One document matched: draft-ietf-ipfix-flow-selection-tech-12.xml
<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
<?rfc toc="yes"?>
<?rfc tocompact="yes"?>
<?rfc tocdepth="3"?>
<?rfc tocindent="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes"?>
<?rfc comments="yes"?>
<?rfc inline="yes"?>
<?rfc compact="yes"?>
<?rfc subcompact="no"?>
<rfc category="std" docName="draft-ietf-ipfix-flow-selection-tech-12.txt"
ipr="pre5378Trust200902">
<front>
<title abbrev="Flow Selection Techniques">Flow Selection
Techniques</title>
<author fullname="Salvatore D'Antonio" initials="S." surname="D'Antonio">
<organization>University of Napoli "Parthenope"</organization>
<address>
<postal>
<street>Centro Direzionale di Napoli Is. C4</street>
<city>Naples</city>
<code>80143</code>
<country>Italy</country>
</postal>
<phone>+39 081 5476766</phone>
<email>salvatore.dantonio@uniparthenope.it</email>
</address>
</author>
<author fullname="Tanja Zseby" initials="T." surname="Zseby">
<organization>CAIDA/FhG FOKUS</organization>
<address>
<postal>
<street>San Diego Supercomputer Center (SDSC)</street>
<street>University of California, San Diego (UCSD)</street>
<street>9500 Gilman Drive</street>
<city>La Jolla</city>
<code>CA 92093-0505</code>
<country>USA</country>
</postal>
<email>tanja@caida.org</email>
</address>
</author>
<author fullname="Christian Henke" initials="C." surname="Henke">
<organization>Tektronix Communication Berlin</organization>
<address>
<postal>
<street>Wohlrabedamm 32</street>
<city>Berlin</city>
<code>13629</code>
<country>Germany</country>
</postal>
<phone>+49 17 2323 8717</phone>
<email>christian.henke@tektronix.com</email>
</address>
</author>
<author fullname="Lorenzo Peluso" initials="L." surname="Peluso">
<organization>University of Napoli</organization>
<address>
<postal>
<street>Via Claudio 21</street>
<city>Napoli</city>
<code>80125</code>
<country>Italy</country>
</postal>
<phone>+39 081 7683821</phone>
<email>lorenzo.peluso@unina.it</email>
</address>
</author>
<date day="24" month="September" year="2012"/>
<workgroup>Internet Engineering Task Force</workgroup>
<abstract>
<t>Flow selection is the process of selecting a subset of Flows from all
observed Flows. The Intermediate Flow Selection Process may be located at an
IPFIX Exporter, Collector, or within an IPFIX Mediator. Flow selection reduces the
effort of post-processing Flow data and transferring Flow Records. This
document describes motivations for Flow selection and presents Flow
selection techniques. It provides an information model for configuring
Flow selection techniques and discusses what information about an Intermediate Flow
Selection Process should be exported.</t>
</abstract>
<note title="Requirements Language">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <xref
target="RFC2119">RFC 2119</xref>.</t>
</note>
</front>
<middle>
<section title="Scope" toc="default">
<t>This document describes Flow selection techniques for network traffic
measurements. A Flow is defined as a set of packets with common
properties as described in <xref target="RFC5101"/>. Flow selection can
be done to limit the resource demands for capturing, storing, exporting
and post-processing of Flow Records. It also can be used to select a
particular set of Flows that are of interest to a specific application.
This document provides a categorization of Flow selection techniques and
describes configuration and reporting parameters for them. In order to
be compliant with this document, at least the Property Match Filtering MUST be implemented. </t>
<t>This document also addresses configuration and reporting parameters
for Flow-state Dependent Packet Selection as described in <xref
target="RFC5475"/>, although this technique is categorized as packet
selection. The reason is that Flow-state Dependent Packet Selection
techniques often aim at the reduction of resources for Flow capturing
and Flow processing. Furthermore, these techniques were only briefly discussed in
<xref target="RFC5475"/>. Therefore configuration and
reporting considerations for Flow-state Dependent Packet Selection
techniques have been included in this document.</t>
</section>
<section title="Terminology">
<t>This document is consistent with the terminology introduced in <xref
target="RFC5101"/>, <xref target="RFC5470"/>, <xref target="RFC5475"/>
and <xref target="RFC3917"/>. As in <xref target="RFC5101"/> and <xref
target="RFC5476"/>, the first letter of each IPFIX-specific and
PSAMP-specific term is capitalized along with the Flow selection
specific terms defined here.</t>
<t>* Packet Classification</t>
<t><list style="empty">
<t>Packet Classification is a process by which packets are mapped to
specific Flow Records based on packet properties or external
properties (e.g. interface). The properties (e.g. header
information, packet content, AS number) make up the Flow Key. In
case a Flow Record for a specific Flow Key already exists the Flow
Record is updated, otherwise a new Flow Record is created.</t>
</list></t>
<t>* Packet Aggregation Process</t>
<t><list style="empty">
<t>In the IPFIX Metering Process the Packet Aggregation Process
aggregates packet data into Flow data and forms the Flow Records.
After the aggregation step only the aggregated Flow information is
available. Information about individual packets is lost.</t>
</list></t>
<t>* Intermediate Flow Selection Process</t>
<t><list style="empty">
<t>An Intermediate Flow Selection Process takes Flow Records as its input and selects a subset of this set as its output. Intermediate Flow Selection Process is a more general concept than Intermediate Selection Process as defined in <xref target="RFC6183"/>. While an Intermediate Selection Process selects Flow Records from a sequence based upon criteria-evaluated Flow record values and passes only those Flow Records that match the criteria, an Intermediate Flow Selection Process selects Flow Records using selection criteria applicable to a larger set of Flow characteristics and information.</t>
</list></t>
<t>* Flow Selection State</t>
<t><list style="empty">
<t>An Intermediate Flow Selection Process maintains state information for
use by the Flow Selector. At a given time, the Flow Selection State
may depend on Flows and packets observed at and before that time, as
well as other variables. Examples include:<list hangIndent="8"
style="hanging">
<t hangText=" (i)">sequence number of packets and accounted
Flow Records;</t>
<t hangText=" (ii)">number of selected Flows;</t>
<t hangText=" (iii)">number of observed Flows;</t>
<t hangText=" (iv)">current Flow cache occupancy;</t>
<t hangText=" (v)">Flow specific counters, lower and upper
bounds;</t>
<t hangText=" (vi)">Flow selection timeout intervals.</t>
</list></t>
</list></t>
<t>* Flow Selector</t>
<t><list style="empty">
<t>A Flow Selector defines the action of an Intermediate Flow Selection Process on
a single Flow of its input. The Flow Selector can make use of the
following information in order to establish whether a Flow has to be
selected or not:<list hangIndent="8" style="hanging">
<t hangText=" (i)">the content of the Flow Record;</t>
<t hangText=" (ii)">any state information related to the
Metering Process or Exporting Process;</t>
<t hangText=" (iii)">any Flow Selection State that may be
maintained by the Intermediate Flow Selection Process.</t>
</list></t>
</list></t>
<t>* Complete Flow</t>
<t><list style="empty">
<t>A Complete Flow consists of all the packets that enter the Intermediate Flow
Selection Process within the Flow time-out interval, and which
belong to the same Flow as defined by the Flow definition in <xref
target="RFC5470"/>. For this definition only packets that arrive at
the Intermediate Flow Selection Process are considered.</t>
</list></t>
<t>* Flow Filtering</t>
<t><list style="empty">
<t>Flow Filtering selects flows based on a deterministic function on
the Flow Record content, Flow Selection State, external properties
(e.g. ingress interface) or external events (e.g violated Access
Control List). If the relevant parts of the Flow Record content can
already be observed at packet level (e.g. Flow Keys from packet
header fields) Flow Filtering can be performed at packet level by
Property Match Filtering as described in <xref
target="RFC5475"/>.</t>
</list></t>
<t>* Hash-based Flow Filtering</t>
<t><list style="empty">
<t>Hash-based Flow Filtering is a deterministic Flow filter function
that selects flows based on a Hash Function. The Hash Function is
calculated over parts of the Flow Record content or external
properties which are called the Hash Domain. If the hash value falls
into a predefined Hash Selection Range the Flow is selected.
Hash-based Flow Filtering can already applied at packet level, in
which case the Hash Domain MUST contain the Flow Key of the packet.
In case Hash-based Flow Filtering is used to select the same subset
of flows at different observation points, the Hash Domain MUST
comprise parts of the packet or Flow thar are invariant on the
packet/Flow path. Also refer to the according Trajectory Sampling
Application Example on packet level in <xref target="RFC5475"/></t>
</list></t>
<t>* Flow-state Dependent Flow Selection</t>
<t><list style="empty">
<t>Flow-state Dependent Flow Selection is a selection function that
selects or drops Flows based on the current Flow Selection State.
The selection can be either deterministic, random or non-uniform
random.</t>
</list></t>
<t>* Flow-state Dependent Packet Selection</t>
<t><list style="empty">
<t>Flow-state Dependent Packet Selection is a selection function
that selects or drops packets based on the current Flow Selection
State. The selection can be either deterministic, random or
non-uniform random. Flow-state Dependent Packet Selection can be
used to prefer the selection of packets belonging to specific Flows.
For example the selection probability of packets belonging to Flows
that are already within the Flow Cache may be higher than for
packets that have not been recorded yet.</t>
</list></t>
<t>* Flow Sampling</t>
<t><list style="empty">
<t>Flow Sampling selects flows based on Flow Record sequence or
arrival times (e.g. entry in Flow cache, arrival time at Exporter or
Mediator). The selection can be systematic (e.g. every n-th Flow) or
based on a random function (e.g. select each Flow Record with
probability p, or randomly select n out of N Flow Records).</t>
</list></t>
</section>
<section title="Difference between Flow Selection and Packet Selection">
<t>Flow selection differs from packet selection described in <xref
target="RFC5475"/>. Packet selection techniques consider packets as the
basic element and the parent population consists of all packets observed
at an observation point. In contrast to this the basic elements in Flow
selection are the Flows. The parent population consists of all observed
Flows and the Intermediate Flow Selection Process operates on the Flows. The major
characteristics of Flow selection are the following:</t>
<t><list hangIndent="8" style="hanging">
<t hangText="- ">Flow selection takes Flows as basic elements. For
packet selection, packets are considered as basic elements.</t>
<t hangText="- ">Flow selection can only take place after Packet
Classification, because the classification rules determine to which
Flow a packet belongs. Packet selection can be applied before and
after Packet Classification. As an example, packet selection before Packet Classification can be random packet selection whereas packet selection after Packet Classification can be Flow-state Dependent Packet Selection (as described
in <xref target="RFC5475"/>)</t>
<t hangText="- ">Flow selection operates on Complete Flows. That
means that after the Intermediate Flow Selection Process either all packets of
the Flow are kept or all packets of the Flow are discarded. That
means that if the Flow selection is preceded by a packet selection
process the Complete Flow consists only of the packets that were not
discarded during the packet selection.</t>
</list></t>
<t>There are some techniques that are difficult to unambiguously
categorize into one of the categories. Here some guidance is given on how to
categorize such techniques: <list hangIndent="8" style="hanging">
<t hangText="- ">Techniques that can be considered as both packet
and Flow selection: some packet selection techniques result in the
selection of Complete Flows and therefore can be considered as
packet or as Flow selection at the same time. An example is Property
Match Filtering of all packets to a specific destination address. If
Flows are defined based on destination addresses, such a packet
selection also results in a Flow selection and can be considered as
packet or Flow selection.</t>
<t hangText="- ">Flow-state Dependent Packet Selection: there exist techniques that select
packets based on the Flow state, e.g. based on the number of already
observed packets belonging to the Flow. Examples of these techniques
from the literature are "Sample and Hold" <xref target="EsVa01"/>
"Fast Filtered Sampling" <xref target="MSZC10"/> or the "Sticky
Sampling" algorithm presented in <xref target="MaMo02"/>. Such
techniques can be used to influence which Flows are captured (e.g.
increase the selection of packets belonging to large Flows) and
reduce the number of Flows that need to be stored in the Flow cache.
Nevertheless, such techniques do not necessarily select Complete
Flows, because they do not ensure that all packets of a selected
Flow are captured. Therefore Flow-state Dependent Packet Selection
techniques that do not ensure that either all or no packets of a Flow
are selected strictly speaking have to be considered as packet
selection techniques and not as Flow selection techniques.</t>
</list></t>
</section>
<!-- Qui -->
<section title="Flow selection within the IPFIX Architecture">
<t>An Intermediate Flow Selection Process can be deployed at any of three places within the IPFIX architecture. As shown in <xref target="flowselection"/> Flow selection can occur
<list
style="numbers">
<t>in the Metering Process at the IPFIX Exporter</t>
<t>in the Exporting Process at the Collector</t>
<t>within a Mediator</t>
</list></t> <figure
anchor="flowselection"
title="Potential Flow selection locations">
<artwork>
+===========================================+
| IPFIX Exporter +----------------+ |
| | Metering Proc. | |
| +-----------------+ +----------------+ |
| | Metering | | Intermediate | |
| | Process | or | Flow Selection | |
| | | | Process | |
| +-----------------+----+----------------+ |
| | Exporting Process | |
| +----|-------------------------------|--+ |
+======|===============================|====+
| |
| |
+======|========================+ |
| | Mediator | |
+ +-V-------------------+ | |
| | Collecting Process | | |
+ +---------------------+ | |
| | Intermediate Flow | | |
| | Selection Process | | |
+ +---------------------+ | |
| | Exporting Process | | |
+ +-|-------------------+ | |
+======|========================+ |
| |
| |
+======|===============================|=====+
| | Collector | |
| +----V-------------------------------V-+ |
| | Collecting Process | |
| +--------------------------------------+ |
| | Intermediate Flow Selection Process | |
| +--------------------------------------+ |
| | Exporting Process | |
| +------------------------------|-------+ |
+================================|===========+
|
|
V
+------------------+
| IPFIX |
+------------------+
</artwork>
</figure>
<t>In contrast to packet selection, Flow selection is always
applied after the packets are classified into Flows. </t>
<section title="Flow selection in the Metering Process">
<t>Flow selection in the Metering process uses packet information to
update the Flow Records in the Flow cache.
