IP Flow Information Export (ipfix) ---------------------------------- Charter Last Modified: 2008-03-20 Current Status: Active Working Group Chair(s): Nevil Brownlee Juergen Quittek Operations and Management Area Director(s): Dan Romascanu Ronald Bonica Operations and Management Area Advisor: Dan Romascanu Mailing Lists: General Discussion:ipfix@ietf.org To Subscribe: http://www1.ietf.org/mailman/listinfo/ipfix Archive: http://www1.ietf.org/mail-archive/web/ipfix/current/index.html Description of Working Group: The IPFIX working group has specified the Information Model (to describe IP flows) and the IPFIX protocol (to transfer IP flow data from IPFIX exporters to collectors). Several implementers have already built applications using the IPFIX protocol. As a result of a series of IPFIX interoperability testing events the WG has produced guidelines for IPFIX implementation and testing as well as recommendations for handling special cases such as bidirectional flow reporting and reducing redundancy in flow records. Practical experiences with IPFIX implementations exposed new requirements for the IPFIX protocol that so far have not been addressed by the WG. The major current goal of the WG is developing solutions that meet the new requirements without modifying the core IPFIX protocol specifications. 1. The IPFIX WG has developed a MIB module for monitoring IPFIX implementations. Means for configuring these devices have not been standardized yet. The WG will develop an XML-based configuration data model that can be used for configuring IPFIX devices and for storing, modifying and managing IPFIX configurations parameter sets. This work will be performed in close collaboration with the NETCONF WG. 2. There is a need for storing measured flow information and for exchanging this information between different systems and organizations. The WG will develop a common IPFIX file format for storing flow data in order to facilitate interoperability and reusability among a wide variety of flow storage, processing, and analysis tools. It will be a flat-file format using binary encodings that are based on the IPFIX message format. 3. When dealing with enterprise-specific information elements in IPFIX flow records, it often occurs that the receiver of the record does not know the definition of the information element. For processing such information elements it would be desirable for the receiver to know at least the data types of the enterprise-specific information elements. The WG will develop an extension to IPFIX that provides means for the encoding of IPFIX data type information within an IPFIX Message stream. 4. Another requirement resulting from practical use of IPFIX is reporting IPFIX template records and corresponding data records within the same SCTP stream. The IPFIX WG will develop guidelines for this use case. 5. First applications of IPFIX at large operator networks showed the need for mediation of flow information, for example, for aggregating huge amounts of flow data and for anomymization of flow information. The IPFIX WG will investigate this issue and produce a problem statement and a framework for IPFIX flow mediation. Goals and Milestones: Done Submit Revised Internet-Draft on IP Flow Export Requirements Done Submit Internet-Draft on IP Flow Export Architecture Done Submit Internet-Draft on IP Flow Export Data Model Done Submit Internet-Draft on IPFIX Protocol Evaluation Report Done Submit Internet-Draft on IP Flow Export Applicability Statement Done Select IPFIX protocol, revise Architecture and Data Model drafts Done Submit IPFX-REQUIREMENTS to IESG for publication as Informational RFC Done Submit IPFIX Protocol Evaluation Report to IESG for publication as Informational RFC Done Submit IPFX-ARCHITECTURE to IESG for publication as Proposed Standard RFC Done Submit IPFX-INFO_MODEL to IESG for publication as Informational RFC Done Submit IPFX-APPLICABILITY to IESG for publication as Informational RFC Done Submit IPFX-PROTOCOL to IESG for publication as Proposed Standard RFC Done Publish Internet Draft on IPFIX Implementation Guidelines Done Publish Internet Draft on Reducing Redundancy in IPFIX data transfer Done Publish Internet Draft on Handling IPFIX Bidirectional Flows Done Publish Internet Draft on IPFIX Testing Done Publish Internet Draft on IPFIX MIB Done Submit IPFIX Implementation Guidelines draft to IESG for publication as Informational RFC Done Submit IPFIX Reducing Redundancy draft to IESG for publication as Informational RFC Done Submit IPFIX Testing draft to IESG for publication as Informational RFC Done Submit IPFIX Biflows draft to IESG for publication as Standards Track RFC Done Publish Internet draft on IPFIX Type Information Export Dec 2007 Publish Internet draft on IPFIX Configuration Data Model Dec 2007 Publish Internet draft on Single SCTP Stream Reporting Done Publish Internet draft on IPFIX File Format Jan 2008 Publish Internet draft on IPFIX Mediation Problem Statement Jan 2008 Submit File Format draft to IESG for publication as Standards track RFC Mar 2008 Submit IPFIX MIB draft to IESG for publication as Standards track RFC Jun 2008 Submit Type Export draft to IESG for publication as Standards track RFC Jun 2008 Submit Single SCTP Stream draft to IESG for publication as Informational RFC Oct 2008 Submit Configuration Data Model draft to IESG for publication as Standards track RFC Oct 2008 Submit Mediation Problem draft to IESG for publication as Informational RFC Internet-Drafts: Posted Revised I-D Title ------ ------- -------------------------------------------- Feb 2002 Sep 2006 Architecture for IP Flow Information Export Jun 2003 Jul 2007 IPFIX Applicability Sep 2006 Dec 2007 IPFIX Implementation Guidelines Sep 2006 May 2007 Reducing Redundancy in IP Flow Information Export (IPFIX) and Packet Sampling (PSAMP) Reports Oct 2006 Feb 2008 Guidelines for IP Flow Information eXport (IPFIX) Testing Feb 2007 Feb 2008 Definitions of Managed Objects for IP Flow Information Export Jan 2008 Feb 2008 An IPFIX-Based File Format Jan 2008 Feb 2008 Exporting Type Information for IPFIX Information Elements Request For Comments: RFC Stat Published Title ------- -- ----------- ------------------------------------ RFC3917 I Oct 2004 Requirements for IP Flow Information Export RFC3955 I Nov 2004 Evaluation of Candidate Protocols for IP Flow Information Export (IPFIX) RFC5103 PS Jan 2008 Bidirectional Flow Export using IP Flow Information Export (IPFIX) RFC5102 PS Jan 2008 Information Model for IP Flow Information Export RFC5101 PS Jan 2008 Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information