Sampling and Filtering Techniques for IP Packet Selection - Update - draft-ietf-psamp-sample-tech-04.txt Tanja Zseby, FhG FOKUS Maurizio Molina, NEC Europe Ltd. Fredric Raspall, NEC Europe Ltd. Nick Duffield, AT&T Labs

draft-ietf-psamp-sample-tech-04.txt2 Changes  Inclusion of 2 mandatory hash functions –Mandatory if hash-based selection is implemented –Result of an investigation on various hash functions  Nicks presentation  Inclusion of extended table for clarification of the categorization of schemes  Text on why configuration of non-uniform probabilistic and flow state sampling is not detailed  Operating time removed from the info model  Small terminology changes (consistent with FW draft)  Some re-wording, minor changes, etc.

draft-ietf-psamp-sample-tech-04.txt3 Hash Functions  Purpose –Sampling ID (random sampling emulation) –Digest ID (packet identifier, e.g. for consistent packet selection at multiple observation points)  Hash Function Definition –Needed for consistent sampling and identification –Different requirements for Sampling and Digest ID –Tests: uniformity of distribution, collision probability, speed  Evaluation Result: –IP Shift-XOR (IPSX) for Sampling ID –CRC32 for Digest ID  MUST for IPSX and CRC32

draft-ietf-psamp-sample-tech-04.txt4 Categorization Table Selection Scheme | deterministic | content- | Category | selection | dependent| systematic | X | _ | Sampling count-based | | | systematic | X | - | Sampling time-based | | | random | - | - | Sampling n-out-of-N | | | random | - | - | Sampling uniform probabilistic | | | random | - | (X) | Sampling non-uniform probabil. | | | random | - | (X) | Sampling non-uniform flow-state | | | mask/match filter | X | X | Filter hash function | X | X | Filter router state filter | X | (X) | Filter

draft-ietf-psamp-sample-tech-04.txt5 Configuration of non-uniform probabilistic and flow state sampling  Many different specific methods possible  Input parameters dependent on sampling goal and implementation  Some concrete proposals from research –e.g. [EsVa01],[DuLT01],[Moli03] –But still in early stage –Need further investigations to prove their usefulness and applicability  Specification of explicit schemes left to vendors (e.g. as extension of the information model)

draft-ietf-psamp-sample-tech-04.txt6 Operating time removed from the info model  Operating time –Start/Stop time of sampling process –Configuration on higher layer (activation of scheme) –Need not be reported (new scheme would be announced anyway)  removed  Further Issues –Term “random sampling approximation” remains –Minor re-wording for clarification

Thank you for your attention ! Questions ?