GENWiki

Premier IT Outsourcing and Support Services within the UK

User Tools

Site Tools


rfc:rfc7014

Internet Engineering Task Force (IETF) S. D'Antonio Request for Comments: 7014 Univ. of Napoli "Parthenope" Category: Standards Track T. Zseby ISSN: 2070-1721 CAIDA/FhG FOKUS

                                                              C. Henke
                                       Tektronix Communications Berlin
                                                             L. Peluso
                                                  University of Napoli
                                                        September 2013
                     Flow Selection Techniques

Abstract

 The Intermediate Flow Selection Process is the process of selecting a
 subset of Flows from all observed Flows.  The Intermediate Flow
 Selection Process may be located at an IP Flow Information Export
 (IPFIX) Exporter or Collector, or within an IPFIX Mediator.  It
 reduces the effort of post-processing Flow data and transferring Flow
 Records.  This document describes motivations for using the
 Intermediate Flow Selection process and presents Intermediate Flow
 Selection techniques.  It provides an information model for
 configuring Intermediate Flow Selection Process techniques and
 discusses what information about an Intermediate Flow Selection
 Process should be exported.

Status of This Memo

 This is an Internet Standards Track document.
 This document is a product of the Internet Engineering Task Force
 (IETF).  It represents the consensus of the IETF community.  It has
 received public review and has been approved for publication by the
 Internet Engineering Steering Group (IESG).  Further information on
 Internet Standards is available in Section 2 of RFC 5741.
 Information about the current status of this document, any errata,
 and how to provide feedback on it may be obtained at
 http://www.rfc-editor.org/info/rfc7014.

D'Antonio, et al. Standards Track [Page 1] RFC 7014 Flow Selection Techniques September 2013

Copyright Notice

 Copyright (c) 2013 IETF Trust and the persons identified as the
 document authors.  All rights reserved.
 This document is subject to BCP 78 and the IETF Trust's Legal
 Provisions Relating to IETF Documents
 (http://trustee.ietf.org/license-info) in effect on the date of
 publication of this document.  Please review these documents
 carefully, as they describe your rights and restrictions with respect
 to this document.  Code Components extracted from this document must
 include Simplified BSD License text as described in Section 4.e of
 the Trust Legal Provisions and are provided without warranty as
 described in the Simplified BSD License.
 This document may contain material from IETF Documents or IETF
 Contributions published or made publicly available before November
 10, 2008.  The person(s) controlling the copyright in some of this
 material may not have granted the IETF Trust the right to allow
 modifications of such material outside the IETF Standards Process.
 Without obtaining an adequate license from the person(s) controlling
 the copyright in such materials, this document may not be modified
 outside the IETF Standards Process, and derivative works of it may
 not be created outside the IETF Standards Process, except to format
 it for publication as an RFC or to translate it into languages other
 than English.

D'Antonio, et al. Standards Track [Page 2] RFC 7014 Flow Selection Techniques September 2013

Table of Contents

 1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  4
   1.1.  Requirements Language  . . . . . . . . . . . . . . . . . .  4
 2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  4
 3.  Difference between Intermediate Flow Selection Process and
     Packet Selection . . . . . . . . . . . . . . . . . . . . . . .  7
 4.  Difference between Intermediate Flow Selection Process and
     Intermediate Selection Process . . . . . . . . . . . . . . . .  9
 5.  Intermediate Flow Selection Process within the IPFIX
     Architecture . . . . . . . . . . . . . . . . . . . . . . . . .  9
   5.1.  Intermediate Flow Selection Process in the Metering
         Process  . . . . . . . . . . . . . . . . . . . . . . . . . 11
   5.2.  Intermediate Flow Selection Process in the Exporting
         Process  . . . . . . . . . . . . . . . . . . . . . . . . . 11
   5.3.  Intermediate Flow Selection Process as a Function of
         the IPFIX Mediator . . . . . . . . . . . . . . . . . . . . 11
 6.  Intermediate Flow Selection Process Techniques . . . . . . . . 12
   6.1.  Flow Filtering . . . . . . . . . . . . . . . . . . . . . . 12
     6.1.1.  Property Match Filtering . . . . . . . . . . . . . . . 12
     6.1.2.  Hash-Based Flow Filtering  . . . . . . . . . . . . . . 13
   6.2.  Flow Sampling  . . . . . . . . . . . . . . . . . . . . . . 13
     6.2.1.  Systematic Sampling  . . . . . . . . . . . . . . . . . 13
     6.2.2.  Random Sampling  . . . . . . . . . . . . . . . . . . . 14
   6.3.  Flow-State Dependent Intermediate Flow Selection
         Process  . . . . . . . . . . . . . . . . . . . . . . . . . 14
   6.4.  Flow-State Dependent Packet Selection  . . . . . . . . . . 15
 7.  Configuration of Intermediate Flow Selection Process
     Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . 16
   7.1.  Intermediate Flow Selection Process Parameters . . . . . . 17
   7.2.  Description of Flow-State Dependent Packet Selection . . . 19
 8.  Information Model for Intermediate Flow Selection Process
     Configuration and Reporting  . . . . . . . . . . . . . . . . . 20
 9.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 22
   9.1.  Registration of Information Elements . . . . . . . . . . . 22
     9.1.1.  flowSelectorAlgorithm  . . . . . . . . . . . . . . . . 22
     9.1.2.  flowSelectedOctetDeltaCount  . . . . . . . . . . . . . 24
     9.1.3.  flowSelectedPacketDeltaCount . . . . . . . . . . . . . 24
     9.1.4.  flowSelectedFlowDeltaCount . . . . . . . . . . . . . . 24
     9.1.5.  selectorIDTotalFlowsObserved . . . . . . . . . . . . . 25
     9.1.6.  selectorIDTotalFlowsSelected . . . . . . . . . . . . . 25
     9.1.7.  samplingFlowInterval . . . . . . . . . . . . . . . . . 26
     9.1.8.  samplingFlowSpacing  . . . . . . . . . . . . . . . . . 26
     9.1.9.  flowSamplingTimeInterval . . . . . . . . . . . . . . . 27
     9.1.10. flowSamplingTimeSpacing  . . . . . . . . . . . . . . . 27
     9.1.11. hashFlowDomain . . . . . . . . . . . . . . . . . . . . 28
   9.2.  Registration of Object Identifier  . . . . . . . . . . . . 28
 10. Security and Privacy Considerations  . . . . . . . . . . . . . 28

D'Antonio, et al. Standards Track [Page 3] RFC 7014 Flow Selection Techniques September 2013

 11. Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 30
 12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 30
   12.1. Normative References . . . . . . . . . . . . . . . . . . . 30
   12.2. Informative References . . . . . . . . . . . . . . . . . . 31

1. Introduction

 This document describes Intermediate Flow Selection Process
 techniques for network traffic measurements.  A Flow is defined as a
 set of packets with common properties, as described in [RFC7011].  An
 Intermediate Flow Selection Process can be executed to limit the
 resource demands for capturing, storing, exporting, and post-
 processing Flow Records.  It also can be used to select a particular
 set of Flows that are of interest to a specific application.  This
 document provides a categorization of Intermediate Flow Selection
 Process techniques and describes configuration and reporting
 parameters for them.
 This document also addresses configuration and reporting parameters
 for Flow-state dependent packet selection as described in [RFC5475],
 although this technique is categorized as packet selection.  The
 reason is that Flow-state dependent packet selection techniques often
 aim at the reduction of resources for Flow capturing and Flow
 processing.  Furthermore, these techniques were only briefly
 discussed in [RFC5475].  Therefore, configuration and reporting
 considerations for Flow-state dependent packet selection techniques
 have been included in this document.

1.1. Requirements Language

 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
 document are to be interpreted as described in RFC 2119 [RFC2119].

2. Terminology

 This document is consistent with the terminology introduced in
 [RFC7011], [RFC5470], [RFC5475], and [RFC3917].  As in [RFC7011] and
 [RFC5476], the first letter of each IPFIX specific and Packet
 Sampling (PSAMP) specific term is capitalized, along with the
 Intermediate Flow Selection Process specific terms defined here.

D'Antonio, et al. Standards Track [Page 4] RFC 7014 Flow Selection Techniques September 2013

  • Packet Classification
    Packet Classification is a process by which packets are mapped to
    specific Flow Records, based on packet properties or external
    properties (e.g., interface).  The properties (e.g., header
    information, packet content, Autonomous System (AS) number) make
    up the Flow Key.  If a Flow Record for a specific Flow Key value
    already exists, the Flow Record is updated; otherwise, a new Flow
    Record is created.
  • Intermediate Flow Selection Process
    An Intermediate Flow Selection Process is an Intermediate Process,
    as defined in [RFC6183] that takes Flow Records as its input and
    selects a subset of this set as its output.  The Intermediate Flow
    Selection Process is a more general concept than the Intermediate
    Selection Process as defined in [RFC6183].  While an Intermediate
    Selection Process selects Flow Records from a sequence based upon
    criteria-evaluated Flow Record values and only passes on those
    Flow Records that match the criteria, an Intermediate Flow
    Selection Process selects Flow Records using selection criteria
    applicable to a larger set of Flow characteristics and
    information.
  • Flow Cache
    A Flow Cache is the set of Flow Records.
  • Flow Selection State
    An Intermediate Flow Selection Process maintains state information
    for use by the Flow Selector.  At a given time, the Flow Selection
    State may depend on Flows and packets observed at and before that
    time, as well as other variables.  Examples include:
    (i)   sequence number of packets and Flow Records;
    (ii)  number of selected Flows;
    (iii) number of observed Flows;
    (iv)  current Flow Cache occupancy;
    (v)   Flow specific counters, lower and upper bounds;
    (vi)  Intermediate Flow Selection Process timeout intervals.

D'Antonio, et al. Standards Track [Page 5] RFC 7014 Flow Selection Techniques September 2013

  • Flow Selector
    A Flow Selector defines the action of an Intermediate Flow
    Selection Process on a single Flow of its input.  The Flow
    Selector can make use of the following information in order to
    establish whether or not a Flow has to be selected:
    (i)   the content of the Flow Record;
    (ii)  any state information related to the Metering Process or
          Exporting Process;
    (iii) any Flow Selection State that may be maintained by the
          Intermediate Flow Selection Process.
  • Complete Flow
    A Complete Flow consists of all the packets that enter the
    Intermediate Flow Selection Process within the Flow timeout
    interval and that belong to the same Flow, per the definition of
    "Flow" in [RFC5470].  For this definition, only packets that
    arrive at the Intermediate Flow Selection Process are considered.
  • Flow Position
    Flow Position is the position of a Flow Record within the Flow
    Cache.
  • Flow Filtering
    Flow Filtering selects flows based on a deterministic function on
    the Flow Record content, Flow Selection State, external properties
    (e.g., ingress interface), or external events (e.g., violated
    Access Control List).  If the relevant parts of the Flow Record
    content can already be observed at the packet level (e.g., Flow
    Keys from packet header fields), Flow Filtering can be performed
    at the packet level by Property Match Filtering, as described in
    [RFC5475].
  • Hash-based Flow Filtering
    Hash-based Flow Filtering is a deterministic Flow filter function
    that selects flows based on a hash function.  The hash function is
    calculated over parts of the Flow Record content or external
    properties that are called the Hash Domain.  If the hash value
    falls into a predefined Hash Selection Range, the Flow is
    selected.

D'Antonio, et al. Standards Track [Page 6] RFC 7014 Flow Selection Techniques September 2013

  • Flow-state Dependent Intermediate Flow Selection Process
    The Flow-state dependent Intermediate Flow Selection Process is a
    selection function that selects or drops Flows based on the
    current Flow Selection State.  The selection can be either
    deterministic, random, or non-uniform random.
  • Flow-state Dependent Packet Selection
    Flow-state dependent packet selection is a selection function that
    selects or drops packets based on the current Flow Selection
    State.  The selection can be either deterministic, random, or non-
    uniform random.  Flow-state dependent packet selection can be used
    to implement a preference for the selection of packets belonging
    to specific Flows.  For example, the selection probability of
    packets belonging to Flows that are already within the Flow Cache
    may be higher than for packets that have not been recorded yet.
  • Flow Sampling
    Flow Sampling selects flows based on Flow Record sequence or
    arrival times (e.g., entry in Flow Cache, arrival time at Exporter
    or Mediator).  The selection can be systematic (e.g., every n-th
    Flow) or based on a random function (e.g., select each Flow Record
    with probability p, or randomly select n out of N Flow Records).

3. Difference between Intermediate Flow Selection Process and Packet

  Selection
 The Intermediate Flow Selection Process differs from packet selection
 as described in [RFC5475].  Packet selection techniques consider
 packets as the basic element, and the parent population consists of
 all packets observed at an Observation Point.  In contrast to this,
 the basic elements in Flow selection are the Flows.  The parent
 population consists of all observed Flows, and the Intermediate Flow
 Selection Process operates on the Flows.  The major characteristics
 of the Intermediate Flow Selection Process are the following:
  1. The Intermediate Flow Selection Process takes Flows as basic

elements. For packet selection, packets are considered as basic

    elements.
  1. The Intermediate Flow Selection Process typically takes place

after Packet Classification, because the classification rules

    determine to which Flow a packet belongs.  The Intermediate Flow
    Selection Process can be performed before Packet Classification.
    In that case, the Intermediate Flow Selection Process is based on
    the Flow Key (and also on a hash value over the Flow Key) but not

D'Antonio, et al. Standards Track [Page 7] RFC 7014 Flow Selection Techniques September 2013

    on characteristics that are only available after Packet
    Classification (e.g., Flow size, Flow duration).  Packet selection
    can be applied before and after Packet Classification.  As an
    example, packet selection before Packet Classification can be
    random packet selection, whereas packet selection after Packet
    Classification can be Flow-state dependent packet selection (as
    described in [RFC5475]).
  1. The Intermediate Flow Selection Process operates on Complete

Flows. That means that after the Intermediate Flow Selection

    Process, either all packets of the Flow are kept or all packets of
    the Flow are discarded.  That means that if the Intermediate Flow
    Selection Process is preceded by a packet selection process, the
    Complete Flow consists only of the packets that were not discarded
    during the packet selection.
 There are some techniques that are difficult to unambiguously
 categorize into one of the categories.  Here, some guidance is given
 on how to categorize such techniques:
  1. Techniques that can be considered as both packet selection and an

Intermediate Flow Selection Process: some packet selection

    techniques result in the selection of Complete Flows and therefore
    can be considered as packet selection or as an Intermediate Flow
    Selection Process at the same time.  An example is Property Match
    Filtering of all packets to a specific destination address.  If
    Flows are defined based on destination addresses, such a packet
    selection also results in an Intermediate Flow Selection Process
    and can be considered as packet selection or as an Intermediate
    Flow Selection Process.
  1. Flow-state Dependent Packet Selection: there exist techniques that

select packets based on the Flow state, e.g., based on the number

    of already observed packets belonging to the Flow.  Examples of
    these techniques from the literature include "Sample and Hold"
    [EsVa01], "Fast Filtered Sampling" [MSZC10], and the "Sticky
    Sampling" algorithm presented in [MaMo02].  Such techniques can be
    used to influence which Flows are captured (e.g., increase the
    selection of packets belonging to large Flows) and reduce the
    number of Flows that need to be stored in the Flow Cache.
    Nevertheless, such techniques do not necessarily select Complete
    Flows, because they do not ensure that all packets of a selected
    Flow are captured.  Therefore, Flow-state dependent packet
    selection techniques that do not ensure that either all or no
    packets of a Flow are selected, strictly speaking, have to be
    considered as packet selection techniques and not as Intermediate
    Flow Selection Process techniques.

D'Antonio, et al. Standards Track [Page 8] RFC 7014 Flow Selection Techniques September 2013

4. Difference between Intermediate Flow Selection Process and

  Intermediate Selection Process
 The Intermediate Flow Selection Process differs from the Intermediate
 Selection Process, since the Intermediate Flow Selection Process uses
 selection criteria that apply to a larger set of Flow information and
 properties than those used by the Intermediate Selection Process.
 The typical function of an Intermediate Selection Process is Property
 Match Filtering, which selects a Flow Record if the value of a
 specific field in the Flow Record matches a configured value or falls
 within a configured range.  This means that the selection criteria
 used by an Intermediate Selection Process are evaluated only on Flow
 Record values.  An Intermediate Flow Selection Process makes its
 decision on whether a Flow has to be selected or not by taking into
 account not only information related to the content of the Flow
 Record but also any Flow Selection State information or variable that
 can be used to select Flows in order to meet application requirements
 or resource constraints (e.g., Flow Cache occupancy, export link
 capacity).  Examples include flow counters, Intermediate Flow
 Selection Process timeout intervals, and Flow Record time
 information.

5. Intermediate Flow Selection Process within the IPFIX Architecture

 An Intermediate Flow Selection Process can be deployed at any of
 three places within the IPFIX architecture.  As shown in Figure 1,
 the Intermediate Flow Selection Process can occur
 1.  in the Metering Process at the IPFIX Exporter
 2.  in the Exporting Process at the Collector
 3.  within a Mediator

D'Antonio, et al. Standards Track [Page 9] RFC 7014 Flow Selection Techniques September 2013

              +===========================================+
              |  IPFIX Exporter        +----------------+ |
              |                        | Metering Proc. | |
              | +-----------------+    +----------------+ |
              | |    Metering     |    |  Intermediate  | |
              | |    Process      | or | Flow Selection | |
              | |                 |    |     Process    | |
              | +-----------------+----+----------------+ |
              | |           Exporting Process           | |
              | +----|-------------------------------|--+ |
              +======|===============================|====+
                     |                               |
                     |                               |
              +======|========================+      |
              |      |  Mediator              |      |
              |    +-V-------------------+    |      |
              |    | Collecting Process  |    |      |
              |    +---------------------+    |      |
              |    | Intermediate Flow   |    |      |
              |    | Selection Process   |    |      |
              |    +---------------------+    |      |
              |    |  Exporting Process  |    |      |
              |    +-|-------------------+    |      |
              +======|========================+      |
                     |                               |
                     |                               |
              +======|===============================|=====+
              |      |         Collector             |     |
              | +----V-------------------------------V-+   |
              | |         Collecting Process           |   |
              | +--------------------------------------+   |
              | | Intermediate Flow Selection Process  |   |
              | +--------------------------------------+   |
              | |           Exporting Process          |   |
              | +------------------------------|-------+   |
              +================================|===========+
                                               |
                                               |
                                               V
                                        +------------------+
                                        |       IPFIX      |
                                        +------------------+
   Figure 1: Potential Intermediate Flow Selection Process Locations
 In contrast to packet selection, the Intermediate Flow Selection
 Process is always applied after the packets are classified into
 Flows.

D'Antonio, et al. Standards Track [Page 10] RFC 7014 Flow Selection Techniques September 2013

5.1. Intermediate Flow Selection Process in the Metering Process

 An Intermediate Flow Selection Process in the Metering Process uses
 packet information to update the Flow Records in the Flow Cache.  The
 Intermediate Flow Selection Process, before Packet Classification,
 can be based on the Flow Key (and also on a hash value over the Flow
 Key) but not on characteristics that are only available after Packet
 Classification (e.g., Flow size, Flow duration).  Here, an
 Intermediate Flow Selection Process is applied to reduce resources
 for all subsequent processes or to select specific Flows of interest
 in cases where such Flow characteristics are already observable at
 the packet level (e.g., Flows to specific IP addresses).  In
 contrast, Flow-state dependent packet selection is a packet selection
 technique, because it does not necessarily select Complete Flows.

5.2. Intermediate Flow Selection Process in the Exporting Process

 An Intermediate Flow Selection Process in the Exporting Process works
 on Flow Records and can therefore depend on Flow characteristics that
 are only visible after the classification of packets, such as Flow
 size and Flow duration.  The Exporting Process may implement policies
 for exporting only a subset of the Flow Records that have been stored
 in the system's memory, in order to offload Flow export and Flow
 post-processing.  An Intermediate Flow Selection Process in the
 Exporting Process may select only the subset of Flow Records that are
 of interest to the user's application or select only as many Flow
 Records as can be handled by the available resources (e.g., limited
 export link capacity).

5.3. Intermediate Flow Selection Process as a Function of the IPFIX

    Mediator
 As shown in Figure 1, the Intermediate Flow Selection Process can be
 performed within an IPFIX Mediator [RFC6183].  The Intermediate Flow
 Selection Process takes a Flow Record stream as its input and selects
 Flow Records from a sequence based upon criteria-evaluated record
 values.  The Intermediate Flow Selection Process can again apply an
 Intermediate Flow Selection Process technique to obtain Flows of
 interest to the application.  Further, the Intermediate Flow
 Selection Process can base its selection decision on the correlation
 of data from different IPFIX Exporters, e.g., by only selecting Flows
 that were recorded on two or more IPFIX Exporters.

D'Antonio, et al. Standards Track [Page 11] RFC 7014 Flow Selection Techniques September 2013

6. Intermediate Flow Selection Process Techniques

 An Intermediate Flow Selection Process technique selects either all
 or none of the packets of a Flow; otherwise, the technique has to be
 considered as packet selection.  A difference between Flow Filtering
 and Flow sampling is recognized.

6.1. Flow Filtering

 Flow Filtering is a deterministic function on the IPFIX Flow Record
 content.  If the relevant Flow characteristics are already observable
 at the packet level (e.g., Flow Keys), Flow Filtering can be applied
 before aggregation at the packet level.  In order to be compliant
 with IPFIX, at least one of this document's Flow Filtering schemes
 MUST be implemented.

