2.4.7 IP Flow Information Export (ipfix)

NOTE: This charter is a snapshot of the 71st IETF Meeting in Philadelphia, PA USA. It may now be out-of-date.

Last Modified: 2008-03-20

Chair(s):

Nevil Brownlee <n.brownlee@auckland.ac.nz>
Juergen Quittek <quittek@netlab.nec.de>

Operations and Management Area Director(s):

Dan Romascanu <dromasca@avaya.com>
Ronald Bonica <rbonica@juniper.net>

Operations and Management Area Advisor:

Dan Romascanu <dromasca@avaya.com>

Mailing Lists:

General Discussion: ipfix@ietf.org
To Subscribe: http://www1.ietf.org/mailman/listinfo/ipfix
Archive: http://www1.ietf.org/mail-archive/web/ipfix/current/index.html

Description of Working Group:

The IPFIX working group has specified the Information Model (to
describe IP flows) and the IPFIX protocol (to transfer IP flow data
from IPFIX exporters to collectors). Several implementers have already
built applications using the IPFIX protocol. As a result of a series
of IPFIX interoperability testing events the WG has produced
guidelines for IPFIX implementation and testing as well as
recommendations for handling special cases such as bidirectional flow
reporting and reducing redundancy in flow records.

Practical experiences with IPFIX implementations exposed new
requirements for the IPFIX protocol that so far have not been
addressed by the WG. The major current goal of the WG is developing
solutions that meet the new requirements without modifying the core
IPFIX protocol specifications.

1. The IPFIX WG has developed a MIB module for monitoring IPFIX
implementations. Means for configuring these devices have not been
standardized yet. The WG will develop an XML-based configuration data
model that can be used for configuring IPFIX devices and for storing,
modifying and managing IPFIX configurations parameter sets. This work
will be performed in close collaboration with the NETCONF WG.

2. There is a need for storing measured flow information and for
exchanging this information between different systems and
organizations. The WG will develop a common IPFIX file format for
storing flow data in order to facilitate interoperability and
reusability among a wide variety of flow storage, processing, and
analysis tools. It will be a flat-file format using binary encodings
that are based on the IPFIX message format.

3. When dealing with enterprise-specific information elements in IPFIX
flow records, it often occurs that the receiver of the record does not
know the definition of the information element. For processing such
information elements it would be desirable for the receiver to know at
least the data types of the enterprise-specific information elements.
The WG will develop an extension to IPFIX that provides means for the
encoding of IPFIX data type information within an IPFIX Message
stream.

4. Another requirement resulting from practical use of IPFIX is
reporting IPFIX template records and corresponding data records within
the same SCTP stream. The IPFIX WG will develop guidelines for this
use case.

5. First applications of IPFIX at large operator networks showed the
need for mediation of flow information, for example, for aggregating
huge amounts of flow data and for anomymization of flow information.
The IPFIX WG will investigate this issue and produce a problem
statement and a framework for IPFIX flow mediation.

Goals and Milestones:

Done  Submit Revised Internet-Draft on IP Flow Export Requirements
Done  Submit Internet-Draft on IP Flow Export Architecture
Done  Submit Internet-Draft on IP Flow Export Data Model
Done  Submit Internet-Draft on IPFIX Protocol Evaluation Report
Done  Submit Internet-Draft on IP Flow Export Applicability Statement
Done  Select IPFIX protocol, revise Architecture and Data Model drafts
Done  Submit IPFX-REQUIREMENTS to IESG for publication as Informational RFC
Done  Submit IPFIX Protocol Evaluation Report to IESG for publication as Informational RFC
Done  Submit IPFX-ARCHITECTURE to IESG for publication as Proposed Standard RFC
Done  Submit IPFX-INFO_MODEL to IESG for publication as Informational RFC
Done  Submit IPFX-APPLICABILITY to IESG for publication as Informational RFC
Done  Submit IPFX-PROTOCOL to IESG for publication as Proposed Standard RFC
Done  Publish Internet Draft on IPFIX Implementation Guidelines
Done  Publish Internet Draft on Reducing Redundancy in IPFIX data transfer
Done  Publish Internet Draft on Handling IPFIX Bidirectional Flows
Done  Publish Internet Draft on IPFIX Testing
Done  Publish Internet Draft on IPFIX MIB
Done  Submit IPFIX Implementation Guidelines draft to IESG for publication as Informational RFC
Done  Submit IPFIX Reducing Redundancy draft to IESG for publication as Informational RFC
Done  Submit IPFIX Testing draft to IESG for publication as Informational RFC
Done  Submit IPFIX Biflows draft to IESG for publication as Standards Track RFC
Done  Publish Internet draft on IPFIX Type Information Export
Dec 2007  Publish Internet draft on IPFIX Configuration Data Model
Dec 2007  Publish Internet draft on Single SCTP Stream Reporting
Done  Publish Internet draft on IPFIX File Format
Jan 2008  Publish Internet draft on IPFIX Mediation Problem Statement
Jan 2008  Submit File Format draft to IESG for publication as Standards track RFC
Mar 2008  Submit IPFIX MIB draft to IESG for publication as Standards track RFC
Jun 2008  Submit Type Export draft to IESG for publication as Standards track RFC
Jun 2008  Submit Single SCTP Stream draft to IESG for publication as Informational RFC
Oct 2008  Submit Configuration Data Model draft to IESG for publication as Standards track RFC
Oct 2008  Submit Mediation Problem draft to IESG for publication as Informational RFC

Internet-Drafts:

  • draft-ietf-ipfix-architecture-12.txt
  • draft-ietf-ipfix-as-12.txt
  • draft-ietf-ipfix-implementation-guidelines-08.txt
  • draft-ietf-ipfix-reducing-redundancy-04.txt
  • draft-ietf-ipfix-testing-04.txt
  • draft-ietf-ipfix-mib-03.txt
  • draft-ietf-ipfix-file-01.txt
  • draft-ietf-ipfix-exporting-type-01.txt

    Request For Comments:

    RFCStatusTitle
    RFC3917 I Requirements for IP Flow Information Export
    RFC3955 I Evaluation of Candidate Protocols for IP Flow Information Export (IPFIX)
    RFC5101 PS Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information
    RFC5102 PS Information Model for IP Flow Information Export
    RFC5103 PS Bidirectional Flow Export using IP Flow Information Export (IPFIX)

    Meeting Minutes


    Slides

    PSAMP Sampling technology
    IPFIX MIB
    File Format
    Exporting Types
    IPFIX Configuration
    Per-stream Export
    Mediators Framework
    Mediators Problem Statement
    Mediators Evolution
    Mediators Aggregation
    Mediators Anonymization
    New Information Elements
    Order of IEs