[13:57:23] --- sleinen has joined
[14:29:05] --- sleinen has left: Logged out
[14:29:23] --- sleinen has joined
[15:01:57] --- acmacm has joined
[15:07:04] --- wej has joined
[15:11:33] --- ggm has joined
[15:16:41] --- sleinen has left: Disconnected
[15:17:42] --- nevil has joined
[15:23:16] <ggm> ggm scribing, plz be gentle on me!
[15:23:18] --- ggm has left
[15:23:43] --- ggm has joined
[15:23:53] <ggm> ggm scribing, plz be gentle with me!
[15:25:15] --- sleinen has joined
[15:25:49] <ggm> administrivia...
[15:27:20] <ggm> documents improving, chairs optimistic
[15:28:12] <ggm> Nevil: wrapping up. good response to WG last call
[15:28:49] <ggm> David Kessins AD: long wait on this protocol from industry, other places. needs to wrap up
[15:29:53] <ggm> Nevil: small details now filled in. docs in pretty good shape. little more editorial work, 1 or 2 issues Jurgen/benoit will bring up
[15:30:28] <ggm> final versions to get out asap after IETF, WG last call, aim to give to IESG by mid-april
[15:31:47] <ggm> Arch Changes. 05 published 3 weeks after DC ietf61. lots of changes from doc editors 06 early feb, few more changes, look at issues listed in draft, reconcile with ML comments to close. published note. feedback, 07 with few more editorial changes, will submit next week
[15:31:59] <ggm> added definition for information element
[15:32:09] <ggm> matches terminology in protocol draft
[15:32:31] <ggm> odd comment on flow expiration. -dropped.
[15:32:44] <ggm> odd comment on data loss in collector failure, -dropped
[15:33:08] <ggm> 6 new issues, ARCH13-ARCH18
[15:33:17] <ggm> 05->06
[15:34:04] <ggm> flow keys. definition changed, flow defined as set of flow-keys
[15:34:38] <ggm> special traffic & devices. sections combined to 'IPFIX in special situations' text
[15:34:56] <ggm> lots if inf.elems useful for NATS, middleboxes, firewalls.
[15:35:19] <ggm> text changes otherwise typos.
[15:35:25] <ggm> 06->07 all editorial changes
[15:35:45] <ggm> better explanation in terminology, metering, more typos
[15:36:27] <ggm> Benoit
[15:36:38] <ggm> issues closed in V7.
[15:37:07] <ggm> SCTP section improved. got rid of inconsistencies. treat SCTP as default protocol, UDP as exception.
[15:37:17] <ggm> more examples, editorial changes (not discussed)
[15:37:25] <ggm> issues closed in V8
[15:37:50] <ggm> TCP section included from Simon. Seq No now number of data records in Hdr
[15:37:55] <ggm> issues closed in V9
[15:38:29] <ggm> new section on protocol format. were describing format and examples together. generic format and separate examples. clearer
[15:38:45] <ggm> examples improved. match inf. elems defined in model-draft.
[15:39:17] <ggm> new sections on data types encoding. originally net-byte order and canonical. but turned out to be not enough.
[15:40:00] <ggm> simplified specific option templates. dont need ipfixOption
[15:41:10] <ggm> emil. sure about scope changes?
[15:41:23] <ggm> benoit yes. giving guidelines, which we think make sense if you have no clue.
[15:41:42] <ggm> emile stephan
[15:41:57] <ggm> changes in V10. not yet out (next week)
[15:42:16] <ggm> improved text on protocol format, removed confusion with terminology
[15:42:34] --- dbh has joined
[15:42:34] <ggm> removed flow expiration section. kept the one in IPFIX-ARCH (as proposed on ML)
[15:42:43] <ggm> more editorial changes
[15:42:49] <ggm> open issues. with consensus
[15:43:19] <ggm> Data Record instead of Flow Data Record or Options Data Record. only one dissenter on list, 6-7 in favour
[15:44:45] <ggm> time. Jurgen to speak about issue, how do we calc the 'base time' -in draft is unsigned32, so offset is always positive. base-time in pkt header must be lowest or lower time.
[15:45:15] <ggm> need encoding for dateTimeMicroSeconds. -editorial stuff and some emails to be checked, but thats it.
[15:45:41] <ggm> Dave: 5 min to discuss. use the time to start Jurgen -then have discussion
[15:46:28] <ggm> Juergen
[15:47:00] <ggm> last time talked about 05. posted 06 few weeks back, working on 07, to post when completed maybe next week
[15:47:07] <ggm> changes since 05.
[15:47:20] <ggm> terminology compliance. import from proto document. make usage consistent
[15:47:49] <ggm> added 2 sections. scope of inf.elems. describe info model, talk about what is a scope. then added naming conventions of inf.elems.
[15:48:12] <ggm> concerned about middleboxes which do more than just forwarding (modify contents) -added post prefix for properties
[15:48:58] <ggm> eg if src ip change, incoming is srcIP and after change is postSrcIP (caps mine)
[15:49:30] <ggm> added 'macAddress' datatypes. editorial issues fixed
[15:50:11] <ggm> new elements (large list) 3 groups. flow stuff, for different precisions. so different start/end for delta/milli/micro/nano
[15:50:33] <ggm> identifiers for cards, vlans. missing address fields.
[15:51:00] <ggm> Stewart Bryant. when added line card/port, creating iana registry for them, don't have to write an RFC?
[15:51:45] <ggm> Benoit, yes, we did it already. discussed last time, scopeIDs are regular inf.elems. way to register any . scopeID doesn't have sub-types
[15:52:03] <ggm> Open Issues.
[15:52:11] <ggm> time stamp issue. abs timestamps, no discussion.
[15:53:20] <ggm> relative timestamps, save space/effort. time base in msg header. now give deltas. discussion about base time as export time. oldest time in record
[15:53:35] <ggm> open issue. Simon.
[15:54:14] <ggm> Simon Leinen. problem with change to semantics of header field , loose piece of information. xport time. may have been useful to know when exporting device did it. probably not terribly important to know.
[15:54:46] <ggm> impl. detail what is used. don't think we loose anything by leaving up to exporting device. constraint should be. lower than actual timestamps in exported recs
[15:55:05] <ggm> current draft has stronger constraint. timebase ==oldest timestamp in all recs.
[15:56:14] <ggm> to compute requires pass over records. can only create header afterwards. (naieve approach) other ways to do it .
[15:56:52] <ggm> base time should be chosen to make computed times +ve offsets in microseconds.
[15:57:36] <ggm> Juergen. 3 choices. old, +ve offset, young, all -ve offset or combined, allow +/-. personal pref for exporting time, gain one more information.
[15:58:44] <ggm> Brian. issues with lag on exporter. may not have 71min in a message. time shrinks arbitrarily., same problem with signed. usually only have a few negs, so waste bits. thats why I think +ve only best
[15:58:56] <ggm> Nevil. who cares about export time?
[15:59:33] <ggm> Emile. export time, is time msg sent. If you need to use delta time, add inf elem. beginning of flowset, give abs time, then deltas from that.
[16:00:16] <ggm> Nevil no simple way to get that into protocol as it stands. Eds going for simple change.
[16:00:21] <ggm> Juergen take to ML
[16:00:36] <ggm> Open issues 2.
[16:01:17] <ggm> in msg header, field called src ID. inf elem, src ID to be used as scope. introduces ambiguity. not defined what to do. (semantics)
[16:01:35] <ggm> Tanja on the Applicability Statement
[16:02:07] <ggm> on V04
[16:02:23] <ggm> added accounting example. common case.
[16:02:38] <ggm> added some sections. limitations, RMON, V6 issues
[16:03:07] <ggm> shortened the RTFM and PSAMP sections
[16:03:21] <ggm> removed TEWG -no volunteers.
[16:03:37] <ggm> improved intro, editorial corrections, rewriting
[16:03:39] <ggm> open issues.
[16:04:27] <ggm> limitations issue. cited from reqts draft about use for usage-based accounting. may want texts on limitations.
[16:04:54] <ggm> PSAMP issue. extend inf.model to make it work. may need reworking.
[16:05:52] <ggm> [ggm off to the loo]
[16:07:59] <sleinen> Topic: aggregating data inside IPFIX devices, such as core routers that cannot maintain all individual flows
[16:08:25] <sleinen> Two main application areas: accounting (for charging) and security monitoring
[16:08:49] <sleinen> Insert something called the Aggregation Process (AP) between Metering Process (MP) and Exporting Process (EP)
[16:09:06] <sleinen> Not an extension of the architecture, only an implementation of the architecture
[16:09:38] <ggm> need aggregation rules.
[16:09:47] <ggm> can do prefix matching, routes, port ranges.
[16:10:32] <ggm> when making rules, from measurement/other applications, need to record it, to tell collector what rule was applied. need template type to report aggr rules used
[16:10:59] <ggm> slide of example. -meta-table has less entries.
[16:11:37] <ggm> may end up with overlapping aggregates. packets can match in both. may lead to confusion. important when specifying aggr rules, give precedence.
[16:13:11] <ggm> [missed slide sorry]
[16:13:41] <ggm> highly aggregated flows can export rules with flow. -solution in draft about template. [juergen interpolates view can also have option template]
[16:14:28] <ggm> conclusions. -lists advantages, data reduction, speed up accounting, multiple stream concentration, transport of inf about aggregation, scaleablility outcome.
[16:15:35] <ggm> Nevil. encourage feedback to Falko
[16:15:49] <ggm> Emile. this document should be WG item.
[16:16:14] <sleinen> Emile Stephan suggests that this should be a WG item - the actual content could be different though.
[16:16:57] <ggm> Elisa. update on per-pkt info export
[16:17:29] <ggm> separate flow/pkt info, put into different templates with an index to correlate.
[16:17:52] <ggm> changes since last version:
[16:18:06] <ggm> adding section on index management (calling them flow IDs)
[16:18:22] <ggm> suggest use of option templates for flow properties. flowID as scope.
[16:18:35] <ggm> improved text a bit
[16:18:45] <ggm> no changes in IPFIX to make this work
[16:18:47] <ggm> next steps.
[16:19:42] <ggm> new version in prep. draft relates to IPFIX and PSAMP. which WG?, want to integrate into a doc. which one?
[16:20:07] <ggm> Dave: did split it appropriately. concerned it would slow down the document. proposal would be to stick with Inf.Elems here, but then carry on in PSAMP
[16:20:39] <ggm> stewart: can be standalone doc, WG one or other group, within the framework/proto definition.
[16:20:53] <ggm> Dave if acceptable to you and other authors, can choose. if IPFIX time constraints too big, go PSAMP
[16:21:11] <ggm> Benoit I think its more like PSAMP. per-packet, this id, its in PSAMP techniques draft.
[16:21:30] <ggm> Stewart. time constraints, want to wind up. But continuous flow of ideas from this protocol.need a place to work for some time.
[16:21:36] <ggm> Nevil get the docs through as RFCs
[16:21:45] <ggm> Stewart this doesnt gate that at all., uses it as platform.
[16:21:57] <ggm> Nevil. want to seek charter revision, pick up on work items, can discuss and take to AD
[16:22:06] <ggm> Stewart will be other ideas. need platform
[16:22:27] <ggm> Nevil can work out of band.
[16:22:32] <ggm> then come back and re-charter.
[16:22:43] <ggm> Stewart. ok. so Q is which WG. clearly, no way it gates anything.
[16:23:10] <ggm> Juergen. where to put it? haven't defined PSAMP protocol in detail. as I see it, discussed with Benoit, see it as application of PSAMP proto, think it belongs. on border line
[16:23:16] <ggm> add information aboutflow.
[16:23:19] <ggm> Dave need to wrap up
[16:23:25] <ggm> Next steps
[16:23:54] <ggm> want to push the milestones out. 21 days to a month. trying to get through last call. ask DKessins to reschedule to mid-april. submit revisions
[16:24:10] <ggm> PSAMP is next session.
[16:25:35] --- nevil has left
[16:26:11] --- sleinen has left
[16:28:19] <ggm> finished
[16:38:34] --- wej has left: Disconnected
[16:40:14] * acmacm has set the topic to: ipfix working group
[16:45:01] --- ggm has left
[16:46:14] --- wej has joined
[17:02:49] --- acmacm has left
[20:07:52] --- Tsuchiya has joined
[20:09:53] --- Tsuchiya has left
[20:24:46] --- Tsuchiya has joined
[20:26:58] --- Tsuchiya has left