6.1.1. Property Match Filtering

 Property Match Filtering is performed similarly to Property Match
 Filtering for packet selection as described in [RFC5475].  The
 difference is that Flow Record fields are used here, instead of
 packet fields, to derive the selection decision.  Property Match
 Filtering is used to select a specific subset of the Flows that are
 of interest to a particular application (e.g., all Flows to a
 specific destination, all large Flows, etc.).  Properties on which
 the filtering is based can be Flow Keys, Flow Timestamps, or Per-Flow
 Counters as described in [RFC7012].  Examples include the Flow size
 in bytes, the number of packets in the Flow, the observation time of
 the first or last packet, and the maximum packet length.  An example
 of Property Match Filtering is to select Flows with more than a
 threshold number of observed octets.  The selection criteria can be a
 specific value, a set of specific values, or an interval.  For
 example, a Flow is selected if destinationIPv4Address and the total
 number of packets of the Flow equal two predefined values.  An
 Intermediate Flow Selection Process using Property Match Filtering in
 the Metering Process relies on properties that are observable at the
 packet level (e.g., Flow Key).  For example, a Flow is selected if
 sourceIPv4Address and sourceIPv4PrefixLength equal, respectively, two
 specific values.
 An Intermediate Flow Selection Process using Property Match Filtering
 in the Exporting Process is based on properties that are only visible
 after Packet Classification, such as Flow size and Flow duration.  An
 example is the selection of the largest Flows or a percentage of
 Flows with the longest lifetime.  Another example is to select and
 remove from the Flow Cache the Flow Record with the lowest Flow
 volume per current Flow lifetime if the Flow Cache is full.

D'Antonio, et al. Standards Track [Page 12] RFC 7014 Flow Selection Techniques September 2013

 An Intermediate Flow Selection Process using Property Match Filtering
 within an IPFIX Mediator selects a Flow Record if the value of a
 specific field in the Flow Record equals a configured value or falls
 within a configured range [RFC6183].

6.1.2. Hash-Based Flow Filtering

 Hash-based Flow Filtering uses a hash function h to map the Flow Key
 c onto a Hash Range R.  A Flow is selected if the hash value h(c) is
 within the Hash Selection Range S, which is a subset of R.  Hash-
 based Flow Filtering can be used to emulate a random sampling process
 but still enable the correlation between selected Flow subsets at
 different Observation Points.  Hash-based Flow Filtering is similar
 to Hash-based packet selection and is in fact identical when Hash-
 based packet selection uses the Flow Key that defines the Flow as the
 hash input.  Nevertheless, there may be the incentive to apply Hash-
 based Flow Filtering, but not at the packet level, in the Metering
 Process, for example, when the size of the selection range, and
 therefore the sampling probability, are dependent on the number of
 observed Flows.  If Hash-based Flow Filtering is used to select the
 same subset of flows at different Observation Points, the Hash Domain
 MUST only include parts of the Flow Record content that are invariant
 on the Flow path.  Refer also to the Trajectory Sampling application
 example of coordinated packet selection [RFC5475], which explains the
 hash-based filtering approach at the packet level.

6.2. Flow Sampling

 Flow sampling operates on Flow Record sequence or arrival times.  It
 can use either a systematic or a random function for the Intermediate
 Flow Selection Process.  Flow sampling usually aims at the selection
 of a representative subset of all Flows in order to estimate
 characteristics of the whole set (e.g., mean Flow size in the
 network).

6.2.1. Systematic Sampling

 Systematic sampling is a deterministic selection function.  It may be
 a periodic selection of the N-th Flow Record that arrives at the
 Intermediate Flow Selection Process.  Systematic sampling MAY be
 applied in the Metering Process.  An example would be to create,
 besides the Flow Cache of selected Flows, an additional data
 structure that saves the Flow Key values of the Flows that are not
 selected.  The selection of a Flow would then be based on the first
 packet of a Flow.  Every time a packet belonging to a new Flow (which
 is not in the data structure of either the selected or non-selected
 Flows) arrives at the Observation Point, a counter is increased.  If

D'Antonio, et al. Standards Track [Page 13] RFC 7014 Flow Selection Techniques September 2013

 the counter is increased to a multiple of N, a new Flow Cache entry
 is created; if the counter is not a multiple of N, the Flow Key value
 is added to the data structure for non-selected Flows.
 Systematic sampling can also be time-based.  Time-based systematic
 sampling is applied by only creating Flows that are observed between
 time-based start and stop triggers.  The time interval may be applied
 at the packet level in the Metering Process or after aggregation at
 the Flow level, e.g., by selecting a Flow arriving at the Exporting
 Process every n seconds.

6.2.2. Random Sampling

 Random Flow sampling is based on a random process that requires the
 calculation of random numbers.  One can differentiate between n-out-
 of-N and probabilistic Flow sampling.

6.2.2.1. n-out-of-N Flow Sampling

 In n-out-of-N Sampling, n elements are selected out of the parent
 population, which consists of N elements.  One example would be to
 generate n different random numbers in the range [1,N] and select all
 Flows that have a Flow Position equal to one of the random numbers.

6.2.2.2. Probabilistic Flow Sampling

 In probabilistic Sampling, the decision of whether or not a Flow is
 selected is made in accordance with a predefined selection
 probability.  For probabilistic Sampling, the Sample Size can vary
 for different trials.  The selection probability does not necessarily
 have to be the same for each Flow.  Therefore, a difference between
 uniform probabilistic sampling (with the same selection probability
 for all Flows) and non-uniform probabilistic sampling (where the
 selection probability can vary for different Flows) is recognized.
 For non-uniform probabilistic Flow sampling, the sampling probability
 may be adjusted according to the Flow Record content.  An example
 would be to increase the selection probability of large-volume Flows
 over small-volume Flows, as described in [DuLT01].

6.3. Flow-State Dependent Intermediate Flow Selection Process

 The Flow-state dependent Intermediate Flow Selection Process can be a
 deterministic or random Intermediate Flow Selection Process, based on
 the Flow Record content and the Flow state that may be kept
 additionally for each of the Flows.  External processes may update
 counters, bounds, and timers for each of the Flow Records, and the
 Intermediate Flow Selection Process utilizes this information for the
 selection decision.  A review of Flow-state dependent Intermediate

D'Antonio, et al. Standards Track [Page 14] RFC 7014 Flow Selection Techniques September 2013

 Flow Selection Process techniques that aim at the selection of the
 most frequent items by keeping additional Flow state information can
 be found in [CoHa08].  The Flow-state dependent Intermediate Flow
 Selection Process can only be applied after packet aggregation, when
 a packet has been assigned to a Flow.  The Intermediate Flow
 Selection Process then decides, based on the Flow state for each
 Flow, whether it is kept in the Flow Cache or not.  Two Flow-state
 dependent Intermediate Flow Selection Process Algorithms are
 described here:
 The Frequent algorithm [KaPS03] is a technique that aims at the
 selection of all flows that at least exceed a 1/k fraction of the
 Observed Packet Stream.  The algorithm has only a Flow Cache of size
 k-1, and each Flow in the Flow Cache has an additional counter.  The
 counter is incremented each time a packet belonging to the Flow in
 the Flow Cache is observed.  If the observed packet does not belong
 to any Flow, all counters are decremented; if any of the Flow
 counters has a value of zero, the Flow is replaced with a Flow formed
 from the new packet.
 Lossy counting is a selection technique that identifies all Flows
 whose packet count exceeds a certain percentage of the whole observed
 packet stream (e.g., 5% of all packets) with a certain estimation
 error e.  Lossy counting separates the observed packet stream in
 windows of size N=1/e, where N is an amount of consecutive packets.
 For each observed Flow, an additional counter will be held in the
 Flow state.  The counter is incremented each time a packet belonging
 to the Flow is observed, and all counters are decremented at the end
 of each window.  Also, all Flows with a counter of zero are removed
 from the Flow Cache.

6.4. Flow-State Dependent Packet Selection

 Flow-state dependent packet selection is not an Intermediate Flow
 Selection Process technique but a packet selection technique.
 Nevertheless, configuration and reporting parameters for this
 technique will be described in this document.  An example is the
 "Sample and Hold" algorithm [EsVa01], which tries to implement a
 preference for large-volume Flows in the selection.  When a packet
 arrives, it is selected when a Flow Record for this packet already
 exists.  If there is no Flow Record, the packet is selected according
 to a certain probability that is dependent on the packet size.

D'Antonio, et al. Standards Track [Page 15] RFC 7014 Flow Selection Techniques September 2013

7. Configuration of Intermediate Flow Selection Process Techniques

 This section describes the configuration parameters of the Flow
 selection techniques presented above.  It provides the basis for an
 information model to be adopted in order to configure the
 Intermediate Flow Selection Process within an IPFIX Device.  The
 information model with the Information Elements (IEs) for
 Intermediate Flow Selection Process configuration is described
 together with the reporting IEs in Section 8.  Table 1 gives an
 overview of the defined Intermediate Flow Selection Process
 techniques, where they can be applied, and what their input
 parameters are.  Depending on where the Flow selection techniques are
 applied, different input parameters can be configured.
 +-------------------+--------------------+--------------------------+
 | Location          | Selection          | Selection Input          |
 |                   | Technique          |                          |
 +-------------------+--------------------+--------------------------+
 | In the Metering   | Flow-state         | packet sampling          |
 | Process           | Dependent Packet   | probabilities, Flow      |
 |                   | Selection          | Selection State, packet  |
 |                   |                    | properties               |
 |                   |                    |                          |
 | In the Metering   | Property Match     | Flow Record IEs,         |
 | Process           | Flow Filtering     | Selection Interval       |
 |                   |                    |                          |
 | In the Metering   | Hash-based Flow    | selection range, hash    |
 | Process           | Filtering          | function, Flow Key, seed |
 |                   |                    | (optional)               |
 |                   |                    |                          |
 | In the Metering   | Time-based         | Flow Position (derived   |
 | Process           | Systematic Flow    | from arrival time of     |
 |                   | sampling           | packets), Flow Selection |
 |                   |                    | State                    |
 |                   |                    |                          |
 | In the Metering   | Sequence-based     | Flow Position (derived   |
 | Process           | Systematic Flow    | from packet position),   |
 |                   | sampling           | Flow Selection State     |
 |                   |                    |                          |
 | In the Metering   | Random Flow        | random number generator  |
 | Process           | sampling           | or list and packet       |
 |                   |                    | position, Flow state     |
 |                   |                    |                          |
 | In the Exporting  | Property Match     | Flow Record content,     |
 | Process/ within   | Flow Filtering     | filter function          |
 | the IPFIX         |                    |                          |
 | Mediator          |                    |                          |
 |                   |                    |                          |

D'Antonio, et al. Standards Track [Page 16] RFC 7014 Flow Selection Techniques September 2013

 | In the Exporting  | Hash-based Flow    | selection range, hash    |
 | Process/ within   | Filtering          | function, hash input     |
 | the IPFIX         |                    | (Flow Keys and other     |
 | Mediator          |                    | Flow properties)         |
 |                   |                    |                          |
 | In the Exporting  | Flow-state         | Flow state parameters,   |
 | Process/ within   | Dependent          | random number generator  |
 | the IPFIX         | Intermediate Flow  | or list                  |
 | Mediator          | Selection Process  |                          |
 |                   |                    |                          |
 | In the Exporting  | Time-based         | Flow arrival time, Flow  |
 | Process/ within   | Systematic Flow    | state                    |
 | the IPFIX         | sampling           |                          |
 | Mediator          |                    |                          |
 |                   |                    |                          |
 | In the Exporting  | Sequence-based     | Flow Position, Flow      |
 | Process/ within   | Systematic Flow    | state                    |
 | the IPFIX         | sampling           |                          |
 | Mediator          |                    |                          |
 |                   |                    |                          |
 | In the Exporting  | Random Flow        | random number generator  |
 | Process/ within   | sampling           | or list and Flow         |
 | the IPFIX         |                    | Position, Flow state     |
 | Mediator          |                    |                          |
 +-------------------+--------------------+--------------------------+
  Table 1: Overview of Intermediate Flow Selection Process Techniques

7.1. Intermediate Flow Selection Process Parameters

 This section defines what parameters are required to describe the
 most common Intermediate Flow Selection Process techniques.
 Intermediate Flow Selection Process Parameters:
 For Property Match Filtering:
  1. Information Element as specified in [IANA-IPFIX]):

Specifies the Information Element that is used as the property in

    the filter expression.  Section 8 specifies the Information
    Elements that MUST be exported by an Intermediate Flow Selection
    Process using Property Match Filtering.
  1. Selection Value or Value Interval:

Specifies the value or interval of the filter expression. Packets

    and Flow Records that have a value equal to the Selection Value or
    within the Interval will be selected.

D'Antonio, et al. Standards Track [Page 17] RFC 7014 Flow Selection Techniques September 2013

 For Hash-based Flow Filtering:
  1. Hash Domain:

Specifies the bits from the packet or Flow that are taken as the

    hash input to the hash function.
  1. Hash Function:

Specifies the name of the hash function that is used to calculate

    the hash value.  Possible hash functions are BOB [RFC5475], IP
    Shift-XOR (IPSX) [RFC5475], and CRC-32 [Bra75].
  1. Hash Selection Range:

Flows that have a hash value within the Hash Selection Range are

    selected.  The Hash Selection Range can be a value interval or
    arbitrary hash values within the Hash Range of the hash function.
  1. Random Seed or Initializer Value:

Some hash functions require an initializing value. In order to

    make the selection decision more secure, one can choose a random
    seed that configures the hash function.
 For Flow-state Dependent Intermediate Flow Selection Process:
  1. Frequency threshold:

Specifies the frequency threshold s for Flow-state dependent Flow

    Selection techniques that try to find the most frequent items
    within a dataset.  All Flows that exceed the defined threshold
    will be selected.
  1. Accuracy parameter:

Specifies the accuracy parameter e for techniques that deal with

    the issue of mining frequent items in a dataset.  The accuracy
    parameter defines the maximum error, i.e., no Flows that have a
    true frequency less than (s - e) N are selected, where s is the
    frequency threshold and N is the total number of packets.
 The above list of parameters for Flow-state dependent Flow Selection
 techniques is suitable for the presented frequent item and lossy
 counting algorithms.  Nevertheless, a variety of techniques exist
 with very specific parameters not defined here.
 For Systematic time-based Flow sampling:
  1. Interval length (in usec):

Defines the length of the sampling interval during which Flows are

    selected.

D'Antonio, et al. Standards Track [Page 18] RFC 7014 Flow Selection Techniques September 2013

  1. Spacing (in usec):

Defines the spacing in usec between the end of one sampling

    interval and the start of the next interval.
 For Systematic count-based Flow sampling:
  1. Interval length:

Defines the number of Flows that are selected within the sampling

    interval.
  1. Spacing:

Defines the spacing, in number of observed Flows, between the end

    of one sampling interval and the start of the next interval.
 For random n-out-of-N Flow sampling:
  1. Population Size N:

The number of all Flows in the Population from which the sample is

    drawn.
  1. Sampling Size n:

The number of Flows that are randomly drawn from the population N.

 For probabilistic Flow sampling:
  1. Sampling probability p:

Defines the probability by which each of the observed Flows is

    selected.

7.2. Description of Flow-State Dependent Packet Selection

 The configuration of Flow-state dependent packet selection has not
 been described in [RFC5475]; therefore, the parameters are defined
 here:
 For Flow-state Dependent Packet Selection:
  1. Packet selection probability per possible Flow state interval:

Defines multiple {Flow interval, packet selection probability}

    value pairs that configure the sampling probability, depending on
    the current Flow state.
  1. Additional parameters:

For the configuration of Flow-state dependent packet selection,

    additional parameters or packet properties may be required, e.g.,
    the packet size [EsVa01].

D'Antonio, et al. Standards Track [Page 19] RFC 7014 Flow Selection Techniques September 2013

8. Information Model for Intermediate Flow Selection Process

  Configuration and Reporting
 This section specifies the Information Elements that MUST be exported
 by an Intermediate Flow Selection Process in order to support the
 interpretation of measurement results from Flow measurements.  The
 information is mainly used to report how many packets and Flows have
 been observed in total and how many of them were selected.  This
 helps, for instance, to calculate the Attained Selection Fraction
 (see also [RFC5476]), which is an important parameter for providing
 an accuracy statement.  The IEs can provide reporting information
 about Flow Records, packets, or bytes.  The reported metrics are the
 total number of elements and the number of selected elements.  The
 number of dropped elements can be derived from this information.

D'Antonio, et al. Standards Track [Page 20] RFC 7014 Flow Selection Techniques September 2013

 Table 2 shows a list of Intermediate Flow Selection Process
 Information Elements:
 ID   Name                         | ID   Name
 ----------------------------------+----------------------------------
 301  selectionSequenceID          | 302  selectorID
                                   |
 390  flowSelectorAlgorithm        |   1  octetDeltaCount
                                   |
 391  flowSelectedOctetDeltaCount  |   2  packetDeltaCount
                                   |
 392  flowSelectedPacketDeltaCount |   3  originalFlowsPresent
                                   |
 393  flowSelectedFlowDeltaCount   | 394  selectorIDTotalFlowsObserved
                                   |
 395  selectorIDTotalFlowsSelected | 396  samplingFlowInterval
                                   |
 397  samplingFlowSpacing          | 309  samplingSize
                                   |
 310  samplingPopulation           | 311  samplingProbability
                                   |
 398  flowSamplingTimeInterval     | 399  flowSamplingTimeSpacing
                                   |
 326  digestHashValue              | 400  hashFlowDomain
                                   |
 329  hashOutputRangeMin           | 330  hashOutputRangeMax
                                   |
 331  hashSelectedRangeMin         | 332  hashSelectedRangeMax
                                   |
 333  hashDigestOutput             | 334  hashInitialiserValue
                                   |
 320  absoluteError                | 321  relativeError
                                   |
 336  upperCILimit                 | 337  lowerCILimit
                                   |
 338  confidenceLevel              |
   Table 2: Intermediate Flow Selection Process Information Elements

D'Antonio, et al. Standards Track [Page 21] RFC 7014 Flow Selection Techniques September 2013

9. IANA Considerations

9.1. Registration of Information Elements

 IANA has registered the following IEs in the "IPFIX Information
 Elements" registry at http://www.iana.org/assignments/ipfix/.

9.1.1. flowSelectorAlgorithm

 Description:
    This Information Element identifies the Intermediate Flow
    Selection Process technique (e.g., Filtering, Sampling) that is
    applied by the Intermediate Flow Selection Process.  Most of these
    techniques have parameters; configuration parameter(s) MUST be
    clearly specified.  Further Information Elements are needed to
    fully specify packet selection with these methods and all their
    parameters.  Further method identifiers may be added to the list
    below.  It might be necessary to define new Information Elements
    to specify their parameters.  The flowSelectorAlgorithm registry
    is maintained by IANA.  New assignments for the registry will be
    administered by IANA, on a First Come First Served basis
    [RFC5226], subject to Expert Review [RFC5226].  Please note that
    the purpose of the flow selection techniques described in this
    document is the improvement of measurement functions as defined in
    the Introduction (Section 1).  Before adding new flow selector
    algorithms, their intended purposes should be determined,
    especially if those purposes contradict any policies defined in
    [RFC2804].  The designated expert(s) should consult with the
    community if a request that runs counter to [RFC2804] is received.
    The registry can be updated when specifications of the new
    method(s) and any new Information Elements are provided.  The
    group of experts must double-check the flowSelectorAlgorithm
    definitions and Information Elements with already-defined
    flowSelectorAlgorithm definitions and Information Elements for
    completeness, accuracy, and redundancy.  Those experts will
    initially be drawn from the Working Group Chairs and document
    editors of the IPFIX and PSAMP Working Groups.  The following
    identifiers for Intermediate Flow Selection Process Techniques are
    defined here:

D'Antonio, et al. Standards Track [Page 22] RFC 7014 Flow Selection Techniques September 2013

       +----+------------------------+--------------------------+
       | ID |       Technique        |      Parameters          |
       +----+------------------------+--------------------------+
       | 1  | Systematic count-based | flowSamplingInterval     |
       |    | Sampling               | flowSamplingSpacing      |
       +----+------------------------+--------------------------+
       | 2  | Systematic time-based  | flowSamplingTimeInterval |
       |    | Sampling               | flowSamplingTimeSpacing  |
       +----+------------------------+--------------------------+
       | 3  | Random n-out-of-N      | samplingSize             |
       |    | Sampling               | samplingPopulation       |
       +----+------------------------+--------------------------+
       | 4  | Uniform probabilistic  | samplingProbability      |
       |    | Sampling               |                          |
       +----+------------------------+--------------------------+
       | 5  | Property Match         | Information Element      |
       |    | Filtering              | Value Range              |
       +----+------------------------+--------------------------+
       |   Hash-based Filtering      | hashInitialiserValue     |
       +----+------------------------+ hashFlowDomain           |
       | 6  | using BOB              | hashSelectedRangeMin     |
       +----+------------------------+ hashSelectedRangeMax     |
       | 7  | using IPSX             | hashOutputRangeMin       |
       +----+------------------------+ hashOutputRangeMax       |
       | 8  | using CRC              |                          |
       +----+------------------------+--------------------------+
       | 9  | Flow-state Dependent   |No agreed Parameters      |
       |    | Intermediate Flow      |                          |
       |    | Selection Process      |                          |
       +----+------------------------+--------------------------+
        Table 3: Intermediate Flow Selection Process Techniques
 Abstract Data Type: unsigned16
 ElementId: 390
 Data Type Semantics: identifier
 Status: current

D'Antonio, et al. Standards Track [Page 23] RFC 7014 Flow Selection Techniques September 2013

