Packet Sampling (PSAMP) Protocol Specifications
RFC 5476

Cullen Jennings cleared his DISCUSS. The AD is waiting for the edits in psamp-tech that would reflect the consensus of the WG regarding the mandatory hash algorithm before sending the final approval announcement

[Ballot comment]
Review by Christian Vogt:

Draft-ietf-psamp-protocol-09 specifies how the IP Flow Information
Export (IPFIX) protocol is used to communicate packet information
between network measurement entities in a PSAMP architecture.  The
protocol was not originally designed for the PSAMP architecture.

A few editorial/structural comments on how the understandability of the
document could be improved for a non-expert reader.  None of these
comments is a technical show-stopper:


(1)  Section 3.2 in this document repeats many of the terminology
definitions from section 3.1 in draft-ietf-psamp-sample-tech-10.  This
makes terminology updates and extensions unnecessarily cumbersome.  I
suggest moving all PSAMP-related terminology into a separate document,
and citing that document where needed.


(2)  Section 3.3.1 does not compare PSAMP-related and IPFIX-related
terminology, which it is supposed to do according to the introduction of
section 3.3.  Instead, section 3.3.1 simply describes PSAMP-related
terms, and thus basically repeats parts of section 3.2.  A comparison
with the relevant IPFIX-related terminology should be added.


(3)  In section 3.3.2, the difference between a PSAMP Packet Report and
a PSAMP Packet Interpretation remains unclear as both are equated to the
same combination of IPFIX terms.

Also, the term "Packet Interpretation" in section 3.3.2 should likely be
replaced by "*Report* Interpretation" according to PSAMP terminology.


(4)  Section 4.2:  Is the underlying architectural difference between
PSAMP and IPFIX, which is relevant here, that aggregation may in IPFIX
happen before data is exported, but not in PSAMP?  If this is correct,
then stating this explicitly would increase the clarity of this section.

[Ballot comment]
Section 6.4.1:

  For each selected packet, the Packet Report SHOULD contain the
  following information:
  - the observationTimeMicroseconds Information Element
   
What is the purpose of this time? To enable determining exactly when the packet was sampled at the observation point? In that case I think it has insufficient resolution. I would recommend a time format that provides better than 10^-12 in resolution. We already today have link technology that serialize small packets in a small number of nano seconds.

[Ballot discuss]
See comments on other document on hash stuff. Some of that may impact this doc.

It is unclear to me how the private initial vector is set or what post-pended string would be added (as mention in section 6.2.2 of psamp-sample-tech doc). I suspect that I am just missing something here and that once explained to me I can clear with no change to the document.

[Ballot comment]
I found Section 5's discussion of the requirements in [PSAMP-FMWK] hard to follow.
I had to read section 4 of that document to sort out that the following paragraphs address
subsections of the "Generic Requirements for PSAMP" referred to in the opening paragraph.

The fact that the second paragraph focused on requirements that indirectly relate to the
prtotocol contributes to the confusion.  The opening paragraph of section 5 explicitly
calls out "requirements that affect directly the PSAMP export protocol."

Revised IANA comments:

IESG NOTE: Expert required.

Upon approval of this document, the IANA will in the following
registry "IP Flow Information Export (IPFIX) Parameters" located at
http://www.iana.org/assignments/ipfix-parameters
create a new sub-registry "PSAMP selectorAlgorithm Information Element"

Assignment by First Come First Served, subject to Expert Review
Initial contents of this sub-registry will be:

Registry:
Value Set Identifier Reference
----------- ------------------------------------------ ----------
0 ???
1 Systematic count-based Sampling [RFC-psamp-protocol-08]
2 Systematic time-based Sampling [RFC-psamp-protocol-08]
3 Random n-out-of-N Sampling [RFC-psamp-protocol-08]
4 Uniform probabilistic Sampling [RFC-psamp-protocol-08]
5 Property match Filtering [RFC-psamp-protocol-08]
6 Hash based Filtering using BOB [RFC-psamp-protocol-08]
7 Hash based Filtering using IPSX [RFC-psamp-protocol-08]
8 Hash based Filtering using CRC [RFC-psamp-protocol-08]
9-65535 available for assignment by IANA


We understand the above to be the only IANA Action for this
document.

IANA Last Call comments:

IANA has questions.

IESG NOTE: Expert required.

Upon approval of this document, the IANA will in the following
registry "IP Flow Information Export (IPFIX) Parameters" located at
http://www.iana.org/assignments/ipfix-parameters
create a new sub-registry "PSAMP selectorAlgorithm Information
Element"

Assignment by First Come First Served, subject to Expert Review
Initial contents of this sub-registry will be:

[ NOTE: It looks like you define Selector Algorithms in the document
(sections 6.5.2.x) but nowhere do you have a table of them. Please
create a table of selectorAlgorithms. In addition, what information
is required in the registry? ]

We understand the above to be the only IANA Action for this
document.

PROTO Write-up

(1.a) Who is the Document Shepherd for this document? Has the
Document Shepherd personally reviewed this version of the
document and, in particular, does he or she believe this
version is ready for forwarding to the IESG for publication?

Juergen Quittek is the document shepherd.
He has personally reviewed this version of the document and believes
it is ready for forwarding to the IESG for publication.

(1.b) Has the document had adequate review both from key WG members
and from key non-WG members? Does the Document Shepherd have
any concerns about the depth or breadth of the reviews that
have been performed?

An adequate review by key WG members was performed.
The document shepherd has no concerns about depth and breadth of the reviews.

(1.c) Does the Document Shepherd have concerns that the document
needs more review from a particular or broader perspective,
e.g., security, operational complexity, someone familiar with
AAA, internationalization or XML?

No.

(1.d) Does the Document Shepherd have any specific concerns or
issues with this document that the Responsible Area Director
and/or the IESG should be aware of? For example, perhaps he
or she is uncomfortable with certain parts of the document, or
has concerns whether there really is a need for it. In any
event, if the WG has discussed those issues and has indicated
that it still wishes to advance the document, detail those
concerns here. Has an IPR disclosure related to this document
been filed? If so, please include a reference to the
disclosure and summarize the WG discussion and conclusion on
this issue.

There are no such concerns.

(1.e) How solid is the WG consensus behind this document? Does it
represent the strong concurrence of a few individuals, with
others being silent, or does the WG as a whole understand and
agree with it?

There is a solid WG consensus on the content of the draft.

(1.f) Has anyone threatened an appeal or otherwise indicated extreme
discontent? If so, please summarize the areas of conflict in
separate email messages to the Responsible Area Director. (It
should be in a separate email because this questionnaire is
entered into the ID Tracker.)

No.

(1.g) Has the Document Shepherd personally verified that the
document satisfies all ID nits? (See
http://www.ietf.org/ID-Checklist.html and
http://tools.ietf.org/tools/idnits/). Boilerplate checks are
not enough; this check needs to be thorough. Has the document
met all formal review criteria it needs to, such as the MIB
Doctor, media type and URI type reviews?

Yes.

(1.h) Has the document split its references into normative and
informative? Are there normative references to documents that
are not ready for advancement or are otherwise in an unclear
state? If such normative references exist, what is the
strategy for their completion? Are there normative references
that are downward references, as described in [RFC3967]? If
so, list these downward references to support the Area
Director in the Last Call procedure for them [RFC3967].

Yes, references are split into two sections.
The normative references include IPFIX and PSAMP WG documents.
The dependence to the IPFIX drafts is necessary since the IPFIX
protocol was chosen as basis for the PSAMP protocol.
All IPFIX WG documents that are referenced as normative are already
in the RFC Editor queue. For one PSAMP WG documents that is referenced
as normative publication as RFC has already been requested. The remaining
PSAMP WG document that is referenced as normative (ietf-psamp-info-model)
in still progressing. Currently, the WG is focused on completing this
document.
All normative references that are not PSAMP or IPFIX WG documents
have already been published as RFC.
There are no downward references.

(1.i) Has the Document Shepherd verified that the document IANA
consideration section exists and is consistent with the body
of the document? If the document specifies protocol
extensions, are reservations requested in appropriate IANA
registries? Are the IANA registries clearly identified? If
the document creates a new registry, does it define the
proposed initial contents of the registry and an allocation
procedure for future registrations? Does it suggest a
reasonable name for the new registry? See [RFC2434]. If the
document describes an Expert Review process has Shepherd
conferred with the Responsible Area Director so that the IESG
can appoint the needed Expert during the IESG Evaluation?

There is a section on IANA considerations that describes the IANA actions
required by the document.

(1.j) Has the Document Shepherd verified that sections of the
document that are written in a formal language, such as XML
code, BNF rules, MIB definitions, etc., validate correctly in
an automated checker?

There are no such sections.

(1.k) The IESG approval announcement includes a Document
Announcement Write-Up. Please provide such a Document
Announcement Write-Up? Recent examples can be found in the
"Action" announcements for approved documents. The approval
announcement contains the following sections:

Technical Summary
Relevant content can frequently be found in the abstract
and/or introduction of the document. If not, this may be
an indication that there are deficiencies in the abstract
or introduction.

Working Group Summary
Was there anything in WG process that is worth noting? For
example, was there controversy about particular points or
were there decisions where the consensus was particularly
rough?

Document Quality
Are there existing implementations of the protocol? Have a
significant number of vendors indicated their plan to
implement the specification? Are there any reviewers that
merit special mention as having done a thorough review,
e.g., one that resulted in important changes or a
conclusion that the document had no substantive issues? If
there was a MIB Doctor, Media Type or other expert review,
what was its course (briefly)? In the case of a Media Type
review, on what date was the request posted?

Technical Summary

This document specifies the export of packet information from a
PSAMP Exporting Process to a PSAMP Collecting Process. For export
of packet information the IP Flow Information eXport (IPFIX)
protocol is used, as both the IPFIX and PSAMP architecture match
very well and the means provided by the IPFIX protocol are
sufficient. The document specifies in detail how the IPFIX protocol
is used for PSAMP export of packet information.

Working Group Summary

This document was a regular WG document. There is strong consensus
in the working group that this protocol is an appropriate solution.

Document Quality

There are no known implementations yet, but two vendors
and academic research institutes announced implementations.
The document is fully supported by the WG and there has no
concerns been raised that there are better alternatives or
that the document is not useful.