Information Model for Packet Sampling Exports
draft-ietf-psamp-info-11

[Ballot discuss]
I am holding a DISCUSS on behalf of IANA who asked for one more day in order to assess carefully this document and its implications for IANA

[Ballot comment]
In Section 8.2.4 and 8.2.5, data type should probably be "unsigned32"
(or some other integer/float type), not dateTimeMicroseconds?

The spec uses "quantity" semantics for many information elements that
don't look like quantities (where e.g. adding two values doesn't
make sense), such as digestHashValue, hashDigestOutput,
hashInitialiservalue, ipHeaderPacketSection,
ipPayloadPacketSection, mplsLabelStackSection, and
mplsPayloadPacketSection,

Appendix A says "The use of Namespaces as an extension mechanism
implies that an IANA registered Namespace URI should be available and
that directory names below this base URI be assigned for relevant IETF
specifications.  The authors are not aware of this mechanism today."
IANA does register namespace URIs; see RFC 3688 for more information .

[Ballot discuss]
DISCUSS DISCUSS:

I don't understand from this document how to represent "errored packets." I see the packet sampling model and I see how psamp is passing errors but, the way to represent "I want to know information about errored packets (e.g. bad chksum, malformed, etc)" isn't explained. I apologize in advance if this is covered elsewhere but, it appears to only represent "positive data" and not "negative data."

[Ballot comment]
Section 8 states:
  The Information Elements specified by the IPFIX information model
  [RFC5102] are used by the PSAMP protocol where applicable.

The document does not provide any guidance on the subset of RFC5106
that is applicable to the psamp information model.  Are implementations
expected to support the entire IPFIX information model?

IANA Last Call comments:

[Note to Author: Please collate the registrations of the Information
Elements into a table either in the IANA Considerations section or
in an Appendix.]

Action 1:

Upon approval of this document, the IANA will make the following assignments
in the "IP Flow Information Export (IPFIX) Information Elements" registry at
http://www.iana.org/assignments/ipfix/ipfix.xhtml
sub-registry "IPFIX Information Elements"

[ INSERT TABLE HERE -- waiting for update from Author ]


Action 2:

Upon approval of this document, the IANA will make the following
changes in "Packet Sampling (PSAMP) Parameters" registry located at
http://www.iana.org/assignments/psamp-parameters/psamp-parameters.xhtml

OLD:

ID Algorithm Reference
-- ------------------ -----------------
0 Reserved [RFC-ietf-psamp-protocol-09]
1 Systematic count-based Sampling [draft-ietf-psamp-info-09]
2 Systematic time-based Sampling [draft-ietf-psamp-info-09]
3 Random n-out-of-N Sampling [draft-ietf-psamp-info-09]
4 Uniform probabilistic Sampling [draft-ietf-psamp-info-09]
5 Property match Filtering [draft-ietf-psamp-info-09]
6 Hash based Filtering using BOB [draft-ietf-psamp-info-09]
7 Hash based Filtering using IPSX [draft-ietf-psamp-info-09]
8 Hash based Filtering using CRC [draft-ietf-psamp-info-09]
9-65535 Unassigned


NEW:

+----+------------------------+------------------------+---------------------+

| ID | Method | Parameters | Reference |

+----+------------------------+------------------------+---------------------+

| 1 | Systematic count-based | samplingPacketInterval | [RFC-psamp-info-10] |

| | Sampling | samplingPacketSpace | |

+----+------------------------+------------------------+---------------------+

| 2 | Systematic time-based | samplingTimeInterval | [RFC-psamp-info-10] |

| | Sampling | samplingTimeSpace | |

+----+------------------------+------------------------+---------------------+

| 3 | Random n-out-of-N | samplingSize | [RFC-psamp-info-10] |

| | Sampling | samplingPopulation | |

+----+------------------------+------------------------+---------------------+

| 4 | Uniform probabilistic | samplingProbability | [RFC-psamp-info-10] |

| | Sampling | | |

+----+------------------------+------------------------+---------------------+

| 5 | Property match | no agreed parameters | [RFC-psamp-info-10] |

| | Filtering | | |

+----+------------------------+------------------------+---------------------+

| Hash based Filtering | hashInitialiserValue | |

+----+------------------------+ hashIPPayloadOffset | |

| 6 | using BOB | hashIPPayloadSize | |

+----+------------------------+ hashSelectedRangeMin | [RFC-psamp-info-10] |

| 7 | using IPSX | hashSelectedRangeMax | |

+----+------------------------+ hashOutputRangeMin | |

| 8 | using CRC | hashOutputRangeMax | |

+----+------------------------+------------------------+---------------------+
+9- | Unassigned | | |
+65535| | | |
+----+------------------------+------------------------+---------------------+


We understand the above to be the only IANA Actions for this document.

Draft-09 left 2 open
points under discussion

* dataLinkFrameSize - usage and meaning of this element is unclear
* padding - usage of padding for the ...Section elements

These issues will be discussed at the IETF meeting in Dublin.

AD Review by Dan Romascanu

Please find below the AD evaluation of draft-ietf-psamp-info-08.txt. The document has reached a fair state of maturity and stability, yet there are a number of issues to be discussed and fixed, and probably a revised ID will be needed before proceeding to IETF Last Call. Please find below my questions and comments, grouped in Technical and Editorial.

Technical

T1. E2. Section 7, second paragraph - it is not clear what  'special information' means here, and thus what this paragraph is saying. 

T2. Section 10.2 specifies that for new selection methods 'configuration parametr(s), along with the way to report it/them with an Options Template, MUST be clearly specified. Should not this information be also clearly specified for the initial set of eight selector algorithms described in 8.2.4? Or maybe they are specified someplace else - reference should be provided here if so.

T3. Section 8.2.4

      New assignments for the PSAMP selection method will be
      administered by IANA, on a First Come First Served basis
      [RFC2434], subject to Expert Review [RFC2434].

The policy here should be Expert Review as per RFC5226, no need to mention FCFS (actually you can't have two policies in place and what numbers are allocated is the IANA business)

T4. Section 8.2.11 - why is Abstract Data type float64 needed? It looks to me like float32 would be enough to express a probability value, or am I missing something?

T5. Section 9 - Security Considerations. It would be good to borrow as is or with minimal adaptations the following two paragraphs from the Security Considerations section of RFC5102:

  For example, exporting values of header fields may make attacks
  possible for the receiver of this information, which would otherwise
  only be possible for direct observers of the reported Flows along the
  data path.

  The underlying protocol used to exchange the information described
  here must therefore apply appropriate procedures to guarantee the
  integrity and confidentiality of the exported information.  Such
  protocols are defined in separate documents, specifically the IPFIX
  protocol document [RFC5101].

T6. Section 10.2

  New assignments for the PSAMP selection method will be administered
  by IANA, on a First Come First Served basis [RFC2434], subject to
  Expert Review [RFC2434]. 

Same comment as in T3, the policy should be just Expert Review as per
RFC5226



Editorial

E1. T2. [RFC2404] was obsoleted and replaced by [RFC5226] - make the change in the references and all over the document.

E2. It should be added in Section 5 that the documents uses the Data Types described in Section 3.1 of [RFC5102]

E3. Section 8.2.4 - s/The selectorAlgorithm registry is maintained by IANA and can be updated as long as specifications/The selectorAlgorithm registry is maintained by IANA and can be updated when specifications/

E4. Section 8.2.6 - s/A value of 100 means that the next interval starts after 100 packets (which are not sampled) when the current "samplingPacketInterval" is over./A value of 100 means that the next interval starts 100 packets (which are not sampled) after the current "samplingPacketInterval" is over./

E5. Section 8.2.8 - s//A value of 100 means that the next interval starts after 100 packets (which are not sampled) when the current "samplingTimeInterval" is over./A value of 100 means that the next interval starts 100 packets (which are not sampled) after the current "samplingTimeInterval" is over./

PROTO write-up by Juergen Quittek


Write-up for draft-ietf-psamp-info-08
=====================================

  (1.a)  Who is the Document Shepherd for this document?  Has the
          Document Shepherd personally reviewed this version of the
          document and, in particular, does he or she believe this
          version is ready for forwarding to the IESG for publication?
         
Juergen Quittek is the document shepherd. He has reviewed it personally and believes that this version is ready for forwarding to the IESG for publication.

  (1.b)  Has the document had adequate review both from key WG members
          and from key non-WG members?  Does the Document Shepherd have
          any concerns about the depth or breadth of the reviews that
          have been performed?

The document had multiple individual reviews from key WG members.
The shepherd has no concern about the depth or breadth of the reviews.

  (1.c)  Does the Document Shepherd have concerns that the document
          needs more review from a particular or broader perspective,
          e.g., security, operational complexity, someone familiar with
          AAA, internationalization, or XML?

The document shepherd sees no need for an additional particular review.
The contained XML document is fully in line with the corresponding XML document of the IPFIX information model. It has been validated by the document shepherd.

  (1.d)  Does the Document Shepherd have any specific concerns or
          issues with this document that the Responsible Area Director
          and/or the IESG should be aware of?  For example, perhaps he
          or she is uncomfortable with certain parts of the document, or
          has concerns whether there really is a need for it.  In any
          event, if the WG has discussed those issues and has indicated
          that it still wishes to advance the document, detail those
          concerns here.  Has an IPR disclosure related to this document
          been filed?  If so, please include a reference to the
          disclosure and summarize the WG discussion and conclusion on
          this issue.

There is no such concern.

  (1.e)  How solid is the WG consensus behind this document?  Does it
          represent the strong concurrence of a few individuals, with
          others being silent, or does the WG as a whole understand and
          agree with it?

There is a strong consensus in the PSAMP WG as well as in the IPFIX WG to publish this version of the document. There are no particular issues in the document without strong consensus of both WGs.

  (1.f)  Has anyone threatened an appeal or otherwise indicated extreme
          discontent?  If so, please summarize the areas of conflict in
          separate email messages to the Responsible Area Director.  (It
          should be in a separate email because this questionnaire is
          entered into the ID Tracker.)

There was no appeal.

  (1.g)  Has the Document Shepherd personally verified that the
          document satisfies all ID nits?  (See
          http://www.ietf.org/ID-Checklist.html and
          http://tools.ietf.org/tools/idnits/.)  Boilerplate checks are
          not enough; this check needs to be thorough.  Has the document
          met all formal review criteria it needs to, such as the MIB
          Doctor, media type, and URI type reviews?  If the document
          does not already indicate its intended status at the top of
          the first page, please indicate the intended status here.

The WG shepherd checked for ID nits and validated the contained XML document.  Also boilerplates have been checked.

  (1.h)  Has the document split its references into normative and
          informative?  Are there normative references to documents that
          are not ready for advancement or are otherwise in an unclear
          state?  If such normative references exist, what is the
          strategy for their completion?  Are there normative references
          that are downward references, as described in [RFC3967]?  If
          so, list these downward references to support the Area
          Director in the Last Call procedure for them [RFC3967].

One reference has been outdated since the document was submitted:
RFC 2434 has recently been obsoleted by RFC 5226. This should be fixed after IETF last call. More references may be obsoleted by then.

  (1.i)  Has the Document Shepherd verified that the document's IANA
          Considerations section exists and is consistent with the body
          of the document?  If the document specifies protocol
          extensions, are reservations requested in appropriate IANA
          registries?  Are the IANA registries clearly identified?  If
          the document creates a new registry, does it define the
          proposed initial contents of the registry and an allocation
          procedure for future registrations?  Does it suggest a
          reasonable name for the new registry?  See [RFC2434].  If the
          document describes an Expert Review process, has the Document
          Shepherd conferred with the Responsible Area Director so that
          the IESG can appoint the needed Expert during IESG Evaluation?

IANA considerations have been checked.

  (1.j)  Has the Document Shepherd verified that sections of the
          document that are written in a formal language, such as XML
          code, BNF rules, MIB definitions, etc., validate correctly in
          an automated checker?

Yes. The contained XML document was validated using Sun's Multi-Schema XML Validator (MSV)

  (1.k)  The IESG approval announcement includes a Document
          Announcement Write-Up.  Please provide such a Document
          Announcement Write-Up.  Recent examples can be found in the
          "Action" announcements for approved documents.  The approval
          announcement contains the following sections:

Technical Summary

  This memo defines an information model for the Packet Sampling
  (PSAMP) protocol.  It is used by the PSAMP protocol for encoding
  sampled packet data and information related to the Sampling process.
  As the PSAMP protocol is based on the IPFIX protocol, this
  information model is an extension to the IPFIX information model.

Working Group Summary

  There is consensus in the WG to publish these documents.

Document Quality

  Several of the Information Elements defined in this document have
  already been implemented by academic as well as industrial institutions.
  But not all of them have been implemented and tested, yet.

Personnel

  Juergen Quittek is shepherding this document. Dan Romascanu is the
  responsible Area director.