Flow selection before Packet Classification can be based on the fields of the
Flow Key (also on a hash value over these fields), but not based on
characteristics that are only available after Packet Classification (e.g.
Flow size, Flow duration). An Intermediate Flow Selection Process
is here applied to reduce resources for all succeeding processes or to
select specific Flows of interest in case such Flow characteristics
are already observable at packet level (e.g. Flows to specific IP
addresses). In contrast, Flow-state Dependent Packet Selection is a
packet selection technique, because it does not necessarily select
Complete Flows.</t>
</section>
<section title="Flow selection in the Exporting Process">
<t>Flow selection in the Exporting Process works on Flow Records. An Intermediate Flow Selection Process in
the Exporting Process can therefore depend on Flow
characteristics that are only visible after the classification of
packets, such as Flow size and Flow duration. The Exporting Process
may implement policies for exporting only a subset of the Flow Records
which have been stored in the system memory in order to unload Flow
export and Flow post-processing. An Intermediate Flow Selection Process in the Exporting
Process may select only the subset of Flow Records which are of
interest to the users application, or select only as many Flow Records
as can be handled by the available resources (e.g. limited export link
capacity).</t>
</section>
<section title="Flow selection as a function of the IPFIX Mediator">
<t>As shown in <xref target="flowselection"/>, Flow selection can be
performed within an IPFIX Mediator <xref
target="RFC6183"/>. The Intermediate Flow Selection Process takes Flow
Record stream as its input and selects Flow Records from a sequence
based upon criteria-evaluated record values. The Intermediate Flow
Selection Process can again apply a Flow selection technique to obtain
Flows of interest to the application. Further, the Intermediate Flow
Selection Process can base its selection decision on the correlation
of data from different IPFIX Exporters, e.g. by only selecting
Flows that were at least recorded on two IPFIX Exporters.</t>
</section>
</section>
<!-- QUI -->
<section title="Flow Selection Techniques">
<t>A Flow selection technique selects either all or none of the packets
of a Flow, otherwise the technique has to be considered as packet
selection. A difference is recognized between Flow Filtering and Flow Sampling.</t>
<section title="Flow Filtering">
<t>Flow Filtering is a deterministic function on the IPFIX Flow Record
content. If the relevant Flow characteristics are already observable
at packet level (e.g. Flow Keys), Flow Filtering can be applied before
aggregation at packet level. In order to be compliant with this
document, at least the Property Match Filtering MUST be
implemented.</t>
<section title="Property Match Filtering">
<t>Property Match Filtering can be performed similarly to Property
Match Filtering for packet selection described in <xref
target="RFC5475"/>. The difference is that, instead of packet
fields, Flow Record fields are here used to derive the selection
decision. Property Match Filtering is typically used to select a
specific subset of the Flows that are of interest to a particular
application (e.g. all Flows to a specific destination, all large
Flows, etc.). Properties on which the filtering is based can be Flow
Keys, Flow Timestamps, or Per-Flow Counters described in <xref
target="RFC5102"/>. Examples of properties are the Flow size in
bytes, the number of packets in the Flow, the observation time of
the first or last packet, or the maximum packet length. An example
is to select Flows with more than a threshold number of observed
octets. The selection criteria can be a specific value, a set of
specific values, or an interval. For example, a Flow is selected if
destinationIPv4Address and the total number of packets of the Flow
equal two predefined values. Property Match Filtering can be applied
in the Metering Process if the properties are already observable
at the packet level (e.g. Flow Key fields). For example, a Flow is
selected if sourceIPv4Address and sourceIPv4PrefixLength equal,
respectively, two specific values.</t>
<t>There are content-based Property Match Filtering techniques that
require a computation on the current Flow cache. An example is the
selection of the largest Flows or a percentage of Flows with the
longest lifetime. This type of Property Match Filtering is also used
in Flow selection techniques that react to external events (e.g.
resource constraint). For example when the Flow cache is full, the
Flow Record with the lowest Flow volume per current Flow life time
may be deleted.</t>
</section>
<section title="Hash-based Flow Filtering">
<t>Hash-based Flow Filtering uses a Hash Function h to map the Flow
Key c onto a Hash Range R. A Flow is selected if the hash value h(c)
is within the Hash Selection Range S, which is a subset of R.
Hash-based Flow Filtering can be used to emulate a random sampling
process but still enable the correlation between selected Flow
subsets at different observation points. Hash-based Flow Filtering
is similar to Hash-based Packet Selection, and in fact is identical
when Hash-based Packet Selection uses the Flow Key that defines the
Flow as the hash input. Nevertheless there may be the incentive to
apply Hash-based Flow Filtering not on the packet level in the
Metering Process, for example when the size of the selection range
and therefore the sampling probability is dependent on the number of
observed Flows.</t>
</section>
</section>
<section title="Flow Sampling">
<t>Flow Sampling operates on Flow Record sequence or arrival times. It
can use either a systematic or a random function for the Intermediate Flow Selection
Process. Flow Sampling usually aims at the selection of a
representative subset of all Flows in order to estimate
characteristics of the whole set (e.g. mean Flow size in the
network).</t>
<section title="Systematic sampling">
<t>Systematic sampling is a deterministic selection function.
Systematic sampling may be a periodic selection of the N-th Flow
Record which arrives at the Intermediate Flow Selection
Process. Systematic sampling MAY be applied in the Metering
Process. An example would be to create, besides the Flow cache of
selected Flows, an additional data structure that saves the Flow
Keys of the Flows that are not selected. The selection of a Flow
would then be based on the first packet of a Flow. Everytime a
packet belonging to a new Flow (which is neither in the data
structure of the selected or not selected Flows) arrives at the
Observation Point, a counter is increased. In case the counter is
increased to a multiple of N a new Flow cache entry is created, and
in case the counter is not a multiple of N the Flow Key is added to
the data structure for not selected Flows.</t>
<t>Systematic sampling can also be time-based. Time-based systematic
sampling is applied by only creating Flows that are observed between
time-based start and stop triggers. The time interval may be applied
at packet level in the Metering Process or after aggregation on
Flow level, e.g. by selecting a Flow arriving at the Exporting
Process every n seconds.</t>
</section>
<section title="Random Sampling">
<t>Random Flow sampling is based on a random process which requires
the calculation of random numbers. One can differentiate between
n-out-N and probabilistic Flow sampling.</t>
<section title="n-out-of-N Flow Sampling">
<t>In n-out-of-N Sampling, n elements are selected out of the
parent population that consists of N elements. One example would
be to generate n different random numbers in the range [1,N] and
select all Flows that have a Flow position equal to one of the
random numbers.</t>
</section>
<section title="Probabilistic Flow Sampling">
<t>In probabilistic Sampling, the decision whether or not a Flow
is selected is made in accordance with a predefined selection
probability. For probabilistic Sampling, the Sample Size can vary
for different trials. The selection probability does not
necessarily have to be the same for each Flow. Therefore, a difference is recognized between uniform probabilistic sampling (with the same selection probability for all Flows) and non-uniform probabilistic
sampling (where the selection probability can vary for different
Flows). For non-uniform probabilistic Flow Sampling the sampling
probability may be adjusted according to the Flow Record content.
