Subject: WG Review: IP Flow Information Export (ipfix)

From: The IESG <[email-masked]>
Date: Thu, 06 Sep 2001 18:45:00 -0400

A new IETF working group has been proposed in the Operations and Management
Area. The IESG has not made any determination as yet. 

The following Description was submitted, and is provided for
informational purposes only:

 IP Flow Information Export (ipfix)
 ----------------------------------

 Current Status: Proposed Working Group

Description of Working Group:

There are a number of IP flow information export systems in common
use.  These systems differ significantly, even though some have
adopted a common transport mechanism; such differences make it
difficult to develop generalised flow analysis tools.  As such, there
is a need in industry and the Internet research community for IP
devices such as routers to export flow information in a standard way
to external systems such as mediation systems, accounting/billing
systems, and network management systems to facilitate services such as
Internet research, measurement, accounting, and billing.

An IP flow information export system includes a data model, which
represents the flow information, and a transport protocol.  An
"exporter," which is typically an IP router or IP traffic measurement
device, will employ the IP flow information export system to report
information about "IP flows," these being series of related IP packets
that have been either forwarded or dropped.  The reported flow
information will include both (1) those attributes derived from the IP
packet headers such as source and destination address, protocol, and
port number and (2) those attributes often known only to the exporter
such as ingress and egress ports, IP (sub)net mask, autonomous system
numbers and perhaps sub-IP-layer information.

This group will select a protocol by which IP flow information can be
transferred in a timely fashion from an "exporter" to a collection
station or stations and define an architecture which employs it.  The
protocol must run over an IETF approved congestion-aware transport
protocol such as TCP or SCTP.

Specific Goals

 o Define the notion of a "standard IP flow."  The flow definition
   will be a practical one, similar to those currently in use by
   existing non-standard flow information export protocols which
   have attempted to achieve similar goals but have not documented
   their flow defintion.

 o Devise data encodings that support analysis of IPv4 and IPv6
   unicast and multicast flows traversing a network element at
   packet header level and other levels of aggregation as requested
   by the network operator according to the capabilities of the
   given router implementation.

 o Consider the notion of IP flow information export based upon
   packet sampling.

 o Identify and address any security privacy concerns affecting
   flow data.  Determine technology for securing the flow information
   export data, e.g. TLS.

 o Specify the transport mapping for carrying IP flow information,
   one which is amenable to router and instrumentation implementors,
   and to deployment.

 o Ensure that the flow export system is reliable in that it will
   minimize the likelihood of flow data being lost due to resource
   constraints in the exporter or receiver and to accurately report
   such loss if it occurs.