlow
to capture traffic either in ingress/egress direction or both.

In the older versions of Cisco CLIs user can only configure NetFlow in
ingress direction.

But I don't know what difference will it make (capturing at ingress from
capturing at egress).

---

From: "Ganesh Prasad .M" <[email-masked]>
Date: 19 Sep 2005 15:36:19 +0530

With Warm Regards
Ganesh

---

From: Paul Aitken <[email-masked]>
Date: Mon, 19 Sep 2005 16:13:39 +0100

gtcubed,

> Does the metering process capture ingress packets, egress packets or both?
> 

A bidirectional interface is a rather vague observation "point". Apart 
from the direction issue, there's no indication whether the OP is before 
or after any processing - though one might assume an OP to be on the 
input traffic before processing.

Break your interface (conceptually!) into input and output sides, so a 
simple device can be modelled as:

	       X               Y
	input ---> processing ---> output

So the observation point can be at X on the input side or at Y on the 
output side (or both, or neither).

The OP might even be in the midst of processing eg, reporting some 
internal processing statistics.

Cheers.
-- 
Paul Aitken
Cisco Systems Ltd, Edinburgh, Scotland.

---

From: Paul Aitken <[email-masked]>
Date: Mon, 19 Sep 2005 16:16:39 +0100

Ganesh,

> But I don't know what difference will it make (capturing at ingress from

With an egress observation point, you see the field values after they've 
been modified by the various features such as ToS remarking and NAT.

---

From: [email-masked]
Date: Mon, 19 Sep 2005 12:51:51 -0400

Thanks Paul,

This clarifies it for me.

-----Original Message-----
From: Paul Aitken <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Sent: Mon, 19 Sep 2005 16:13:39 +0100
Subject: Re: [ipfix-info] Observation Point and Traffic Direction

gtcubed, 

A bidirectional interface is a rather vague observation "point". Apart 
 from the direction issue, there's no indication whether the OP is 
before or after any processing - though one might assume an OP to be on 
the input traffic before processing. 

  X Y 

 
Cheers. 
-- Paul Aitken