An example would be to increase the selection probability of large
volume Flows over small volume Flows as described in the Smart
Sampling technique <xref target="DuLT01"/>.</t>
</section>
</section>
</section>
<section title="Flow-state Dependent Flow Selection">
<t>Flow-state Dependent Flow Selection can be a deterministic or
random Intermediate Flow Selection Process based on the Flow Record content and the
Flow state which may be kept additionally for each of the Flows.
External processes may update counters, bounds and timers for each of
the Flow Records and the Intermediate Flow Selection Process utilises this
information for the selection decision. A review of Flow-state
Dependent Flow Selection techniques that aim at the selection of the
most frequent items by keeping additional Flow state information can
be found in <xref target="CoHa08"/>. Flow-state Dependent Flow
Selection can only be applied after packet aggregation, when a packet
has been assigned to a Flow. The Intermediate Flow Selection Process then decides based
upon the Flow state for each Flow if it is kept in the Flow cache or
not. Two Flow-state Dependent Flow Selection Algorithms are here
described:</t>
<t>The frequent algorithm <xref target="KaPS03"/> is a technique that
aims at the selection of all flows that at least exceed a 1/k fraction
of the Observed Packet Stream. The algorithm has only a Flow cache of
size k-1 and each Flow in the cache has an additional counter. The
counter is incremented each time a packet belonging to the Flow in the
Flow cache is observed. In case the observed packet does not belong to
any Flow all counters are decremented and if any of the Flow counters
has a value of zero the Flow is replaced with a Flow formed from the
new packet.</t>
<t>Lossy counting is a selection technique that identifies all Flows
whose packet count exceeds a certain percentage of the whole observed
packet stream (e.g. 5% of all packets) with a certain estimation error
e. Lossy counting separates the observed packet stream in windows of
size N=1/e, where N is an amount of consecutive packets. For each
observed Flow an additional counter will be held in the Flow state.
The counter is incremented each time a packet belonging to the Flow is
observed and all counters are decremented at the end of each window
and all Flows with a counter of zero are removed from the Flow
cache.</t>
</section>
<section title="Flow-state Dependent Packet Selection">
<t>Flow-state Dependent Packet Selection is not a Flow selection
technique but a packet selection technique. Nevertheless configuration and reporting parameters for this technique will be described in this document. An example is the "Sample and Hold" algorithm <xref
target="EsVa01"/> that tries to prefer large volume Flows in the
selection. When a packet arrives it is selected when a Flow Record for
this packet already exists. In case there is no Flow Record, the
packet is selected by a certain probability that is dependent on the
packet size.</t>
</section>
</section>
<section anchor="config"
title="Configuration of Flow Selection Techniques">
<t>This section describes the configuration parameters of the Flow
selection techniques presented above. It provides the basis for an
information model to be adopted in order to configure the Flow Selection
Process within an IPFIX Device. The actual information model with the
Information Elements (IEs) for the configuration is described together
with the reporting IEs in section 7. The following table gives an
overview of the defined Flow selection techniques, where they can be applied
and what their input parameters are. Depending on where the Flow
selection techniques are applied different input parameters can be
configured.</t>
<t>Overview of Flow Selection Techniques:</t>
<texttable align="left" style="all"
title="Table 1: Overview of Flow Selection Techniques">
<ttcol>Location</ttcol>
<ttcol>Selection Technique</ttcol>
<ttcol>Selection Input</ttcol>
<c>In the Metering Process</c>
<c>Flow-state Dependent Packet Selection</c>
<c>packet sampling probabilities, Flow Selection State, packet
properties</c>
<c>In the Metering Process</c>
<c>Property Match Flow Filtering</c>
<c>Flow record IEs, Selection Interval</c>
<c>In the Metering Process</c>
<c>Hash-based Flow Filtering</c>
<c>selection range, Hash Function, Flow Key, (seed)</c>
<c>In the Metering Process</c>
<c>Time-based Systematic Flow Sampling</c>
<c>Flow position (derived from arrival time of packets), Flow
Selection State</c>
<c>In the Metering Process</c>
<c>Sequence-based Systematic Flow Sampling</c>
<c>Flow position (derived from packet position), Flow Selection
State</c>
<c>In the Metering Process</c>
<c>Random Flow Sampling</c>
<c>random number generator or list and packet position, Flow state</c>
<c>In the Exporting Process/ within the IPFIX Mediator</c>
<c>Property Match Flow Filtering</c>
<c>Flow Record content, filter function</c>
<c>In the Exporting Process/ within the IPFIX Mediator</c>
<c>Hash-based Flow Filtering</c>
<c>selection range, Hash Function, hash input (Flow Keys and other
Flow properties)</c>
<c>In the Exporting Process/ within the IPFIX Mediator</c>
<c>Flow-state Dependent Flow Selection</c>
<c>Flow state parameters, random number generator or list</c>
<c>In the Exporting Process/ within the IPFIX Mediator</c>
<c>Time-based Systematic Flow Sampling</c>
<c>Flow arrival time, Flow state</c>
<c>In the Exporting Process/ within the IPFIX Mediator</c>
<c>Sequence-based Systematic Flow Sampling</c>
<c>Flow position, Flow state</c>
<c>In the Exporting Process/ within the IPFIX Mediator</c>
<c>Random Flow Sampling</c>
<c>random number generator or list and Flow position, Flow state</c>
</texttable>
<section title="Intermediate Flow Selection Process Parameters">
<t>This section defines what parameters are required to describe
the most common Flow selection techniques.</t>
<t>Intermediate Flow Selection Process Parameters:</t>
<t>For Property Match Filtering: <list hangIndent="4" style="hanging">
<t hangText="- ">Information Element as specified in <xref
target="iana-ipfix-assignments"/>): <vspace blankLines="0"/>
Specifies the Information Element which is used as the property in
the filter expression.</t>
<t hangText="- ">Selection Value or Value Interval: <vspace
blankLines="0"/> Specifies the value or interval of the filter
expression. Packets and Flow Records that have a value equal to the
Selection Value or within the Interval will be selected.</t>
</list></t>
<t>For Hash-based Flow Filtering: <list hangIndent="4" style="hanging">
<t hangText="- ">Hash Domain: <vspace blankLines="0"/> Specifies
the bits from the packet or Flow which are taken as the hash input
to the Hash Function.</t>
<t hangText="- ">Hash Function: <vspace blankLines="0"/> Specifies
the name of the Hash Function that is used to calculate the hash
value. Possible Hash Functions are BOB <xref target="RFC5475"/>,
IPSX <xref target="RFC5475"/>, CRC-32 <xref target="Bra75"/></t>
<t hangText="- ">Hash Selection Range: <vspace blankLines="0"/>
Flows that have a hash value within the Hash Selection Range are
selected. The Hash Selection Range can be a value interval or
arbitrary hash values within the Hash Range of the Hash
Function.</t>
<t hangText="- ">Random Seed or Initializer Value: <vspace
blankLines="0"/> Some Hash Functions require an initializing
value. In order to make the selection decision more secure one can
choose a random seed that configures the hash function.</t>
</list></t>
<t>For Flow-state Dependent Flow Selection: <list hangIndent="4"
style="hanging">
<t hangText="- ">frequency threshold: <vspace blankLines="0"/>
Specifies the frequency threshold s for Flow-state Dependent Flow
Selection techniques that try to find the most frequent items
within a dataset. All Flows which exceed the defined threshold
will be selected.</t>
<t hangText="- ">accuracy parameter: <vspace blankLines="0"/>
specifies the accuracy parameter e for techniques that deal with
the frequent items problems. The accuracy parameter defines the
maximum error, i.e. no Flows that have a true frequency less than
( s - e) N are selected, where s is the frequency threshold and N
is the total number of packets.</t>
</list></t>
<t>The above list of parameters for Flow-state Dependent Flow
Selection techniques is suitable for the presented frequent item and
lossy counting algorithms. Nevertheless a variety of techniques exist
with very specific parameters which are not defined here.</t>
<t>For Systematic time-based Flow Sampling: <list hangIndent="4"
style="hanging">
<t hangText="- ">Interval length (in usec) <vspace
blankLines="0"/> Defines the length of the sampling interval
during which Flows are selected.</t>
<t hangText="- ">Spacing (in usec) <vspace blankLines="0"/> The
spacing parameter defines the spacing in usec between the end of
one sampling interval and the start of the next succeeding
interval.</t>
</list></t>
<t>For Systematic count-based Flow Sampling: <list hangIndent="4"
style="hanging">
<t hangText="- ">Interval length <vspace blankLines="0"/> Defines
the number of Flows that are selected within the sampling
interval.</t>
<t hangText="- ">Spacing <vspace blankLines="0"/> The spacing
parameter defines the spacing in number of observed Flows between
the end of one sampling interval and the start of the next
succeeding interval.</t>
</list></t>
<t>For random n-out-of-N Flow Sampling: <list hangIndent="4"
style="hanging">
<t hangText="- ">Population Size N <vspace blankLines="0"/> The
Population Size N is the number of all Flows in the Population
from which the sample is drawn.</t>
<t hangText="- ">Sampling Size n <vspace blankLines="0"/> The
sampling size n is the number of Flows that are randomly drawn
from the population N.</t>
</list></t>
<t>For probabilistic Flow Sampling: <list hangIndent="4"
style="hanging">
<t hangText="- ">Sampling probability p <vspace blankLines="0"/>
The sampling probability p defines the probability by which each
of the observed Flows is selected.</t>
</list></t>
</section>
<section title="Description of Flow-state Dependent Packet Selection">
<t>The configuration of Flow-state Dependent Packet Selection has not
been described in <xref target="RFC5475"/> therefore the parameters
are defined here:</t>
<t>For Flow-state Dependent Packet Selection: <list hangIndent="4"
style="hanging">
<t hangText="- ">packet selection probability per possible Flow
state interval <vspace blankLines="0"/> Defines multiple {Flow
interval, packet selection probability} value pairs that configure
the sampling probability depending on the current Flow state.</t>
<t hangText="- ">additional parameters <vspace blankLines="0"/>
For the configuration of Flow-state Dependent Packet Selection
additional parameters or packet properties may be required, e.g.
the packet size (<xref target="EsVa01"/>)</t>
</list></t>
</section>
</section>
<section title="Information Model for Intermediate Flow Selection Process Configuration and Reporting">
<t>This section specifies the Information Elements (IEs) that MUST be
exported by an Intermediate Flow Selection Process in order to support the
interpretation of measurement results from Flow measurements. The information is mainly used to report how
many packets and Flows have been observed in total and how many of them
were selected. This helps for instance to calculate the Attained
Selection Fraction (see also <xref target="RFC5476"/>), which is an
important parameter to provide an accuracy statement. The IEs can
provide reporting information about Flow Records, packets or bytes. The
reported metrics are total number of elements and the number of selected
elements. From this the number of dropped elements can be derived. </t>
<t>List of Flow Selection Information Elements:</t>
<texttable align="center" style="all"
title="Table 2: Flow Selection Information Elements">
<ttcol>ID</ttcol>
<ttcol>Name</ttcol>
<ttcol>ID</ttcol>
<ttcol>Name</ttcol>
<c>301</c>
<c>selectionSequenceID</c>
<c>302</c>
<c>selectorID</c>
<c>TBD1</c>
<c>flowSelectorAlgorithm</c>
<c>1</c>
<c>octetDeltaCount</c>
<c>TBD2</c>
<c>flowSelectedOctetDeltaCount</c>
<c>2</c>
<c>packetDeltaCount</c>
<c>TBD3</c>
<c>flowSelectedPacketDeltaCount</c>
<c>3</c>
<c>originalFlowsPresent</c>
<c>TBD4</c>
<c>flowSelectedFlowDeltaCount</c>
<c>TBD5</c>
<c>selectorIDTotalFlowsObserved</c>
<c>TBD6</c>
<c>selectorIDTotalFlowsSelected</c>
<c>TBD7</c>
<c>samplingFlowInterval</c>
<c>TBD8</c>
<c>samplingFlowSpacing</c>
<c>309</c>
<c>samplingSize</c>
<c>310</c>
<c>samplingPopulation</c>
<c>311</c>
<c>samplingProbability</c>
<c>TBD9</c>
<c>flowSamplingTimeInterval</c>
<c>TBD10</c>
<c>flowSamplingTimeSpacing</c>
<c>326</c>
<c>digestHashValue</c>
<c>TBD11</c>
<c>hashFlowDomain</c>
<c>329</c>
<c>hashOutputRangeMin</c>
<c>330</c>
<c>hashOutputRangeMax</c>
<c>331</c>
<c>hashSelectedRangeMin</c>
<c>332</c>
<c>hashSelectedRangeMax</c>
<c>333</c>
<c>hashDigestOutput</c>
<c>334</c>
<c>hashInitialiserValue</c>
<c>320</c>
<c>absoluteError</c>
<c>321</c>
<c>relativeError</c>
<c>336</c>
<c>upperCILimit</c>
<c>337</c>
<c>lowerCILimit</c>
<c>338</c>
<c>confidenceLevel</c>
</texttable>
<section title="flowSelectorAlgorithm">
<t>Description:<list>
<t>This Information Element identifies the Flow selection
technique(e.g., Filtering, Sampling) that is applied by the Intermediate Flow
Selection Process. Most of these techniques have parameters as
decribed in <xref target="config"/>. Further technique identifiers may be added
to the list below. It might be necessary to define new Information
Elements to specify their parameters. The flowSelectorAlgorithm
registry is maintained by IANA. New assignments for the registry
will be administered by IANA and are subject to Expert Review
<xref target="RFC5226"/>. The registry can be updated when
specifications of the new technique(s) and any new Information
Elements are provided.</t>
</list></t>
<figure title="Flow Selection Techniques">
<artwork>
+----+------------------------+--------------------------+
| ID | Technique | Parameters |
+----+------------------------+--------------------------+
| 1 | Systematic count-based | flowSamplingInterval |
| | Sampling | flowSamplingSpacing |
+----+------------------------+--------------------------+
| 2 | Systematic time-based | flowSamplingTimeInterval |
| | Sampling | flowSamplingTimeSpacing |
+----+------------------------+--------------------------+
| 3 | Random n-out-of-N | samplingSize |
| | Sampling | samplingPopulation |
+----+------------------------+--------------------------+
| 4 | Uniform probabilistic | samplingProbability |
| | Sampling | |
+----+------------------------+--------------------------+
| 5 | Property Match | Information Element |
| | Filtering | Value Range |
+----+------------------------+--------------------------+
| Hash-based Filtering | hashInitialiserValue |
+----+------------------------+ hashFlowDomain |
| 6 | using BOB | hashSelectedRangeMin |
+----+------------------------+ hashSelectedRangeMax |
| 7 | using IPSX | hashOutputRangeMin |
+----+------------------------+ hashOutputRangeMax |
| 8 | using CRC | |
+----+------------------------+--------------------------+
| 9 | Flow-state Dependent | No agreed Parameters |
| | Flow Selection | |
+----+------------------------+--------------------------+
</artwork>
</figure>
<t>Abstract Data Type: unsigned16</t>
<t>ElementId: TBD1</t>
<t>Data Type Semantics: identifier</t>
<t>Status: Proposed</t>
</section>
<section title="flowSelectedOctetDeltaCount">
<t>Description:<list>
<t>This Information Element specifies the volume in octets of all
Flows that are selected in the Intermediate Flow Selection Process since
the previous report.</t>
</list></t>
<t>Abstract Data Type: unsigned64</t>
<t>ElementId: TBD2</t>
<t>Units: Octets</t>
<t>Status: Proposed</t>
</section>
<section title="flowSelectedPacketDeltaCount">
<t>Description:<list>
<t>This Information Element specifies the volume in packets of all
Flows that were selected in the Intermediate Flow Selection Process since
the previous report.</t>
</list></t>
<t>Abstract Data Type: unsigned64</t>
<t>ElementId: TBD3</t>
<t>Units: Packets</t>
<t>Status: Proposed</t>
</section>
<section title="flowSelectedFlowDeltaCount">
<t>Description:<list>
<t>This Information Element specifies the number of Flows that
were selected in the Intermediate Flow Selection Process since the last
report.</t>
</list></t>
<t>Abstract Data Type: unsigned64</t>
<t>ElementId: TBD4</t>
<t>Units: Flows</t>
<t>Status: Proposed</t>
</section>
<section title="selectorIDTotalFlowsObserved">
<t>Description:<list>
<t>This Information Element specifies the total number of Flows
observed by a Selector, for a specific value of SelectorId. This
Information Element should be used in an Options Template scoped
to the observation to which it refers. See Section 3.4.2.1 of the
IPFIX protocol document <xref target="RFC5101"/> .</t>
</list></t>
<t>Abstract Data Type: unsigned64</t>
<t>ElementId: TBD5</t>
<t>Units: Flows</t>
<t>Status: Proposed</t>
</section>
<section title="selectorIDTotalFlowsSelected">
<t>Description:<list>
<t>This Information Element specifies the total number of Flows
selected by a Selector, for a specific value of SelectorId. This
Information Element should be used in an Options Template scoped
to the observation to which it refers. See Section 3.4.2.1 of the
IPFIX protocol document <xref target="RFC5101"/>.</t>
</list></t>
<t>Abstract Data Type: unsigned64</t>
<t>ElementId: TBD6</t>
<t>Units: Flows</t>
<t>Status: Proposed</t>
</section>
<section title="samplingFlowInterval">
<t>Description:<list>
<t>This Information Element specifies the number of Flows that are
consecutively sampled. A value of 100 means that 100 consecutive
Flows are sampled. For example, this Information Element may be
used to describe the configuration of a systematic count-based
Sampling Selector.</t>
</list></t>
<t>Abstract Data Type: unsigned64</t>
<t>ElementId: TBD7</t>
<t>Units: Flows</t>
<t>Status: Proposed</t>
</section>
<section title="samplingFlowSpacing">
<t>Description:<list>
<t>This Information Element specifies the number of Flows between
two "samplingFlowInterval"s. A value of 100 means that the next
interval starts 100 Flows (which are not sampled) after the
current "samplingFlowInterval" is over. For example, this
Information Element may be used to describe the configuration of a
systematic count-based Sampling Selector.</t>
</list></t>
<t>Abstract Data Type: unsigned64</t>
<t>ElementId: TBD8</t>
<t>Units: Flows</t>
<t>Status: Proposed</t>
</section>
<section title="flowSamplingTimeInterval">
<t>Description:<list>
<t>This Information Element specifies the time interval in
microseconds during which all arriving Flows are sampled. For
example, this Information Element may be used to describe the
configuration of a systematic time-based Sampling Selector.</t>
</list></t>
<t>Abstract Data Type: unsigned64</t>
<t>ElementId: TBD9</t>
<t>Units: microseconds</t>
<t>Status: Proposed</t>
</section>
<section title="flowSamplingTimeSpacing">
<t>Description:<list>
<t>This Information Element specifies the time interval in
microseconds between two "flowSamplingTimeInterval"s. A value of
100 means that the next interval starts 100 microseconds (during
which no Flows are sampled) after the current
"flowsamplingTimeInterval" is over. For example, this Information
Element may used to describe the configuration of a systematic
time-based Sampling Selector.</t>
</list></t>
<t>Abstract Data Type: unsigned64</t>
<t>ElementId: TBD10</t>
<t>Units: microseconds</t>
<t>Status: Proposed</t>
</section>
<section title="hashFlowDomain">
<t>Description:<list>
<t>This Information Element specifies the Information Elements
that are used by the Hash-based Flow Selection Selector as the
Hash Domain.</t>
</list></t>
<t>Abstract Data Type: unsigned16</t>
<t>ElementId: TBD11</t>
<t>Data Type Semantics: identifier</t>
<t>Status: Proposed</t>