9.1.2. flowSelectedOctetDeltaCount

 Description:
    This Information Element specifies the volume in octets of all
    Flows that are selected in the Intermediate Flow Selection Process
    since the previous report.
 Abstract Data Type: unsigned64
 ElementId: 391
 Units: octets
 Status: current

9.1.3. flowSelectedPacketDeltaCount

 Description:
    This Information Element specifies the volume in packets of all
    Flows that were selected in the Intermediate Flow Selection
    Process since the previous report.
 Abstract Data Type: unsigned64
 ElementId: 392
 Units: packets
 Status: current

9.1.4. flowSelectedFlowDeltaCount

 Description:
    This Information Element specifies the number of Flows that were
    selected in the Intermediate Flow Selection Process since the last
    report.
 Abstract Data Type: unsigned64
 ElementId: 393
 Units: flows
 Status: current

D'Antonio, et al. Standards Track [Page 24] RFC 7014 Flow Selection Techniques September 2013

9.1.5. selectorIDTotalFlowsObserved

 Description:
    This Information Element specifies the total number of Flows
    observed by a Selector, for a specific value of SelectorID.  This
    Information Element should be used in an Options Template scoped
    to the observation to which it refers.  See Section 3.4.2.1 of the
    IPFIX protocol document [RFC7011].
 Abstract Data Type: unsigned64
 ElementId: 394
 Units: flows
 Status: current

9.1.6. selectorIDTotalFlowsSelected

 Description:
    This Information Element specifies the total number of Flows
    selected by a Selector, for a specific value of SelectorID.  This
    Information Element should be used in an Options Template scoped
    to the observation to which it refers.  See Section 3.4.2.1 of the
    IPFIX protocol document [RFC7011].
 Abstract Data Type: unsigned64
 ElementId: 395
 Units: flows
 Status: current

D'Antonio, et al. Standards Track [Page 25] RFC 7014 Flow Selection Techniques September 2013

9.1.7. samplingFlowInterval

 Description:
    This Information Element specifies the number of Flows that are
    consecutively sampled.  A value of 100 means that 100 consecutive
    Flows are sampled.  For example, this Information Element may be
    used to describe the configuration of a systematic count-based
    Sampling Selector.
 Abstract Data Type: unsigned64
 ElementId: 396
 Units: flows
 Status: current

9.1.8. samplingFlowSpacing

 Description:
    This Information Element specifies the number of Flows between two
    "samplingFlowInterval"s.  A value of 100 means that the next
    interval starts 100 Flows (which are not sampled) after the
    current "samplingFlowInterval" is over.  For example, this
    Information Element may be used to describe the configuration of a
    systematic count-based Sampling Selector.
 Abstract Data Type: unsigned64
 ElementId: 397
 Units: flows
 Status: current

D'Antonio, et al. Standards Track [Page 26] RFC 7014 Flow Selection Techniques September 2013

9.1.9. flowSamplingTimeInterval

 Description:
    This Information Element specifies the time interval in
    microseconds during which all arriving Flows are sampled.  For
    example, this Information Element may be used to describe the
    configuration of a systematic time-based Sampling Selector.
 Abstract Data Type: unsigned64
 ElementId: 398
 Units: microseconds
 Status: current

9.1.10. flowSamplingTimeSpacing

 Description:
    This Information Element specifies the time interval in
    microseconds between two "flowSamplingTimeInterval"s.  A value of
    100 means that the next interval starts 100 microseconds (during
    which no Flows are sampled) after the current
    "flowsamplingTimeInterval" is over.  For example, this Information
    Element may be used to describe the configuration of a systematic
    time-based Sampling Selector.
 Abstract Data Type: unsigned64
 ElementId: 399
 Units: microseconds
 Status: current

D'Antonio, et al. Standards Track [Page 27] RFC 7014 Flow Selection Techniques September 2013

9.1.11. hashFlowDomain

 Description:
    This Information Element specifies the Information Elements that
    are used by the Hash-based Flow Selector as the Hash Domain.
 Abstract Data Type: unsigned16
 ElementId: 400
 Data Type Semantics: identifier
 Status: Current

9.2. Registration of Object Identifier

 IANA has registered the following OID in the IPFIX-SELECTOR-MIB
 Functions subregistry at http://www.iana.org/assignments/smi-numbers
 according to the procedures set forth in [RFC6615].
 +---------+-----------------------+---------------------+-----------+
 | Decimal | Name                  | Description         | Reference |
 +---------+-----------------------+---------------------+-----------+
 | 8       | flowSelectorAlgorithm | This Object         | [RFC7014] |
 |         |                       | Identifier          |           |
 |         |                       | identifies the      |           |
 |         |                       | Intermediate Flow   |           |
 |         |                       | Selection Process   |           |
 |         |                       | technique (e.g.,    |           |
 |         |                       | Filtering,          |           |
 |         |                       | Sampling) that is   |           |
 |         |                       | applied by the      |           |
 |         |                       | Intermediate Flow   |           |
 |         |                       | Selection Process   |           |
 +---------+-----------------------+---------------------+-----------+
             Table 4: Object Identifiers to Be Registered

10. Security and Privacy Considerations

 Flow data exported by Exporting Processes, and collected by
 Collecting Processes, can be sensitive for privacy reasons and need
 to be protected.  Privacy considerations for collected data are
 provided in [RFC7011].
 Some of the described Intermediate Flow Selection Process techniques
 (e.g., Flow sampling, hash-based Flow Filtering) aim at the selection

D'Antonio, et al. Standards Track [Page 28] RFC 7014 Flow Selection Techniques September 2013

 of a representative subset of flows in order to estimate parameters
 of the population.  An adversary may have incentives to influence the
 selection of flows, for example, to circumvent accounting or to avoid
 the detection of packets that are part of an attack.
 Security considerations concerning the choice of a hash function for
 Hash-based packet selection have been discussed in Section 6.2.3 of
 [RFC5475] and are also appropriate for Hash-based Flow Selection.
 [RFC5475] discusses the possibility of crafting Packet Streams that
 are disproportionately selected or can be used to discover hash
 function parameters.  It also describes vulnerabilities of different
 hash functions to these attacks and discusses practices to minimize
 these vulnerabilities.
 For other sampling approaches, an adversary can gain knowledge about
 the start and stop triggers in time-based systematic Sampling, e.g.,
 by sending test packets.  This knowledge might allow adversaries to
 modify their send schedule in such a way that their packets are
 disproportionately selected or not selected.  For random Sampling, an
 input to the encryption process, like the Initialization Vector of
 the CBC (Cipher Block Chaining) mode, should be used to prevent an
 adversary from predicting the selection decision [Dw01].
 Further security threats can occur when Intermediate Flow Selection
 Process parameters are configured or communicated to other entities.
 The protocol(s) for the configuration and reporting of Intermediate
 Flow Selection Process parameters are out of scope for this document.
 Nevertheless, a set of initial requirements for future configuration
 and reporting protocols are stated below:
 1.  Protection against disclosure of configuration information:
     Intermediate Flow Selection Process configuration information
     describes the Intermediate Flow Selection Process and its
     parameters.  This information can be useful to attackers.
     Attackers may craft packets that never fit the selection criteria
     in order to prevent Flows from being seen by the Intermediate
     Flow Selection Process.  They can also craft a lot of packets
     that fit the selection criteria and overload or bias subsequent
     processes.  Therefore, any transmission of configuration data
     (e.g., to configure a process or to report its actual status)
     should be protected by encryption.
 2.  Protection against modification of configuration information:
     Sending incorrect configuration information to the Intermediate
     Flow Selection Process can lead to a malfunction of the
     Intermediate Flow Selection Process.  Additionally, reporting
     incorrect configuration information from the Intermediate Flow
     Selection Process to other processes can lead to incorrect

D'Antonio, et al. Standards Track [Page 29] RFC 7014 Flow Selection Techniques September 2013

     estimations at subsequent processes.  Therefore, any protocol
     that transmits configuration information should prevent an
     attacker from modifying configuration information.  Data
     integrity can be achieved by authenticating the data.
 3.  Protection against malicious nodes sending configuration
     information:
     The remote configuration of Intermediate Flow Selection Process
     techniques should be protected against access by unauthorized
     nodes.  This can be achieved by access control lists at the
     device that hosts the Intermediate Flow Selection Process (e.g.,
     IPFIX Exporter, IPFIX Mediator, or IPFIX Collector) and by source
     authentication.  The reporting of configuration data from an
     Intermediate Flow Selection Process has to be protected in the
     same way.  That means that protocols that report configuration
     data from the Intermediate Flow Selection Process to other
     processes also need to protect against unauthorized nodes
     reporting configuration information.
 The security threats that originate from communicating configuration
 information to and from Intermediate Flow Selection Processes cannot
 be assessed solely with the information given in this document.  A
 further and more detailed assessment of security threats is necessary
 when a specific protocol for the configuration or reporting
 configuration data is proposed.

11. Acknowledgments

 We would like to thank the IPFIX group, especially Brian Trammell,
 Paul Aitken, and Benoit Claise, for fruitful discussions and for
 proofreading the document.

12. References

12.1. Normative References

 [RFC2119]     Bradner, S., "Key words for use in RFCs to Indicate
               Requirement Levels", BCP 14, RFC 2119, March 1997.
 [RFC5475]     Zseby, T., Molina, M., Duffield, N., Niccolini, S., and
               F. Raspall, "Sampling and Filtering Techniques for IP
               Packet Selection", RFC 5475, March 2009.
 [RFC5476]     Claise, B., Johnson, A., and J. Quittek, "Packet
               Sampling (PSAMP) Protocol Specifications", RFC 5476,
               March 2009.

D'Antonio, et al. Standards Track [Page 30] RFC 7014 Flow Selection Techniques September 2013

 [RFC6615]     Dietz, T., Kobayashi, A., Claise, B., and G. Muenz,
               "Definitions of Managed Objects for IP Flow Information
               Export", RFC 6615, June 2012.
 [RFC7011]     Claise, B., Ed., Trammell, B., Ed., and P. Aitken,
               "Specification of the IP Flow Information Export
               (IPFIX) Protocol for the Exchange of Flow Information",
               STD 77, RFC 7011, September 2013.
 [RFC7012]     Claise, B., Ed. and B. Trammell, Ed., "Information
               Model for IP Flow Information Export (IPFIX)",
               RFC 7012, September 2013.

12.2. Informative References

 [Bra75]       Brayer, K., "Evaluation of 32 Degree Polynomials in
               Error Detection on the SATIN IV Autovon Error
               Patterns", National Technical Information Service,
               August 1975.
 [CoHa08]      Cormode, G. and M. Hadjieleftheriou, "Finding Frequent
               Items in Data Streams", Proceedings of the 34th
               International Conference on Very Large DataBases
               (VLDB), Auckland, New Zealand, Volume 1, Issue 2, pages
               1530-1541, August 2008.
 [DuLT01]      Duffield, N., Lund, C., and M. Thorup, "Charging from
               Sampled Network Usage", ACM SIGCOMM Internet
               Measurement Workshop (IMW) 2001, pages 245-256, San
               Francisco, CA, USA, November 2001.
 [Dw01]        Dworkin, M., "Recommendation for Block Cipher Modes of
               Operation - Methods and Techniques", NIST Special
               Publication 800-38A, December 2001.
 [EsVa01]      Estan, C. and G,. Varghese, "New Directions in Traffic
               Measurement and Accounting: Focusing on the Elephants,
               Ignoring the Mice", ACM SIGCOMM Internet Measurement
               Workshop (IMW) 2001, San Francisco, CA, USA,
               November 2001.
 [IANA-IPFIX]  IANA, "IP Flow Information Export (IPFIX) Entities
               Registry", <http://www.iana.org/assignments/ipfix/>.
 [KaPS03]      Karp, R., Papadimitriou, C., and S. Shenker, "A simple
               algorithm for finding frequent elements in sets and
               bags", ACM Transactions on Database Systems, Volume 28,
               pages 51-55, March 2003.

D'Antonio, et al. Standards Track [Page 31] RFC 7014 Flow Selection Techniques September 2013

 [MSZC10]      Mai, J., Sridharan, A., Zang, H., and C. Chuah, "Fast
               Filtered Sampling", Computer Networks Volume 54, Issue
               11, pages 1885-1898, ISSN 1389-1286, August 2010.
 [MaMo02]      Manku, G. and R. Motwani, "Approximate Frequency Counts
               over Data Streams", Proceedings of the 28th
               International Conference on Very Large DataBases
               (VLDB), Hong Kong, China, pages 346-357, August 2002.
 [RFC2804]     IAB and IESG, "IETF Policy on Wiretapping", RFC 2804,
               May 2000.
 [RFC3917]     Quittek, J., Zseby, T., Claise, B., and S. Zander,
               "Requirements for IP Flow Information Export (IPFIX)",
               RFC 3917, October 2004.
 [RFC5226]     Narten, T. and H. Alvestrand, "Guidelines for Writing
               an IANA Considerations Section in RFCs", BCP 26,
               RFC 5226, May 2008.
 [RFC5470]     Sadasivan, G., Brownlee, N., Claise, B., and J.
               Quittek, "Architecture for IP Flow Information Export",
               RFC 5470, March 2009.
 [RFC6183]     Kobayashi, A., Claise, B., Muenz, G., and K. Ishibashi,
               "IP Flow Information Export (IPFIX) Mediation:
               Framework", RFC 6183, April 2011.

D'Antonio, et al. Standards Track [Page 32] RFC 7014 Flow Selection Techniques September 2013

Authors' Addresses

 Salvatore D'Antonio
 University of Napoli "Parthenope"
 Centro Direzionale di Napoli Is. C4
 Naples  80143
 Italy
 Phone: +39 081 5476766
 EMail: salvatore.dantonio@uniparthenope.it
 Tanja Zseby
 CAIDA/FhG FOKUS
 San Diego Supercomputer Center (SDSC)
 University of California, San Diego (UCSD)
 9500 Gilman Drive
 La Jolla, CA  92093-0505
 USA
 EMail: tanja.zseby@tuwien.ac.at
 Christian Henke
 Tektronix Communications Berlin
 Wohlrabedamm 32
 Berlin  13629
 Germany
 Phone: +49 17 2323 8717
 EMail: christian.henke@tektronix.com
 Lorenzo Peluso
 University of Napoli
 Via Claudio 21
 Napoli  80125
 Italy
 Phone: +39 081 7683821
 EMail: lorenzo.peluso@unina.it

D'Antonio, et al. Standards Track [Page 33]

/data/webs/external/dokuwiki/data/pages/rfc/rfc7014.txt · Last modified: 2013/09/16 04:49 by 127.0.0.1

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki