GENWiki

Premier IT Outsourcing and Support Services within the UK

User Tools

Site Tools


rfc:rfc5476

Network Working Group B. Claise, Ed. Request for Comments: 5476 A. Johnson Category: Standards Track Cisco Systems, Inc.

                                                            J. Quittek
                                                       NEC Europe Ltd.
                                                            March 2009
          Packet Sampling (PSAMP) Protocol Specifications

Status of This Memo

 This document specifies an Internet standards track protocol for the
 Internet community, and requests discussion and suggestions for
 improvements.  Please refer to the current edition of the "Internet
 Official Protocol Standards" (STD 1) for the standardization state
 and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

 Copyright (c) 2009 IETF Trust and the persons identified as the
 document authors.  All rights reserved.
 This document is subject to BCP 78 and the IETF Trust's Legal
 Provisions Relating to IETF Documents in effect on the date of
 publication of this document (http://trustee.ietf.org/license-info).
 Please review these documents carefully, as they describe your rights
 and restrictions with respect to this document.
 This document may contain material from IETF Documents or IETF
 Contributions published or made publicly available before November
 10, 2008.  The person(s) controlling the copyright in some of this
 material may not have granted the IETF Trust the right to allow
 modifications of such material outside the IETF Standards Process.
 Without obtaining an adequate license from the person(s) controlling
 the copyright in such materials, this document may not be modified
 outside the IETF Standards Process, and derivative works of it may
 not be created outside the IETF Standards Process, except to format
 it for publication as an RFC or to translate it into languages other
 than English.

Claise, et al. Standards Track [Page 1] RFC 5476 PSAMP Protocol Specification March 2009

Abstract

 This document specifies the export of packet information from a
 Packet SAMPling (PSAMP) Exporting Process to a PSAMP Collecting
 Process.  For export of packet information, the IP Flow Information
 eXport (IPFIX) protocol is used, as both the IPFIX and PSAMP
 architecture match very well, and the means provided by the IPFIX
 protocol are sufficient.  The document specifies in detail how the
 IPFIX protocol is used for PSAMP export of packet information.

Table of Contents

 1. Introduction ....................................................3
    1.1. Conventions Used in This Document ..........................3
 2. PSAMP Documents Overview ........................................4
 3. Terminology .....................................................4
    3.1. IPFIX Terminology ..........................................4
    3.2. PSAMP Terminology ..........................................5
         3.2.1. Packet Streams and Packet Content ...................5
         3.2.2. Selection Process ...................................6
         3.2.3. Reporting ...........................................7
         3.2.4. Metering Process ....................................8
         3.2.5. Exporting Process ...................................8
         3.2.6. PSAMP Device ........................................8
         3.2.7. Collector ...........................................8
         3.2.8. Selection Methods ...................................9
    3.3. IPFIX and PSAMP Terminology Comparison ....................11
         3.3.1. IPFIX and PSAMP Processes ..........................11
         3.3.2. Packet Report, Packet Interpretation, and
                Data Record ........................................12
 4. Differences between PSAMP and IPFIX ............................12
    4.1. Architecture Point of View ................................12
    4.2. Protocol Point of View ....................................14
    4.3. Information Model Point of View ...........................14
 5. PSAMP Requirements versus the IPFIX Solution ...................14
    5.1. High-Level View of the Integration ........................15
 6. Using the IPFIX Protocol for PSAMP .............................16
    6.1. Selector ID ...............................................17
    6.2. The Selection Sequence ID .................................17
    6.3. The Exporting Process .....................................17
    6.4. Packet Report .............................................17
         6.4.1. Basic Packet Report ................................17
         6.4.2. Extended Packet Report .............................21
    6.5. Report Interpretation .....................................22
         6.5.1. Selection Sequence Report Interpretation ...........23
         6.5.2. Selector Report Interpretation .....................25
                6.5.2.1. Systematic Count-Based Sampling ...........25
                6.5.2.2. Systematic Time-Based Sampling ............27

Claise, et al. Standards Track [Page 2] RFC 5476 PSAMP Protocol Specification March 2009

                6.5.2.3. Random n-out-of-N Sampling ................28
                6.5.2.4. Uniform Probabilistic Sampling ............29
                6.5.2.5. Property Match Filtering ..................31
                6.5.2.6. Hash-Based Filtering ......................33
                6.5.2.7. Other Selection Methods ...................36
         6.5.3. Selection Sequence Statistics Report
                Interpretation .....................................37
         6.5.4. Accuracy Report Interpretation .....................39
 7. Security Considerations ........................................43
 8. IANA Considerations ............................................43
    8.1. IPFIX-Related Considerations ..............................43
    8.2. PSAMP-Related Considerations ..............................43
 9. References .....................................................44
    9.1. Normative References ......................................44
    9.2. Informative References ....................................44
 10. Acknowledgments ...............................................45

1. Introduction

 The name PSAMP is a contraction of the phrase "Packet Sampling".  The
 word "Sampling" captures the idea that only a subset of all packets
 passing a network element will be selected for reporting.  PSAMP
 selection operations include random selection, deterministic
 selection, and deterministic approximations to random selection
 (Hash-based Selection).
 The IP Flow Information eXport (IPFIX) protocol specified in
 [RFC5101] exports IP traffic information [RFC5102] observed at
 network devices.  This matches the general protocol requirements
 outlined in the PSAMP framework [RFC5474].  However, there are some
 architectural differences between IPFIX and PSAMP in the requirements
 for an export protocol.  While the IPFIX architecture [RFC5470] is
 focused on gathering and exporting IP traffic flow information, the
 focus of the PSAMP framework [RFC5474] is on exporting information on
 individual packets.  This basic difference and a set of derived
 differences in protocol requirements are outlined in Section 4.
 Despite these differences, the IPFIX protocol is well suited for the
 PSAMP protocol.  Section 5 specifies how the IPFIX protocol is used
 for the export of packet samples.  Required extensions of the IPFIX
 information model are specified in the PSAMP information model
 [RFC5477].

1.1. Conventions Used in This Document

 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
 document are to be interpreted as described in RFC 2119 [RFC2119].

Claise, et al. Standards Track [Page 3] RFC 5476 PSAMP Protocol Specification March 2009

2. PSAMP Documents Overview

 This document is one out of a series of documents from the PSAMP
 group.
 [RFC5474]: "A Framework for Packet Selection and Reporting" describes
 the PSAMP framework for network elements to select subsets of packets
 by statistical and other methods, and to export a stream of reports
 on the selected packets to a Collector.
 [RFC5475]: "Sampling and Filtering Techniques for IP Packet
 Selection" describes the set of packet selection techniques supported
 by PSAMP.
 RFC 5476 (this document): "Packet Sampling (PSAMP) Protocol
 Specifications" specifies the export of packet information from a
 PSAMP Exporting Process to a PSAMP Collecting Process.
 [RFC5477]: "Information Model for Packet Sampling Exports" defines an
 information and data model for PSAMP.

3. Terminology

 As the IPFIX export protocol is used to export the PSAMP information,
 the relevant IPFIX terminology from [RFC5101] is copied over in this
 document.  All terms defined in this section have their first letter
 capitalized when used in this document.  The terminology summary
 table in Section 3.1 gives a quick overview of the relationships
 between the different IPFIX terms.  The PSAMP terminology defined
 here is fully consistent with all terms listed in [RFC5475] and
 [RFC5474], but only definitions that are relevant to the PSAMP
 protocol appear here.  Section 3.3 applies the PSAMP terminology to
 the IPFIX protocol terminology.

3.1. IPFIX Terminology

 IPFIX-specific terminology used in this document is defined in
 Section 2 of [RFC5101].  The only exceptions are the Metering
 Process, Exporting Process, and the Collector terms, which are
 defined more precisely in the PSAMP terminology section.  In this
 document, as in [RFC5101], the first letter of each IPFIX-specific
 term is capitalized.

Claise, et al. Standards Track [Page 4] RFC 5476 PSAMP Protocol Specification March 2009

    +------------------+---------------------------------------------+
    |                  |                 contents                    |
    |                  +--------------------+------------------------+
    |       Set        |      Template      |         record         |
    +------------------+--------------------+------------------------+
    |     Data Set     |          /         |     Data Record(s)     |
    +------------------+--------------------+------------------------+
    |   Template Set   | Template Record(s) |           /            |
    +------------------+--------------------+------------------------+
    | Options Template | Options Template   |           /            |
    |       Set        | Record(s)          |                        |
    +------------------+--------------------+------------------------+
                   Figure A: Terminology Summary Table

3.2. PSAMP Terminology

 The PSAMP terminology section has been copied from [RFC5475].

3.2.1. Packet Streams and Packet Content

  • Observed Packet Stream
    The Observed Packet Stream is the set of all packets observed at
    the Observation Point.
  • Packet Stream
    A Packet Stream denotes a set of packets from the Observed Packet
    Stream that flows past some specified point within the Metering
    Process.  An example of a Packet Stream is the output of the
    Selection Process.  Note that packets selected from a stream,
    e.g., by Sampling, do not necessarily possess a property by which
    they can be distinguished from packets that have not been
    selected.  For this reason, the term "stream" is favored over
    "flow", which is defined as a set of packets with common
    properties [RFC3917].
  • Packet Content
    The Packet Content denotes the union of the packet header (which
    includes link layer, network layer, and other encapsulation
    headers) and the packet payload.  Note that, depending on the
    Observation Point, the link layer information might not be
    available.

Claise, et al. Standards Track [Page 5] RFC 5476 PSAMP Protocol Specification March 2009

3.2.2. Selection Process

  • Selection Process
    A Selection Process takes the Observed Packet Stream as its input
    and selects a subset of that stream as its output.
  • Selection State
    A Selection Process may maintain state information for use by the
    Selection Process.  At a given time, the Selection State may
    depend on packets observed at and before that time, and other
    variables.  Examples include:
       (i) sequence numbers of packets at the input of Selectors;
      (ii) a timestamp of observation of the packet at the Observation
           Point;
     (iii) iterators for pseudorandom number generators;
      (iv) hash values calculated during selection;
       (v) indicators of whether the packet was selected by a given
           Selector.
    Selection Processes may change portions of the Selection State as
    a result of processing a packet.  Selection state for a packet is
    to reflect the state after processing the packet.
  • Selector
    A Selector defines the action of a Selection Process on a single
    packet of its input.  If selected, the packet becomes an element
    of the output Packet Stream.
    The Selector can make use of the following information in
    determining whether a packet is selected:
       (i) the Packet Content;
      (ii) information derived from the packet's treatment at the
           Observation Point;
     (iii) any selection state that may be maintained by the Selection
           Process.

Claise, et al. Standards Track [Page 6] RFC 5476 PSAMP Protocol Specification March 2009

  • Composite Selector
    A Composite Selector is an ordered composition of Selectors, in
    which the output Packet Stream issuing from one Selector forms the
    input Packet Stream to the succeeding Selector.
  • Primitive Selector
    A Selector is primitive if it is not a Composite Selector.
  • Selector ID
    The Selector ID is the unique ID identifying a Primitive Selector.
    The ID is unique within the Observation Domain.
  • Selection Sequence
    From all the packets observed at an Observation Point, only a few
    packets are selected by one or more Selectors.  The Selection
    Sequence is a unique value per Observation Domain describing the
    Observation Point and the Selector IDs through which the packets
    are selected.

3.2.3. Reporting

  • Packet Reports
    Packet Reports comprise a configurable subset of a packet's input
    to the Selection Process, including the Packet Content,
    information relating to its treatment (for example, the output
    interface), and its associated selection state (for example, a
    hash of the Packet Content).
  • Report Interpretation
    Report Interpretation comprises subsidiary information, relating
    to one or more packets, that is used for interpretation of their
    Packet Reports.  Examples include configuration parameters of the
    Selection Process.
  • Report Stream
    The Report Stream is the output of a Metering Process, comprising
    two distinguished types of information: Packet Reports and Report
    Interpretation.

Claise, et al. Standards Track [Page 7] RFC 5476 PSAMP Protocol Specification March 2009

3.2.4. Metering Process

  • Metering Process
    A Metering Process selects packets from the Observed Packet Stream
    using a Selection Process, and produces as output a Report Stream
    concerning the selected packets.
    The PSAMP Metering Process can be viewed as analogous to the IPFIX
    Metering Process [RFC5101], which produces Flow Records as its
    output, with the difference that the PSAMP Metering Process always
    contains a Selection Process.  The relationship between PSAMP and
    IPFIX is further described in [RFC5477] and [RFC5474].

3.2.5. Exporting Process

  • Exporting Process
    An Exporting Process sends, in the form of Export Packets, the
    output of one or more Metering Processes to one or more
    Collectors.
  • Export Packet
    An Export Packet is a combination of Report Interpretation(s)
    and/or one or more Packet Reports that are bundled by the
    Exporting Process into an Export Packet for exporting to a
    Collector.

3.2.6. PSAMP Device

  • PSAMP Device
    A PSAMP Device is a device hosting at least an Observation Point,
    a Selection Process, and an Exporting Process.  Typically,
    corresponding Observation Point(s), Selection Process(es), and
    Exporting Process(es) are co-located at this device, for example,
    at a router.

3.2.7. Collector

  • Collector
    A Collector receives a Report Stream exported by one or more
    Exporting Processes.  In some cases, the host of the Metering
    and/or Exporting Processes may also serve as the Collector.

Claise, et al. Standards Track [Page 8] RFC 5476 PSAMP Protocol Specification March 2009

3.2.8. Selection Methods

  • Filtering
    A filter is a Selector that selects a packet deterministically
    based on the Packet Content, or its treatment, or functions of
    these occurring in the Selection State.  Two examples are:
       (i) Property Match Filtering: A packet is selected if a
           specific field in the packet equals a predefined value.
      (ii) Hash-based Selection: A Hash Function is applied to the
           Packet Content, and the packet is selected if the result
           falls in a specified range.
  • Sampling
           A Selector that is not a filter is called a Sampling
           operation.  This reflects the intuitive notion that if the
           selection of a packet cannot be determined from its content
           alone, there must be some type of Sampling taking place.
  • Content-Independent Sampling
           A Sampling operation that does not use Packet Content (or
           quantities derived from it) as the basis for selection is
           called a Content-independent Sampling operation.  Examples
           include systematic Sampling, and uniform pseudorandom
           Sampling driven by a pseudorandom number whose generation
           is independent of Packet Content.  Note that in Content-
           independent Sampling, it is not necessary to access the
           Packet Content in order to make the selection decision.
  • Content-Dependent Sampling
           A Sampling operation where selection is dependent on Packet
           Content is called a Content-dependent Sampling operation.
           An example is pseudorandom selection according to a
           probability that depends on the contents of a packet field.
           Note that this is not a filter, because the selection is
           not deterministic.
  • Hash Domain
           A Hash Domain is a subset of the Packet Content and the
           packet treatment, viewed as an N-bit string for some
           positive integer N.

Claise, et al. Standards Track [Page 9] RFC 5476 PSAMP Protocol Specification March 2009

  • Hash Range
           A Hash Range is a set of M-bit strings for some positive
           integer M that define the range of values the result of the
           hash operation can take.
  • Hash Function
           A Hash Function defines a deterministic map from the Hash
           Domain into the Hash Range.
  • Hash Selection Range
           A Hash Selection Range is a subset of the Hash Range.  The
           packet is selected if the action of the Hash Function on
           the Hash Domain for the packet yields a result in the Hash
           Selection Range.
  • Hash-based Selection
           A Hash-based Selection is Filtering specified by a Hash
           Domain, a Hash Function, a Hash Range, and a Hash Selection
           Range.
  • Approximative Selection
           Selectors in any of the above categories may be
           approximated by operations in the same or another category
           for the purposes of implementation.  For example, uniform
           pseudorandom Sampling may be approximated by Hash-based
           Selection, using a suitable Hash Function and Hash Domain.
           In this case, the closeness of the approximation depends on
           the choice of Hash Function and Hash Domain.
  • Population
           A Population is a Packet Stream, or a subset of a Packet
           Stream.  A Population can be considered as a base set from
           which packets are selected.  An example is all packets in
           the Observed Packet Stream that are observed within some
           specified time interval.
  • Population Size
           The Population Size is the number of all packets in the
           Population.

Claise, et al. Standards Track [Page 10] RFC 5476 PSAMP Protocol Specification March 2009

  • Sample Size
           The Sample Size is the number of packets selected from the
           Population by a Selector.
  • Configured Selection Fraction
           The Configured Selection Fraction is the expected ratio of
           the Sample Size to the Population Size, as based on the
           configured selection parameters.
  • Attained Selection Fraction
           The Attained Selection Fraction is the ratio of the actual
           Sample Size to the Population Size.  For some Sampling
           methods, the Attained Selection Fraction can differ from
           the Configured Selection Fraction due to, for example, the
           inherent statistical variability in Sampling decisions of
           probabilistic Sampling and Hash-based Selection.
           Nevertheless, for large Population Sizes and properly
           configured Selectors, the Attained Selection Fraction
           usually approaches the Configured Selection Fraction.

3.3. IPFIX and PSAMP Terminology Comparison

 The PSAMP terminology has been specified with an IPFIX background, as
 PSAMP and IPFIX have similar terms.  However, this section clarifies
 the terms between the IPFIX and PSAMP terminology.

3.3.1. IPFIX and PSAMP Processes

 Figure B indicates the sequence of the IPFIX processes (Metering and
 Exporting) within the PSAMP Device.
              +------------------+
              | Metering Process |
              | +-----------+    |     +-----------+
    Observed  | | Selection |    |     | Exporting |
    Packet--->| | Process   |--------->| Process   |--->Collector
    Stream    | +-----------+    |     +-----------+
              +------------------+
                        Figure B: PSAMP Processes
 The Selection Process, which takes an Observed Packet Stream as its
 input, is an integral part of the Metering Process.  The Selection
 Process chooses which packets from its input Packet Stream will be

Claise, et al. Standards Track [Page 11] RFC 5476 PSAMP Protocol Specification March 2009

 reported on by the rest of the Metering Process.  Note that a
 "Process" is not necessarily implemented as a separate CPU thread.

3.3.2. Packet Report, Packet Interpretation, and Data Record

 The PSAMP terminology speaks of Packet Report and Packet
 Interpretation, while the IPFIX terminology speaks of Data Record and
 (Options) Template Record.  The PSAMP Packet Report, which comprises
 information about the observed packet, can be viewed as analogous to
 the IPFIX Data Record defined by a Template Record.  The PSAMP Report
 Interpretation, which comprises subsidiary information used for the
 interpretation of the Packet Reports, can be viewed as analogous to
 the IPFIX Data Record defined by an Options Template Record.  This
 Options Template Record contains subsidiary information, applicable
 to the observed packet sent into the PSAMP Packet Report.

4. Differences between PSAMP and IPFIX

 The output of the IPFIX working group relevant for this document is
 structured into three documents:
  1. IP Flow information architecture [RFC5470]
  1. IPFIX protocol specifications [RFC5101]
  1. IP Flow information export information model [RFC5102]
 In the following sections, we investigate the differences between
 IPFIX and PSAMP for each of those aspects.

4.1. Architecture Point of View

 Traffic Flow measurement as described in the IPFIX requirements
 [RFC3917] and the IPFIX architecture [RFC5470] can be separated into
 two stages: packet processing and Flow processing.  Figure C
 illustrates these stages.
 In stage 1, all processing steps act on packets.  Packets are
 captured, timestamped, selected by one or more selection steps, and
 finally forwarded to packet classification that maps packets to
 Flows.  The packets' selection steps may include Filtering and
 Sampling functions.
 In stage 2, all processing steps act on Flows.  After packets are
 classified (mapped to Flows), Flows are generated (or updated if they
 exist already).  Flow generation and update steps may be performed
 repeatedly for aggregating Flows.  Finally, Flows are exported.

Claise, et al. Standards Track [Page 12] RFC 5476 PSAMP Protocol Specification March 2009

 Packet Sampling as described in the PSAMP framework [RFC5474] covers
 only stage 1 of the IPFIX architecture with the packet classification
 replaced by Packet Report export, while IPFIX covers stage 2 also, as
 it generates Flow Records out of the selected packets.
    IPFIX architecture                       PSAMP framework
      packet header                           packet header
        capturing     \                         capturing
            |          |                            |
       timestamping    |                       timestamping
            |          |                            |
            v          |                            v
    +------>+          |  stage 1:          +------>+
    |       |           > packet            |       |
    |    packet        |  processing        |    packet
    |   selection      |                    |   selection
    |       |          |                    |       |
    +-------+          |                    +-------+
            |          |                            |
            v          |                            v
         packet       /                       Packet Report
      classification  \                          export
            |          |
            v          |
    +------>+          |
    |       |          |
    | Flow generation  |
    |   and update     |  stage 2:
    |       |           > Flow
    |       v          |  processing
    |     Flow         |
    |   selection      |
    |       |          |
    +-------+          |
            |          |
            v          |
       Flow Record    /
         export
     Figure C: Comparison of IPFIX Architecture and PSAMP Framework

Claise, et al. Standards Track [Page 13] RFC 5476 PSAMP Protocol Specification March 2009

4.2. Protocol Point of View

 Concerning the protocol, the major difference between IPFIX and PSAMP
 is that the IPFIX protocol exports Flow Records while the PSAMP
 protocol exports Packet Reports.  From a pure export point of view,
 IPFIX will not distinguish a Flow Record composed of several packets
 aggregated together from a Flow Record composed of a single packet.
 So the PSAMP export can be seen as a special IPFIX Flow Record
 containing information about a single packet.
 All extensions of the IPFIX protocol that are required to satisfy the
 PSAMP requirements have already been incorporated in the IPFIX
 protocol [RFC5101], which was developed in parallel with the PSAMP
 protocol.  An example is the need for a data type for protocol fields
 that have flexible length, such as an octet array.  This was added to
 the IPFIX protocol specification in order to meet the requirement of
 the PSAMP protocol to report content of captured packets, for
 example, the first octets of a packet.

4.3. Information Model Point of View

 From the information model point of view, the overlap between both
 the IPFIX and PSAMP protocols is quite large.  Most of the
 Information Elements in the IPFIX protocol are also relevant for
 exporting packet information, for example, all fields reporting
 packet header properties.  Only a few Information Elements, such as
 observedFlowTotalCount (whose value will always be 1 for PSAMP),
 etc., cannot be used in a meaningful way by the PSAMP protocol.
 Also, IPFIX protocol requirements concerning stage 2 of Figure C do
 not apply to the PSAMP Metering Process.
 Further required extensions apply to the information model.  Even if
 the IPFIX charter speaks of Sampling, no Sampling-related Information
 Elements are specified in [RFC5102].  The task of specifying them was
 intentionally left for the PSAMP information model [RFC5477].  A set
 of several additional fields is required for satisfying the
 requirements for the PSAMP information model [RFC5475].
 Exploiting the extensibility of the IPFIX information model, the
 required extension is covered by the PSAMP information model
 specified in [RFC5477].

5. PSAMP Requirements versus the IPFIX Solution

 The [RFC5474] contains PSAMP protocol requirements throughout the
 document, with a special focus in Section 4, "Generic Requirements
 for PSAMP", and its subsections.

Claise, et al. Standards Track [Page 14] RFC 5476 PSAMP Protocol Specification March 2009

 Section 4 of [RFC5474] describes one requirement that, if not
 directly related to the export protocol, will put some constraints on
 it.  Parallel Measurements: multiple independent Selection Processes
 at the same entity.
 [RFC5474] also describes a series of requirements specifying the
 different Information Elements that MUST and SHOULD be reported to
 the Collector.  Nevertheless, IPFIX, being a generic export protocol,
 can export any Information Elements as long as they are described in
 the information model.  So these requirements are mainly targeted for
 [RFC5477].
 The PSAMP protocol specification meets almost all the protocol
 requirements stated in the PSAMP framework document [RFC5474]:
  • Extensibility
  • Parallel selection processes
  • Encrypted packets
  • Indication of information loss
  • Accuracy
  • Privacy
  • Timeliness
  • Congestion avoidance
  • Secure export
  • Export rate limit
  • Microsecond timestamp resolution
 The only requirement that is not met is Export Packet compression.
 With the choice of IPFIX as the PSAMP export protocol, the Export
 Packet compression option mentioned in the Section 8.5 of the
 framework document [RFC5474] is not addressed.

5.1. High-Level View of the Integration

 The Template Record in the Template Set is used to describe the
 different PSAMP Information Elements that will be exported to the
 Collector.  The Collector decodes the Template Record in the Template
 Set and knows which Information Elements to expect when it receives

Claise, et al. Standards Track [Page 15] RFC 5476 PSAMP Protocol Specification March 2009

 the Data Records in the PSAMP Packet Report Data Set.  Typically, in
 the base level of the PSAMP functionality, the Template Set will
 contain the input sequence number, the packet fragment (some number
 of contiguous bytes from the start of the packet or from the start of
 the payload), and the Selection Sequence.
 The Options Template Record in the Options Template Set is used to
 describe the different PSAMP Information Elements that concern the
 Metering Process itself: Sampling and/or Filtering functions, and the
 associated parameters.  The Collector decodes the Options Template
 Records in the Options Template Set and knows which Information
 Elements to expect when it receives the Data Records in the PSAMP
 Report Interpretation Data Set.  Typically, the Options Template
 would contain the Selection Sequence, the Sampling or Filtering
 functions, and the Sampling or Filtering associated parameters.
 PSAMP requires all the different possibilities of the IPFIX protocol
 specifications [RFC5101], that is, the three types of Sets (Data Set,
 Template Set, and Options Templates Set) with the two types of
 Template Records (Template Record and Options Template Record), as
 described in Figure A.  As a consequence, PSAMP can't rely on a
 subset of the IPFIX protocol specifications described in [RFC5101].
 The entire IPFIX protocol specifications [RFC5101] MUST be
 implemented for the PSAMP protocol.

6. Using the IPFIX Protocol for PSAMP

 In this section, we describe the usage of the IPFIX protocol for
 PSAMP.  We describe the record formats and the additional
 requirements that must be met.  PSAMP uses two different types of
 messages:
  1. Packet Reports
  1. Report Interpretation
 The format of Packet Reports is defined in IPFIX Template Records.
 The PSAMP data is transferred as Information Elements in IPFIX Data
 Records as described by the Template Record.  There are two different
 types of Packet Reports.  Basic Packet Reports contain only the basic
 Information Elements required for PSAMP reporting.  Extended Packet
 Reports MAY contain other Information Elements, and do not
 necessarily include Packet Content (See section 6.4.2).
 The format of Report Interpretations is defined in the IPFIX Options
 Template Record.  The Information Elements are transferred in IPFIX
 Data Records as described by the Options Template Record.  There are
 four different types of Report Interpretation messages:

Claise, et al. Standards Track [Page 16] RFC 5476 PSAMP Protocol Specification March 2009

  1. Selection Sequence Report Interpretation
  1. Selector Report Interpretation
  1. Selection Sequence Statistics Report Interpretation
  1. Accuracy Report Interpretation
 A description and examples about the usage of those reports are given
 below.

6.1. Selector ID

 The Selector ID is the unique ID identifying a Primitive Selector.
 Each Primitive Selector MUST have a unique ID within the Observation
 Domain.  The Selector ID is represented by the selectorId Information
 Element [RFC5477].

6.2. The Selection Sequence ID

 From all the packets observed at an Observation Point, a subset of
 packets is selected by one or more Selectors.  The Selection Sequence
 is the combination of an Observation Point and one or more
 Selector(s) through which the packets are selected.  The Selection
 Sequence ID is a unique value representing that combination.  The
 Selection Sequence ID is represented by the selectionSequenceId
 Information Element [RFC5477].

6.3. The Exporting Process

 An Exporting Process MUST be able to limit the export rate according
 to a configurable value.  The Exporting Process MAY limit the export
 rate on a per Collecting Process basis.

6.4. Packet Report

 For each Selection Sequence, for each selected packet, a Packet
 Report MUST be created.  The format of the Packet Report is specified
 in a Template Record contained in a Template Set.
 There are two types of Packet Report, as described in [RFC5474]: the
 basic Packet Report and the extended Packet Report.

6.4.1. Basic Packet Report

 For each selected packet, the Packet Report MUST contain the
 following information:

Claise, et al. Standards Track [Page 17] RFC 5476 PSAMP Protocol Specification March 2009

  1. The selectionSequenceId Information Element

If there is a digest function in the Selection Sequence, the Packet

   Report MUST contain the hash value (digestHashValue Information
   Element) generated by the digest Hash Function for each selected
   packet.  If there is more than one digest function, then each hash
   value MUST be included in the same order as they appear in the
   Selection Sequence.  If there are no digest functions in the
   Selection Sequence, no element for the digest needs to be sent.
  1. Some number of contiguous bytes from the start of the packet,

including the packet header (which includes link layer, network

   layer, and other encapsulation headers) and some subsequent bytes
   of the packet payload.  Alternatively, the number of contiguous
   bytes may start at the beginning of the payload.  The
   dataLinkFrameSection, mplsLabelStackSection,
   mplsPayloadPacketSection, ipPacketSection, and
   ipPayloadPacketSection PSAMP Information Elements are available for
   this use.
 For each selected packet, the Packet Report SHOULD contain a time-
 related Information Element that matches the Metering Process time
 accuracy.  Typically, the observationTimeMicroseconds Information
 Element.  Other possible Information Elements are the
 observationTimeSeconds, the observationTimeMilliseconds, or the
 observationTimeNanoseconds.
 In the Packet Report, the PSAMP Device MUST be capable of exporting
 the number of observed packets and the number of packets selected by
 each instance of its Primitive Selectors (as described by the
 non-scope Information Elements of the Selection Sequence Statistics
 Report Interpretation), although it MAY be a configurable option not
 to include them.  If exported, the Attained Selection Fraction may be
 calculated precisely for the Observed Packet Stream.  The Packet
 Report MAY include only the final selector packetSelected, to act as
 an index for that Selection Sequence in the Selection Sequence
 Statistics Report Interpretation, which also allows the calculation
 of the Attained Selection Fraction.
 The contiguous Information Elements (dataLinkFrameSection,
 mplsLabelStackSection, mplsPayloadPacketSection, ipPacketSection, and
 ipPayloadPacketSection) MAY be encoded with a fixed-length field or
 with a variable-sized field.  If one of these Information Elements is
 encoded with a fixed-length field whose length is too long for the
 number of contiguous bytes in the selected packet, padding MUST NOT
 be used.  In this case, the Exporting Process MUST export the
 information either in a new Template Record with the correct fixed-
 length field or in a new Template Record with a variable-length
 field.

Claise, et al. Standards Track [Page 18] RFC 5476 PSAMP Protocol Specification March 2009

 Here is an example of a basic Packet Report, with a
 SelectionSequenceId value of 9 and dataLinkFrameSection Information
 Element of 12 bytes, 0x4500 005B A174 0000 FF11 832E, encoded with a
 fixed-length field.
 IPFIX Template Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID = 2          |         Length = 24           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |        Template ID = 260      |        Field Count = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   selectionSequenceId = 301   |        Field Length = 4       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      digestHashValue = 326    |        Field Length = 4       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   dataLinkFrameSection = 315  |        Field Length = 12      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |observationTimeMicroseconds=324|        Field Length = 4       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 The associated IPFIX Data Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID = 260        |           Length = 32         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               9                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         0x9123 0613                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         0x4500 005B                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         0xA174 0000                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         0xFF11 832E                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                       observation time ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |        ... encoded as dateTimeMicroSeconds [RFC5101]          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
               Figure D: Example of a Basic Packet Report

Claise, et al. Standards Track [Page 19] RFC 5476 PSAMP Protocol Specification March 2009

 Here is an example of a basic Packet Report, with a
 SelectionSequenceId value of 9 and ipHeaderPacketSection Information
 Element of 12 bytes, 0x4500 005B A174 0000 FF11 832E, encoded with a
 variable-sized field.
 IPFIX Template Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID = 2          |         Length = 16           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |        Template ID = 261      |        Field Count = 2        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |    selectionSequenceId = 301  |        Field Length = 4       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |  ipHeaderPacketSection = 313  |      Field Length = 65535     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 The associated IPFIX Data Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID = 261        |           Length = 21         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               9                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |  Length = 12  |                  0x4500 ...                   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   ...  005B   |                  0xA174 ...                   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   ...  0000   |                  0xFF11 ...                   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   ...  832E   |
    +-+-+-+-+-+-+-+-+
                Figure E: Example of a Basic Packet Report
                       with a Variable-Sized Field

Claise, et al. Standards Track [Page 20] RFC 5476 PSAMP Protocol Specification March 2009

6.4.2. Extended Packet Report

 Alternatively to the basic Packet Report, the extended Packet Report
 MAY contain other Information Elements related to the protocols used
 in the packet (such as source and destination IP addresses), related
 to the packet treatment (such as output interface, destination BGP
 autonomous system [RFC4271]), or related to the Selection State
 associated with the packet (such as timestamp, hash value).
 It is envisaged that selection of fields for extended Packet Reports
 may be used to reduce reporting bandwidth, in which case the option
 to report some number of contiguous bytes from the start of the
 packet, mandatory in the basic Packet Report, may not be exercised.
 In this case, the Packet Content MAY be omitted.  Note this
 configuration is quite similar to an IPFIX Device for which a
 Template Record containing information about a single packet is
 reported.
 Example of a detailed Extended Packet Report:
 IPFIX Template Record:
    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            Set ID =  2        |           Length = 32         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Template ID = 261       |         Field Count = 6       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|  selectionSequenceId = 301  |         Field Length = 4      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|  sourceIPv4Address = 8      |         Field Length = 4      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0| destinationIPv4Address = 12 |         Field Length = 4      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|    totalLengthIPv4 = 190    |         Field Length = 2      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|     tcpSourcePort = 182     |         Field Length = 2      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|  tcpDestinationPort = 183   |         Field Length = 2      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Claise, et al. Standards Track [Page 21] RFC 5476 PSAMP Protocol Specification March 2009

 The associated IPFIX Data Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID = 261        |            Length = 20        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               9                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                           192.0.2.1                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                          192.0.2.106                          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                72             |                1372           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |               80              |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
             Figure F: Example of an Extended Packet Report

6.5. Report Interpretation

 To make full sense of the Packet Reports, there are a number of
 additional pieces of information that must be communicated to the
 Collector:
  1. The details about which Selectors and Observation Points are being

used within a Selection Sequence MUST be provided using the

   Selection Sequence Report Interpretation.
  1. The configuration details of each Selector MUST be provided using

the Selector Report Interpretation.

  1. The Selector ID statistics MUST be provided using the Selection

Sequence Statistics Report Interpretation.

  1. The accuracies of the reported fields MUST be provided using the

Accuracy Report Interpretation.

Claise, et al. Standards Track [Page 22] RFC 5476 PSAMP Protocol Specification March 2009

6.5.1. Selection Sequence Report Interpretation

 Each Packet Report contains a selectionSequenceId Information Element
 that identifies the particular combination of Observation Point and
 Selector(s) used for its selection.  For every selectionSequenceId
 Information Element in use, the PSAMP Device MUST export a Selection
 Sequence Report Interpretation using an Options Template with the
 following Information Elements:
 Scope:     selectionSequenceId
 Non-Scope: one Information Element mapping the Observation Point
            selectorId (one or more)
 An Information Element representing the Observation Point would
 typically be taken from the ingressInterface, egressInterface,
 lineCardId, exporterIPv4Address, or exporterIPv6Address Information
 Elements (specified in [RFC5102]), but is not limited to those: any
 Information Element specified in [RFC5102] or [RFC5477] can
 potentially be used.  In case of more complex Observation Points
 (such as a list of interfaces, a bus, etc.), a new Information
 Element describing the new type of Observation Point must be
 specified, along with an Options Template Record describing it in
 more detail (if necessary).
 If the packets are selected by a Composite Selector, the Selection
 Sequence is composed of several Primitive Selectors.  In such a case,
 the Selection Sequence Report Interpretation MUST contain the list of
 all the Primitive Selector IDs in the Selection Sequence.  If
 multiple Selectors are contained in the Selection Sequence Report
 Interpretation, the selectorId's MUST be identified in the order they
 are used.
 Example of two Selection Sequences:
 Selection Sequence 7 (Filter->Sampling):
   ingressInterface    5
   selectorId          5 (Filter, match IPV4SourceAddress 192.0.2.1)
   selectorId         10 (Sampler, Random 1 out-of ten)
 Selection Sequence 9 (Sampling->Filtering):
   ingressInterface    5
   selectorId         10 (Sampler, Random 1 out-of ten)
   selectorId          5 (Filter, match IPV4SourceAddress 192.0.2.1)

Claise, et al. Standards Track [Page 23] RFC 5476 PSAMP Protocol Specification March 2009

 IPFIX Options Template Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |          Set ID = 3           |          Length = 26          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |        Template ID = 262      |         Field Count = 4       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     Scope Field Count =  1    |0|  selectionSequenceId = 301  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Scope 1 Length = 4      |0|     ingressInterface = 10   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |        Field Length = 4       |0|      selectorId = 302       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |        Field Length = 4       |0|      selectorId = 302       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |        Field Length = 4       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 The associated IPFIX Data Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |          Set ID = 262         |           Length = 36         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               7                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               5                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               5                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                              10                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               9                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               5                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                              10                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               5                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     Figure G: Example of a Selection Sequence Report Interpretation

Claise, et al. Standards Track [Page 24] RFC 5476 PSAMP Protocol Specification March 2009

 Notes:
  • There are two Records here in the same Data Set. Each record

defines a different Selection Sequence.

  • If, for example, a different Selection Sequence is composed of

three Selectors, then a different Options Template with three

   selectorId Information Elements (instead of two) must be used.

6.5.2. Selector Report Interpretation

 An IPFIX Data Record, defined by an Options Template Record, MUST be
 used to send the configuration details of every Selector in use.  The
 Options Template Record MUST contain the selectorId Information
 Element as the Scope field and the SelectorAlgorithm Information
 Element followed by some specific configuration parameters:
 Scope:     selectorId
 Non-scope: selectorAlgorithm
            algorithm-specific Information Elements
 The algorithm-specific Information Elements are specified in the
 following subsections, depending on the selection method represented
 by the value of the selectorAlgorithm [RFC5477].

6.5.2.1. Systematic Count-Based Sampling

 In systematic count-based Sampling, the start and stop triggers for
 the Sampling interval are defined in accordance with the spatial
 packet position (packet count) [RFC5475].
 The REQUIRED algorithm-specific Information Elements in the case of
 systematic count-based Sampling are:
    samplingPacketInterval: number of packets selected in a row
    samplingPacketSpace:    number of packets between selections
 Example of a simple 1 out-of 10 systematic count-based Selector
 definition, where the samplingPacketInterval is 1 and the
 samplingPacketSpace is 9.

Claise, et al. Standards Track [Page 25] RFC 5476 PSAMP Protocol Specification March 2009

 IPFIX Options Template Record:
    0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |          Set ID = 3           |          Length = 26          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |        Template ID =  263     |         Field Count = 4       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |    Scope Field Count =  1     |0|       selectorId = 302      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Scope 1 Length = 4       |0|   selectorAlgorithm = 304   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 1        |0|samplingPacketInterval = 305 |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 1        |0|  samplingPacketSpace = 306  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 1        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 Associated IPFIX Data Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            Set ID = 263       |          Length = 11          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                              15                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       1       |      1        |      9        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
         Figure H: Example of the Selector Report Interpretation
                   for Systematic Count-Based Sampling
 Notes:
  • A selectorAlgorithm value of 1 represents systematic count-based

Sampling.

  • samplingPacketInterval and samplingPacketSpace are of type

unsigned32 but are compressed down to one octet here, as allowed by

   the IPFIX protocol specifications [RFC5101].

Claise, et al. Standards Track [Page 26] RFC 5476 PSAMP Protocol Specification March 2009

6.5.2.2. Systematic Time-Based Sampling

 In systematic time-based Sampling, the start and stop triggers are
 used to define the Sampling intervals [RFC5475].  The REQUIRED
 algorithm-specific Information Elements in the case of systematic
 time-based Sampling are:
    samplingTimeInterval: time (in microseconds) when packets are
                          selected
    samplingTimeSpace:    time (in microseconds) between selections
 Example of a 100 microsecond out-of 1000 microsecond systematic
 time-based Selector definition, where the samplingTimeInterval is 100
 and the samplingTimeSpace is 900.
 IPFIX Options Template Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID = 3          |          Length = 26          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Template ID = 264        |        Field Count = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |    Scope Field Count = 1      |0|      selectorId = 302       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     Scope 1 Length = 4        |0|     selectorAlgorithm = 304 |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Field Length = 1         |0|  samplingTimeInterval = 307 |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Field Length = 1         |0|   samplingTimeSpace = 308   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Field Length = 2         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 Associated IPFIX Data Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID = 264        |          Length = 12          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                              16                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |        2      |       100     |             900               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
         Figure I: Example of the Selector Report Interpretation

Claise, et al. Standards Track [Page 27] RFC 5476 PSAMP Protocol Specification March 2009

                   for Systematic Time-Based Sampling
 Notes:
  • A selectorAlgorithm value of 2 represents systematic time-based

Sampling.

  • samplingTimeInterval and samplingTimeSpace are of type unsigned32

but are compressed down here.

6.5.2.3. Random n-out-of-N Sampling

 In random n-out-of-N Sampling, n elements are selected out of the
 parent Population that consists of N elements [RFC5475].  The
 REQUIRED algorithm-specific Information Elements in case of random
 n-out-of-N Sampling are:
    samplingSize:       number of packets selected
    samplingPopulation: number of packets in selection Population
 Example of a 1 out-of 10 random n-out-of-N Sampling Selector:
 IPFIX Options Template Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID = 3          |          Length = 26          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Template ID = 265        |        Field Count = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     Scope Field Count = 1     |0|      selectorId = 302       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     Scope 1 Length = 4        |0|  selectorAlgorithm = 304    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Field Length = 1         |0|      samplingSize = 309     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Field Length = 1         |0|  samplingPopulation = 310   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Field Length = 1         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Claise, et al. Standards Track [Page 28] RFC 5476 PSAMP Protocol Specification March 2009

 Associated IPFIX Data Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |         Set ID = 265          |          Length = 11          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                              17                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       3       |       1       |        10     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
         Figure J: Example of the Selector Report Interpretation
                     for Random n-out-of-N Sampling
 Notes:
  • A selectorAlgorithm value of 3 represents Random n-out-of-N

Sampling.

  • samplingSize and samplingPopulation are of type unsigned32 but are

compressed down to one octet here.

6.5.2.4. Uniform Probabilistic Sampling

 In uniform probabilistic Sampling, each element has the same
 probability p of being selected from the parent Population [RFC5475].
 The algorithm-specific Information Element in case of uniform
 probabilistic Sampling is:
    samplingProbability: a floating point number for the Sampling
                         probability.

Claise, et al. Standards Track [Page 29] RFC 5476 PSAMP Protocol Specification March 2009

 Example of a 15% uniform probability Sampling Selector:
 IPFIX Options Template Record:
    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |          Set ID = 3           |             Length = 22       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Template ID = 271       |         Field Count = 3       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     Scope Field Count = 1     |0|      selectorId = 302       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Field Length = 4         |0|   selectorAlgorithm = 304   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Field Length = 1         |0| samplingProbability = 311   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Field Length = 4         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 Associated IPFIX Data Record:
    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID = 271        |          Length = 11          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                              20                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      4        |                          0.15                 |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |               |
    +-+-+-+-+-+-+-+-+
         Figure K: Example of the Selector Report Interpretation
                   for Uniform Probabilistic Sampling
 Notes:
  • A selectorAlgorithm value of 4 represents Uniform Probabilistic

Sampling.

  • samplingProbability is of type float64 but is compressed down to a

float32 here.

Claise, et al. Standards Track [Page 30] RFC 5476 PSAMP Protocol Specification March 2009

6.5.2.5. Property Match Filtering

 This classification includes match(es) on field(s) within a packet
 and/or on properties of the router state.  With this method, a packet
 is selected if a specific field in the packet equals a predefined
 value.
 The algorithm-specific Information Elements defining configuration
 parameters for Property Match Filtering are taken from the full range
 of available Information Elements.
 When multiple different Information Elements are defined, the filter
 acts as a logical AND.  Note that the logical OR is not covered by
 these PSAMP specifications.  The Property Match Filtering Options
 Template Record MUST NOT have multiple identical Information
 Elements.  The result of the filter is independent from the order of
 the Information Elements in the Options Template Record, but the
 order may be important for implementation purposes, as the first
 filter will have to work at a higher rate.  In any case, an
 implementation is not constrained to respect the filter ordering as
 long as the result is the same, and it may even implement the
 composite Filtering in one single step.
 Since encryption alters the meaning of encrypted fields, when the
 Property Match Filtering classification is based on the encrypted
 field(s) in the packet, it MUST be able to recognize that the
 field(s) are not available and MUST NOT select those packets unless
 specifically directed by the Information Element description.  Even
 if they are ignored, the encrypted packets MUST be accounted for in
 the Selector packetsObserved Information Element [RFC5477], part of
 the Selection Sequence Statistics Report Interpretation.
 Example of a match-based filter Selector, whose rules are:
    IPv4 Source Address   = 192.0.2.1
    IPv4 Next-Hop Address = 192.0.2.129

Claise, et al. Standards Track [Page 31] RFC 5476 PSAMP Protocol Specification March 2009

 IPFIX Options Template Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |             Set ID =  3       |          Length = 26          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |        Template ID = 266      |       Field Count = 4         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     Scope Field Count = 1     |0|     selectorId = 302        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Scope 1 Length = 4       |0|   selectorAlgorithm = 304   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 1        |0|    sourceIPv4Address = 8    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |0|   ipNextHopIPv4Address = 15 |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 Associated IPFIX Data Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID = 266        |        Length = 11            |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                              21                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       5       |                        192.0.2 ...            |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    | ... .1        |                        192.0.2 ...            |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    | ... .129      |
    +-+-+-+-+-+-+-+-+
         Figure L: Example of the Selector Report Interpretation
               for Match-Based and Router State Filtering
 Notes:
  • A selectorAlgorithm value of 5 represents Property Match Filtering.
  • In this filter, there is a mix of information from the packet and

information from the router.

Claise, et al. Standards Track [Page 32] RFC 5476 PSAMP Protocol Specification March 2009

6.5.2.6. Hash-Based Filtering

 In Hash-based Selection, a Hash Function is run on IPv4 traffic.  The
 following fields MUST be used as input to that Hash Function:
  1. IP identification field
  1. Flags field
  1. Fragment offset
  1. Source IP address
  1. Destination IP address
  1. A number of bytes from the IP payload. The number of bytes and

starting offset MUST be configurable if the Hash Function

      supports it.
 For the bytes taken from the IP payload, IPSX has a fixed offset of 0
 bytes and a fixed size of 8 bytes.  The number and offset of payload
 bytes in the BOB function MUST be configurable.
 The minimum configuration ranges MUST be as follows:
    Number of bytes:  from 8 to 32
    Offset:           from 0 to 64
 If the selected payload bytes are not available and the Hash Function
 can take a variable-sized input, then the Hash Function MUST be run
 with the information that is available and a shorter size.  Passing 0
 as a substitute for missing payload bytes is only acceptable if the
 Hash Function takes a fixed size as is the case with IPSX.
 If the Hash Function can take an initialization value, then this
 value MUST be configurable.
 A Hash-based Selection function MAY be configurable as a digest
 function.  Any Selection Process that is configured as a digest
 function MUST have the output value included in the basic Packet
 Report for any selected packet.
 Each Hash Function used as a Hash-based Selection Selector requires
 its own value for the selectorAlgorithm.  Currently, we have BOB (6),
 IPSX (7), and CRC (8) defined and any MAY be used for either
 Filtering or creating a Packet Digest.  Only BOB is recommended
 though and SHOULD be used.

Claise, et al. Standards Track [Page 33] RFC 5476 PSAMP Protocol Specification March 2009

 The REQUIRED algorithm-specific Information Elements in case of
 Hash-based Selection are:
 hashIPPayloadOffset   - The payload offset used by a Hash-based
                         Selection Selector
 hashIPPayloadSize     - The payload size used by a Hash-based
                         Selection Selector
 hashOutputRangeMin    - One or more values for the beginning of each
                         potential output range.
 hashOutputRangeMax    - One or more values for the end of each
                         potential output range.
 hashSelectedRangeMin  - One or more values for the beginning of each
                         selected range.
 hashSelectedRangeMax  - One or more values for the end of each
                         selected range.
 hashDigestOutput      - A boolean value, TRUE if the output from this
                         Selector has been configured to be included
                         in the Packet Report as a packet digest.
 Note: If more than one selection or output range needs to be sent,
 then the minimum and maximum elements may be repeated as needed.
 These MUST make one or more non-overlapping ranges.  The elements
 SHOULD be sent as pairs of minimum and maximum in ascending order;
 however, if they are sent out of order, then there will only be one
 way to interpret the ranges to produce a non-overlapping range and
 the Collecting Process MUST be prepared to accept and decode this.
 The following algorithm-specific Information Element MAY be sent, but
 is optional for security considerations:
 hashInitialiserValue  - The initialiser value to the Hash Function.
 Since encryption alters the meaning of encrypted fields, when the
 Hash-based Filtering classification is based on the encrypted
 field(s) in the packet, it MUST be able to recognize that the
 field(s) are not available and MUST NOT select those packets.  Even
 if they are ignored, the encrypted packets MUST be accounted for in
 the Selector packetsObserved Information Element [RFC5477], which is
 part of the Selection Sequence Statistics Report Interpretation.

Claise, et al. Standards Track [Page 34] RFC 5476 PSAMP Protocol Specification March 2009

 Example of a Hash-based Filter Selector, whose configuration is:
    Hash Function           = BOB
    Hash IP Payload Offset  = 0
    Hash IP Payload Size    = 16
    Hash Initialiser Value  = 0x9A3F9A3F
    Hash Output Range       = 0 to 0xFFFFFFFF
    Hash Selected Range     = 100 to 200 and 400 to 500
 IPFIX Options Template Record:
    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |             Set ID =  3       |          Length = 50          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |        Template ID = 269      |       Field Count = 8         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     Scope Field Count = 1     |0|     selectorId = 302        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Scope 1 Length = 4       |0|   selectorAlgorithm = 302   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 1        |0|  hashIPpayloadOffset = 327  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |0|   hashIPpayloadSize = 328   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |0|  hashInitialiserValue = 329 |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |0|   hashOutputRangeMin = 330  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |0|   hashOutputRangeMax = 331  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |0|  hashSeletionRangeMin = 332 |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |0|  hashSeletionRangeMax = 333 |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |0|  hashSeletionRangeMin = 332 |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |0|  hashSeletionRangeMax = 333 |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Claise, et al. Standards Track [Page 35] RFC 5476 PSAMP Protocol Specification March 2009

 Associated IPFIX Data Record:
    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID = 266        |        Length = 45            |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                              22                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       6       |                            ...                |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    | ...   0       |                            ...                |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    | ...  16       |                      0x9A3F9A ...             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    | ...  3F       |                            ...                |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    | ...   0       |                      0xFFFFFF ...             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    | ...  FF       |                        ... 100                |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      ...      |                        ... 200                |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      ...      |                        ... 400                |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      ...      |                        ... 500                |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      ...      |
    +-+-+-+-+-+-+-+-+
         Figure M: Example of the Selector Report Interpretation
                        for Hash-based Filtering
 Notes:
  • A selectorAlgorithm value of 6 represents Hash-based Filtering

using the BOB algorithm.

6.5.2.7. Other Selection Methods

 Some potential new selection methods MAY be added.  Some of the new
 selection methods, such as non-uniform probabilistic Sampling and
 flow-state-dependent Sampling, are described in [RFC5475], with
 further references.

Claise, et al. Standards Track [Page 36] RFC 5476 PSAMP Protocol Specification March 2009

 Each new selection method MUST be assigned a unique value for the
 selectorAlgorithm Information Element.  Its configuration
 parameter(s), along with the way to report it/them with an Options
 Template, MUST be clearly specified.

6.5.3. Selection Sequence Statistics Report Interpretation

 A Selector MAY be used in multiple Selection Sequences.  However,
 each use of a Selector must be independent, so each separate logical
 instance of a Selector MUST maintain its own individual Selection
 State and statistics.
 The Selection Sequence Statistics Report Interpretation MUST include
 the number of observed packets (Population Size) and the number of
 packets selected (Sample Size) by each instance of its Primitive
 Selectors.
 Within a Selection Sequence composed of several Primitive Selectors,
 the number of packets selected for one Selector is equal to the
 number of packets seen by the next Selector.  The order of the
 Selectors in the Selection Sequence Statistics Report Interpretation
 MUST match the order of the Selectors in the Selection Sequence.
 If the full set of statistics is not sent as part of the Basic Packet
 Reports, the PSAMP Device MUST export a Selection Sequence Statistics
 Report Interpretation for every Selection Sequence, using an Options
 Template containing the following Information Elements:
    Scope:         selectionSequenceId
    Non-scope:     packetsObserved
                   packetsSelected (first Selector)
                   ...
                   packetsSelected (last Selector)
 The packetsObserved Information Element [RFC5477] MUST contain the
 number of packets seen at the Observation Point, and as a consequence
 passed to the first Selector in the Selection Sequence.  The
 packetsSelected Information Element [RFC5477] contains the number of
 packets selected by a Selector in the Selection Sequence.
 The Attained Selection Fraction for the Selection Sequence is
 calculated by dividing the number of selected packets
 (packetsSelected Information Element) for the last Selector by the
 number of observed packets (packetsObserved Information Element).
 The Attained Selection Fraction can be calculated for each Selector
 by dividing the number of packets selected for that Selector by the
 value for the previous Selector.

Claise, et al. Standards Track [Page 37] RFC 5476 PSAMP Protocol Specification March 2009

 The statistics for the whole sequence SHOULD be taken at a single
 logical point in time; the input value for a Selector MUST equal the
 output value of the previous Selector.
 The Selection Sequence Statistics Report Interpretation MUST be
 exported periodically.
 Example of Selection Sequence Statistics Report Interpretation:
 Selection Sequence 7 (Filter->Sampling):
    Observed   100  (observationPointId  1, Interface 5)
    Selected    50  (selectorId  5, match IPV4SourceAddress 192.0.2.1)
    Selected     6  (selectorId 10, Sampler: Random one out-of ten)
 Selection Sequence 9 (Sampling->Filtering):
    Observed   100  (observationPointId  1, Interface 5)
    Selected    10  (selectorId 10, Sampler: Random one out-of ten)
    Selected     3  (selectorId  5, match IPV4SourceAddress 192.0.2.1)
 IPFIX Options Template Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            Set ID = 3         |           Length = 26         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Template ID = 267       |        Field Count = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     Scope Field Count = 1     |0|  selectionSequenceId = 301  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Scope 1 Length = 4       |0|    packetsObserved = 318    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |0|    packetsSelected = 319    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |0|    packetsSelected = 319    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Claise, et al. Standards Track [Page 38] RFC 5476 PSAMP Protocol Specification March 2009

 The associated IPFIX Data Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID =  267       |          Length = 36          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               7                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                              100                              |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                              50                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               6                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               9                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                              100                              |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                              10                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                               3                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
         Figure N: Example of the Selection Sequence Statistics
                          Report Interpretation
 Notes:
  • The Attained Selection Fractions for Selection Sequence 7 are:

Filter 10: 50/100

          Sampler 5: 6/50
          Number of samples selected: 6
  • The Attained Selection Fractions for Selection Sequence 9 are:

Sampler 5: 10/100

          Filter 10: 3/10
          Number of samples selected: 3

6.5.4. Accuracy Report Interpretation

 In order for the Collecting Process to determine the inherent
 accuracy of the reported quantities (for example, timestamps), the
 PSAMP Device SHOULD send an Accuracy Report Interpretation.
 The Accuracy Report Interpretation MUST be exported by an Options
 Template Record with a scope that contains the Information Element
 for which the accuracy is required.  In case the accuracy is specific

Claise, et al. Standards Track [Page 39] RFC 5476 PSAMP Protocol Specification March 2009

 to a template, a second scope containing the templateId value MUST be
 added to the Options Template Record.  The accuracy SHOULD be
 reported either with the absoluteError Information Element [RFC5477]
 or with the relativeError Information Element [RFC5477].
 Accuracy Report Interpretation using the absoluteError Information
 Element:
  Scope:     informationElementId
  Non-scope: absoluteError
 Accuracy Report Interpretation using the absoluteError Information
 Element and a double scope:
  Scope:     templateId
             informationElementId
  Non-scope: absoluteError
 Accuracy Report Interpretation using the relativeError Information
 Element:
  Scope:     informationElementId
  Non-scope: relativeError
 Accuracy Report Interpretation using the relativeError Information
 Element and a double scope:
  Scope:     templateId
             informationElementId
  Non-scope: relativeError
 For example, the accuracy of an Information Element whose Abstract
 Data Type is dateTimeMilliseconds [RFC5102], for which the unit is
 specified as milliseconds, can be specified with the absoluteError
 Information Element with the milliseconds units.  In this case, the
 error interval is the Information Element value +/- the value
 reported in the absoluteError.
 For example, the accuracy of an Information Element to estimate the
 accuracy of a sampled flow, for which the unit would be specified in
 octets, can be specified with the relativeError Information Element
 with the octet units.  In this case, the error interval is the
 Information Element value +/- the value reported in the relativeError
 times the reported Information Element value.
 An alternative to reporting either the absoluteError Information
 Element or the relativeError Information Element in the Accuracy
 Report Interpretation, is to report both.  For this case whatever is
 least accurate for the reported value should be used.
 If the accuracy of a reported quantity changes on the Metering
 Process, a new Accuracy Report Interpretation MUST be generated.  The

Claise, et al. Standards Track [Page 40] RFC 5476 PSAMP Protocol Specification March 2009

 Collecting Process MUST keep the accuracy of the latest Accuracy
 Report Interpretation.
 Example of an Accuracy Report Interpretation using the absoluteError
 Information Element and a double scope: the timeMicroseconds
 contained in the Template 5 has an accuracy of +/- 2 ms, represented
 by the absoluteError Information Element.
 Scope:     templateId = 6
            informationElementId = timeMicroseconds
 Non-scope: absoluteError = 2 ms
 IPFIX Options Template Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            Set ID = 3         |           Length = 22         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Template ID = 267       |        Field Count = 3        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     Scope Field Count = 2     |0|       templateId = 145      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Scope 1 Length = 2       |0| InformationElementId = 303  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Scope 2 Length = 2       |0|      absoluteError = 320    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 The associated IPFIX Data Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID =  267       |          Length = 12          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              5                |             324               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                    2  (encoded as a float32)                  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
               Figure O: Example of the Selection Sequence
                    Statistics Report Interpretation

Claise, et al. Standards Track [Page 41] RFC 5476 PSAMP Protocol Specification March 2009

 Notes:
  • absoluteError is of type float64 but is compressed down to a

float32 here.

 The second example displays an Accuracy Report Interpretation using
 the relativeError Information Element and a single scope: the
 timeMicroseconds has an error of 5%, represented by the
 proportionalAccuracy Information Element.
 Scope:     informationElementId = timeMicroseconds
 Non-scope: relativeError = 0.05
 IPFIX Options Template Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            Set ID = 3         |           Length = 18         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Template ID = 268       |        Field Count = 2        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     Scope Field Count = 1     |0| InformationElementId = 303  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Scope 1 Length = 2       |0|      relativeError= 321     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 The associated IPFIX Data Record:
     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Set ID =  267       |          Length = 10          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |             324               |                     0.05 ...  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    | ...(encoded as a float32)     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
               Figure P: Example of the Selection Sequence
                    Statistics Report Interpretation
 Notes:
  • relativeError is of type float64 but is compressed down to a

float32 here.

Claise, et al. Standards Track [Page 42] RFC 5476 PSAMP Protocol Specification March 2009

7. Security Considerations

 As IPFIX has been selected as the PSAMP export protocol and as the
 PSAMP security requirements are not stricter than the IPFIX security
 requirements, refer to the IPFIX export protocol [RFC5101] for the
 security considerations.
 In the basic Packet Report, a PSAMP Device exports some number of
 contiguous bytes from the start of the packet, including the packet
 header (which includes link layer, network layer, and other
 encapsulation headers) and some subsequent bytes of the packet
 payload.  The PSAMP Device SHOULD NOT export the full payload of
 conversations, as this would mean wiretapping [RFC2804].  The PSAMP
 Device MUST respect local privacy laws.

8. IANA Considerations

 The PSAMP protocol, as set out in this document, has two sets of
 assigned numbers.  Considerations for assigning them are discussed in
 this section, using the example policies as set out in [RFC5226],
 "Guidelines for IANA Considerations".

8.1. IPFIX-Related Considerations

 As the PSAMP protocol uses the IPFIX protocol, refer to the IANA
 considerations section in [RFC5101] for the assignments of numbers
 used in the protocol and for the numbers used in the information
 model.

8.2. PSAMP-Related Considerations

 Each new selection method MUST be assigned a unique value for the
 selectorAlgorithm Information Element [RFC5477].  Initial contents of
 this registry are found in Section 8.2.1 in [RFC5477].  Its
 configuration parameter(s), along with the way to report them with an
 Options Template, MUST be clearly specified.
 New assignments for the PSAMP selection method will be administered
 by IANA, on a First Come First Served basis [RFC5226], subject to
 Expert Review [RFC5226].  The group of experts must double check the
 Information Elements definitions with already defined Information
 Elements for completeness, accuracy, and redundancy.  These experts
 will initially be drawn from the Working Group Chairs and document
 editors of the IPFIX and PSAMP Working Groups.

Claise, et al. Standards Track [Page 43] RFC 5476 PSAMP Protocol Specification March 2009

9. References

9.1. Normative References

 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.
 [RFC5101] Claise, B., Ed., "Specification of the IP Flow Information
           Export (IPFIX) Protocol for the Exchange of IP Traffic Flow
           Information", RFC 5101, January 2008.
 [RFC5102] Quittek, J., Bryant, S., Claise, B., Aitken, P., and J.
           Meyer, "Information Model for IP Flow Information Export",
           RFC 5102, January 2008.
 [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
           IANA Considerations Section in RFCs", BCP 26, RFC 5226, May
           2008.
 [RFC5475] Zseby, T., Molina, M., Duffield, N., Niccolini, S., and F.
           Raspall, "Sampling and Filtering Techniques for IP Packet
           Selection", RFC 5475, March 2009.
 [RFC5477] Dietz, T., Claise, B., Aitken, P., Dressler, F., and G.
           Carle, "Information Model for Packet Sampling Exports", RFC
           5477, March 2009.

9.2. Informative References

 [RFC2804] IAB and IESG, "IETF Policy on Wiretapping", RFC 2804, May
           2000.
 [RFC3917] Quittek, J., Zseby, T., Claise, B., and S. Zander,
           "Requirements for IP Flow Information Export (IPFIX)", RFC
           3917, October 2004.
 [RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A Border
           Gateway Protocol 4 (BGP-4)", RFC 4271, January 2006.
 [RFC5470] Sadasivan, G., Brownlee, N., Claise, B., and  J. Quittek,
           "Architecture for IP Flow Information Export" RFC 5470,
           March 2009.
 [RFC5474] Duffield, N., Ed., "A Framework for Packet Selection and
           Reporting", RFC 5474, March 2009.

Claise, et al. Standards Track [Page 44] RFC 5476 PSAMP Protocol Specification March 2009

10. Acknowledgments

 The authors would like to thank the PSAMP group, especially Paul
 Aitken for fruitful discussions and for proofreading the document
 several times.

Authors' Addresses

 Benoit Claise
 Cisco Systems
 De Kleetlaan 6a b1
 1831 Diegem
 Belgium
 Phone: +32 2 704 5622
 EMail: bclaise@cisco.com
 Juergen Quittek
 NEC Europe Ltd.
 Network Laboratories
 Kurfuersten-Anlage 36
 69115 Heidelberg
 Germany
 Phone: +49 6221 90511-15
 EMail: quittek@nw.neclab.eu
 Andrew Johnson
 Cisco Systems
 96 Commercial Quay
 Edinburgh EH6 6LX
 Scotland
 Phone: +44 131 561 3641
 EMail: andrjohn@cisco.com

Claise, et al. Standards Track [Page 45]

/data/webs/external/dokuwiki/data/pages/rfc/rfc5476.txt · Last modified: 2009/03/31 22:40 by 127.0.0.1

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki