1. Per-Packet Record Export Proposal draft-kim-ipfix-ppr-00.txt Chang H. Kim, Taesang Choi {kimch, choits}@etri.re.kr

2. Motivation Contents-awareness is getting more important Applicability Application Recognition/Identification User-configurable or dynamic ports, overloaded ports, etc. are big concerns Contents-based Service Differentiation and Accounting Attack/Intrusion Detection Some worms or viruses do not incur flow/packet number increases, esp. at the early stage of dissemination.

3. Real-world Situation Port/Application Port-based Accounting Contents-based Accounting 80/HTTP67 GB 59.1 GB (11.8% reduced) 21/FTP_CTRL0.29 GB0.28 GB 20/FTP_DATA43 GB42 GB ?/FTP_DATA_PASSIVEn/a 6 GB (14.3% of FTP_DATA, 2% of the total volume) 5003/?692 MB HTTP: 13.2 MB BUGS_MUSIC: 420.8 MB EDONKEY: 172.3 MB etc.: 85.7 MB PosTech Traffic Breakdown - PosTech Campus Network (24h sum in May, 304GB total volume)

4. Exporting Payload Required Contents-awareness requires exporting packet payload Entire/partial payloads can be exported on a per-packet basis our approach in the draft on the existing flow basis might be another decent option

5. Why per-packet basis? Payload investigation is expensive requires fragmentation, drop, and out-of-order handling O(t*p) or O(t+p) time complexity t = text length, p = pattern length Timely transmission is important can’t wait until a flow terminates

6. Other Applications of PPR Export QoS Monitoring and Traffic Profiling Understanding per-packet traits required

7. The Objective of the Draft Incorporating per-packet information export into the existing ipfix proposals providing a generalized version of a ppr export mechanism so that all the required fields of a packet (including payload) can be exported leveraging the existing ipfix protocol, information model, and architecture

8. Correspondence with the WG Charters ipfix or psamp? When it’s literally grounded on the charters, the draft better matches with psamp than ipfix. Nevertheless, we first brought this up to ipfix because psamp seems to be focusing on sampling and filtering mechanisms and the mibs for configuration Corresponding to the “ipfix-psamp relationship” proposal

9. Suggested Extensions Information Model Extension The draft includes information elements based on IPv4/TCP/UDP headers and packet payloads Exporting first n bytes of a packet supported Configuration Extension A selection criteria for enabling/disabling per-packet record generation Adding Per-Packet Info Export flag to the existing selection criteria suffices Pattern Specification for packet payload investigation and export (optional)

10. Extended Architecture Packet Capturing Timestamping Sampling Generating Flow Records Generating Packet Records (A payload is appended only when a specified pattern is found on the payload) Payload Investigation (Null when No pattern or Wildcard pattern) Classifying PPIE flag == on

11. Data Export Utilizing the existing Data Export mechanism Requires at the most two different record templates Flow Properties record and Packet Properties record In psamp, Flow Properties record merely means shared information element; just for stringent network resource consumption Associating packet records with the corresponding flow record is accomplished on the basis of the order of the two records; a Flow Properties record must be disposed right ahead of the corresponding Packet Properties records Packet record export intervals synchronized with the flow export unsynchronized with the flow export periodic/instant export

12. A Sample Layout of an Export Packet Containing PPR Packet Header Data FlowSet (Ordinary Flow Records)... Flow Properties FlowSet (Flow Record of flow “X”) Packet Properties FlowSet (Packet Records within “X”)... FlowSet ID = p FlowSet ID = q or p FlowSet ID = r

13. Issues Discussed Assigning a unique pkt id globally unique? flow-locally unique? what about calculating the unique id at the collecting process? Schemes for associating packet records to the corresponding flow record Incorporating information elements for IPv6 packets

14. Proposed Next Steps Regarding contents-awareness To supplement the applicability draft with some texts Exporting packet payloads using the existing flow export mechanisms may also be separately documented Regarding per-packet information export Verifying the correctness of utilizing ipfix protocol and information model under ipfix/psamp? Then, building up as a wg document in psamp? Cooperation with another interested group expected

15. Thank You!