Evaluation of NetFlow Version 9 Against IPFIX Requirements: changes from version 03 to 04 draft-claise-ipfix-eval-netflow-04.txt Benoit Claise, Cisco Systems

draft-claise-ipfix-eval-netflow-04.txt2 Small Editorial Changes  Is it already implemented?  Is it already in commercial use?  ICMP  Etc...

draft-claise-ipfix-eval-netflow-04.txt3 Sampling  From the evaluation team last report: Sampling, Extension Needed  Now, Total Compliance –Adding a sampling function to the metering process: Total Compliance –Removing a sampling function from the metering process: Total Compliance –Change sampling method: Total Compliance –Change sampling parameter: Total Compliance

draft-claise-ipfix-eval-netflow-04.txt4 Time Synchronization  From the evaluation team last report: Time Synchronization, Partial Compliance  Total Compliance with proposed solution –The flow records contain both the flow start and the flow end sysUpTime. –The exporter could periodically send an Option Template containing a time synchronization pair composed of a sysUpTime and a unix_msecs (Number of milli seconds since 0000 UTC 1970), taken at the same point in time. –The collecting process could deduce the flow start and flow end UTC time of every single flow record.

draft-claise-ipfix-eval-netflow-04.txt5 Congestion Awareness  “It was suggested that advocates must elaborate on how their protocol will be extended”  Upcoming Compliance with SCTP-PR  For more details on proposed implementations, refer to the draft: draft-djernaes-netflow-9-transport-00

draft-claise-ipfix-eval-netflow-04.txt6 Reliability Extensions  “The data transfer between exporting process and collecting process MUST be open to reliability extensions  Upcoming Compliance with SCTP-PR  refer to the draft: draft-djernaes-netflow-9-transport-00

draft-claise-ipfix-eval-netflow-04.txt7 Set of Properties for Distinguishing Flows  “it MUST be ensured that a collecting process is able to clearly identify for each received flow record which set of properties was used for distinguishing this flow from other ones”  From the Template ID and the Observation Domain we can find back the set of properties used to distinguish the flows.  Total Compliance

Thank you for your attention ! Questions ?

draft-claise-ipfix-eval-netflow-04.txt9 Summary  Reliability (metering)E  Sampling E ->T  Overload BehaviorT  TimestampsT  Time Synchronization P->T  Information ModelT  Data ModelT  Congestion Awareness F-> U  Reliability ExtensionP -> U  SecurityE  Push Mode ReportingT  Pull Mode ReportingF  Notifications on EventsT  AnonymizationE  OpennessT  ScalabilityT  Several Collecting Proc.T