RFC 2724
RTFM: New Attributes for Traffic Flow Measurement
RFC 2724: RTFM: New Attributes for Traffic Flow Measurement 🦋
Okay bestie, this one is from October 1999 and it's marked Experimental, so it's an experiment and not an Internet standard 🧪. The authors are S. Handelman, S. Stibler (both at IBM), N. Brownlee (The University of Auckland), and G. Ruth (GTE Internetworking). It doesn't obsolete or update any other RFCs, as far as the title block says 📜.
Status of This Memo 💌
This memo defines an Experimental Protocol for the Internet community. It is not an Internet standard of any kind. The authors are asking for discussion and suggestions for improvement. You can distribute this memo however you like 🫶.
Copyright Notice 🔒
Copyright (C) The Internet Society (1999). All Rights Reserved.
Abstract ✨
Okay so the RTFM Traffic Measurement Architecture gives you a general framework for describing and measuring network traffic flows 🌊. Flows are defined by their Address Attribute values and get measured by a 'Traffic Meter' 📏. This doc talks about RTFM flows and the attributes they can have, so there's a logical framework for adding new attributes to the architecture 🧩.
The extensions covered include Address Attributes like DSCodePoint, SourceASN and DestASN, plus Group Attributes like short-term bit rates and turnaround times 🍓. It also goes over Quality of Service parameters for Integrated Services 💜.
Table of Contents 📚
1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1 RTFM's Definition of Flows . . . . . . . . . . . . . . . . 3
1.2 RTFM's Current Definition of Flows and their Attributes . . 3
1.3 RTFM Flows, Integrated Services, IPPM and Research in Flows 4
2 Flow Abstractions . . . . . . . . . . . . . . . . . . . . . . . 5
2.1 Meter Readers and Meters . . . . . . . . . . . . . . . . . 5
2.2 Attribute Types . . . . . . . . . . . . . . . . . . . . . . 6
2.3 Packet Traces . . . . . . . . . . . . . . . . . . . . . . . 7
2.4 Aggregate Attributes . . . . . . . . . . . . . . . . . . . 8
2.5 Group Attributes . . . . . . . . . . . . . . . . . . . . . 8
2.6 Actions on Exceptions . . . . . . . . . . . . . . . . . . .10
3 Extensions to the 'Basic' RTFM Meter . . . . . . . . . . . . .10
3.1 Flow table extensions . . . . . . . . . . . . . . . . . . .10
3.2 Specifying Distributions in RuleSets . . . . . . . . . . .11
3.3 Reading Distributions . . . . . . . . . . . . . . . . . . .13
4 Extensions to the Rules Table, Attribute Numbers . . . . . . .13
5 Security Considerations . . . . . . . . . . . . . . . . . . . .15
6 References . . . . . . . . . . . . . . . . . . . . . . . . . .16
7 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . .17
8 Full Copyright Statement . . . . . . . . . . . . . . . . . . .181. Introduction 🌸
The Real-Time Flow Measurement (RTFM) Working Group (WG) built a system for measuring and reporting info about traffic flows on the Internet 🌐. This doc explores how to define extensions to the flow measurements that are currently defined in [RTFM-ARC]. The new attributes here are going to be useful for monitoring network performance, and they expand RTFM past basic traffic volume measurement 📈. A companion document will come later to define MIB structures for the new attributes 🧠.
This memo got started in 1996 to move the RTFM group's work forward 🚀. The goal is a simple set of abstractions that are easy to implement and that still make RTFM Meters way more valuable 💎. The doc also defines a way to organize the flow abstractions so they augment the existing RTFM flow table 🗂️.
Nevil Brownlee implemented RTFM Meters at the University of Auckland in NZ, and Stephen Stibler and Sig Handelman did the same at IBM in Hawthorne, NY, USA 🗽. The RTFM WG also defined the Meter Reader role, which is to retrieve flow data from the Meter 📥.
Note on flows and positioning of meters:
A flow as it travels across the Internet may have some of its characteristics changed as it passes through Routers, Switches, and other network units 🔀. So it really matters where the Meter is when you talk about a flow's attributes 📍. For example, a server might send a sequence of packets in a definite order, with inter-packet timing shaped by a leaky bucket algorithm 🪣. A meter reading downstream of the leaky bucket would record a set with minimal inter-packet timing because of the leaky bucket 😮💨. At the client's location, though, the packets might arrive out of sequence with the timings altered 🙈. A meter at the client's location would record different attributes for that same flow 🤯.
1.1. RTFM's Definition of Flows 💖
The RTFM Meter architecture sees a flow as a set of packets between two endpoints. Those endpoints are defined by their source and destination attribute values and their start and end times 🎯. It's also BI-DIRECTIONAL, which means the meter effectively monitors two sub-flows, one in each direction 🔁.
Reasons why RTFM flows are bi-directional:
- The WG wants to understand how sessions behave between endpoints 👀.
- The endpoint attribute values (the "Address" and "Type" ones) are the same for both directions, so storing them in bi-directional flows cuts down on the meter's memory demands 🧠💅.
- 'One-way' (uni-directional) flows are a degenerate case 🙃. Existing RTFM meters can handle them by using one of the computed attributes (e.g. FlowKind) to show direction 🧭.
1.2. RTFM's Current Definition of Flows and their Attributes 🎀
Flows, as described in the "Architecture" document [RTFM-ARC], have the following properties:
- a. They occur between two endpoints, which are specified as sets of attribute values in the meter's current rule set 🫂. A flow is completely identified by its set of endpoint attribute values 🪪.
- b. Each flow may also have values for "computed" attributes (Class and Kind) ✨. These are derived directly from the endpoint attribute values 🧮.
- c. A new flow gets created when a packet needs to be counted and doesn't match the attributes of an existing flow 🆕. The meter records the time when this new flow is created ⏰.
- d. The attribute values in (a), (b) and (c) are set when the meter sees the first packet for the flow, and they are never changed 🔒.
- e. Each flow has a "LastTime" attribute, which shows the time the meter last saw a packet for the flow 🕰️.
- f. Each flow has two packet counters and two byte counters, one for each flow direction (Forward and Backward) 🔢. These get updated as the meter observes packets for the flow 👁️.
- g. ALL the attributes have (more or less) the same meaning across a variety of protocols: IPX, AppleTalk, DECnet and CLNS as well as TCP/IP 🌍💫.
Current flow attributes, as described above, fit really well into the SNMP data model 💜. They are either static or continuously updated counters, and they are NEVER reset 🙌. In this document they're called "old-style" attributes 🏛️.
It's easy to add more "old-style" attributes, since they don't need any new features in the architecture 🍰. For example:
- Count of the number of "lost" packets. This is determined by watching sequence number fields for packets in each direction, and it's only available for protocols that have such sequence numbers 🔍.
- In the future, RTFM could coordinate directly with the Flow Label from the IPv6 header 🔮.
1.3. RTFM Flows, Integrated Services, IPPM and Research in Flows 🧁
Flows have been studied in lots of different contexts 📚. For extending RTFM, a good starting point is the work of the Integrated Services WG 🚦. The plan is to measure quantities that are often set by Integrated Services configuration programs ⚙️. The doc also looks at the work of the Benchmarking/IP Performance Metrics Working Group, and at the work of Claffy, Braun and Polyzos [C-B-P] 👩🔬. It'll also show how RTFM can compute throughput, packet loss, and delays from flows 📊.
"The Use of RSVP with IETF Integrated Services" [IIS-RSVP] is an example of using capacity and performance info 💡. RSVP's use of Integrated Services revolves around Token Bucket Rate, Token Bucket Size, Peak Data Rate, Minimum Policed Unit, Maximum Packet Size, and the Slack term 🪣. These are set by TSpec, ADspec and FLowspec (Integrated Services Keywords), and they get used when configuring and operating Integrated Services 🛠️. RTFM could monitor Peak Data Rate, Minimum Policed Unit, Maximum Packet Size, and the Slack term explicitly 👑. RTFM could also infer details of the Token Bucket 🕵️♀️. The WG will develop measures to work with these service metrics 🧪. An initial implementation of IIS Monitoring was developed at CEFRIEL in Italy [IIS-ACCT] 🇮🇹.
RTFM will work with several traffic measurements identified by IPPM [IPPM-FRM] 💕. There are three broad areas where RTFM is useful for IPPM 🌈:
- An RTFM Meter could act as a passive device, gathering traffic and performance statistics at appropriate places in networks (server or client locations) 👂.
- RTFM could give detailed analyses of IPPM test flows that pass through the Network segment RTFM is monitoring 🔬.
- RTFM could be used to identify the most-used paths in a network mesh, so detailed IPPM work could be applied to those most-used paths 🛣️.
2. Flow Abstractions 🪞
Performance attributes include throughput, packet loss, delays, jitter, and congestion measures 📉. RTFM will calculate these attributes as extensions to the RTFM flow attributes, sorted into three general classes 🗃️:
- 'Trace', which are attributes of individual packets in a flow or of a segment of a flow (e.g. last packet size, last packet arrival time) 📦.
- 'Aggregate', which are attributes derived from the flow taken as a whole (e.g. mean rate, max packet size, packet size distribution) 🧺.
- 'Group', which are attributes that depend on groups of packet values within the flow (e.g. inter-arrival times, short-term traffic rates) 👯.
These attributes within each class can have different types of values, like numbers, distributions, time series, and so on 🎨.
2.1. Meter Readers and Meters 🤝
Here's the deal on how Meter Readers and Meters relate 💌.
Several of the measurements listed below can be implemented by a Meter Reader that's tied to a meter with very short response time and very high bandwidth ⚡. If the Meter Reader and Meter can be arranged that way, RTFM could collect Packet Traces with time stamps and hand them directly to the Meter Reader for further processing 🫧.
A more useful alternative is to have the Meter calculate some flow statistics locally 🧠. That allows a looser coupling between the Meter and Meter Reader 🧶. RTFM will monitor an 'extended attribute' depending on settings in its Rule table 📋. RTFM will not create any "extended attribute" data without explicit instructions in the Rule table 🙅♀️.
2.2. Attribute Types 🎀
okay so Section 2 laid out three different classes of attributes, and this part is all about the "data types" they come in 💅
Packet Traces (more on those below) are the special case here 🧚. They're tables where each row holds a sequence of values, and each value can be a different type. Basically they're "compound objects," aka lists of attribute values for a whole string of packets ✨
Aggregate attributes give off "old-style" attribute vibes 💖. Their types are:
- Addresses, represented as byte strings (1 to 20 bytes long)
- Counters, represented as 64-bit unsigned integers
- Times, represented as 32-bit unsigned integers
Addresses get saved when the first packet of a flow is observed 🌸. They don't change over time, and they're the key for finding the flow's entry in the meter's flow table.
Counters get incremented for every packet and are never reset 🔥. An analysis app can compute differences between readings of the counters to figure out rates for these attributes. Like, if we read flow data every five minutes, we can work out five-minute packet and byte rates for the flow's two directions 🍓
Times are derived from the FirstTime for a flow, which gets set when its first packet is observed. LastTime gets updated as each packet in the flow is observed ⏰
All of the above types have one thing in common: they're all single values 🫶. But at least some of the new attributes will need multiple values. If we care about inter-packet time intervals, we can compute an interval for every packet after the first. If we care about packet sizes, a new value shows up as each packet arrives. When it's time to store this data, we have two options:
- As a distribution, i.e. in an array of 'buckets'. This is a compact representation: the values are stored as counters between a minimum and maximum, with defined steps in each bucket. It fits the RTFM goal of compact data storage 💜
- As a sequence of single values. This saves all the information, but it doesn't fit well with the RTFM goal of doing as much data reduction as possible within the meter 😭
Studies that would be limited by distributions might be better off using packet traces instead 👀
A method for specifying the distribution parameters, and for encoding the distribution so it can be easily read, is described in section 3.2 📖
2.3. Packet Traces 🕵️♀️
The simplest way to collect a trace in the meter would be a new attribute called, say, "PacketTrace". It could be a table with a column for each property you care about. For example, you could trace:
- Packet Arrival time (TimeTicks from sysUpTime, or microseconds from FirstTime for the flow).
- Packet Direction (Forward or Backward)
- Packet Sequence number (for protocols with sequence numbers)
- Packet Flags (for TCP at least)
Note: The following implementation proposal is for the user who is familiar with writing rule sets for the RTFM Meter. Nerd corner, bestie 🤓
Adding a row to the table only needs a rule which PushPkts the PacketTrace attribute 🎀. To use it, you'd write a rule set that selects a small number of flows of interest, with a PushPkt PacketTrace rule for each of them. A MaxTraceRows default value of 2000 would be enough to let a Meter Reader read one-second ping traces every 10 minutes or so. More realistically, a MaxTraceRows of 500 would be enough for one-minute pings, read once each hour ⏳
Packet traces are already implemented by the RMON MIB [RMON-MIB, RMON2-MIB], in the Packet Capture Group. So they're a low priority for RTFM 😌
2.4. Aggregate Attributes 📊
RTFM's "old-style" flow attributes count the bytes and packets for packets that match the rule set for an individual flow. On top of those totals, RTFM could calculate Packet Size statistics, for example. This data can be stored as distributions, though sometimes it's enough to just keep a maximum value.
Let's talk Packet Size. RTFM's packet flows can be examined to find the maximum packet size in a flow. This gives the Network Operator an indication of the MTU being used in a flow. It also hints at how sensitive a flow is to loss, because losing large packets means more data gets retransmitted 💀
Aggregate attributes are a simple extension of 'old-style' attributes, and their values are never reset. For example, an array of counters could hold a 'packet size' distribution. The counters keep going up, a meter reader collects their values at regular intervals, and an analysis app computes and displays the packet size distributions for each collection interval 🦋
2.5. Group Attributes 🧁
Group attributes keep simple stats for measures that involve more than one packet. This section covers some group attributes that are feasible to implement in a traffic meter and seem interesting and useful.
Short-term bit rate - The data could also be recorded as the maximum and minimum data rate of the flow, found over specific time periods during the flow's lifetime. This is a special kind of 'distribution'. Bit rate could define the throughput of a flow, and if the RTFM flow is defined as the sum of all traffic in a network, you can find the throughput of the network 🚀
If we care about '10-second' forward data rates, the meter might compute this for each flow of interest like so:
- maintain an array of counters to hold the flow's 10-second data rate distribution.
- every 10 seconds, compute and save 10-second octet count, and save a copy of the flow's forward octet counter.
To pull this off, the meter has to keep a list of aggregate flows and the intervals at which they need processing. Careful programming is needed, but as long as the meter isn't asked to do it for very large numbers of flows, it has been successfully implemented ✨
Inter-arrival times. The Meter knows the time it encounters each individual packet. Statistics can be kept to record the inter-arrival times of the packets, which would give an indication of the jitter found in the Flow.
Turn-around statistics. Since the Meter knows the time it encounters each individual packet, it can produce statistics of the time intervals between packets observed on the network in opposite directions. For protocols such as SNMP (where every packet elicits an answering packet) this gives a good indication of turn-around times 🔁
Subflow analysis. Since the choice of flow endpoints is controlled by the meter's rule set, it's easy to define an aggregate flow, e.g. "all the TCP streams between hosts A and B." Preliminary implementation work suggests that, at least for this case, it should be possible for the meter to maintain a table of information about all the active streams. This could produce at least the following attributes:
- Number of streams, e.g. streams active for n-second intervals. Determined for TCP and UDP using source-dest port number pairs.
- Number of TCP bytes, determined by taking the difference of TCP sequence numbers for each direction of the aggregate flow.
IIS attributes. Work at CEFRIEL [IIS-ACCT] has produced a traffic meter with a rule set modified 'on the fly' so it maintains a list of RSVP-reserved flows. For such flows, the following attributes have been implemented (these quantities are defined in [GUAR-QOS]):
QoSService: Service class for the flow (guaranteed, controlled load)QoSStyle: Reservation setup style (wildcard filter, fixed filter, shared explicit)QoSRate: [byte/s] rate for flows with guaranteed serviceQoSSlackTerm: [microseconds] Slack Term QoS parameter for flows with guaranteed serviceQoSTokenBucketRate: [byte/s] Token Bucket Rate QoS parameter for flows with guaranteed or controlled load service
The following are also being considered:
QoSTokenBucketSize: [byte] Size of Token BucketQoSPeakDataRate: [byte/s] Maximum rate for incoming dataQoSMinPolicedUnit: [byte] IP datagrams less than this are counted as being this sizeQoSMaxDatagramSize: [byte] Size of biggest datagram which conforms to the traffic specification
2.6. Actions on Exceptions 🚨
Some RTFM users have asked to be able to mark flows as having High Watermarks 🚩. Abnormal service conditions, like a non-ending flow or a flow that goes over a given traffic limit (e.g. a flow that's eating up the capacity of the line that carries it), would cause an ALERT to be sent to the Meter Reader for forwarding to the Manager. Operations Support could define service situations in many different environments. This is an area for further discussion on Alert and Trap handling 💬
3. Extensions to the 'Basic' RTFM Meter ✨
The Working Group agreed that the basic RTFM Meter won't be altered by the addition of the new attributes in this document. This section describes the extensions needed to implement the new attributes 🧚
3.1. Flow table extensions 🗂️
The architecture of RTFM defines the structure of flows, and this memo doesn't change that structure. The flow table could have ancillary tables called "Distribution Tables" and "Trace Tables," which would contain rows of values and/or actions as defined above. Each entry in these tables would be marked with the number of its corresponding flow in the RTFM flow table 💖
Note: The following section is for the user who is familiar with writing rule sets for the RTFM Meter.
To identify the data in a Packet Flow Table, the attribute name could be pushed into a string at the head of each row. For example, if a table entry has "To Bit Rate" for a particular flow, the ToBitRate string would be found at the head of the row. (An alternative method would be to code an identification value for each extended attribute and push that value into the head of the row.) See section 4. for an initial set of ten extended flow attributes 🌈
3.2. Specifying Distributions in RuleSets
Okay so at first glance it seems like we'd need to add extra features to the RTFM Meter architecture to support distributions 👀. Turns out that's not necessarily the case 💅✨.
What we actually need is a way to specify the distribution parameters inside a ruleset 🎀. That covers the number of counters, the lower and upper bounds of the distribution, whether it's linear or logarithmic, and any other details (e.g. the time interval for short-term rate attributes) 🍓.
Any attribute that's distribution-valued needs its own RuleAttributeNumber value. These get chosen so they extend the list already in the RTFM Meter MIB document [RTFM-MIB] 🦋.
Distribution attributes are multi-valued, so testing them doesn't make sense 🙈. That means a PushPkt (or PushPkttoAct) action has to run to add a new value to the distribution. The old-style attributes use the mask field to say which bits of the value are required, but that's not the case for distributions either. And the MatchedValue (value) field of a PushPkt rule is never used. So overall, the mask and value fields in the PushPkt rule are free to hold the distribution parameters 🧚.
Both of these fields are at least six bytes long, the size of a MAC address. All we have to do is decide how those bytes get used! 🫶 As a starting point, the following is proposed (bytes are numbered left-to-right):
Mask bytes:
1 Transform 1 = linear, 2 = logarithmic
2 Scale Factor Power of 10 multiplier for Limits
and Counts
3-4 Lower Limit Highest value for first bucket
5-6 Upper Limit Highest value for last bucket
Value bytes:
1 Buckets Number of buckets. Does not include
the 'overflow' bucket
2 Parameter-1 } Parameter use depends
3-4 Parameter-2 } on distribution-valued
5-6 Parameter-3 } attributeFor example, experiments with NeTraMet have used the following rules:
FromPacketSize & 1.0.25!1500 = 60.0!0: PushPkttoAct, Next;
ToInterArrivalTime & 2.3.1!1800 = 60.0.0!0: PushPkttoAct, Next;
FromBitRate & 2.3.1!10000 = 60.5.0!0: PushPkttoAct, Next;In these mask and value fields, a dot means the preceding number is a one-byte integer, and the exclamation marks mean the preceding number is a two-byte integer. The last number is two bytes wide because that was the width of the field before it. (Note that this convention follows the one for IP addresses, so 130.216 means 130.216.0.0 💜.)
The first rule sets up a distribution of packet sizes. It uses an array of 60 buckets, storing values from 1 to 1500 bytes (i.e. linear steps of 25 bytes per bucket). Any packet bigger than 1500 bytes gets counted in the 'overflow' bucket, so there are 61 counters for the distribution 📦.
The second rule sets up an interarrival-time distribution on a logarithmic scale. It uses an array of 60 counters (plus an overflow bucket) for rates from 1 ms to 1.8 s. Arrival times are measured in microseconds, so the scale factor of 3 tells us the limits are given in milliseconds ⏱️.
The third rule sets up a bit-rate distribution, with the rate calculated every 5 seconds (parameter 1) 🔥. It uses a logarithmic array of 60 counters (plus an overflow bucket) for rates from 1 kbps to 10 Mbps. The scale factor of 3 means the limits are given in thousands of bits per second (rates are measured in bps) 🌈.
These distribution parameters have to be stored in the meter so they're available when the distribution gets built. They also have to be read back from the meter and saved alongside the other flow data 💖.
3.3. Reading Distributions
RTFM flows are bi-directional, so each distribution-valued quantity (e.g. packet size, bit rate, etc.) actually needs two sets of counters, one for packets travelling in each direction 🦋. It's tempting to treat those two as parts of a single 'distribution', but in lots of cases only one direction is interesting. So it's better to keep them in separate distributions 💅. This is similar to the old-style counter-valued attributes like toOctets and fromOctets.
A meter reader should read a distribution as a single, structured object 🎀. The components of a distribution object are:
- 'mask' and 'value' fields from the rule which created the distribution
- sequence of counters ('buckets' + overflow)
These can be easily collected into a BER-encoded octet string, and would be read and referred to as a 'distribution' 🫶.
4. Extensions to the Rules Table, Attribute Numbers ✨
The Rules Table of "old-style" attributes gets extended for the new flow types 🌸. A list of actions and keywords, such as "ToBitRate", "ToPacketSize", etc., will be developed and used to tell an RTFM meter to collect a set of extended values for a particular flow (or set of flows) 🧚.
Note: An implementation suggestion. Value 65 is used for 'Distributions', which has one bit set for each distribution-valued attribute present for the flow, using bit 0 for attribute 66, bit 1 for attribute 67, etc. 💡
Here are ten possible distribution-valued attributes, numbered according to RTFM WG consensus at the 1997 meeting in Munich 🌈:
ToPacketSize(66) size of PDUs in bytes (i.e. number
FromPacketSize(67) of bytes actually transmitted)
ToInterarrivalTime(68) microseconds between successive packets
FromInterarrivalTime(69) travelling in the same direction
ToTurnaroundTime(70) microseconds between successive packets
FromTurnaroundTime(71) travelling in opposite directions
ToBitRate(72) short-term flow rate in bits per second
FromBitRate(73) Parameter 1 = rate interval in seconds
ToPDURate(74) short-term flow rate in PDUs per second
FromPDURate(75) Parameter 1 = rate interval in seconds
(76 .. 97) other distributionsIt seems reasonable to allocate another group of numbers for the IIS attributes described above 💜:
QoSService(98)
QoSStyle(99)
QoSRate(100)
QoSSlackTerm(101)
QoSTokenBucketRate(102)
QoSTokenBucketSize(103)
QoSPeakDataRate(104)
QoSMinPolicedUnit(105)
QoSMaxPolicedUnit(106)The following attributes have also been implemented in NetFlowMet, a version of the RTFM traffic meter 🍓:
MeterID(112) Integer identifying the router producing
NetFlow data (needed when NetFlowMet takes
data from several routers)
SourceASN(113) Autonomous System Number for flow's source
SourcePrefix(114) CIDR width used by router for determining
flow's source network
DestASN(115) Autonomous System Number for flow's destination
DestPrefix(116) CIDR width used by router for determining
flow's destination networkSome of the above, e.g. SourceASN and DestASN, might sensibly be given attribute numbers below 64, which would make them part of the 'base' RTFM meter attributes 🌟.
To support using the RTFM meter as an 'Edge Device' for implementing Differentiated Services, and/or for metering traffic carried via such services, one more attribute will be useful 🎀:
DSCodePoint(118) DS Code Point (6 bits) for packets in this flowSince the DS Code Point is a single field within a packet's IP header, it's not possible to have both Source- and Dest-CodePoint attributes 🙅. Possible uses of DSCodePoint include aggregating flows that use the same Code Points, and separating flows that have the same end-point addresses but use different Code Points 🦋.
5. Security Considerations 🔐
The attributes considered in this document represent properties of traffic flows. They do not present any security issues in themselves 🫶. The attributes may, however, be used to measure the behaviour of traffic flows, and the collected traffic flow data could be of considerable value 😭. Suitable precautions should be taken to keep such data safe 🔒.
6. References 📚
[C-B-P] Claffy, K., Braun, H-W, Polyzos, G., "A Parameterizable Methodology for Internet Traffic Flow Profiling," IEEE Journal on Selected Areas in Communications, Vol. 13, No. 8, October 1995.
[GUAR-QOS] Shenker, S., Partridge, C. and R. Guerin, "Specification of Guaranteed Quality of Service", RFC 2212, September 1997.
[IIS-ACCT] Maiocchi, S: "NeTraMet & NeMaC for IIS Accounting: Users' Guide", CEFRIEL, Milan, 5 May 1998. (See also http://www.cefriel.it/ntw)
[IIS-RSVP] Wroclawski, J., "The Use of RSVP with IETF Integrated Services", RFC 2210, September 1997.
[IPPM-FRM] Paxson, V., Almes, G., Mahdavi, J. and Mathis, M., "Framework for IP Performance Metrics", RFC 2330, May 1998.
[RMON-MIB] Waldbusser, S., "Remote Network Monitoring Management Information Base", RFC 1757, February 1995.
[RMON2-MIB] Waldbusser, S., "Remote Network Monitoring Management Information Base Version 2 using SMIv2", RFC 2021, January 1997.
[RTFM-ARC] Brownlee, N., Mills, C. and G. Ruth, "Traffic Flow Measurement: Architecture", RFC 2722, October 1999.
[RTFM-MIB] Brownlee, N., "Traffic Flow Measurement: Meter MIB", RFC 2720, October 1999.
7. Authors' Addresses 🌸
Sig Handelman
IBM Research Division
T.J. Watson Research Center
P.O. Box 704
Yorktown Heights, NY 10598
Phone: +1 914 784 7626
EMail: swhandel@us.ibm.com
Stephen Stibler
IBM Research Division
T.J. Watson Research Center
P.O. Box 704
Yorktown Heights, NY 10598
Phone: +1 914 784 7191
EMail: stibler@us.ibm.com
Nevil Brownlee
Information Technology Systems & Services
The University of Auckland
Private Bag 92-019
Auckland, New Zealand
Phone: +64 9 373 7599 x8941
EMail: n.brownlee@auckland.ac.nz
Greg Ruth
GTE Internteworking
3 Van de Graaff Drive
P.O. Box 3073
Burlington, MA 01803, U.S.A.
Phone: +1 781 262 4831
EMail: gruth@bbn.com8. Full Copyright Statement ✨
okay bestie, this is the legal bit, and it's giving very official 💅 but we're keeping every single word. no cap, it matters 🎀
Copyright (C) The Internet Society (1999). All Rights Reserved. 💖
So this document, and translations of it, can be copied and handed out to other people. Derivative works that comment on it, explain it, or help people implement it can also be written, copied, published, and distributed, whether that's all of it or just a part, with no restrictions of any kind. The one condition is that the copyright notice and this paragraph stay on every copy and every derivative work 🫶
The original document itself, though, may not be modified in any way. That means you can't remove the copyright notice or the references to the Internet Society or other Internet organizations. The exception is when it's needed for developing Internet standards, and then the copyright procedures in the Internet Standards process have to be followed. Translating it into languages other than English is also allowed 🌈
The permissions above are perpetual. The Internet Society, its successors, and its assigns will not revoke them 🦋
This document and the information in it are provided "AS IS", and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 💀
Acknowledgement 🙌
the RFC Editor function is currently funded by the Internet Society 💜
📦 where this page comes from
- ietf: rfc2724 1999-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms