RTFM: New Attributes for Traffic Flow Measurement
RFC 2724

Document Type RFC - Experimental (October 1999; No errata)
Last updated 2013-03-02
Stream IETF
Formats plain text pdf html bibtex
Stream WG state (None)
Document shepherd No shepherd assigned
IESG IESG state RFC 2724 (Experimental)
Consensus Boilerplate Unknown
Telechat date
Responsible AD (None)
Send notices to (None)
Network Working Group                                       S. Handelman
Request for Comments: 2724                                    S. Stibler
Category: Experimental                                               IBM
                                                             N. Brownlee
                                              The University of Auckland
                                                                 G. Ruth
                                                     GTE Internetworking
                                                            October 1999

           RTFM: New Attributes for Traffic Flow Measurement

Status of this Memo

   This memo defines an Experimental Protocol for the Internet
   community.  It does not specify an Internet standard of any kind.
   Discussion and suggestions for improvement are requested.
   Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1999).  All Rights Reserved.

Abstract

   The RTFM Traffic Measurement Architecture provides a general
   framework for describing and measuring network traffic flows.  Flows
   are defined in terms of their Address Attribute values and measured
   by a 'Traffic Meter'.  This document discusses RTFM flows and the
   attributes which they can have, so as to provide a logical framework
   for extending the architecture by adding new attributes.

   Extensions described include Address Attributes such as DSCodePoint,
   SourceASN and DestASN, and Group Attributes such as short-term bit
   rates and turnaround times.  Quality of Service parameters for
   Integrated Services are also discussed.

Table of Contents

   1  Introduction .  . . . . . . . . . . . . . . . . . . . . . . . . 2
      1.1 RTFM's Definition of Flows  . . . . . . . . . . . . . . . . 3
      1.2 RTFM's Current Definition of Flows and their Attributes . . 3
      1.3 RTFM Flows, Integrated Services, IPPM and Research in Flows 4
   2  Flow Abstractions . . . . . . . . . . . . . . . . . . . . . . . 5
      2.1 Meter Readers and Meters  . . . . . . . . . . . . . . . . . 5
      2.2 Attribute Types . . . . . . . . . . . . . . . . . . . . . . 6
      2.3 Packet Traces . . . . . . . . . . . . . . . . . . . . . . . 7
      2.4 Aggregate Attributes  . . . . . . . . . . . . . . . . . . . 8

Handelman, et al.             Experimental                      [Page 1]
RFC 2724                  RTFM: New Attributes              October 1999

      2.5 Group Attributes  . . . . . . . . . . . . . . . . . . . . . 8
      2.6 Actions on Exceptions . . . . . . . . . . . . . . . . . . .10
   3  Extensions to the 'Basic' RTFM Meter  . . . . . . . . . . . . .10
      3.1 Flow table extensions . . . . . . . . . . . . . . . . . . .10
      3.2 Specifying Distributions in RuleSets  . . . . . . . . . . .11
      3.3 Reading Distributions . . . . . . . . . . . . . . . . . . .13
   4  Extensions to the Rules Table, Attribute Numbers  . . . . . . .13
   5  Security Considerations . . . . . . . . . . . . . . . . . . . .15
   6  References  . . . . . . . . . . . . . . . . . . . . . . . . . .16
   7  Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . .17
   8  Full Copyright Statement  . . . . . . . . . . . . . . . . . . .18

1  Introduction

   The Real-Time Flow Measurement (RTFM) Working Group (WG) has
   developed a system for measuring and reporting information about
   traffic flows in the Internet.  This document explores the definition
   of extensions to the flow measurements as currently defined in
   [RTFM-ARC]. The new attributes described in this document will be
   useful for monitoring network performance and will expand the scope
   of RTFM beyond simple measurement of traffic volumes.  A companion
   document to this memo will be written to define MIB structures for
   the new attributes.

   This memo was started in 1996 to advance the work of the RTFM group.
   The goal of this work is to produce a simple set of abstractions,
   which can be easily implemented and at the same time enhance the
   value of RTFM Meters.  This document also defines a method for
   organizing the flow abstractions to augment the existing RTFM flow
   table.

   Implementations of the RTFM Meter have been done by Nevil Brownlee in
   the University of Auckland, NZ, and Stephen Stibler and Sig Handelman
   at IBM in Hawthorne, NY, USA. The RTFM WG has also defined the role
   of the Meter Reader whose role is to retrieve flow data from the
   Meter.

   Note on flows and positioning of meters:

      A flow as it traverses the Internet may have some of its
      characteristics altered as it travels through Routers, Switches,
      and other network units.  It is important to note the spatial
      location of the Meter when referring to attributes of a flow.  An
      example, a server may send a sequence of packets with a definite
      order, and inter packet timing with a leaky bucket algorithm.  A
      meter reading downstream of the leaky bucket would record a set
Show full document text