Re: [IPFIX] clarification questions

Hi Ram,

The configuration model of RFC 6728 does not cover flow selection. If 
you want to configure something like flow selection, you need to extend 
the model.

It seems that your actual question is how flow selection fits into the 
IPFIX device architecture which has been taken as a basis for RFC 6728. 
Concretely, you seem to wonder  whether your flow selection is a kind of 
Selection Process or a new kind of Cache (or maybe both?).

I cannot answer this question because I do not know how it would be 
implemented.

Regarding your question:
- With TimeoutCache and NaturalCache, the Flow is only exported when it 
is expired. At expiration, the Flow is immediately removed from the 
Cache. A longlasting flow will result in a new Flow being created in the 
Cache.
- It's different with PermanentCache. Here, the Flow remains in the 
Cache, and the status is periodically exported.

Regards,
Gerhard


On 27.03.2013 18:40, ramki Krishnan wrote:
>
> Dear IPFIX experts,
>
> From RFC 6728,
>
> 1.Section 4.3.2
>
> oIs there a way to periodically export the flows if we are using a 
> TimeoutCache or NaturalCache ?
>
> 2.Suppose we want to populate the cache only with long-lived large 
> flows (see Note1  below for data model definitions)
>
> oOne way to achieve this would be to have a selection process, using a 
> unique observation domain, which filters the long-lived large flows. 
> Are any other better ways ?
>
> 3.Continuing from 3) - suppose we want to sample the other flows (not 
> the long-lived large flows)
>
> oIs there a way to not include the long-lived large flows in the 
> selection process ?
>
> Note 1:
>
> -observationInterval: The minimum time interval to observe a flow for 
> performing further processing of the flow. Unit is in seconds.
>
> -bandwidthThreshold: The minimum bandwidth of the flow during the 
> observation interval for declaring the flow a long-lived large flow. 
> Unit is in Mbps.
>
> For example, a flow which is at or above 10 Mbps (bandwidthThreshold 
> )for a time period of at least 30 seconds (observationInterval) could 
> be declared a long-lived large flow.
>
> --
>
> Thanks,
>
> Ram (aka Ramki)
>
>
>
> _______________________________________________
> IPFIX mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/ipfix

_______________________________________________
IPFIX mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipfix