Internet Engineering Task Force                             S. D'Antonio
Internet-Draft                                     University of Napoli
Intended status: Standards Track                            "Parthenope"
Expires: May 17, 2012                                           T. Zseby
                                              Fraunhofer Institute FOKUS
                                                                C. Henke
                                           Technische Universitat Berlin
                                                               L. Peluso
                                                    University of Napoli
                                                       November 14, 2011


                       Flow Selection Techniques
              draft-ietf-ipfix-flow-selection-tech-08.txt

Abstract

   Flow selection is the process of selecting a subset of flows from all
   observed flows.  The Flow Selection Process may be located at an
   observation point, or on an IPFIX Mediator.  Flow selection reduces
   the effort of post-processing flow data and transferring Flow
   Records.  This document describes motivations for flow selection and
   presents flow selection techniques.  It provides an information model
   for configuring flow selection techniques and discusses what
   information about a flow selection process should be exported.

Requirements Language

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [RFC2119].

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on May 17, 2012.



D'Antonio, et al.         Expires May 17, 2012                  [Page 1]


Internet-Draft          Flow Selection Techniques          November 2011


Copyright Notice

   Copyright (c) 2011 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

   This document may contain material from IETF Documents or IETF
   Contributions published or made publicly available before November
   10, 2008.  The person(s) controlling the copyright in some of this
   material may not have granted the IETF Trust the right to allow
   modifications of such material outside the IETF Standards Process.
   Without obtaining an adequate license from the person(s) controlling
   the copyright in such materials, this document may not be modified
   outside the IETF Standards Process, and derivative works of it may
   not be created outside the IETF Standards Process, except to format
   it for publication as an RFC or to translate it into languages other
   than English.

























D'Antonio, et al.         Expires May 17, 2012                  [Page 2]


Internet-Draft          Flow Selection Techniques          November 2011


Table of Contents

   1.  Scope  . . . . . . . . . . . . . . . . . . . . . . . . . . . .  4
   2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  4
   3.  Difference between Flow Selection and Packet Selection . . . .  7
   4.  Flow selection as a Function in the IPFIX Architecture . . . .  8
     4.1.  Flow selection during the Metering Process . . . . . . . . 10
     4.2.  Flow selection during the Exporting Process  . . . . . . . 10
     4.3.  Flow selection as a function of the IPFIX Mediator . . . . 10
   5.  Flow Selection Techniques  . . . . . . . . . . . . . . . . . . 11
     5.1.  Flow Filtering . . . . . . . . . . . . . . . . . . . . . . 11
       5.1.1.  Property Match Filtering . . . . . . . . . . . . . . . 11
       5.1.2.  Hash-based Flow Filtering  . . . . . . . . . . . . . . 11
     5.2.  Flow Sampling  . . . . . . . . . . . . . . . . . . . . . . 12
       5.2.1.  Systematic sampling  . . . . . . . . . . . . . . . . . 12
       5.2.2.  Random Sampling  . . . . . . . . . . . . . . . . . . . 12
     5.3.  Flow-state Dependent Flow Selection  . . . . . . . . . . . 13
     5.4.  Flow-state Dependent Packet Selection  . . . . . . . . . . 14
   6.  Configuration of Flow Selection Techniques . . . . . . . . . . 14
     6.1.  Flow Selection Parameters  . . . . . . . . . . . . . . . . 16
     6.2.  Description of Flow-state Dependent Packet Selection . . . 18
   7.  Information Model for Flow Selection Configuration and
       Reporting  . . . . . . . . . . . . . . . . . . . . . . . . . . 18
     7.1.  FlowSelectorAlgorithm  . . . . . . . . . . . . . . . . . . 19
     7.2.  flowSelectedOctetDeltaCount  . . . . . . . . . . . . . . . 21
     7.3.  flowSelectedPacketDeltaCount . . . . . . . . . . . . . . . 21
     7.4.  flowSelectedFlowDeltaCount . . . . . . . . . . . . . . . . 21
     7.5.  selectorIDTotalFlowsObserved . . . . . . . . . . . . . . . 22
     7.6.  selectorIDTotalFlowsSelected . . . . . . . . . . . . . . . 22
     7.7.  samplingFlowInterval . . . . . . . . . . . . . . . . . . . 22
     7.8.  samplingFlowSpace  . . . . . . . . . . . . . . . . . . . . 23
     7.9.  flowSamplingTimeInterval . . . . . . . . . . . . . . . . . 23
     7.10. flowSamplingTimeSpace  . . . . . . . . . . . . . . . . . . 23
     7.11. hashFlowDomain . . . . . . . . . . . . . . . . . . . . . . 24
   8.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 24
     8.1.  Registration of Information Elements . . . . . . . . . . . 24
     8.2.  Registration of Object Identifier  . . . . . . . . . . . . 32
   9.  Security Considerations  . . . . . . . . . . . . . . . . . . . 32
   10. Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 33
   11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 33
     11.1. Normative References . . . . . . . . . . . . . . . . . . . 33
     11.2. Informative References . . . . . . . . . . . . . . . . . . 33
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 34








D'Antonio, et al.         Expires May 17, 2012                  [Page 3]


Internet-Draft          Flow Selection Techniques          November 2011


1.  Scope

   This document describes flow selection techniques for network traffic
   measurements.  A flow is defined as a set of packets with common
   properties as described in [RFC5101].  Flow selection can be done to
   limit the resource demands for capturing, storing, exporting and
   post-processing of Flow Records.  It also can be used to select a
   particular set of flows that are of interest to a specific
   application.  This document provides a categorization of flow
   selection techniques and describes configuration and reporting
   parameters for them.  In order to be compliant with this document, at
   least one of the flow selection schemes MUST be implemented.  That
   means that the configuration parameters as well as the reporting
   Information Elements for this particular scheme MUST be supported.

   This document also addresses configuration and reporting parameters
   for flow-state dependent packet selection as described in [RFC5475],
   although this technique is categorized as packet selection.  The
   reason is, that flow-state dependent packet selection techniques
   often aim at the reduction of resources for flow capturing and flow
   processing.  Furthermore, they were only briefly discussed in
   [RFC5475].  Therefore we included configuration and reporting
   considerations for such techniques in this document.


2.  Terminology

   This document is consistent with the terminology introduced in
   [RFC5101], [RFC5470], [RFC5475] and [RFC3917].  As in [RFC5101] and
   [RFC5476], the first letter of each IPFIX-specific and PSAMP-specific
   term is capitalized along with the flow selection specific terms
   defined here.

   * Packet Classification

      Packet Classification is a process by which packets are mapped to
      specific Flow Records based on packet properties or external
      properties (e.g. interface).  The properties (e.g. header
      information, packet content, AS number) make up the Flow Key. In
      case a Flow Record for a specific Flow Key already exists the Flow
      Record is updated, otherwise a new Flow Record is created.

   * Packet Aggregation Process

      In the IPFIX Metering Process the Packet Aggregation Process
      aggregates packet data into flow data and forms the Flow Records.
      After the aggregation step only the aggregated flow information is
      available.  Information about individual packets is lost.



D'Antonio, et al.         Expires May 17, 2012                  [Page 4]


Internet-Draft          Flow Selection Techniques          November 2011


   * Flow Selection Process

      A Flow Selection Process takes Flow Records as its input and
      selects a subset of this set as its output.  A Flow Selection
      Process MAY run in several places within the IPFIX architecture.
      A Flow Selection Process MAY be part of an IPFIX Metering Process,
      Exporting Process or as an Intermediate Selection Process as
      defined for the IPFIX Mediator [RFC6183].

   * Flow Selection State

      A Flow Selection Process SHOULD maintain state information for use
      by the Flow Selector.  At a given time, the Flow Selection State
      may depend on flows and packets observed at and before that time,
      as well as other variables.  Examples include:

        (i)   sequence number of packets and accounted Flow Records;

        (ii)  number of selected flows;

        (iii) number of observed flows;

        (iv)  current flow cache occupancy;

        (v)   flow specific counters, lower and upper bounds;

        (vi)  flow selection timeout intervals.

   * Flow Selector

      A Flow Selector defines the action of a Flow Selection Process on
      a single flow of its input.  The Flow Selector can make use of the
      following information in order to establish whether a flow has to
      be selected or not:

        (i)   the content of the Flow Record;

        (ii)  any state information related to the Metering Process or
              Exporting Process;

        (iii) any Flow Selection State that may be maintained by the
              Flow Selection Process.

   * Complete Flow

      A Complete Flow consists of all the packets that enter the Flow
      Selection Process within the flow time-out interval, and which
      belong to the same flow as defined by the flow definition in



D'Antonio, et al.         Expires May 17, 2012                  [Page 5]


Internet-Draft          Flow Selection Techniques          November 2011


      [RFC5470].  For this definition only packets that arrive at the
      Flow Selection Process are considered.  That means, packets that
      are not observed at the Flow Selection Process because of prior
      packet selection or packet loss are not considered as belonging to
      the Complete Flow.

   * Flow Filtering

      Flow Filtering selects flows based on a deterministic function on
      the Flow Record content, Flow Selection State, external properties
      (e.g. ingress interface) or external events (e.g violated Access
      Control List).  If the relevant parts of the Flow Record content
      can already be observed at packet level (e.g.  Flow Keys from
      packet header fields) Flow Filtering can be performed at packet
      level by Property Match Filtering as described in [RFC5475].

   * Hash-based Flow Filtering

      Hash-based Flow Filtering is a deterministic flow filter function
      that selects flows based on a Hash Function.  The Hash Function is
      calculated over parts of the Flow Record content or external
      properties which are called the Hash Domain.  If the hash value
      falls into a predefined Hash Selection Range the flow is selected.
      Hash-based Flow Filtering can already applied at packet level, in
      which case the Hash Domain MUST contain the Flow Key of the
      packet.  In case Hash-based Flow Filtering is used to select the
      same subset of flows at different observation points, the Hash
      Domain MUST comprise parts of the packet or flow thar are
      invariant on the packet/flow path.  Also refer to the according
      Trajectory Sampling Application Example on packet level in
      [RFC5475]

   * Flow-state Dependent Flow Selection

      Flow-state Dependent Flow Selection is a selection function that
      selects or drops flows based on the current Flow Selection State.
      The selection can be either deterministic, random or non-uniform
      random.

   * Flow-state Dependent Packet Selection

      Flow-state Dependent Packet Selection is a selection function that
      selects or drops packets based on the current Flow Selection
      State.  The selection can be either deterministic, random or non-
      uniform random.  Flow-state Dependent Packet Selection can be used
      to prefer the selection of packets belonging to specific flows.
      For example the selection probability of packets belonging to
      flows that are already within the Flow Cache may be higher than



D'Antonio, et al.         Expires May 17, 2012                  [Page 6]


Internet-Draft          Flow Selection Techniques          November 2011


      for packets that have not been recorded yet.

   * Flow Sampling

      Flow Sampling selects flows based on Flow Record sequence or
      arrival times (e.g. entry in flow cache, arrival time at Exporter
      or Mediator).  The selection can be systematic (e.g. every n-th
      flow) or based on a random function (e.g. select each Flow Record
      with probability p, or randomly select n out of N Flow Records).


3.  Difference between Flow Selection and Packet Selection

   Flow selection differs from packet selection described in [RFC5475].
   Packet selection techniques consider packets as the basic element and
   the parent population consists of all packets observed at an
   observation point.  In contrast to this the basic elements in flow
   selection are the flows.  The parent population consists of all
   observed flows and the selection process operates on the flows.  The
   major characteristics of flow selection are the following:

   -       Flow selection takes flows as basic elements.  For packet
           selection, packets are considered as basic elements.

   -       Flow selection can only take place after Packet
           Classification, because the classification rules determine to
           which flow a packet belongs.  Packet selection can be applied
           before and after Packet Classification.

   -       Flow selection operates on Complete Flows.  That means that
           after the Flow Selection Process either all packets of the
           flow are kept or all packets of the flow are discarded.  That
           means that if the flow selection is preceded by a packet
           selection process the Complete Flow consists only of the
           packets that were not discarded during the packet selection.

   There are some techniques that are difficult to unambiguously
   categorize into one of the categories.  Here we give some guidance
   how to categorize such techniques:

   -       Techniques that can be considered as both packet and flow
           selection: some packet selection techniques result in the
           selection of Complete Flows and therefore can be considered
           as packet or as flow selection at the same time.  An example
           is Property Match Filtering of all packets to a specific
           destination address.  If flows are defined based on
           destination addresses, such a packet selection also results
           in a flow selection and can be considered as packet or flow



D'Antonio, et al.         Expires May 17, 2012                  [Page 7]


Internet-Draft          Flow Selection Techniques          November 2011


           selection.

   -       Flow-state Dependent Packet Selection (as described in
           [RFC5475]): there exist techniques that select packets based
           on the flow state, e.g. based on the number of already
           observed packets belonging to the flow.  Examples of these
           techniques from the literature are "Sample and Hold" [EsVa01]
           "Fast Filtered Sampling" [MSZC10] or the "Sticky Sampling"
           algorithm presented in [MaMo02].  Such techniques can be used
           to influence which flows are captured (e.g. increase the
           selection of packets belonging to large flows) and reduce the
           number of flows that need to be stored in the flow cache.
           Nevertheless, such techniques do not necessarily select
           Complete Flows, because they do not ensure that all packets
           of a selected flow are captured.  Therefore Flow-state
           Dependent Packet Selection methods that do not ensure that
           either all or no packets of a flow are selected strictly
           speaking have to be considered as packet selection techniques
           and not as flow selection techniques.


4.  Flow selection as a Function in the IPFIX Architecture

   Figure 1 shows the IPFIX reference model as defined in [RFC5470] and
   shows the Packet Classification and Packet Aggregation Process in the
   Metering Process.

























D'Antonio, et al.         Expires May 17, 2012                  [Page 8]


Internet-Draft          Flow Selection Techniques          November 2011


                       Packet(s) coming in to Observation Point(s)
                         |                                     |
                         v                                     v
        +----------------+---------------------------+   +-----+-------+
        |          Metering Process                  |   |             |
        |                                            |   |             |
        |   packet header capturing                  |   |             |
        |        |                                   |...| Metering    |
        |   timestamping                             |   | Process N   |
        |        |                                   |   |             |
        |   packet sampling                          |   |             |
        |        |                                   |   |             |
        |   (packet classification)                  |   |             |
        |        |                                   |   |             |
        |   packet filtering*                        |   |             |
        |        |                                   |   |             |
        |   (packet aggregation)*                    |   |             |
        |        |                                   |   |             |
        +--------|-----------------------------------+   +-----|-------+
            Flow Records                                   Flow Records
                 |                                             |
                 +----------------------+----------------------+
                                        |
                 +----------------------|-----------------+
                 | Exporting Process*                     |
                 +----------------------+-----------------+
                                        |  IPFIX (Flow Records)
                                        v
              +-------------------------|-----------------------+
              |  IPFIX Mediator         |                       |
              |                         v                       |
              |               Collecting Process(es)            |
              |                         |                       |
              |      Intermediate Flow Selection Process (*)    |
              |                         |                       |
              |               Exporting Process(es) (*)             |
              +-------------------------|-----------------------+
                                        v
                                      IPFIX

         (*) indicates where flow selection can take place.

