Sampling%20and%20Filtering%20Techniques%20for%20IP%20Packet%20Selection%20-%20Update%20-%20%20draft-ietf-psamp-sample-tech-05.txt

1
Sampling and Filtering Techniques for IP Packet
Selection- Update - draft-ietf-psamp-sample-tec
h-05.txt

• Tanja Zseby, FhG FOKUS
• Maurizio Molina, DANTE
• Nick Duffield, ATT Labs
• Saverio Niccolini, NEC Europe Ltd.
• Fredric Raspall, EPSC-UPC

2
Changed

• Associations
• If no IPFIX process specified, packet selector
  applies to all processes on observation point
• Only AND for router state filters
• Use of correct terminology in 7.2.
• e.g. Hash Selection Range instead of Selection
  Interval Specification
• Address changes
• 3 of the 5 authors changed affiliation
• Some clarifications that came up from MIB
  definition
• Some re-wording proposed by Stewart

3
Not Changed

• Some proposed changes not addressed
• Simplicity of filter model was criticized
• But substitution of complex by simple model
  (limitied to AND) was result of last IETF
  discussion
• Terminology remains in both documents
• Nothing changed regarding recommended hash
  function because ongoing discussion
• Small TODOs
• Change references to documents if titles of other
  documents change (as proposed by Benoit, e.g.
  MIB)
• Some terminology re-wording proposed by Stewart
  that need to be consistent with FW draft
• Benoit has corrected some typos on his paper
  version ? already done for 07 version

4
Open Issue Recommended Hash-Function

• Some clarification
• PSAMP compliance MUST implement at least one of
  the selection method (sampling or filtering)
• ? Its not mandatory to implement a hash-based
  selection
• But we want to give a recommendation which hash
  function to use in case someone decided to use
  hash-based selection
• ? IF hash-based selection is chosen, function
  SHOULD be implemented
• Current recommendation
• IPSX for packet selection
• CRC for packet digest
• New Proposal
• Recommend BOB for both
• IPSX and CRC optional

5
Open Issue Recommended Hash-Function

• Selection Function
• Speed important (process each packet)
• Collisions not relevant
• Pro IPSX
• IPSX is 7 times faster than BOB
• IPSX is simple
• Pro BOB
• IPSX limited to 16 bytes input
• problem with IPv6 packets
• poor uniformity
• For all hash functions with 16 bit input
• Improvement for BOB and CRC if larger input
• Couldnt be checked with IPSX

6
Open Issue Recommended Hash-Function

• Digest Function
• Collisions relevant
• Speed less important (only operate on selected
  packets)
• Pro CRC
• Faster in hardware ?
• But existing implementations cannot be used ?
• Pro BOB
• BOB is faster than CRC on software implementation
• BOB achieves similar good collision probability
  as CRC
• Approaches
• 1. BOB for digest, IPSX for IPv4 selection, BOB
  for IPv6 selection, others optional
• 2. BOB for digest and selection, others optional
• ? Still ongoing discussion on list

7
Other Issues

• Which hash function to recommend for IPv6 ?
  depends on hash discussion
• Better reference for IPSX ?
• Allow NOT operation for filters ?
• Seems not difficult to implement
• Allow for all or only for some filter types ?

8
Research Topics for IMRG ?

• Extend work on hash-based sampling ?
• More tests on uniformity and speed
• Hash-functions for IPv6
• Flow-state and router-state methods ?
• Suitability for PSAMP (criteria ?)
• Investigate/Compare different methods
• Volunteers ?

9
Thank you for your attention !

• Questions ?