1. Sampling and Filtering Techniques for IP Packet Selection - Update - draft-ietf-psamp-sample-tech-02.txt Tanja Zseby, FhG FOKUS Maurizio Molina, NEC Europe Ltd. Fredric Raspall, NEC Europe Ltd. Nick Duffield, AT&T Labs

2. draft-ietf-psamp-sample-tech-02.txt2 Changes  Terminology –Aligned with Framework draft –Moved to framework –Terms for describing schemes repeated  will be removed  Description of schemes –Aligned with framework draft, agreed on schemes –Aligned with terminology –All detailed descriptions now in sample-tech draft  Restructuring of document  Complexity levels removed –Difficult to agree on levels –Vendors can select scheme(s)  Flow-state sampling added

3. draft-ietf-psamp-sample-tech-02.txt3 Definitions  Agreement with framework document:  Filtering: deterministic selection based on the packet content  Sampling: everything else –Content-independent Sampling Deterministic or random selection independent of packet content Examples: systematic, random sampling that is independent of packet content. –Content-dependent Sampling Selection dependent on packet content Example: pseudorandom selection according to a probability that depends on the contents of a packet field

4. draft-ietf-psamp-sample-tech-02.txt4 Schemes and Parameters: Sampling  Systematic count-based –start and stop in accordance to spatial packet position (packet count). –Input parameters: Interval length (in number of packets) Spacing between intervals (in number of packets)  Systematic time-based –start and stop in accordance to temporal packet position (arrival time). –Input parameters: Interval length (in µsec) Spacing (in µsec)  Not covered: –Systematic sampling with combined time- and count based trigger –Non-equal spacing

5. draft-ietf-psamp-sample-tech-02.txt5 Schemes and Parameters: Sampling  Random n-out-of-N –Random selection of n packets from N –Input parameters: List of n (random) sampling positions Parent size N  Uniform Probabilistic –Same sampling probability for each packet –Input parameters: Sampling probability p  Non-Uniform Probabilistic –Sampling probability depends on input –Input parameters: Function for calculation probability p  Flow State Probabilistic –Sampling probability depends on flow state (of own flow or other flows) –Input parameters: Policy for selecting flows

6. draft-ietf-psamp-sample-tech-02.txt6 Schemes and Parameters: Filtering  Match/Mask –Apply a bit mask to packet header and/or the first N bytes of the payload –Select packet if the bit string after masking falls within one or more selection range –Input Parameters header/payload masks (as bit strings) header/payload selection ranges (as bit strings)  Hashing –Apply bit mask to packet header and/or the first N bytes of the payload, create unique bit string –Optionally, link with another pre-defined bit string (seed) –Apply hash function on the string –Select the packet if the result falls into one or more a selection range(s) –Input Parameters Input mask (as bit strings) Seed Selection interval Hashfunction

7. draft-ietf-psamp-sample-tech-02.txt7 Schemes and Parameters: Filtering  Router-state selection –Select packet on the basis of its route/treatment in the router (e.g. IF to which it is routed, no route found, etc.) –Input parameters Router state (when packet should be selected)  Combined Schemes –Combination of the defined sampling and filtering schemes –E.g. for stratified sampling –Coupled via STREAM_ID [your scheme here]

8. draft-ietf-psamp-sample-tech-02.txt8 Schemes and Parameters Scheme | input parameters | functions ---------------+------------------------+--------------------- systematic | packet position | packet counter count-based | sampling pattern | ---------------+------------------------+--------------------- systematic | arrival time | clock or timer time-based | sampling pattern | ---------------+------------------------+--------------------- random | packet position | packet counter, n-out-of-N | sampling pattern | random numbers | (random number list) | ---------------+------------------------+--------------------- uniform | sampling | random function probabilistic | probability | ---------------+------------------------+--------------------- non-uniform |e.g. packet position | selection function, probabilistic |or packet content(parts)| probability calc. ---------------+------------------------+--------------------- non-uniform |e.g. flow state | selection function, flow-state |or packet content(parts)| probability calc. ---------------+------------------------+--------------------- mask/match | packet content(parts) | filter function ---------------+------------------------+--------------------- hash-based | packet content(parts) | hash function ---------------+------------------------+--------------------- router state | router state | router state | | discovery ---------------+------------------------+--------------------- Further clarification needed

9. draft-ietf-psamp-sample-tech-02.txt9 Next Steps/Open Issues  Plan –Include description of specific (pre-defined) functions (hash- functions, non-uniform selection, flow states) –Formal information model in separate document  Open Issues –More/other schemes needed ? –Which hash functions ? –High level filter specification needed ? Currently bit level (allows all combinations) Optionally also support high level definition (fields) Existing work on this in other groups ? –Include flow state sampling ?

10. Thank you for your attention ! Questions ?