            Figure 1: Flow selection in the IPFIX Architecture

   In contrast to packet selection, flow selection is always applied
   after the packets are classified into flows.  Flows can be selected
   at different stages of the measurement chain:




D'Antonio, et al.         Expires May 17, 2012                  [Page 9]


Internet-Draft          Flow Selection Techniques          November 2011


   1.  during the Metering Process

   2.  during Exporting Process(es)

   3.  during an Intermediate Selection Process on a Mediator

4.1.  Flow selection during the Metering Process

   In the Packet Aggregation Process the packet information is used to
   update the Flow Records in the flow cache.  Flow selection that is
   applied before aggregation equals a packet selection process.  The
   flow still consists of individual packets.  Those are then selected
   based on the classification information, i.e. based on the flow they
   belong to.  Flow selection before aggregation can be based on the
   fields of the Flow Key (also on a hash value over these fields), but
   not based on characteristics that are only available after packet
   aggregation (e.g. flow size, flow duration).  Flow selection during
   the Metering Process is applied to reduce resources for all
   succeeding processes or to select specific flows of interest in case
   such flow characteristics are already observable at packet level
   (e.g. flows to specific IP addresses).  In contrast, Flow-state
   Dependent Packet Selection is a packet selection method, because it
   does not necessarily select Complete Flows.

4.2.  Flow selection during the Exporting Process

   The Flow Selection Process at the Exporter is similar to an
   Intermediate Selection Process as described in [RFC6183] and works on
   Flow records.  Flow selection during the Exporting Process can
   therefore also depend on flow characteristics that are only visible
   after the aggregation of packets, such as flow size and flow
   duration.  The Exporting Process may implement policies for exporting
   only a subset of the Flow Records which have been stored in the
   system memory in order to unload flow export and flow post-
   processing.  Flow selection during the Exporting Process may select
   only the subset of Flow Records which are of interest to the users
   application, or select only as many Flow Records as can be handled by
   the available resources (e.g. limited export link capacity).

4.3.  Flow selection as a function of the IPFIX Mediator

   As shown in Figure 1, flow selection can be performed as an
   Intermediate Process within an IPFIX Mediator [RFC6183].  The
   Intermediate Selection Process takes Flow Record stream as its input
   and selects Flow Records from a sequence based upon criteria-
   evaluated record values.  The Intermediate Selection Process can
   again apply a flow selection technique to obtain flows of interest to
   the application.  Further, the Intermediate Selection Process can



D'Antonio, et al.         Expires May 17, 2012                 [Page 10]


Internet-Draft          Flow Selection Techniques          November 2011


   base its selection decision on the correlation of data from different
   observation points, e.g. by only selecting flows that were at least
   recorded on two observation points.


5.  Flow Selection Techniques

   A flow selection technique selects either all or none of the packets
   of a flow, otherwise the technique has to be considered as packet
   selection.  We distinguish between Flow Filtering and Flow Sampling.

5.1.  Flow Filtering

   Flow Filtering is a deterministic function on the IPFIX Flow Record
   content.  If the relevant flow characteristics are already observable
   at packet level (e.g.  Flow Keys), Flow Filtering can be applied
   before aggregation at packet level.

5.1.1.  Property Match Filtering

   Flow Filtering can be performed similarly to Property Match Filtering
   for packet selection described in [RFC5475].  The difference is that,
   instead of packet fields, Flow Record fields are here used to derive
   the selection decision.  Property Match Filtering is typically used
   to select a specific subset of the flows that are of interest to a
   particular application (e.g. all flows to a specific destination, all
   large flows, etc.).  Properties on which the filtering is based can
   be for example Flow Keys, the flow size in bytes, the number of
   packets in the flow, the observation time of the first or last
   packet, or the maximum packet length.  The selection criteria can be
   a specific value or an interval.  Property Match Filtering can be
   applied during the Metering Process if the properties are already
   observable at the packet level (e.g.  Flow Key fields).

   There are content-based Property Match Filtering techniques that
   require a computation on the current flow cache.  An example is the
   selection of the largest flows or a percentage of flows with the
   longest lifetime.  This type of Property Match Filtering is also used
   in flow selection techniques that react to external events (e.g.
   resource constraint).  For example when the flow cache is full, the
   Flow Record with the lowest flow volume per current flow life time
   may be deleted.

5.1.2.  Hash-based Flow Filtering

   Hash-based Flow Filtering uses a Hash Function h to map the Flow Key
   c onto a Hash Range R. A flow is selected if the hash value h(c) is
   within the Hash Selection Range S, which is a subset of R. Hash-based



D'Antonio, et al.         Expires May 17, 2012                 [Page 11]


Internet-Draft          Flow Selection Techniques          November 2011


   Flow Filtering can be used to emulate a random sampling process but
   still enable the correlation between selected flow subsets at
   different observation points.  Hash-based Flow Filtering is similar
   to Hash-based Packet Selection, and in fact is identical when Hash-
   based Packet Selection uses the Flow Key that defines the flow as the
   hash input.  Nevertheless there MAY be the incentive to apply Hash-
   based Flow Filtering not on the packet level during the Metering
   Process, for example when the size of the selection range and
   therefore the sampling probability is dependent on the number of
   observed flows.

5.2.  Flow Sampling

   Flow Sampling operates on Flow Record sequence or arrival times.  It
   can use either a systematic or a random function for the selection
   process.  Flow Sampling usually aims at the selection of a
   representative subset of all flows in order to estimate
   characteristics of the whole set (e.g. mean flow size in the
   network).

5.2.1.  Systematic sampling

   Systematic sampling is a deterministic selection function.
   Systematic sampling may be a periodic selection of the N-th Flow
   Record which arrives at the Exporting or Intermediate Selection
   Process.  Systematic sampling MAY BE applied during the Metering
   Process.  An example would be to create, besides the Flow cache of
   selected flows, an additional data structure that saves the Flow Keys
   of the flows that are not selected.  The selection of a flow would
   then be based on the first packet of a flow.  Everytime a packet
   belonging to a new flow (which is neither in the data structure of
   the selected or not selected flows) arrives at the measurement point,
   a counter is increased.  In case the counter is increased to a
   multiple of N a new flow cache entry is created, and in case the
   counter is not a multiple of N the Flow Key is added to the data
   structure for not selected flows.

   Systematic sampling can also be time-based.  Time-based systematic
   sampling is applied by only creating flows that are observed between
   time-based start and stop triggers.  The time interval may be applied
   at packet level during the Metering Process or after aggregation on
   flow level, e.g. by selecting a flow arriving at the Exporting
   Process every n seconds.

5.2.2.  Random Sampling

   Random flow sampling is based on a random process which requires the
   calculation of random numbers.  One can differentiate between n-out-N



D'Antonio, et al.         Expires May 17, 2012                 [Page 12]


Internet-Draft          Flow Selection Techniques          November 2011


   and probabilistic flow sampling.

5.2.2.1.  n-out-of-N Flow Sampling

   In n-out-of-N Sampling, n elements are selected out of the parent
   population that consists of N elements.  One example would be to
   generate n different random numbers in the range [1,N] and select all
   flows that have a flow position equal to one of the random numbers.

5.2.2.2.  Probabilistic Flow Sampling

   In probabilistic Sampling, the decision whether or not a flow is
   selected is made in accordance with a predefined selection
   probability.  For probabilistic Sampling, the Sample Size can vary
   for different trials.  The selection probability does not necessarily
   have to be the same for each flow.  Therefore, we distinguish between
   uniform probabilistic sampling (with the same selection probability
   for all flows) and non-uniform probabilistic sampling (where the
   selection probability can vary for different flows).  For non-uniform
   probabilistic Flow Sampling the sampling probability may be adjusted
   according to the Flow Record content.  An example would be to
   increase the selection probability of large volume flows over small
   volume flows as described in the Smart Sampling technique [DuLT01].

5.3.  Flow-state Dependent Flow Selection

   Flow-state Dependent Flow Selection can be a deterministic or random
   flow selection process based on the Flow Record content and the flow
   state which may be kept additionally for each of the flows.  External
   processes may update counters, bounds and timers for each of the Flow
   Records and the Flow Selection Process utilises this information for
   the selection decision.  A review of Flow-state Dependent Flow
   Selection techniques that aim at the selection of the most frequent
   items by keeping additional flow state information can be found in
   [CoHa08].  Flow-state Dependent Flow Selection can only be applied
   after packet aggregation, when a packet has been assigned to a flow.
   The selection process then decides based upon the flow state for each
   flow if it is kept in the flow cache or not.  Two Flow State
   Dependent Flow Selection Algorithms are here described:

   The frequent algorithm [KaPS03] is a technique that aims at the
   selection of all flows that at least exceed a 1/k fraction of the
   Observed Packet Stream.  The algorithm has only a flow cache of size
   k-1 and each flow in the cache has an additional counter.  The
   counter is incremented each time a packet belonging to the flow in
   the flow cache is observed.  In case the observed packet does not
   belong to any flow all counters are decremented and if any of the
   flow counters has a value of zero the flow is replaced with a flow



D'Antonio, et al.         Expires May 17, 2012                 [Page 13]


Internet-Draft          Flow Selection Techniques          November 2011


   formed from the new packet.

   Lossy counting is a selection technique that identifies all flows
   whose packet count exceeds a certain percentage of the whole observed
   packet stream (e.g. 5% of all packets) with a certain estimation
   error e.  Lossy counting separates the observed packet stream in
   windows of size N=1/e, where N is an amount of consecutive packets.
   For each observed flow an additional counter will be held in the flow
   state.  The counter is incremented each time a packet belonging to
   the flow is observed and all counters are decremented at the end of
   each window and all flows with a counter of zero are removed from the
   flow cache.

5.4.  Flow-state Dependent Packet Selection

   Flow-state Dependent Packet Selection is not a flow selection
   technique but a packet selection technique.  Nevertheless we will
   describe configuration and reporting parameters for this technique in
   this document.  An example is the "Sample and Hold" algorithm
   [EsVa01] that tries to prefer large volume flows in the selection.
   When a packet arrives it is selected when a Flow Record for this
   packet already exists.  In case there is no Flow Record, the packet
   is selected by a certain probability that is dependent on the packet
   size.


6.  Configuration of Flow Selection Techniques

   This section describes the configuration parameters of the flow
   selection techniques presented above.  It provides the basis for an
   information model to be adopted in order to configure the Flow
   Selection Process within an IPFIX Device.  The actual information
   model with the Information Elements (IEs) for the configuration is
   described together with the reporting IEs in section 7.  The
   following table gives an overview of the defined selection
   techniques, where they can be applied and what their input parameters
   are.  Depending on where the flow selection techniques are applied
   different input parameters can be configured.

   Overview of Flow Selection Techniques:











D'Antonio, et al.         Expires May 17, 2012                 [Page 14]


Internet-Draft          Flow Selection Techniques          November 2011


   +------------------+-----------------+------------------------------+
   | Location         | Selection       | Selection Input              |
   |                  | Method          |                              |
   +------------------+-----------------+------------------------------+
   | During the       | Flow-state      | packet sampling              |
   | Metering Process | Dependent       | probabilities, Flow          |
   | based on Packets | Packet          | Selection State, packet      |
   |                  | Selection       | properties                   |
   +------------------+-----------------+------------------------------+
   |                  | Property Match  | Flow record IEs, Selection   |
   |                  | Flow Filtering  | Interval                     |
   +------------------+-----------------+------------------------------+
   |                  | Hash-based Flow | selection range, Hash        |
   |                  | Filtering       | Function, Flow Key, (seed)   |
   +------------------+-----------------+------------------------------+
   |                  | Time-based      | flow position (derived from  |
   |                  | Systematic Flow | arrival time of packets),    |
   |                  | Sampling        | flow selection state         |
   +------------------+-----------------+------------------------------+
   |                  | Sequence-based  | flow position (derived from  |
   |                  | Systematic Flow | packet position), flow       |
   |                  | Sampling        | selection state              |
   +------------------+-----------------+------------------------------+
   |                  | Random Flow     | random number generator or   |
   |                  | Sampling        | list and packet position,    |
   |                  |                 | flow state                   |
   +------------------+-----------------+------------------------------+
   | Exporting /      | Property Match  | Flow Record content, filter  |
   | Intermediate     | Flow Filtering  | function                     |
   | Selection        |                 |                              |
   | Process          |                 |                              |
   +------------------+-----------------+------------------------------+
   |                  | Hash-based Flow | selection range, Hash        |
   |                  | Filtering       | Function, hash input (Flow   |
   |                  |                 | Keys and other flow          |
   |                  |                 | properties)                  |
   +------------------+-----------------+------------------------------+
   |                  | Flow-state      | flow state parameters,       |
   |                  | Dependent Flow  | random number generator or   |
   |                  | Selection       | list                         |
   +------------------+-----------------+------------------------------+
   |                  | Time-based      | flow arrival time, flow      |
   |                  | Systematic Flow | state                        |
   |                  | Sampling        |                              |
   +------------------+-----------------+------------------------------+
   |                  | Sequence-based  | flow position, flow state    |
   |                  | Systematic Flow |                              |
   |                  | Sampling        |                              |



D'Antonio, et al.         Expires May 17, 2012                 [Page 15]


Internet-Draft          Flow Selection Techniques          November 2011


   |                  | Random Flow     | random number generator or   |
   |                  | Sampling        | list and flow position, flow |
   |                  |                 | state                        |
   +------------------+-----------------+------------------------------+

6.1.  Flow Selection Parameters

   In this section, we define what parameters are required to describe
   the most common Flow Selection techniques.

   Flow Selection Parameters:

   For Property Match Filtering:

   -   Information Element as specified in [iana-ipfix-assignments]):
       Specifies the Information Element which is used as the property
       in the filter expression.

   -   Selection Value or Value Interval:
       Specifies the value or interval of the filter expression.
       Packets and Flow Record that have a value equal to the Selection
       Value or within the Interval will be selected.

   For Hash-based Flow Filtering:

   -   Hash Domain:
       Specifies the bits from the packet or flow which are taken as the
       hash input to the Hash Function.

   -   Hash Function:
       Specifies the name of the Hash Function that is used to calculate
       the hash value.  Possible Hash Functions are BOB, IPSX, CRC-32

   -   Hash Selection Range:
       Flows that have a hash value within the Hash Selection Range are
       selected.  The Hash Selection Range can be a value interval or
       arbitrary hash values within the Hash Range of the Hash Function.

   -   Random Seed or Initializer Value:
       Some Hash Functions require an initializing value.  In order to
       make the selection decision more secure one can choose a random
       seed that configures the hash function.

   For Flow-state Dependent Flow Selection:







D'Antonio, et al.         Expires May 17, 2012                 [Page 16]


Internet-Draft          Flow Selection Techniques          November 2011


   -   frequency threshold:
       Specifies the frequency threshold s for flow state dependent flow
       selection techniques that try to find the most frequent items
       within a dataset.  All flows which exceed the defined threshold
       will be selected.

   -   accuracy parameter:
       specifies the accuracy parameter e for techniques that deal with
       the frequent items problems.  The accuracy parameter defines the
       maximum error, i.e. no flows that have a true frequency less than
       ( s - e) N are selected, where s is the frequency threshold and N
       is the total number of packets.

   The above list of parameters for Flow-state Dependent Flow Selection
   techniques is suitable for the presented frequent item and lossy
   counting algorithms.  Nevertheless a variety of techniques exist with
   very specific parameters which are not defined here.

   For Systematic time-based Flow Sampling:

   -   Interval length (in usec)
       Defines the length of the sampling interval during which flows
       are selected.

   -   Spacing (in usec)
       The spacing parameter defines the spacing in usec between the end
       of one sampling interval and the start of the next succeeding
       interval.

   For Systematic count-based Flow Sampling:

   -   Interval length
       Defines the number of flows that are selected within the sampling
       interval.

   -   Spacing
       The spacing parameter defines the spacing in number of observed
       flows between the end of one sampling interval and the start of
       the next succeeding interval.

   For random n-out-of-N Flow Sampling:

   -   Population Size N
       The Population Size N is the number of all flows in the
       Population from which the sample is drawn.






D'Antonio, et al.         Expires May 17, 2012                 [Page 17]


Internet-Draft          Flow Selection Techniques          November 2011


   -   Sampling Size n
       The sampling size n is the number of flows that are randomly
       drawn from the population N.

   For probabilistic Flow Sampling:

   -   Sampling probability p
       The sampling probability p defines the probability by which each
       of the observed flows is selected.

6.2.  Description of Flow-state Dependent Packet Selection

   The configuration of Flow-state Dependent Packet Selection has not
   been described in [RFC5475] therefore the parameters are defined
   here:

   For Flow-state Dependent Packet Selection:

   -   packet selection probability per possible flow state interval
       Defines multiple {flow interval, packet selection probability}
       value pairs that configure the sampling probability depending on
       the current flow state.

   -   additional parameters
       For the configuration of flow state dependent packet selection
       additional parameters or packet properties may be required, e.g.
       the packet size ([EsVa01])


7.  Information Model for Flow Selection Configuration and Reporting

   In this section we describe Information Elements (IEs) that SHOULD be
   exported by a flow selection process in order to support the
   interpretation of measurement results from flow measurements where
   only some flows are selected.  The information is mainly used to
   report how many packets and flows have been observed in total and how
   many of them were selected.  This helps for instance to calculate the
   Attained Selection Fraction (see also [RFC5476]), which is an
   important parameter to provide an accuracy statement.  The IEs can
   provide reporting information about Flow Records, packets or bytes.
   The reported metrics are total number of elements and the number of
   selected elements.  From this the number of dropped elements can be
   derived.  All counters SHOULD be exported and reset when a new
   measurement interval starts.

   List of Flow Selection Information Elements:





D'Antonio, et al.         Expires May 17, 2012                 [Page 18]


Internet-Draft          Flow Selection Techniques          November 2011


   +------+-------------------------+-------+--------------------------+
   | ID   | Name                    | ID    | Name                     |
   +------+-------------------------+-------+--------------------------+
   | 301  | selectionSequenceID     | 302   | selectorID               |
   +------+-------------------------+-------+--------------------------+
   | TBD1 | FlowSelectorAlgorithm   | 1     | octetDeltaCount          |
   +------+-------------------------+-------+--------------------------+
   | TBD2 | flowSelectedOctetDeltaC | 2     | PacketDeltaCount         |
   |      | ount                    |       |                          |
   +------+-------------------------+-------+--------------------------+
   | TBD3 | flowSelectedPacketDelta | 3     | originalFlowsPresent     |
   |      | Count                   |       |                          |
   +------+-------------------------+-------+--------------------------+
   | TBD4 | flowSelectedFlowDeltaCo | TBD5  | selectorIDTotalFlowsObse |
   |      | unt                     |       | rved                     |
   +------+-------------------------+-------+--------------------------+
   | TBD6 | selectorIDTotalFlowsSel | TBD7  | samplingFlowInterval     |
   |      | ected                   |       |                          |
   +------+-------------------------+-------+--------------------------+
   | TBD8 | samplingFlowSpace       | 309   | samplingSize             |
   +------+-------------------------+-------+--------------------------+
   | 310  | samplingPopulation      | 311   | samplingProbability      |
   +------+-------------------------+-------+--------------------------+
   | TBD9 | flowSamplingTimeInterva | TBD10 | flowSamplingTimeSpace    |
   |      | l                       |       |                          |
   +------+-------------------------+-------+--------------------------+
   | 326  | digestHashValue         | TBD11 | hashFlowOffset           |
   +------+-------------------------+-------+--------------------------+
   | TBD1 | hashFlowSize            | 329   | hashOutputRangeMin       |
   | 2    |                         |       |                          |
   +------+-------------------------+-------+--------------------------+
   | 330  | hashOutputRangeMax      | 331   | hashSelectedRangeMin     |
   +------+-------------------------+-------+--------------------------+
   | 332  | hashSelectedRangeMax    | 333   | hashDigestOutput         |
   +------+-------------------------+-------+--------------------------+
   | 334  | hashInitialiserValue    | 320   | absoluteError            |
   +------+-------------------------+-------+--------------------------+
   | 321  | relativeError           | 336   | upperCILimit             |
   +------+-------------------------+-------+--------------------------+
   | 337  | lowerCILimit            | 338   | confidenceLevel          |
   +------+-------------------------+-------+--------------------------+

7.1.  FlowSelectorAlgorithm

   Description:

      This Information Element identifies the flow selection
      method(e.g., Filtering, Sampling) that is applied by the Flow



D'Antonio, et al.         Expires May 17, 2012                 [Page 19]


Internet-Draft          Flow Selection Techniques          November 2011


      Selection Process.  Most of these methods have parameters as
      decribed in Section 6.  Further Information Elements are needed to
      fully specify packet selection with these methods and all their
      parameters.  Further method identifiers may be added to the list
      below.  It might be necessary to define new Information Elements
      to specify their parameters.  The flowSelectorAlgorithm registry
      is maintained by IANA.  New assignments for the registry will be
      administered by IANA and are subject to Expert Review [RFC5226].
      The registry can be updated when specifications of the new
      method(s) and any new Information Elements are provided.


   +----+------------------------+--------------------------+
   | ID |        Method          |      Parameters          |
   +----+------------------------+--------------------------+
   | 1  | Systematic count-based | flowSamplingInterval     |
   |    | Sampling               | flowSamplingSpace        |
   +----+------------------------+--------------------------+
   | 2  | Systematic time-based  | flowSamplingTimeInterval |
   |    | Sampling               | flowSamplingTimeSpace    |
   +----+------------------------+--------------------------+
   | 3  | Random n-out-of-N      | samplingSize             |
   |    | Sampling               | samplingPopulation       |
   +----+------------------------+--------------------------+
   | 4  | Uniform probabilistic  | samplingProbability      |
   |    | Sampling               |                          |
   +----+------------------------+--------------------------+
   | 5  | Property Match         | Information Element      |
   |    | Filtering              | Value Range              |
   +----+------------------------+--------------------------+
   |   Hash-based Filtering      | hashInitialiserValue     |
   +----+------------------------+ hashFlowDomain           |
   | 6  | using BOB              | hashSelectedRangeMin     |
   +----+------------------------+ hashSelectedRangeMax     |
   | 7  | using IPSX             | hashOutputRangeMin       |
   +----+------------------------+ hashOutputRangeMax       |
   | 8  | using CRC              |                          |
   +----+------------------------+--------------------------+
   | 9  | Flow State Dependent   | No agreed Parameters     |
   |    | Flow Selection         |                          |
   +----+------------------------+--------------------------+

   Abstract Data Type: unsigned16

   ElementId: TBD1

   Data Type Semantics: identifier




D'Antonio, et al.         Expires May 17, 2012                 [Page 20]


Internet-Draft          Flow Selection Techniques          November 2011


   Status: Proposed

7.2.  flowSelectedOctetDeltaCount

   Description:

      This Information Element specifies the volume in octets of all
      flows that are selected during the Flow Selection Process since
      the previous report.

   Abstract Data Type: unsigned64

   ElementId: TBD2

   Units: Octets

   Status: Proposed

7.3.  flowSelectedPacketDeltaCount

   Description:

      This Information Element specifies the volume in packets of all
      flows that were selected during the Flow Selection Process since
      the previous report.

   Abstract Data Type: unsigned64

   ElementId: TBD3

   Units: Packets

   Status: Proposed

7.4.  flowSelectedFlowDeltaCount

   Description:

      This Information Element specifies the number of Flows that were
      selected during the Flow Selection Process since the last report.

   Abstract Data Type: unsigned64

   ElementId: TBD4

   Units: Flows

   Status: Proposed



D'Antonio, et al.         Expires May 17, 2012                 [Page 21]


Internet-Draft          Flow Selection Techniques          November 2011


7.5.  selectorIDTotalFlowsObserved

   Description:

      This Information Element specifies the total number of flows
      observed by a Selector, for a specific value of SelectorId.  This
      Information Element should be used in an Options Template scoped
      to the observation to which it refers.  See Section 3.4.2.1 of the
      IPFIX protocol document [RFC5101] .

   Abstract Data Type: unsigned64

   ElementId: TBD5

   Units: Flows

   Status: Proposed

7.6.  selectorIDTotalFlowsSelected

   Description:

      This Information Element specifies the total number of flows
      selected by a Selector, for a specific value of SelectorId.  This
      Information Element should be used in an Options Template scoped
      to the observation to which it refers.  See Section 3.4.2.1 of the
      IPFIX protocol document [RFC5101].

   Abstract Data Type: unsigned64

   ElementId: TBD6

   Units: Flows

   Status: Proposed

7.7.  samplingFlowInterval

   Description:

      This Information Element specifies the number of flows that are
      consecutively sampled.  A value of 100 means that 100 consecutive
      flows are sampled.  For example, this Information Element may be
      used to describe the configuration of a systematic count-based
      Sampling Selector.

   Abstract Data Type: unsigned32




D'Antonio, et al.         Expires May 17, 2012                 [Page 22]


Internet-Draft          Flow Selection Techniques          November 2011


   ElementId: TBD7

   Units: Flows

   Status: Proposed

7.8.  samplingFlowSpace

   Description:

      This Information Element specifies the number of flows between two
      "samplingFlowInterval"s.  A value of 100 means that the next
      interval starts 100 flows (which are not sampled) after the
      current "samplingFlowInterval" is over.  For example, this
      Information Element may be used to describe the configuration of a
      systematic count-based Sampling Selector.

   Abstract Data Type: unsigned32

   ElementId: TBD8

   Units: Flows

   Status: Proposed

7.9.  flowSamplingTimeInterval

   Description:

      This Information Element specifies the time interval in
      microseconds during which all arriving flows are sampled.  For
      example, this Information Element may be used to describe the
      configuration of a systematic time-based Sampling Selector.

   Abstract Data Type: unsigned32

   ElementId: TBD9

   Units: microseconds

   Status: Proposed

7.10.  flowSamplingTimeSpace

   Description:

      This Information Element specifies the time interval in
      microseconds between two "flowSamplingTimeInterval"s.  A value of



D'Antonio, et al.         Expires May 17, 2012                 [Page 23]


Internet-Draft          Flow Selection Techniques          November 2011


      100 means that the next interval starts 100 microseconds (during
      which no flows are sampled) after the current
      "flowsamplingTimeInterval" is over.  For example, this Information
      Element may used to describe the configuration of a systematic
      time-based Sampling Selector.

   Abstract Data Type: unsigned32

   ElementId: TBD10

   Units: microseconds

   Status: Proposed

7.11.  hashFlowDomain

   Description:

      This Information Element specifies the Information Elements that
      are used by the Hash-based flow Selection Selector as the Hash
      Domain.

   Abstract Data Type: unsigned16

   ElementId: TBD11

   Data Type Semantics: identifier

   Status: Proposed


8.  IANA Considerations

8.1.  Registration of Information Elements

   IANA will register the following IEs in the IPFIX Information
   Elements registry at http://www.iana.org/assignments/ipfix/ipfix.xml:














D'Antonio, et al.         Expires May 17, 2012                 [Page 24]


Internet-Draft          Flow Selection Techniques          November 2011


   +-----+----------------+--------+---------+-------+-----------------+
   | Val | Name           | Data   | Data    | Statu | Description     |
   | ue  |                | Type   | Type    | s     |                 |
   |     |                |        | Semanti |       |                 |
   |     |                |        | cs      |       |                 |
   +-----+----------------+--------+---------+-------+-----------------+
   | 1   | FlowSelectorAl | unsign | identif | Propo | This            |
   |     | gorithm        | ed16   | ier     | sed   | Information     |
   |     |                |        |         |       | Element         |
   |     |                |        |         |       | identifies the  |
   |     |                |        |         |       | flow selection  |
   |     |                |        |         |       | method(e.g.,    |
   |     |                |        |         |       | Filtering,      |
   |     |                |        |         |       | Sampling) that  |
   |     |                |        |         |       | is applied by   |
   |     |                |        |         |       | the Flow        |
   |     |                |        |         |       | Selection       |
   |     |                |        |         |       | Process         |
   +-----+----------------+--------+---------+-------+-----------------+
   | 2   | FlowSelectedOc | unsign | Octets  | Propo | This            |
   |     | tetDeltaCount  | ed64   |         | sed   | Information     |
   |     |                |        |         |       | Element         |
   |     |                |        |         |       | specifies the   |
   |     |                |        |         |       | volume in       |
   |     |                |        |         |       | octets of all   |
   |     |                |        |         |       | flows that are  |
   |     |                |        |         |       | selected during |
   |     |                |        |         |       | the Flow        |
   |     |                |        |         |       | Selection       |
   |     |                |        |         |       | Process since   |
   |     |                |        |         |       | the previous    |
   |     |                |        |         |       | report.         |
   +-----+----------------+--------+---------+-------+-----------------+
   | 3   | flowSelectedPa | unsign | Packets | Propo | This            |
   |     | cketDeltaCount | ed64   |         | sed   | Information     |
   |     |                |        |         |       | Element         |
   |     |                |        |         |       | specifies the   |
   |     |                |        |         |       | volume in       |
   |     |                |        |         |       | packets of all  |
   |     |                |        |         |       | flows that were |
   |     |                |        |         |       | selected during |
   |     |                |        |         |       | the Flow        |
   |     |                |        |         |       | Selection       |
   |     |                |        |         |       | Process since   |
   |     |                |        |         |       | the previous    |
   |     |                |        |         |       | report.         |
   +-----+----------------+--------+---------+-------+-----------------+




D'Antonio, et al.         Expires May 17, 2012                 [Page 25]


Internet-Draft          Flow Selection Techniques          November 2011


   +-----+----------------+--------+---------+-------+-----------------+
   | 4   | flowSelectedFl | unsign | Flows   | Propo | This            |
   |     | owDeltaCount   | ed64   |         | sed   | Information     |
   |     |                |        |         |       | Element         |
   |     |                |        |         |       | specifies the   |
   |     |                |        |         |       | number of Flows |
   |     |                |        |         |       | that were       |
   |     |                |        |         |       | selected during |
   |     |                |        |         |       | the Flow        |
   |     |                |        |         |       | Selection       |
   |     |                |        |         |       | Process since   |
   |     |                |        |         |       | the last        |
   |     |                |        |         |       | report.         |
   +-----+----------------+--------+---------+-------+-----------------+
   | 5   | selectorIDTota | unsign | Flows   | Propo | This            |
   |     | lFlowsObserved | ed64   |         | sed   | Information     |
   |     |                |        |         |       | Element         |
   |     |                |        |         |       | specifies the   |
   |     |                |        |         |       | total number of |
   |     |                |        |         |       | flows observed  |
   |     |                |        |         |       | by a Selector,  |
   |     |                |        |         |       | for a specific  |
   |     |                |        |         |       | value of        |
   |     |                |        |         |       | SelectorId.     |
   |     |                |        |         |       | This            |
   |     |                |        |         |       | Information     |
   |     |                |        |         |       | Element should  |
   |     |                |        |         |       | be used in an   |
   |     |                |        |         |       | Options         |
   |     |                |        |         |       | Template scoped |
   |     |                |        |         |       | to the          |
   |     |                |        |         |       | observation to  |
   |     |                |        |         |       | which it        |
   |     |                |        |         |       | refers.  See    |
   |     |                |        |         |       | Section 3.4.2.1 |
   |     |                |        |         |       | of the IPFIX    |
   |     |                |        |         |       | protocol        |
   |     |                |        |         |       | document        |
   |     |                |        |         |       | [RFC5101]       |
   +-----+----------------+--------+---------+-------+-----------------+











D'Antonio, et al.         Expires May 17, 2012                 [Page 26]


Internet-Draft          Flow Selection Techniques          November 2011


   +-----+----------------+--------+---------+-------+-----------------+
   | 6   | selectorIDTota | unsign | Flows   | Propo | This            |
   |     | lFlowsSelected | ed64   |         | sed   | Information     |
   |     |                |        |         |       | Element         |
   |     |                |        |         |       | specifies the   |
   |     |                |        |         |       | total number of |
   |     |                |        |         |       | flows selected  |
   |     |                |        |         |       | by a Selector,  |
   |     |                |        |         |       | for a specific  |
   |     |                |        |         |       | value of        |
   |     |                |        |         |       | SelectorId.     |
   |     |                |        |         |       | This            |
   |     |                |        |         |       | Information     |
   |     |                |        |         |       | Element should  |
   |     |                |        |         |       | be used in an   |
   |     |                |        |         |       | Options         |
   |     |                |        |         |       | Template scoped |
   |     |                |        |         |       | to the          |
   |     |                |        |         |       | observation to  |
   |     |                |        |         |       | which it        |
   |     |                |        |         |       | refers.  See    |
   |     |                |        |         |       | Section 3.4.2.1 |
   |     |                |        |         |       | of the IPFIX    |
   |     |                |        |         |       | protocol        |
   |     |                |        |         |       | document        |
   |     |                |        |         |       | [RFC5101].      |
   +-----+----------------+--------+---------+-------+-----------------+
























D'Antonio, et al.         Expires May 17, 2012                 [Page 27]


Internet-Draft          Flow Selection Techniques          November 2011


   +-----+----------------+--------+---------+-------+-----------------+
   | 7   | samplingFlowIn | unsign | Flows   | Propo | This            |
   |     | terval         | ed32   |         | sed   | Information     |
   |     |                |        |         |       | Element         |
   |     |                |        |         |       | specifies the   |
   |     |                |        |         |       | number of flows |
   |     |                |        |         |       | that are        |
   |     |                |        |         |       | consecutively   |
   |     |                |        |         |       | sampled.  A     |
   |     |                |        |         |       | value of 100    |
   |     |                |        |         |       | means that 100  |
   |     |                |        |         |       | consecutive     |
   |     |                |        |         |       | flows are       |
   |     |                |        |         |       | sampled.  For   |
   |     |                |        |         |       | example, this   |
   |     |                |        |         |       | Information     |
   |     |                |        |         |       | Element may be  |
   |     |                |        |         |       | used to         |
   |     |                |        |         |       | describe the    |
   |     |                |        |         |       | configuration   |
   |     |                |        |         |       | of a systematic |
   |     |                |        |         |       | count-based     |
   |     |                |        |         |       | Sampling        |
   |     |                |        |         |       | Selector.       |
   +-----+----------------+--------+---------+-------+-----------------+


























D'Antonio, et al.         Expires May 17, 2012                 [Page 28]


Internet-Draft          Flow Selection Techniques          November 2011


   +-----+----------------+--------+---------+-------+-----------------+
   | 8   | samplingFlowSp | unsign | Flows   | Propo | This            |
   |     | ace            | ed32   |         | sed   | Information     |
   |     |                |        |         |       | Element         |
   |     |                |        |         |       | specifies the   |
   |     |                |        |         |       | number of flows |
   |     |                |        |         |       | between two     |
   |     |                |        |         |       | "samplingFlowIn |
   |     |                |        |         |       | terval"s.  A    |
   |     |                |        |         |       |  value of 100   |
   |     |                |        |         |       |  means that the |
   |     |                |        |         |       |  next interval  |
   |     |                |        |         |       |  starts 100     |
   |     |                |        |         |       |  flows (which   |
   |     |                |        |         |       |  are not        |
   |     |                |        |         |       |  sampled) after |
   |     |                |        |         |       |  the current    |
   |     |                |        |         |       |  "samplingFlowI |
   |     |                |        |         |       | nterval" is ove |
   |     |                |        |         |       | r.For example,  |
   |     |                |        |         |       |   this          |
   |     |                |        |         |       |   Information   |
   |     |                |        |         |       |   Element may b |
   |     |                |        |         |       | e used to       |
   |     |                |        |         |       |   describe the  |
   |     |                |        |         |       |   configuration |
   |     |                |        |         |       |   of a systemat |
   |     |                |        |         |       | iccount-based   |
   |     |                |        |         |       |   Sampling      |
   |     |                |        |         |       |   Selector.     |
   +-----+----------------+--------+---------+-------+-----------------+




















D'Antonio, et al.         Expires May 17, 2012                 [Page 29]


Internet-Draft          Flow Selection Techniques          November 2011


   +-----+----------------+--------+---------+-------+-----------------+
   | 9   | flowSamplingTi | unsign | microse | Propo | This            |
   |     | meInterval     | ed32   | conds   | sed   | Information     |
   |     |                |        |         |       | Element         |
   |     |                |        |         |       | specifies the   |
   |     |                |        |         |       | time interval   |
   |     |                |        |         |       | in microseconds |
   |     |                |        |         |       | during which    |
   |     |                |        |         |       | all arriving    |
   |     |                |        |         |       | flows are       |
   |     |                |        |         |       | sampled.  For   |
   |     |                |        |         |       | example, this   |
   |     |                |        |         |       | Information     |
   |     |                |        |         |       | Element may be  |
   |     |                |        |         |       | used to         |
   |     |                |        |         |       | describe the    |
   |     |                |        |         |       | configuration   |
   |     |                |        |         |       | of a systematic |
   |     |                |        |         |       | time-based      |
   |     |                |        |         |       | Sampling        |
   |     |                |        |         |       | Selector.       |
   +-----+----------------+--------+---------+-------+-----------------+





























D'Antonio, et al.         Expires May 17, 2012                 [Page 30]


Internet-Draft          Flow Selection Techniques          November 2011


   +-----+----------------+--------+---------+-------+-----------------+
   | 10  | flowSamplingTi | unsign | microse | Propo | This            |
   |     | meSpace        | ed32   | conds   | sed   | Information     |
   |     |                |        |         |       | Element         |
   |     |                |        |         |       | specifies the   |
   |     |                |        |         |       | time interval   |
   |     |                |        |         |       | in microseconds |
   |     |                |        |         |       | between two     |
   |     |                |        |         |       | "flowSamplingTi |
   |     |                |        |         |       | meInterval"s.   |
   |     |                |        |         |       | Avalue of 100   |
   |     |                |        |         |       |  means that the |
   |     |                |        |         |       |  next interval  |
   |     |                |        |         |       |  starts 100     |
   |     |                |        |         |       |  microseconds   |
   |     |                |        |         |       |  (during which  |
   |     |                |        |         |       |  no flows are   |
   |     |                |        |         |       |  sampled) after |
   |     |                |        |         |       |  the current    |
   |     |                |        |         |       |  "flowsamplingT |
   |     |                |        |         |       | imeInterval" is |
   |     |                |        |         |       |   over.  For    |
   |     |                |        |         |       |   example, this |
   |     |                |        |         |       |   Information   |
   |     |                |        |         |       |   Element may   |
   |     |                |        |         |       |   used to       |
   |     |                |        |         |       |   describe the  |
   |     |                |        |         |       |   configuration |
   |     |                |        |         |       |   of a systemat |
   |     |                |        |         |       | ictime-based    |
   |     |                |        |         |       |   Sampling      |
   |     |                |        |         |       |   Selector.     |
   +-----+----------------+--------+---------+-------+-----------------+
   | 11  | hashFlowDomain | unsign | identif | Propo | This            |
   |     |                | ed16   | ier     | sed   | Information     |
   |     |                |        |         |       | Element         |
   |     |                |        |         |       | specifies the   |
   |     |                |        |         |       | Information     |
   |     |                |        |         |       | Elements that   |
   |     |                |        |         |       | are used by the |
   |     |                |        |         |       | Hash-based flow |
   |     |                |        |         |       | Selection       |
   |     |                |        |         |       | Selector as the |
   |     |                |        |         |       | Hash Domain.    |
   +-----+----------------+--------+---------+-------+-----------------+






D'Antonio, et al.         Expires May 17, 2012                 [Page 31]


Internet-Draft          Flow Selection Techniques          November 2011


8.2.  Registration of Object Identifier

   IANA will register the following OID in the IPFIX-SELECTOR-MIB
   Functions sub-registry at http://www.iana.org/assignments/smi-numbers
   according to the procedures set forth in [I-D.dkcm-ipfix-rfc5815bis]

   +---------+-----------------------+---------------------+-----------+
   | Decimal | Name                  | Description         | Reference |
   +---------+-----------------------+---------------------+-----------+
   | 1       | FlowSelectorAlgorithm | This Object         | [RFCyyyy] |
   |         |                       | Identifier          |           |
   |         |                       | identifies the flow |           |
   |         |                       | selection           |           |
   |         |                       | method(e.g.,        |           |
   |         |                       | Filtering,          |           |
   |         |                       | Sampling) that is   |           |
   |         |                       | applied by the Flow |           |
   |         |                       | Selection Process   |           |
   +---------+-----------------------+---------------------+-----------+

   Editor's Note (to be removed prior to publication): the RFC editor is
   asked to replace "yyyy" in this document by the number of the RFC
   when the assignment has been made.


9.  Security Considerations

   The described flow sampling techniques and the hash-based flow
   filtering technique aim at the selection of a representative subset
   in order to make an accurate estimation of the population.  An
   adversary may have incentives to influence the selection of his
   flows, for example to circumvent accounting.

   Security considerations concerning the choice of a Hash Function for
   Hash-based Packet Selection have been discussed in Section 6.2.3 of
   [RFC5475] and are also appropiate for Hash-Based Flow Selection.
   This section discussed a number of potential attacks to craft Streams
   that are disproportionately detected and/or discover the Hash
   Function parameters, the vulnerabilities of different Hash Functions
   to these attacks, and practices to minimize these vulnerabilities.

   For other sampling approaches a user can gain knowledge about the
   start and stop triggers in time-based systematic Sampling, e.g., by
   sending test packets.  This knowledge might allow users to modify
   their send schedule in a way that their packets are
   disproportionately selected or not selected.  For random Sampling, a
   cryptographically strong random number generator should be used in
   order to prevent that an advisory can predict the selection decision



D'Antonio, et al.         Expires May 17, 2012                 [Page 32]


Internet-Draft          Flow Selection Techniques          November 2011


   [GoRe07].

   Further security threats can occur when Sampling parameters are
   configured or communicated to other entities.  The protocol(s) for
   the configuration and reporting of Sampling parameters are out of
   scope of this document.  Therefore, the security threats that
   originate from this kind of communication cannot be assessed with the
   information given in this document.  Some of these threats can
   probably be addressed by keeping configuration information
   confidential and by authenticating entities that configure Sampling.
   Nevertheless, a full analysis and assessment of threats for
   configuration and reporting has to be done if configuration or
   reporting methods are proposed.


10.  Acknowledgments

   We would like to thank the IPFIX group, especially Brian Trammell,
   Paul Aitken and Benoit Claise for fruitful discussions and for
   proofreading the document.


11.  References

11.1.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

11.2.  Informative References

   [CoHa08]   Cormode, G. and M. Hadjieleftheriou, "Finding frequent
              items in data streams", Journal, Proceedings of the Very
              Large DataBase Endowment VLDB Endowment, Volume 1 Issue 2,
              August 2008, August 2008.

   [DuLT01]   Duffield, N., Lund, C., and M. Thorup, "Charging from
              Sampled Network Usage", ACM Internet Measurement Workshop
              IMW 2001, San Francisco, USA, November 2001.

   [EsVa01]   Estan, C. and G,. Varghese, "New Directions in Traffic
              Measurement and Accounting: Focusing on the Elephants,
              Ignoring the Mice", ACM SIGCOMM Internet Measurement
              Workshop 2001, San Francisco (CA), November 2001.

   [KaPS03]   Karp, R., Papadimitriou, C., and S. S. Shenker, "A simple
              algorithm for finding frequent elements in sets and
              bags.", ACM Transactions on Database Systems, Volume 28,



D'Antonio, et al.         Expires May 17, 2012                 [Page 33]


Internet-Draft          Flow Selection Techniques          November 2011


              51-55, 2003, March 2003.

   [MSZC10]   Mai, J., Sridharan, A., Zang, H., and C. Chuah, "Fast
              Filtered Sampling", Computer Networks Volume 54, Issue 11,
              Pages 1885-1898, ISSN 1389-1286, January 2010.

   [MaMo02]   Manku, G. and R. Motwani, "Approximate Frequency Counts
              over Data Streams", Proceedings of the International
              Conference on Very large DataBases (VLDB) pages 346--357,
              2002, Hong Kong, China, 2002.

   [RFC3917]  Quittek, J., Zseby, T., Claise, B., and S. Zander,
              "Requirements for IP Flow Information Export (IPFIX)",
              RFC 3917, October 2004.

   [RFC5101]  Claise, B., "Specification of the IP Flow Information
              Export (IPFIX) Protocol for the Exchange of IP Traffic
              Flow Information", RFC 5101, January 2008.

   [RFC5102]  Quittek, J., Bryant, S., Claise, B., Aitken, P., and J.
              Meyer, "Information Model for IP Flow Information Export",
              RFC 5102, January 2008.

   [RFC5470]  Sadasivan, G., Brownlee, N., Claise, B., and J. Quittek,
              "Architecture for IP Flow Information Export", RFC 5470,
              March 2009.

   [RFC5475]  Zseby, T., Molina, M., Duffield, N., Niccolini, S., and F.
              Raspall, "Sampling and Filtering Techniques for IP Packet
              Selection", RFC 5475, March 2009.

   [RFC5476]  Claise, B., Johnson, A., and J. Quittek, "Packet Sampling
              (PSAMP) Protocol Specifications", RFC 5476, March 2009.

   [RFC6183]  Kobayashi, A., Claise, B., Muenz, G., and K. Ishibashi,
              "IP Flow Information Export (IPFIX) Mediation: Framework",
              RFC 6183, April 2011.

   [iana-ipfix-assignments]
              "IP Flow Information Export Information Elements", 2007,
              <http://www.iana.org/assignments/ipfix/ipfix.xml>.










D'Antonio, et al.         Expires May 17, 2012                 [Page 34]


Internet-Draft          Flow Selection Techniques          November 2011


Authors' Addresses

   Salvatore D'Antonio
   University of Napoli "Parthenope"
   Centro Direzionale di Napoli Is. C4
   Naples  80143
   Italy

   Phone: +39 081 5476766
   Email: salvatore.dantonio@uniparthenope.it


   Tanja Zseby
   Fraunhofer Institute FOKUS
   Kaiserin-Augusta-Allee 31
   Berlin  10589
   Germany

   Phone: +49 30 3463 7153
   Email: tanja.zseby@fokus.fraunhofer.de


   Christian Henke
   Technische Universitat Berlin
   Strasse des 17. Juni 135
   Berlin  10623
   Germany

   Phone: +49 30 3463 7366
   Email: c.henke@tu-berlin.de


   Lorenzo Peluso
   University of Napoli
   Via Claudio 21
   Napoli  80125
   Italy

   Phone: +39 081 7683821
   Email: lorenzo.peluso@unina.it











D'Antonio, et al.         Expires May 17, 2012                 [Page 35]