</section>
</section>
<section title="IANA Considerations">
<section title="Registration of Information Elements">
<t>IANA will register the following IEs in the IPFIX Information
Elements registry at
http://www.iana.org/assignments/ipfix/ipfix.xml:</t>
<texttable align="center" style="all" title="Table 3: Information Elements to be registered">
<ttcol>Value</ttcol>
<ttcol>Name</ttcol>
<ttcol>Data Type</ttcol>
<ttcol>Data Type Semantics</ttcol>
<ttcol>Status</ttcol>
<ttcol>Description</ttcol>
<c>1</c>
<c>flowSelectorAlgorithm</c>
<c>unsigned16</c>
<c>identifier</c>
<c>Proposed</c>
<c>This Information Element identifies the Flow selection
technique(e.g., Filtering, Sampling) that is applied by the Intermediate Flow
Selection Process</c>
<c>2</c>
<c>flowSelectedOctetDeltaCount</c>
<c>unsigned64</c>
<c>Octets</c>
<c>Proposed</c>
<c>This Information Element specifies the volume in octets of all
Flows that are selected in the Intermediate Flow Selection Process since the
previous report.</c>
<c>3</c>
<c>flowSelectedPacketDeltaCount</c>
<c>unsigned64</c>
<c>Packets</c>
<c>Proposed</c>
<c>This Information Element specifies the volume in packets of all
Flows that were selected in the Intermediate Flow Selection Process since the
previous report.</c>
<c>4</c>
<c>flowSelectedFlowDeltaCount</c>
<c>unsigned64</c>
<c>Flows</c>
<c>Proposed</c>
<c>This Information Element specifies the number of Flows that were
selected in the Intermediate Flow Selection Process since the last
report.</c>
<c>5</c>
<c>selectorIDTotalFlowsObserved</c>
<c>unsigned64</c>
<c>Flows</c>
<c>Proposed</c>
<c>This Information Element specifies the total number of Flows
observed by a Selector, for a specific value of SelectorId. This
Information Element should be used in an Options Template scoped to
the observation to which it refers. See Section 3.4.2.1 of the IPFIX
protocol document [RFC5101]</c>
<c>6</c>
<c>selectorIDTotalFlowsSelected</c>
<c>unsigned64</c>
<c>Flows</c>
<c>Proposed</c>
<c>This Information Element specifies the total number of Flows
selected by a Selector, for a specific value of SelectorId. This
Information Element should be used in an Options Template scoped to
the observation to which it refers. See Section 3.4.2.1 of the IPFIX
protocol document [RFC5101].</c>
<c>7</c>
<c>samplingFlowInterval</c>
<c>unsigned64</c>
<c>Flows</c>
<c>Proposed</c>
<c>This Information Element specifies the number of Flows that are
consecutively sampled. A value of 100 means that 100 consecutive
Flows are sampled. For example, this Information Element may be used
to describe the configuration of a systematic count-based Sampling
Selector.</c>
<c>8</c>
<c>samplingFlowSpacing</c>
<c>unsigned64</c>
<c>Flows</c>
<c>Proposed</c>
<c>This Information Element specifies the number of Flows between
two "samplingFlowInterval"s. A value of 100 means that the next
interval starts 100 Flows (which are not sampled) after the current
"samplingFlowInterval" is over. For example, this Information
Element may be used to describe the configuration of a systematic
count-based Sampling Selector.</c>
<c>9</c>
<c>flowSamplingTimeInterval</c>
<c>unsigned64</c>
<c>microseconds</c>
<c>Proposed</c>
<c>This Information Element specifies the time interval in
microseconds during which all arriving Flows are sampled. For
example, this Information Element may be used to describe the
configuration of a systematic time-based Sampling Selector.</c>
<c>10</c>
<c>flowSamplingTimeSpacing</c>
<c>unsigned64</c>
<c>microseconds</c>
<c>Proposed</c>
<c>This Information Element specifies the time interval in
microseconds between two "flowSamplingTimeInterval"s. A value of 100
means that the next interval starts 100 microseconds (during which
no Flows are sampled) after the current "flowsamplingTimeInterval"
is over. For example, this Information Element may used to describe
the configuration of a systematic time-based Sampling Selector.</c>
<c>11</c>
<c>hashFlowDomain</c>
<c>unsigned16</c>
<c>identifier</c>
<c>Proposed</c>
<c>This Information Element specifies the Information Elements that
are used by the Hash-based Flow Selection Selector as the Hash
Domain.</c>
</texttable>
</section>
<section title="Registration of Object Identifier">
<t>IANA will register the following OID in the IPFIX-SELECTOR-MIB
Functions sub-registry at http://www.iana.org/assignments/smi-numbers
according to the procedures set forth in
[RFC5815]</t>
<texttable align="center" style="all" title="Table 4: Object Identifiers to be registered">
<ttcol>Decimal</ttcol>
<ttcol>Name</ttcol>
<ttcol>Description</ttcol>
<ttcol>Reference</ttcol>
<c></c>
<c>flowSelectorAlgorithm</c>
<c>This Object Identifier identifies the Flow selection technique
(e.g., Filtering, Sampling) that is applied by the Flow Selection
Process</c>
<c>[RFCyyyy]</c>
</texttable>
<t>Editor's Note (to be removed prior to publication): the RFC editor
is asked to replace "yyyy" in this document by the number of the RFC
when the assignment has been made.</t>
</section>
</section>
<section title="Security Considerations">
<t>Some of the described flow selection techniques (e.g., flow sampling, hash-based flow filtering)
aim at the selection of a representative subset of flows in order to estimate parameters of the population.
An adversary may have incentives to influence the selection of flows, for example to circumvent accounting
or to avoid the detection of packets that are part of an attack. </t>
<t>Security considerations concerning the choice of a Hash Function for Hash-based Packet Selection have
been discussed in Section 6.2.3 of <xref target="RFC5475"/> and are also appropriate for Hash-based Flow
Selection. <xref target="RFC5475"/> discusses the possibility to craft Packet Streams which are disproportionately
selected or can be used to discover Hash Function parameters. It also describes vulnerabilities of different Hash
Functions to these attacks, and practices to minimize these vulnerabilities.</t>
<t>For other sampling approaches a user can gain knowledge about the start and stop triggers in time-based systematic
Sampling, e.g., by sending test packets. This knowledge might allow users to modify their send schedule in a way
that their packets are disproportionately selected or not selected. For random Sampling, a cryptographically strong
random number generator should be used in order to prevent that an advisory can predict the selection decision [GoRe08].</t>
<t>Further security threats can occur when Flow Selection parameters are configured or communicated to other entities.
The protocol(s) for the configuration and reporting of Flow Selection parameters are out of scope of this document.
Nevertheless, a set of initial requirements for future configuration and reporting protocols are stated below:
<list style="numbers">
<t> Protection against disclosure of configuration information: Flow Selection configuration information describes the Intermediate Flow Selection Process and its parameters. This information can be useful to attackers. Attackers may craft packets that never fit the selection criteria in order to prevent Flows to be seen by the Intermediate Flow Selection Process. They can also craft a lot of packets that fit the selection criteria and overload or bias subsequent processes. Therefore any transmission of configuration data (e.g., to configure a process or to report its actual status) should be protected by encryption.</t>
<t> Protection against modification of configuration information: if wrong configuration information is sent to the Intermediate Flow Selection Process, it can lead to a malfunction of the Intermediate Flow Selection Process. Also if wrong configuration information is reported from the Flow Selection Process to other processes it can lead to wrong estimations at subsequent processes. Therefore any protocol that transmits configuration information should prevent that an attacker can modify configuration information. Data integrity can be achieved by authenticating the data.</t>
<t>Protection against malicious nodes sending configuration information: The remote configuration of Flow Selection techniques should be protected against access by unauthorized nodes. This can be achieved by access control lists at the device that hosts the Flow Selection Process (e.g. IPFIX Exporter, IPFIX Mediator or IPFIX Collector) and by source authentication. The reporting of configuration data from an Intermediate Flow Selection Process has to be protected in the same way. That means that also protocols that report configuration data from the Intermediate Flow Selection Process to other processes need to protect against unauthorized nodes reporting configuration information.</t>
</list>
</t>
<t>The security threats that originate from communicating configuration information to and from Intermediate Flow Selection Processes cannot be assessed solely with the information given in this document. A further more detailed assessment of security threats is necessary when a specific protocol for the configuration or reporting configuration data is proposed.</t>
</section>
<section title="Acknowledgments">
<t>We would like to thank the IPFIX group, especially Brian Trammell,
Paul Aitken and Benoit Claise for fruitful discussions and for
proofreading the document.</t>
</section>
</middle>
<back>
<references title="Normative References">
<?rfc include="reference.RFC.2119"?>
<?rfc include="reference.RFC.5101"?>
<?rfc include="reference.RFC.5102"?>
<?rfc include="reference.RFC.5475"?>
<?rfc include="reference.RFC.5476"?>
<?rfc include="reference.RFC.5815"?>
</references>
<references title="Informative References">
<!--
<reference anchor="DuLT01b">
<front>
<title>Properties and Prediction of Flow Statistics from Sampled
Packet Streams</title>
<author fullname="N.G. Duffield" initials="N.G." surname="Duffield">
<organization></organization>
<address>
<postal>
<street></street>
<city></city>
<region></region>
<code></code>
<country></country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email></email>
<uri></uri>
</address>
</author>
<author fullname="C. Lund" initials="C." surname="Lund">
<organization></organization>
<address>
<postal>
<street></street>
<city></city>
<region></region>
<code></code>
<country></country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email></email>
<uri></uri>
</address>
</author>
<author fullname="M. Thorup" initials="M." surname="Thorup">
<organization></organization>
<address>
<postal>
<street></street>
<city></city>
<region></region>
<code></code>
<country></country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email></email>
<uri></uri>
</address>
</author>
<date day="6-8" month="November" year="2002" />
<abstract>
<t></t>
</abstract>
</front>
<seriesInfo name="ACM SIGCOMM"
value="Internet Measurement Workshop 2002" />
</reference>
-->
<reference anchor="DuLT01">
<front>
<title>Charging from Sampled Network Usage</title>
<author fullname="N.G. Duffield" initials="N.G." surname="Duffield"/>
<author fullname="C. Lund" initials="C." surname="Lund">
<organization/>
</author>
<author fullname="M. Thorup" initials="M." surname="Thorup">
<organization/>
</author>
<date day="1-2" month="November" year="2001"/>
<abstract>
<t/>
</abstract>
</front>
<seriesInfo name="ACM"
value="Internet Measurement Workshop IMW 2001, San Francisco, USA"/>
</reference>
<reference anchor="Bra75">
<front>
<title>Evaluation of 32 Degree Polynomials in Error Detection on the
SATIN IV Autovon Error Patterns</title>
<author fullname="Kenneth Brayer" initials="K." surname="Brayer">
<organization/>
</author>
<date month="August" year="1975"/>
</front>
<seriesInfo name="National Technical Information Service" value="p.74"/>
</reference>
<!--
<reference anchor="Moli03">
<front>
<title>A scalable and efficient methodology for flow monitoring in
the Internet</title>
<author fullname="Maurizio Molina" initials="M." surname="Molina">
<organization></organization>
</author>
<date month="September" year="2003" />
</front>
<seriesInfo name="International Teletraffic Congress"
value="(ITC-18), Berlin" />
</reference>
-->
<reference anchor="CoHa08">
<front>
<title>Finding frequent items in data streams</title>
<author fullname="Graham Cormode" initials="G." surname="Cormode">
<organization/>
</author>
<author fullname="Marios Hadjieleftheriou" initials="M."
surname="Hadjieleftheriou">
<organization/>
</author>
<date month="August" year="2008"/>
</front>
<seriesInfo name="Journal, Proceedings of the Very Large DataBase Endowment"
value="VLDB Endowment, Volume 1 Issue 2, August 2008"/>
</reference>
<reference anchor="KaPS03">
<front>
<title>A simple algorithm for finding frequent elements in sets and
bags.</title>
<author fullname=" R. Karp" initials="R." surname="Karp">
<organization/>
</author>
<author fullname="C. Papadimitriou" initials="C."
surname="Papadimitriou">
<organization/>
</author>
<author fullname="S. Shenker" initials="S." surname="S. Shenker">
<organization/>
</author>
<date month="March" year="2003"/>
</front>
<seriesInfo name="ACM Transactions on Database Systems,"
value="Volume 28, 51-55, 2003"/>
</reference>
<reference anchor="MaMo02">
<front>
<title>Approximate Frequency Counts over Data Streams</title>
<author fullname="Gurmeet Singh Manku " initials="G.S."
surname="Manku">
<organization/>
</author>
<author fullname="Rajeev Motwani " initials="R." surname="Motwani">
<organization/>
</author>
<date year="2002"/>
</front>
<seriesInfo name="Proceedings of the International Conference on Very large DataBases (VLDB)"
value="pages 346--357, 2002, Hong Kong, China"/>
</reference>
<reference anchor="MSZC10">
<front>
<title>Fast Filtered Sampling</title>
<author fullname="Jianning Mai" initials="J." surname="Mai">
<organization/>
</author>
<author fullname="Ashwin Sridharan" initials="A."
surname="Sridharan">
<organization/>
</author>
<author fullname="Hui Zang" initials="H." surname="Zang">
<organization/>
</author>
<author fullname="Chen-Nee Chuah" initials="C.-N." surname="Chuah">
<organization/>
</author>
<date month="January" year="2010"/>
</front>
<seriesInfo name="Computer Networks"
value="Volume 54, Issue 11, Pages 1885-1898, ISSN 1389-1286"/>
</reference>
<reference anchor="iana-ipfix-assignments"
target="http://www.iana.org/assignments/ipfix/ipfix.xml">
<front>
<title>IP Flow Information Export Information Elements</title>
<author fullname="Internet Assigned Numbers Authority">
<organization/>
</author>
<date year="2007"/>
</front>
</reference>
<reference anchor="EsVa01">
<front>
<title>New Directions in Traffic Measurement and Accounting:
Focusing on the Elephants, Ignoring the Mice</title>
<author fullname="C. Estan" initials="C." surname="Estan">
<organization/>
</author>
<author fullname="G. Varghese" initials="G," surname="Varghese">
<organization/>
<address>
<postal>
<street/>
<city/>
<region/>
<code/>
<country/>
</postal>
<phone/>
<facsimile/>
<email/>
<uri/>
</address>
</author>
<date month="November" year="2001"/>
</front>
<seriesInfo name="ACM SIGCOMM"
value="Internet Measurement Workshop 2001, San Francisco (CA)"/>
</reference>
<reference anchor="GoRe08">
<front>
<title>Path-quality monitoring in the presence of adversaries</title>
<author fullname="S. Goldberg" initials="S." surname="Goldberg">
<organization></organization>
</author>
<author fullname="D. Xiao" initials="D." surname="Xiao">
<organization></organization>
<address>
<postal>
<street></street>
<city></city>
<region></region>
<code></code>
<country></country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email></email>
<uri></uri>
</address>
</author>
<author fullname="E. Tromer" initials="E." surname="Tromer">
<organization></organization>
</author>
<author fullname="B. Barak" initials="B." surname="Barak">
<organization></organization>
</author>
<author fullname="J. Rexford" initials="J." surname="Rexford">
<organization></organization>
</author>
<date month="June" year="2008" />
</front>
<seriesInfo name="ACM SIGMETRICS"
value="ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems, Annapolis, MD, USA" />
</reference>
<?rfc include="reference.RFC.3917"?>
<?rfc include="reference.RFC.5470"?>
<?rfc include="reference.RFC.6183"?>
<?rfc include="reference.RFC.5226"?>
</references>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-23 14:17:51 |