Re: [IPFIX] [QUAR] Re: exporterIPv4Address and exporterIPv6Address question

Paul,

On 12/07/2012 02:19 PM, Paul Aitken wrote:
> Andrew,

[ snip ]
>> What if I poll a bunch of SNMP and export that information as IPFIX 
>> to a collector?  The polled devices are not necessarily exporters, 
>> but this seems to be the most appropriate IE.  I don't see a 
>> situation where this would cause a problem, but maybe I am missing 
>> something.
>
> In this case it seems that you'd want to report the addresses of the 
> polled devices, ie the source(s) of the SNMP information, rather than 
> the exporter's address. Anyway the exporter's address will be visible 
> to the collector (unless it's NAT'd).
>
> So perhaps "sourceIPv4Address" would be appropriate? And we need to 
> improve the definition for cases where packets aren't being observed, 
> eg the exporting device is sending reports or alarms, or is being SNMP 
> polled.

OK, what about this hypothetical example.

Firewall reports via SNMP  firewall events, and the IP address(es) involved.

An agent polls that device to send this information (via IPFIX) to a 
collector for reporting.

My original thinking was that you might send

exporterIPv4Address, sourceIPv4Address, destinationIPv4Address, 
firewallEvent

This seems equivalent to what you would get if (instead of polling) my 
hypothetical agent was a proxy for the same information being sent via 
IPFIX from my hypothetical device.

Using sourceIPv4Address in place of exporterIPv4Address doesn't seem 
like the right choice here.

-Andrew

_______________________________________________
IPFIX mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipfix