Subject: Re: [sip-clf] IETF 76 Minutes posted

From: "Spencer Dawkins" <[email-masked]>
Date: Tue, 15 Dec 2009 13:55:40 -0600

Just following up...

> Please let me know (quickly!) about any changes to 
> http://www.ietf.org/proceedings/09nov/minutes/sipclf.htm that Theo and I 
> need to make.

OK, Theo and I haven't seen any requests for changes to the minutes, so 
let's go from where we said we were after Hiroshima.

For the problem statement - we said we would look at the next version of 
draft-gurbani-sipclf-problem-statement for adoption. Vijay, do you have an 
ETA for this?

For the file format drafts - I know that Hadriel is working on a proposal on 
the IPFIX side. We also had proposals for a text format and an indexed-text 
format. My understanding from Hiroshima was that these proposals were likely 
to be combined - Vijay and Adam, can you confirm or deny?

Thanks,

Spencer, as co-chair

---

From: Adam Roach <[email-masked]>
Date: Tue, 15 Dec 2009 14:12:27 -0600

On 12/15/09 13:55, Dec 15, Spencer Dawkins wrote:
>
> For the file format drafts - I know that Hadriel is working on a 
> proposal on the IPFIX side. We also had proposals for a text format 
> and an indexed-text format. My understanding from Hiroshima was that 
> these proposals were likely to be combined - Vijay and Adam, can you 
> confirm or deny?

That was my understanding of the plan also.

/a

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Tue, 15 Dec 2009 14:28:27 -0600

Spencer Dawkins wrote:
> draft-gurbani-sipclf-problem-statement for adoption. Vijay, do you have 
> an ETA for this?

Sorry -- been swamped.  I am planning to work on this next
week (when no one else is around at the office ;-) )

> proposal on the IPFIX side. We also had proposals for a text format and 
> an indexed-text format. My understanding from Hiroshima was that these 
> proposals were likely to be combined - Vijay and Adam, can you confirm 
> or deny?

Confirmed.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/

---

From: Hadriel Kaplan <[email-masked]>
Date: Tue, 15 Dec 2009 17:20:52 -0500

Actually Saverio's writing up a draft explaining why IPFIX is a good solution, with several folks agreeing to help him on it.  I think the plan is to get that submitted sometime in January.

His group also did submit a proposal called "SIPFIX" for using IPFIX for SIP previously, into the IPFIX WG, available at:
http://tools.ietf.org/html/draft-huici-ipfix-sipfix-00

We debated that draft in IPFIX back in Stockholm, and it went beyond what we're looking for in SIP-CLF, but it's another useful data point.

To create a draft on using IPFIX for a SIP-CLF, though, doesn't require a draft detailing the file format - the "file format" is already defined: it would be based on RFC 5655.  All we need is to decide on the information element fields.

-hadriel

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Spencer Dawkins
> Sent: Tuesday, December 15, 2009 2:56 PM
> To: SIP-CLF Mailing List
> Subject: Re: [sip-clf] IETF 76 Minutes posted
> 
> Just following up...
> 
> _______________________________________________
> sip-clf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sip-clf

---

From: "David Harrington" <[email-masked]>
Date: Mon, 28 Dec 2009 16:04:04 -0500

Hi,

comments inline.

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Hadriel Kaplan
> Sent: Tuesday, December 15, 2009 5:21 PM
> To: Spencer Dawkins; SIP-CLF Mailing List
> Actually Saverio's writing up a draft explaining why IPFIX is 
> a good solution, with several folks agreeing to help him on 
> it.  I think the plan is to get that submitted sometime in January.
> 
> His group also did submit a proposal called "SIPFIX" for 
> using IPFIX for SIP previously, into the IPFIX WG, available at:
> We debated that draft in IPFIX back in Stockholm, and it went 
> beyond what we're looking for in SIP-CLF, but it's another 
> useful data point.
> 
> To create a draft on using IPFIX for a SIP-CLF, though, 
> doesn't require a draft detailing the file format - the "file 
> format" is already defined: it would be based on RFC 5655.  
> All we need is to decide on the information element fields.

As Technical advisor, I will point out that IETF NM protocols
typically define three parts, following the general recommendations of
RFC1052 "IAB recommendations for the development of Internet network
management standards". That is, design solutions in three parts - a
data modeling language, data models, and one or more protocols to
transport the data. Most, if not all, IETF Standards-track NM
protocols follow this paradigm, including SNMP, Netconf, syslog,
ipfix, etc. This approach has proven to be effective. I recommend that
sipclf follow this paradigm as well.

Ipfix already provides a protocol and a data modeling language. In
addition, RFC5655 specifies a file format for storing data that has
been received in the ipfix file format. The IPFIX File format is
designed to facilitate interoperability and reusability among a wide
variety of flow storage, processing, and analysis tools.

As Hadriel points out, what needs to be done is to decide on the
information element fields - the data model.

I recommend that WG participants read RFC3444 "On the Difference
between Information Models and Data Models", and start by
understanding the capabilities of relevant data modeling languages
(text, indexed-text, and ipfix), then deciding on an information
model. 

Regardless of which data modeling language you use, you will need to
reach consensus on how the logged information will be used, to
understand what to log.  That is your information model.

>From the information model, you can create corresponding, consistent,
data models in different formats, possibly for different purposes.
When you discuss data models, you will need to reach consensus on when
vendor interoperability will be important, and how to secure the data
both at rest and in transit.

David Harrington
[email-masked]
[email-masked]
[email-masked]

> > From: [email-masked] 
> [mailto:[email-masked]] On Behalf
> > Of Spencer Dawkins
> > For the file format drafts - I know that Hadriel is working 
> on a proposal
> > on
> > the IPFIX side. We also had proposals for a text format and 
> an indexed-
> > text
> > format. My understanding from Hiroshima was that these 
> proposals were
> > likely