Re: [IPFIX] RFC 5101bis: CP MUST Close and Simplified Template Management
Paul Aitken <[email protected]>
| Newsgroups | gmane.ietf.ipfix |
|---|---|
| Message-ID | <[email protected]> |
Brian, >>>> 4. Template Withdrawals MAY be sent on UDP. >>> Ok. Template Withdrawal does not hurt in case of UDP. >> UDP doesn't guarantee in-order delivery. Therefore not waiting long enough after sending a TWM before sending a new template definition using the same template ID, could result in the new template definition arriving first, then being withdrawn. >> >> ie, "Template N¹, TWM N, Template N²" becomes, "Template N¹, Template N², TWM N". >> >> Of course, this can be avoided by checking the header timestamps, and ignoring the TWM if it originated prior to the current template. > You can also stick them all in the same message, no? That violates 5101, which specifically excludes TWM over UDP. However, if the restriction is removed, then inter-message timestamps and intra-message order must both be honoured. eg, if your collector sub-divides messages and processes them in multiple threads. >> Brian's reply later in this thread: >> >> The EP can ensure this by setting the Export Time in the header; all sequencing is done via this header (as opposed to actual time the packet leaves the EP or arrives at the CP). >> >> >> I wonder how many collectors process data in time order versus order of receipt? Since 5101 has nothing to say on the matter, some interesting interop test cases could be devised around this question. > I presume most CPs process data in order of receipt, +1 However, they should then reject out-of-order messages according to the header timestamp. - except that this introduces a potential DoS vector, where I can send my ISP a (possibly null) message with a header timestamp of "7th Jan 2106" and block all future messages... - except that collectors should also reject messages which are far in the future (while allowing for collectors in remote timezones and DST changes). > and for the most part things should run as such. However, if a collector detects that something is not right (in circumstances in which it can do so, which we addressed in the hallway once but which are now less clear to me than they were then) +1 P. > then it can use the export time ordering to try and recover. > > (Or it can scream at the admin and have the admin go tweak some timeouts and/or fetch a bigger pipe. Again, IPFIX over UDP is a game for people with very-well-provisioned measurement networks and/or a penchant for gambling.) > > Cheers, > > Brian _______________________________________________ IPFIX mailing list [email protected] https://www.ietf.org/mailman/listinfo/ipfix