Re: [IPFIX] NetFlow v9 to IPFIX conversion

Petr, please see replies inline:


From: IPFIX [mailto:[email protected]] On Behalf Of Petr Velan
Sent: 06 January 2015 12:03
To: [email protected]
Subject: [IPFIX] NetFlow v9 to IPFIX conversion

Hello all,
I'm not sure whether this is the right place to ask, but we encountered following problem when converting NetFlow v9 messages to IPFIX.
Some vendors (I've heard of ntop) are using elements IDs large than 32767 in NetFlow v9.

[P] That’s not invalid in NFv9. RFC 3954 allows a 16-bit “Field Type” ID.


When converting messages with these elements to IPFIX, they are considered to be Enterprise Numbers. To generate proper IPFIX message, we need to do one of the following:
a) Generate a list of the elements and map them to PEN of the correct vendor. However, this would result in an attempt to cover all possible elements that anybody used in NetFlow v9. Moreover, we would still have to somehow handle the cases where the element is unknown

[P] When I was netflow–police at cisco, the guys at Plixer helped to identify non-cisco NFv9 exporters, and I allocated blocks of 500 or 1000 IDs for each them in the 50,000 – 60,000 range – effectively blacklisting those IDs so that cisco wouldn’t create duplicate IDs.  At that time there were just 5 such blocks recognized by Cisco. If we can identify a PEN for each block then it’d be simple to write a decoder. Unfortunately this method doesn’t extend to recognizing future allocations, or export IDs that weren’t known to us at the time.

BTW, you’re also supposing that the IDs < 32768 are identical and will remain so in future.


b) Request a PEN for NetFlow compatibility and just add this PEN for every element that has ID larger than 32767.
[P] It’d be more accurate to use Cisco’s PEN for this ;-)  However in principal it’s a NFv9-in-IPFIX indicator.

Personally, I believe that the b) is more general and error-prone. Do you think, that it would be possible to dedicate whole PEN to this cause?
[P] I believe you could convince IANA to allocate an ID. However I’m not yet convinced that it’s a good idea.
P.


Thank you for any opinions,

Petr Velan

_______________________________________________
IPFIX mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipfix