datatracker.ietf.org
Sign in
Version 5.4.0, 2014-04-22
Report a bug

Evaluation of Candidate Protocols for IP Flow Information Export (IPFIX)
RFC 3955

Document type: RFC - Informational (October 2004)
Document stream: IETF
Last updated: 2013-03-02
Other versions: plain text, pdf, html

IETF State: (None)
Consensus: Unknown
Document shepherd: No shepherd assigned

IESG State: RFC 3955 (Informational)
Responsible AD: Bert Wijnen
Send notices to: <simon@switch.ch>, <plonka@doit.wisc.edu>, <n.brownlee@auckland.ac.nz>

Network Working Group                                          S. Leinen
Request for Comments: 3955                                        SWITCH
Category: Informational                                     October 2004

                 Evaluation of Candidate Protocols for
                   IP Flow Information Export (IPFIX)

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2004).

Abstract

   This document contains an evaluation of the five candidate protocols
   for an IP Flow Information Export (IPFIX) protocol, based on the
   requirements document produced by the IPFIX Working Group.  The
   protocols are characterized and grouped in broad categories, and
   evaluated against specific requirements.  Finally, a recommendation
   is made to select the NetFlow v9 protocol as the basis for the IPFIX
   specification.

Table of Contents

   1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . .   2
   2. Protocol Summaries . . . . . . . . . . . . . . . . . . . . . .   2
      2.1.  CRANE. . . . . . . . . . . . . . . . . . . . . . . . . .   3
      2.2.  Diameter . . . . . . . . . . . . . . . . . . . . . . . .   4
      2.3.  LFAP . . . . . . . . . . . . . . . . . . . . . . . . . .   4
      2.4.  NetFlow v9 . . . . . . . . . . . . . . . . . . . . . . .   5
      2.5.  Streaming IPDR . . . . . . . . . . . . . . . . . . . . .   6
   3. Broad Classification of Candidate Protocols .  . . . . . . . .   7
      3.1.  Design Goals . . . . . . . . . . . . . . . . . . . . . .   7
      3.2.  Data Representation. . . . . . . . . . . . . . . . . . .   8
      3.3.  Protocol Flow. . . . . . . . . . . . . . . . . . . . . .   9
   4. Item-Level Compliance Evaluation . . . . . . . . . . . . . . .  10
      4.1.  Meter Reliability (5.1). . . . . . . . . . . . . . . . .  10
      4.2.  Sampling (5.2) . . . . . . . . . . . . . . . . . . . . .  11
      4.3.  Overload Behavior (5.3). . . . . . . . . . . . . . . . .  12
      4.4.  Timestamps (5.4) . . . . . . . . . . . . . . . . . . . .  12
      4.5.  Time Synchronization (5.5) . . . . . . . . . . . . . . .  12
      4.6.  Flow Expiration (5.6). . . . . . . . . . . . . . . . . .  13

Leinen                       Informational                      [Page 1]
RFC 3955      Evaluation of Candidate Protocols for IPFIX   October 2004

      4.7.  Ignore Port Copy (5.9) . . . . . . . . . . . . . . . . .  13
      4.8.  Information Model (6.1). . . . . . . . . . . . . . . . .  13
      4.9.  Data Model (6.2) . . . . . . . . . . . . . . . . . . . .  13
      4.10. Data Transfer (6.3). . . . . . . . . . . . . . . . . . .  14
   5. Conclusions. . . . . . . . . . . . . . . . . . . . . . . . . .  18
      5.1.  Recommendation . . . . . . . . . . . . . . . . . . . . .  19
   6. Security Considerations. . . . . . . . . . . . . . . . . . . .  19
   7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . .  19
   8. References . . . . . . . . . . . . . . . . . . . . . . . . . .  20
      8.1.  Normative References . . . . . . . . . . . . . . . . . .  20
      8.2.  Informative References . . . . . . . . . . . . . . . . .  20
   Appendix.  A Note on References to the Candidate Protocol
              Documents. . . . . . . . . . . . . . . . . . . . . . .  22
   Author's Address. . . . . . . . . . . . . . . . . . . . . . . . .  22
   Full Copyright Statement. . . . . . . . . . . . . . . . . . . . .  23

1.  Introduction

   The IP Flow Information Export (IPFIX) Working Group has been
   chartered to select a protocol for the export of flow information
   from traffic-observing devices (such as routers or dedicated probes).
   To this end, an evaluation team was formed to evaluate submitted
   protocols.  Each protocol was represented by an advocate, who
   submitted a specific evaluation document for the respective protocol
   against the requirements document [1].  The specification of each
   protocol was itself available as one or several Internet-Drafts,
   sometimes referring normatively to documents from outside the IETF.

   This document contains an evaluation of the submitted protocols with
   respect to the requirements document, and on a more general level, to
   the working group charter.

   The following IPFIX candidate protocol submissions were evaluated:

   o  CRANE [7], [8]
   o  Diameter [9], [10]
   o  LFAP [11], [12], [13]
   o  NetFlow v9 [2], [15], [16]
   o  Streaming IPDR [17], [18]

   This document uses terminology defined in [1] intermixed with that
   from submissions to explain the mapping between the two.

2.  Protocol Summaries

   In the following, each candidate protocol is described briefly,

[include full document text]