RFC 5476
Packet Sampling (PSAMP) Protocol Specifications
Packet Sampling (PSAMP) Protocol Specifications 🎀
okay bestie, this is the title block 💅 It's RFC 5476, filed under the Network Working Group in March 2009. The category is Standards Track 🔥
The authors are B. Claise, Ed. (the Ed. means editor 🫶), A. Johnson from Cisco Systems, Inc., and J. Quittek from NEC Europe Ltd. The title block doesn't list anything it obsoletes or updates.
Status of This Memo ✨
this doc is an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 🫶 For the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌸
Copyright Notice 🌈
Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved.
this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, as they were in effect on the date of publication. Please read them carefully, because they explain your rights and restrictions for this document 📜 (the link is http://trustee.ietf.org/license-info).
ngl, the next bit is the important part 👀 This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The people who control the copyright in some of that material may not have given the IETF Trust permission to allow modifications outside the IETF Standards Process. Unless you get an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process. The exceptions are formatting it for publication as an RFC and translating it into languages other than English 💖
Abstract 🦋
this doc specifies how packet information gets exported from a Packet SAMPling (PSAMP) Exporting Process to a PSAMP Collecting Process. For exporting packet information, it uses the IP Flow Information eXport (IPFIX) protocol. IPFIX and the PSAMP architecture match really well, and the means IPFIX provides are sufficient 🧚 The document goes into detail about how IPFIX is used for PSAMP export of packet information ✨
Table of Contents 🍓
1. Introduction ....................................................3
1.1. Conventions Used in This Document ..........................3
2. PSAMP Documents Overview ........................................4
3. Terminology .....................................................4
3.1. IPFIX Terminology ..........................................4
3.2. PSAMP Terminology ..........................................5
3.2.1. Packet Streams and Packet Content ...................5
3.2.2. Selection Process ...................................6
3.2.3. Reporting ...........................................7
3.2.4. Metering Process ....................................8
3.2.5. Exporting Process ...................................8
3.2.6. PSAMP Device ........................................8
3.2.7. Collector ...........................................8
3.2.8. Selection Methods ...................................9
3.3. IPFIX and PSAMP Terminology Comparison ....................11
3.3.1. IPFIX and PSAMP Processes ..........................11
3.3.2. Packet Report, Packet Interpretation, and
Data Record ........................................12
4. Differences between PSAMP and IPFIX ............................12
4.1. Architecture Point of View ................................12
4.2. Protocol Point of View ....................................14
4.3. Information Model Point of View ...........................14
5. PSAMP Requirements versus the IPFIX Solution ...................14
5.1. High-Level View of the Integration ........................15
6. Using the IPFIX Protocol for PSAMP .............................16
6.1. Selector ID ...............................................17
6.2. The Selection Sequence ID .................................17
6.3. The Exporting Process .....................................17
6.4. Packet Report .............................................17
6.4.1. Basic Packet Report ................................17
6.4.2. Extended Packet Report .............................21
6.5. Report Interpretation .....................................22
6.5.1. Selection Sequence Report Interpretation ...........23
6.5.2. Selector Report Interpretation .....................25
6.5.2.1. Systematic Count-Based Sampling ...........25
6.5.2.2. Systematic Time-Based Sampling ............27
6.5.2.3. Random n-out-of-N Sampling ................28
6.5.2.4. Uniform Probabilistic Sampling ............29
6.5.2.5. Property Match Filtering ..................31
6.5.2.6. Hash-Based Filtering ......................33
6.5.2.7. Other Selection Methods ...................36
6.5.3. Selection Sequence Statistics Report
Interpretation .....................................37
6.5.4. Accuracy Report Interpretation .....................39
7. Security Considerations ........................................43
8. IANA Considerations ............................................43
8.1. IPFIX-Related Considerations ..............................43
8.2. PSAMP-Related Considerations ..............................43
9. References .....................................................44
9.1. Normative References ......................................44
9.2. Informative References ....................................44
10. Acknowledgments ...............................................451. Introduction ✨
the name PSAMP is short for "Packet Sampling" 🌸 The "Sampling" part means only a subset of all the packets passing through a network element gets selected for reporting. PSAMP selection operations include random selection, deterministic selection, and deterministic approximations to random selection (Hash-based Selection) 🫧
the IP Flow Information eXport (IPFIX) protocol, specified in [RFC5101], exports IP traffic information [RFC5102] observed at network devices. That lines up with the general protocol requirements in the PSAMP framework [RFC5474]. There are still some architectural differences between IPFIX and PSAMP in what they require from an export protocol 👀 IPFIX architecture [RFC5470] is focused on gathering and exporting IP traffic flow information, while the PSAMP framework [RFC5474] focuses on exporting information about individual packets. This basic difference, plus a set of differences it causes in protocol requirements, is outlined in Section 4. Even so, IPFIX is well suited for PSAMP 💅 Section 5 specifies how IPFIX is used to export packet samples. Required extensions to the IPFIX information model are specified in the PSAMP information model [RFC5477] 🦋
1.1. Conventions Used in This Document
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 🫶
2. PSAMP Documents Overview 🧚
this document is one of a series of documents from the PSAMP group 💖
[RFC5474]: "A Framework for Packet Selection and Reporting" describes the PSAMP framework for network elements to select subsets of packets by statistical and other methods, and to export a stream of reports on the selected packets to a Collector.
[RFC5475]: "Sampling and Filtering Techniques for IP Packet Selection" describes the set of packet selection techniques supported by PSAMP.
RFC 5476 (this document): "Packet Sampling (PSAMP) Protocol Specifications" specifies the export of packet information from a PSAMP Exporting Process to a PSAMP Collecting Process.
[RFC5477]: "Information Model for Packet Sampling Exports" defines an information and data model for PSAMP 🎀
3. Terminology 🌈
the IPFIX export protocol is used to export the PSAMP information, so the relevant IPFIX terminology from [RFC5101] gets copied over into this document 📋 Every term defined in this section has its first letter capitalized when it's used here. The terminology summary table in Section 3.1 gives a quick overview of how the different IPFIX terms relate to each other. The PSAMP terminology defined here is fully consistent with all the terms in [RFC5475] and [RFC5474], but only the definitions that matter for the PSAMP protocol appear in this section. Section 3.3 applies the PSAMP terminology to the IPFIX protocol terminology ✨
3.1. IPFIX Terminology
IPFIX-specific terminology used in this document is defined in Section 2 of [RFC5101]. The only exceptions are the Metering Process, Exporting Process, and Collector terms, which the PSAMP terminology section defines more precisely. In this document, as in [RFC5101], the first letter of each IPFIX-specific term is capitalized 💜
+------------------+---------------------------------------------+
| | contents |
| +--------------------+------------------------+
| Set | Template | record |
+------------------+--------------------+------------------------+
| Data Set | / | Data Record(s) |
+------------------+--------------------+------------------------+
| Template Set | Template Record(s) | / |
+------------------+--------------------+------------------------+
| Options Template | Options Template | / |
| Set | Record(s) | |
+------------------+--------------------+------------------------+
Figure A: Terminology Summary Table3.2. PSAMP Terminology
the PSAMP terminology section has been copied from [RFC5475] 🍓
3.2.1. Packet Streams and Packet Content
- Observed Packet Stream
The Observed Packet Stream is the set of all packets observed at the Observation Point.
- Packet Stream
A Packet Stream denotes a set of packets from the Observed Packet Stream that flows past some specified point within the Metering Process. An example of a Packet Stream is the output of the Selection Process. Packets selected from a stream, e.g., by Sampling, don't necessarily have a property that tells them apart from packets that weren't selected. That's why the term "stream" is preferred over "flow", which is defined as a set of packets with common properties [RFC3917] 🦋
- Packet Content
the Packet Content denotes the union of the packet header (which includes link layer, network layer, and other encapsulation headers) and the packet payload. Depending on the Observation Point, the link layer information might not be available 🫧
3.2.2. Selection Process ✨
- Selection Process 💅: A Selection Process takes the Observed Packet Stream as its input and picks out a subset of that stream as its output. Literally the main character of this whole thing 🎀
- Selection State 🧠: A Selection Process can keep state info for its own use. At any moment, the Selection State can depend on packets seen at or before that moment, plus other variables. Examples include:
(i) sequence numbers of packets at the input of Selectors;
(ii) a timestamp of observation of the packet at the Observation Point;
(iii) iterators for pseudorandom number generators;
(iv) hash values calculated during selection;
(v) indicators of whether the packet was selected by a given Selector.
A Selection Process can change parts of the Selection State while it processes a packet. The selection state for a packet reflects the state after that packet has been processed. Iconic behaviour 🦋
- Selector 🎯: A Selector defines what the Selection Process does to one single packet from its input. If the packet is selected, it becomes an element of the output Packet Stream. The Selector can use this info to decide whether a packet gets picked:
(i) the Packet Content;
(ii) information derived from the packet's treatment at the Observation Point;
(iii) any selection state that may be maintained by the Selection Process.
- Composite Selector 🧩: A Composite Selector is an ordered stack of Selectors. The output Packet Stream from one Selector becomes the input Packet Stream for the next one in line.
- Primitive Selector ✨: A Selector counts as primitive if it is not a Composite Selector. Simple and iconic.
- Selector ID 🪪: The Selector ID is the unique ID that identifies a Primitive Selector. It is unique within the Observation Domain.
- Selection Sequence 🌸: Out of all the packets observed at an Observation Point, only a few get selected by one or more Selectors. The Selection Sequence is a unique value per Observation Domain. It describes the Observation Point and the Selector IDs that the packets were selected through. Very detailed, very cute 🍓
3.2.3. Reporting 📋
- Packet Reports 🎀: Packet Reports are a configurable subset of a packet's input to the Selection Process. That can include the Packet Content, info about its treatment (for example, the output interface), and its associated selection state (for example, a hash of the Packet Content).
- Report Interpretation 🔍: Report Interpretation is supporting info about one or more packets. It's used to make sense of their Packet Reports. Examples include configuration parameters of the Selection Process.
- Report Stream 🌊: The Report Stream is the output of a Metering Process. It has two special types of info in it: Packet Reports and Report Interpretation.
3.2.4. Metering Process ⏱️
- Metering Process 💖: A Metering Process picks packets out of the Observed Packet Stream using a Selection Process. Then it outputs a Report Stream about the selected packets.
Think of the PSAMP Metering Process as a cousin of the IPFIX Metering Process [RFC5101], which outputs Flow Records. The big difference is that the PSAMP Metering Process always has a Selection Process inside it. The relationship between PSAMP and IPFIX is explained further in [RFC5477] and [RFC5474]. Go read those if you're curious 👀
3.2.5. Exporting Process 📦
- Exporting Process 🚀: An Exporting Process sends the output of one or more Metering Processes to one or more Collectors. It does this in the form of Export Packets.
- Export Packet 🎁: An Export Packet is a bundle. It combines Report Interpretation(s) and/or one or more Packet Reports, which the Exporting Process packs up for a Collector.
3.2.6. PSAMP Device 🖥️
- PSAMP Device 👑: A PSAMP Device is a device that hosts at least an Observation Point, a Selection Process, and an Exporting Process. Usually, the Observation Point(s), Selection Process(es), and Exporting Process(es) all live together on the same device. A router is a classic example 🦋
3.2.7. Collector 🗂️
- Collector 🫶: A Collector receives a Report Stream exported by one or more Exporting Processes. Sometimes the host running the Metering and/or Exporting Processes can also be the Collector. Multitasking queen 👑
3.2.8. Selection Methods 🎨
- Filtering 🔒: A filter is a Selector that picks a packet deterministically. The pick is based on the Packet Content, on its treatment, or on functions of these that occur in the Selection State. Two examples:
(i) Property Match Filtering: A packet is selected if a specific field in the packet equals a predefined value.
(ii) Hash-based Selection: A Hash Function is applied to the Packet Content, and the packet is selected if the result falls in a specified range.
- Sampling 🎲: A Selector that is not a filter is called a Sampling operation. This matches the vibe that if you can't tell whether a packet gets selected just from its content, then some kind of Sampling must be happening 🙈
- Content-Independent Sampling 🧊: A Sampling operation that does not use the Packet Content (or anything derived from it) as the basis for selection is called a Content-independent Sampling operation. Examples include systematic Sampling, and uniform pseudorandom Sampling driven by a pseudorandom number whose generation is independent of the Packet Content. Note that with Content-independent Sampling, you don't need to access the Packet Content to make the selection decision. No cap, that's clean 🧼
- Content-Dependent Sampling 🌈: A Sampling operation where the selection depends on the Packet Content is called a Content-dependent Sampling operation. An example is pseudorandom selection according to a probability that depends on the contents of a packet field. Note that this is not a filter, because the selection is not deterministic.
- Hash Domain 🔢: A Hash Domain is a subset of the Packet Content and the packet treatment, viewed as an N-bit string for some positive integer N.
- Hash Range 📏: A Hash Range is a set of M-bit strings for some positive integer M. It defines the range of values the result of the hash operation can take.
- Hash Function 🧮: A Hash Function defines a deterministic map from the Hash Domain into the Hash Range.
- Hash Selection Range 🎯: A Hash Selection Range is a subset of the Hash Range. The packet is selected if the action of the Hash Function on the Hash Domain for that packet yields a result in the Hash Selection Range.
- Hash-based Selection 💫: A Hash-based Selection is Filtering that is specified by a Hash Domain, a Hash Function, a Hash Range, and a Hash Selection Range.
- Approximative Selection 🪄: Selectors in any of the above categories can be approximated by operations in the same or another category, for implementation purposes. For example, uniform pseudorandom Sampling can be approximated by Hash-based Selection, using a suitable Hash Function and Hash Domain. In this case, how close the approximation is depends on the choice of Hash Function and Hash Domain.
- Population 🐣: A Population is a Packet Stream, or a subset of a Packet Stream. Think of it as the base set that packets get selected from. An example is all packets in the Observed Packet Stream that are observed within some specified time interval.
- Population Size 🔟: The Population Size is the number of all packets in the Population.
- Sample Size 🧺: The Sample Size is the number of packets that a Selector picks from the Population.
- Configured Selection Fraction 📐: The Configured Selection Fraction is the expected ratio of the Sample Size to the Population Size, based on the configured selection parameters.
- Attained Selection Fraction 📊: The Attained Selection Fraction is the ratio of the actual Sample Size to the Population Size. For some Sampling methods, the Attained Selection Fraction can differ from the Configured Selection Fraction. This can happen because of things like the natural statistical variability in the decisions made by probabilistic Sampling and Hash-based Selection. Still, for large Population Sizes and properly configured Selectors, the Attained Selection Fraction usually gets close to the Configured Selection Fraction ✨
3.3. IPFIX and PSAMP Terminology Comparison 🆚
PSAMP terminology was written with an IPFIX background, since PSAMP and IPFIX have similar terms. This section sorts out the differences between the IPFIX and PSAMP terms 💜
3.3.1. IPFIX and PSAMP Processes ⚙️
Figure B shows the order of the IPFIX processes (Metering and Exporting) inside the PSAMP Device.
+------------------+
| Metering Process |
| +-----------+ | +-----------+
Observed | | Selection | | | Exporting |
Packet--->| | Process |--------->| Process |--->Collector
Stream | +-----------+ | +-----------+
+------------------+
Figure B: PSAMP ProcessesThe Selection Process takes an Observed Packet Stream as its input, and it is a built-in part of the Metering Process. It decides which packets from its input Packet Stream get reported on by the rest of the Metering Process. Also, a "Process" doesn't have to be its own separate CPU thread, so don't picture it that way 🧵
3.3.2. Packet Report, Packet Interpretation, and Data Record 📑
PSAMP terminology talks about Packet Report and Packet Interpretation. IPFIX terminology talks about Data Record and (Options) Template Record. A PSAMP Packet Report, which holds info about the observed packet, can be seen as a cousin of the IPFIX Data Record that is defined by a Template Record. A PSAMP Report Interpretation, which holds supporting info used to interpret the Packet Reports, can be seen as a cousin of the IPFIX Data Record that is defined by an Options Template Record. That Options Template Record holds supporting info that applies to the observed packet sent into the PSAMP Packet Report. Same energy, different name tags 🏷️
4. Differences between PSAMP and IPFIX 🔍
The IPFIX working group output that matters for this document is organised into three documents:
- IP Flow information architecture [RFC5470]
- IPFIX protocol specifications [RFC5101]
- IP Flow information export information model [RFC5102]
In the sections that follow, we dig into the differences between IPFIX and PSAMP for each of those aspects 🫶
4.1. Architecture Point of View ✨
Okay so, traffic flow measurement (the IPFIX requirements [RFC3917] and the IPFIX architecture [RFC5470]) can be split into two stages: packet processing and Flow processing 🧚 Figure C shows the whole glow-up.
In stage 1, every step acts on packets. Packets get captured, timestamped, picked by one or more selection steps, and then forwarded to packet classification, which maps each packet to a Flow. The selection steps can include Filtering and Sampling functions 💅
In stage 2, every step acts on Flows. Once packets are classified (mapped to Flows), Flows get generated, or updated if they already exist 🌸 Flow generation and update steps can run again and again to aggregate Flows. At the very end, Flows are exported.
Packet Sampling as described in the PSAMP framework [RFC5474] only covers stage 1 of the IPFIX architecture. Classification gets swapped out for Packet Report export. IPFIX covers stage 2 too, because it generates Flow Records out of the selected packets 🎀
IPFIX architecture PSAMP framework
packet header packet header
capturing \ capturing
| | |
timestamping | timestamping
| | |
v | v
+------>+ | stage 1: +------>+
| | > packet | |
| packet | processing | packet
| selection | | selection
| | | | |
+-------+ | +-------+
| | |
v | v
packet / Packet Report
classification \ export
| |
v |
+------>+ |
| | |
| Flow generation |
| and update | stage 2:
| | > Flow
| v | processing
| Flow |
| selection |
| | |
+-------+ |
| |
v |
Flow Record /
export
Figure C: Comparison of IPFIX Architecture and PSAMP Framework4.2. Protocol Point of View 🦋
Protocol-wise, the big difference between IPFIX and PSAMP is that IPFIX exports Flow Records, while PSAMP exports Packet Reports. From a pure export point of view, IPFIX doesn't tell apart a Flow Record made of several aggregated packets from one made of a single packet 👀
So you can think of a PSAMP export as a special IPFIX Flow Record that only holds info about one packet. Iconic, right? 💜
All the IPFIX extensions needed to meet the PSAMP requirements were already baked into the IPFIX protocol [RFC5101], which got developed at the same time as PSAMP. One example is a data type for fields with flexible length, like an octet array. That got added so PSAMP could report the content of captured packets, like the first octets of a packet 🫶
4.3. Information Model Point of View 🌈
From the information model side, the overlap between IPFIX and PSAMP is honestly huge 😭 Most IPFIX Information Elements are also useful for exporting packet info. Think of every field that reports packet header properties. Only a few, like observedFlowTotalCount (whose value will always be 1 for PSAMP), etc., can't be used in a meaningful way by PSAMP. Also, the IPFIX protocol requirements for stage 2 of Figure C don't apply to the PSAMP Metering Process.
There's more extension work on the information model too. Even though the IPFIX charter talks about Sampling, no Sampling-related Information Elements are specified in [RFC5102]. That job was intentionally left for the PSAMP information model [RFC5477]. On top of that, a bunch of extra fields are needed to meet the requirements for the PSAMP information model [RFC5475] 🍓
Since the IPFIX information model is extensible, that required extension is covered by the PSAMP information model specified in [RFC5477] ✨
5. PSAMP Requirements versus the IPFIX Solution 💅
The PSAMP protocol requirements are all over [RFC5474], with the main focus in Section 4, "Generic Requirements for PSAMP", and its subsections 🎀
Section 4 of [RFC5474] has one requirement that isn't really about the export protocol, but still puts some constraints on it. It's Parallel Measurements: multiple independent Selection Processes at the same entity 🔥
[RFC5474] also lists a series of requirements about which Information Elements MUST and SHOULD be reported to the Collector. Here's the tea though: IPFIX is a generic export protocol, so it can export any Information Elements as long as they're described in the information model. That means these requirements are mostly aimed at [RFC5477] 🧚
The PSAMP protocol spec meets almost every protocol requirement from the PSAMP framework document [RFC5474] 👑
- Extensibility
- Parallel selection processes
- Encrypted packets
- Indication of information loss
- Accuracy
- Privacy
- Timeliness
- Congestion avoidance
- Secure export
- Export rate limit
- Microsecond timestamp resolution
The one requirement that isn't met is Export Packet compression 😭 Since IPFIX is the export protocol PSAMP chose, the Export Packet compression option mentioned in Section 8.5 of the framework document [RFC5474] isn't addressed.
5.1. High-Level View of the Integration 🌸
The Template Record in the Template Set describes the different PSAMP Information Elements that get exported to the Collector. The Collector decodes that Template Record and knows which Information Elements to expect when Data Records arrive in the PSAMP Packet Report Data Set. At the base level of PSAMP functionality, the Template Set usually includes the input sequence number, the packet fragment (some number of contiguous bytes from the start of the packet or from the start of the payload), and the Selection Sequence 💖
The Options Template Record in the Options Template Set describes the PSAMP Information Elements about the Metering Process itself: the Sampling and/or Filtering functions, and their associated parameters. The Collector decodes the Options Template Records and knows what to expect when Data Records show up in the PSAMP Report Interpretation Data Set. Usually the Options Template holds the Selection Sequence, the Sampling or Filtering functions, and their associated Sampling or Filtering parameters 🦋
PSAMP needs every possibility the IPFIX protocol specifications [RFC5101] offer. That's three types of Sets (Data Set, Template Set, and Options Templates Set) and two types of Template Records (Template Record and Options Template Record), as shown in Figure A. So PSAMP can't rely on a subset of the IPFIX protocol specs in [RFC5101]. The entire IPFIX protocol specification [RFC5101] MUST be implemented for PSAMP 🫶
6. Using the IPFIX Protocol for PSAMP 🎀
In this section we go over how IPFIX gets used for PSAMP. We cover the record formats and the extra requirements that must be met. PSAMP uses two different types of messages 💅
- Packet Reports
- Report Interpretation
Packet Reports are defined by IPFIX Template Records. The PSAMP data travels as Information Elements inside IPFIX Data Records, following the Template Record. There are two types of Packet Reports 🌈 Basic Packet Reports only contain the basic Information Elements needed for PSAMP reporting. Extended Packet Reports MAY contain other Information Elements, and they don't necessarily include Packet Content (See section 6.4.2).
Report Interpretations are defined by the IPFIX Options Template Record. Their Information Elements get carried in IPFIX Data Records, following the Options Template Record. There are four types of Report Interpretation messages 🔥
- Selection Sequence Report Interpretation
- Selector Report Interpretation
- Selection Sequence Statistics Report Interpretation
- Accuracy Report Interpretation
Descriptions and examples of how to use those reports are below 👇
6.1. Selector ID 🧚
The Selector ID is the unique ID that identifies a Primitive Selector. Each Primitive Selector MUST have a unique ID within the Observation Domain. The Selector ID is represented by the selectorId Information Element [RFC5477] ✨
6.2. The Selection Sequence ID 🦋
From all the packets seen at an Observation Point, one or more Selectors pick a subset of packets. The Selection Sequence is the combo of an Observation Point and those one or more Selector(s) that do the picking. The Selection Sequence ID is a unique value that represents that combo. It's represented by the selectionSequenceId Information Element [RFC5477] 💜
6.3. The Exporting Process 💖
An Exporting Process MUST be able to limit its export rate to a configurable value. The Exporting Process MAY limit the export rate on a per Collecting Process basis 🌸
6.4. Packet Report 🫶
For each Selection Sequence, a Packet Report MUST be created for each selected packet. The format of the Packet Report is specified in a Template Record contained in a Template Set 💅
There are two types of Packet Report, as described in [RFC5474]: the basic Packet Report and the extended Packet Report 🎀
6.4.1. Basic Packet Report 🦋
okay so for every single selected packet, the Packet Report MUST contain the following info, no exceptions bestie 💅
selectionSequenceIdInformation Element 🧚 If there is a digest function in the Selection Sequence, the Packet Report MUST contain the hash value (digestHashValueInformation Element) generated by the digest Hash Function for each selected packet. If there's more than one digest function, then each hash value MUST be included in the same order as they appear in the Selection Sequence. If there are no digest functions in the Selection Sequence, no element for the digest needs to be sent.- Some number of contiguous bytes from the start of the packet, including the packet header (which includes link layer, network layer, and other encapsulation headers) and some subsequent bytes of the packet payload. Alternatively, the number of contiguous bytes may start at the beginning of the payload. The
dataLinkFrameSection,mplsLabelStackSection,mplsPayloadPacketSection,ipPacketSection, andipPayloadPacketSectionPSAMP Information Elements are available for this use. 🎀
For each selected packet, the Packet Report SHOULD contain a time-related Information Element that matches the Metering Process time accuracy. Typically, that's the observationTimeMicroseconds Information Element ⏰. Other possible ones are the observationTimeSeconds, the observationTimeMilliseconds, or the observationTimeNanoseconds.
In the Packet Report, the PSAMP Device MUST be capable of exporting the number of observed packets and the number of packets selected by each instance of its Primitive Selectors (as described by the non-scope Information Elements of the Selection Sequence Statistics Report Interpretation), although it MAY be a configurable option not to include them. If exported, the Attained Selection Fraction may be calculated precisely for the Observed Packet Stream. The Packet Report MAY include only the final selector packetSelected, to act as an index for that Selection Sequence in the Selection Sequence Statistics Report Interpretation, which also allows the calculation of the Attained Selection Fraction. It's giving flexible but still precise 🌸
The contiguous Information Elements (dataLinkFrameSection, mplsLabelStackSection, mplsPayloadPacketSection, ipPacketSection, and ipPayloadPacketSection) MAY be encoded with a fixed-length field or with a variable-sized field. If one of these Information Elements is encoded with a fixed-length field whose length is too long for the number of contiguous bytes in the selected packet, padding MUST NOT be used. In this case, the Exporting Process MUST export the information either in a new Template Record with the correct fixed-length field or in a new Template Record with a variable-length field. No padding, periodt 🙅♀️
Here is an example of a basic Packet Report, with a SelectionSequenceId value of 9 and a dataLinkFrameSection Information Element of 12 bytes, 0x4500 005B A174 0000 FF11 832E, encoded with a fixed-length field. Let's look at the IPFIX Template Record first 👑
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 2 | Length = 24 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 260 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| selectionSequenceId = 301 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| digestHashValue = 326 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| dataLinkFrameSection = 315 | Field Length = 12 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|observationTimeMicroseconds=324| Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+And now the associated IPFIX Data Record 🌈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 260 | Length = 32 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0x9123 0613 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0x4500 005B |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0xA174 0000 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0xFF11 832E |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| observation time ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... encoded as dateTimeMicroSeconds [RFC5101] |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure D: Example of a Basic Packet ReportHere is another basic Packet Report, same vibe: a SelectionSequenceId value of 9 and an ipHeaderPacketSection Information Element of 12 bytes, 0x4500 005B A174 0000 FF11 832E, but this time encoded with a variable-sized field 🧩 The template first:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 2 | Length = 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 261 | Field Count = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| selectionSequenceId = 301 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ipHeaderPacketSection = 313 | Field Length = 65535 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+And the associated IPFIX Data Record 🍓
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 261 | Length = 21 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length = 12 | 0x4500 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 005B | 0xA174 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 0000 | 0xFF11 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 832E |
+-+-+-+-+-+-+-+-+
Figure E: Example of a Basic Packet Report
with a Variable-Sized Field6.4.2. Extended Packet Report 🌟
Alternatively to the basic Packet Report, the extended Packet Report MAY contain other Information Elements related to the protocols used in the packet (such as source and destination IP addresses), related to the packet treatment (such as output interface, destination BGP autonomous system [RFC4271]), or related to the Selection State associated with the packet (such as timestamp, hash value). So many options, I'm obsessed 😭
It is envisaged that selection of fields for extended Packet Reports may be used to reduce reporting bandwidth. In that case, the option to report some number of contiguous bytes from the start of the packet (mandatory in the basic Packet Report) may not be exercised. Then the Packet Content MAY be omitted. Note this configuration is quite similar to an IPFIX Device for which a Template Record containing information about a single packet is reported 🦋
Example of a detailed Extended Packet Report 🧚 Here's the IPFIX Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 2 | Length = 32 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 261 | Field Count = 6 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| selectionSequenceId = 301 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| sourceIPv4Address = 8 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| destinationIPv4Address = 12 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| totalLengthIPv4 = 190 | Field Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| tcpSourcePort = 182 | Field Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0| tcpDestinationPort = 183 | Field Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The associated IPFIX Data Record 💜
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 261 | Length = 20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 192.0.2.1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 192.0.2.106 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 72 | 1372 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 80 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure F: Example of an Extended Packet Report6.5. Report Interpretation ✨
okay so, Packet Reports are cute, but on their own they're kinda useless 🙈 the Collector needs a bunch more info to actually make sense of them:
- Which Selectors and Observation Points are being used inside a Selection Sequence MUST be sent using the Selection Sequence Report Interpretation. 💅
- The configuration details of each Selector MUST be sent using the Selector Report Interpretation. 🎀
- The Selector ID statistics MUST be sent using the Selection Sequence Statistics Report Interpretation. 📊
- The accuracies of the reported fields MUST be sent using the Accuracy Report Interpretation. 🎯
6.5.1. Selection Sequence Report Interpretation
each Packet Report has a selectionSequenceId Information Element that tells you which combo of Observation Point and Selector(s) did the selecting 🦋 so for every selectionSequenceId Information Element in use, the PSAMP Device MUST export a Selection Sequence Report Interpretation using an Options Template with these Information Elements:
Scope: selectionSequenceId
Non-Scope: one Information Element mapping the Observation Point
selectorId (one or more)an Information Element representing the Observation Point would typically be pulled from ingressInterface, egressInterface, lineCardId, exporterIPv4Address, or exporterIPv6Address (specified in [RFC5102]), but it's not limited to those. any Information Element specified in [RFC5102] or [RFC5477] can potentially be used 🌈 for more complex Observation Points (like a list of interfaces, a bus, etc.), a new Information Element describing the new type of Observation Point must be specified, along with an Options Template Record describing it in more detail (if necessary). it's giving flexibility, bestie ✨
if the packets are selected by a Composite Selector, the Selection Sequence is made of several Primitive Selectors 🧚 in that case, the Selection Sequence Report Interpretation MUST contain the list of all the Primitive Selector IDs in the Selection Sequence. and if multiple Selectors are in the Selection Sequence Report Interpretation, the selectorIds MUST be identified in the order they are used. order matters, periodt 💜
Example of two Selection Sequences:
Selection Sequence 7 (Filter->Sampling):
ingressInterface 5
selectorId 5 (Filter, match IPV4SourceAddress 192.0.2.1)
selectorId 10 (Sampler, Random 1 out-of ten)
Selection Sequence 9 (Sampling->Filtering):
ingressInterface 5
selectorId 10 (Sampler, Random 1 out-of ten)
selectorId 5 (Filter, match IPV4SourceAddress 192.0.2.1)IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 262 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectionSequenceId = 301 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| ingressInterface = 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 262 | Length = 36 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 7 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure G: Example of a Selection Sequence Report Interpretation
Notes:
- There are two Records here in the same Data Set. Each record defines a different Selection Sequence. 👯
- If, for example, a different Selection Sequence is composed of three Selectors, then a different Options Template with three
selectorIdInformation Elements (instead of two) must be used. 🍓
6.5.2. Selector Report Interpretation
An IPFIX Data Record, defined by an Options Template Record, MUST be used to send the configuration details of every Selector in use. The Options Template Record MUST contain the selectorId Information Element as the Scope field and the SelectorAlgorithm Information Element followed by some specific configuration parameters:
Scope: selectorId
Non-scope: selectorAlgorithm
algorithm-specific Information Elementsthe algorithm-specific Information Elements are specified in the following subsections, depending on the selection method represented by the value of the selectorAlgorithm [RFC5477]. choose your fighter 💖
6.5.2.1. Systematic Count-Based Sampling
in systematic count-based Sampling, the start and stop triggers for the Sampling interval are defined in accordance with the spatial packet position (packet count) [RFC5475]. so it's all about counting packets, literally 🔢
The REQUIRED algorithm-specific Information Elements in the case of systematic count-based Sampling are:
samplingPacketInterval: number of packets selected in a row
samplingPacketSpace: number of packets between selectionsExample of a simple 1 out-of 10 systematic count-based Selector definition, where the samplingPacketInterval is 1 and the samplingPacketSpace is 9. 🎀
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 263 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| selectorAlgorithm = 304 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0|samplingPacketInterval = 305 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingPacketSpace = 306 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 263 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 15 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 1 | 1 | 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure H: Example of the Selector Report Interpretation for Systematic Count-Based Sampling
Notes:
- A
selectorAlgorithmvalue of 1 represents systematic count-based Sampling. 🧮 samplingPacketIntervalandsamplingPacketSpaceare of type unsigned32 but are compressed down to one octet here, as allowed by the IPFIX protocol specifications [RFC5101]. tiny packing, big brain 🧠
6.5.2.2. Systematic Time-Based Sampling 🕰️✨
okay so for systematic time-based Sampling, the start and stop triggers are what set up the Sampling intervals [RFC5475]. The algorithm-specific Information Elements that are REQUIRED here are:
samplingTimeInterval: time (in microseconds) when packets are selectedsamplingTimeSpace: time (in microseconds) between selections
Here's a example to make it click 💅: a 100 microsecond out-of 1000 microsecond systematic time-based Selector, where samplingTimeInterval is 100 and samplingTimeSpace is 900.
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 264 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| selectorAlgorithm = 304 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingTimeInterval = 307 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingTimeSpace = 308 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 264 | Length = 12 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 2 | 100 | 900 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure I: Example of the Selector Report Interpretation for Systematic Time-Based Sampling
Notes:
- A
selectorAlgorithmvalue of 2 represents systematic time-based Sampling. samplingTimeIntervalandsamplingTimeSpaceare of type unsigned32 but are compressed down here.
6.5.2.3. Random n-out-of-N Sampling 🎲💜
In random n-out-of-N Sampling, n elements get picked out of the parent Population, which has N elements [RFC5475]. The algorithm-specific Information Elements that are REQUIRED in this case are:
samplingSize: number of packets selectedsamplingPopulation: number of packets in selection Population
Example of a 1 out-of 10 random n-out-of-N Sampling Selector:
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 265 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| selectorAlgorithm = 304 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingSize = 309 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingPopulation = 310 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 265 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 17 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 3 | 1 | 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure J: Example of the Selector Report Interpretation for Random n-out-of-N Sampling
Notes:
- A
selectorAlgorithmvalue of 3 represents Random n-out-of-N Sampling. samplingSizeandsamplingPopulationare of type unsigned32 but are compressed down to one octet here.
6.5.2.4. Uniform Probabilistic Sampling 🌸
In uniform probabilistic Sampling, each element has the same probability p of being selected from the parent Population [RFC5475]. The algorithm-specific Information Element for uniform probabilistic Sampling is:
samplingProbability: a floating point number for the Sampling probability.
Example of a 15% uniform probability Sampling Selector:
IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 22 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 271 | Field Count = 3 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| selectorAlgorithm = 304 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| samplingProbability = 311 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 271 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 4 | 0.15 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+-+-+-+-+-+-+-+-+Figure K: Example of the Selector Report Interpretation for Uniform Probabilistic Sampling
Notes:
- A
selectorAlgorithmvalue of 4 represents Uniform Probabilistic Sampling. samplingProbabilityis of type float64 but is compressed down to a float32 here.
6.5.2.5. Property Match Filtering ✨
okay so this classification is giving match(es)! 💅 It looks at field(s) inside a packet and/or properties of the router state. Basically, a packet gets selected if a specific field in it equals a predefined value. 💖
The algorithm-specific Information Elements that set the configuration parameters for Property Match Filtering get pulled from the full range of available Information Elements 🧚
When multiple different Information Elements are defined, the filter acts as a logical AND. ngl the logical OR isn't covered by these PSAMP specifications, so don't go hunting for it here 🙈 The Property Match Filtering Options Template Record MUST NOT have multiple identical Information Elements. The result of the filter doesn't depend on the order of the Information Elements in the Options Template Record, but the order may be important for implementation purposes, since the first filter has to work at a higher rate. Anyway, an implementation isn't constrained to respect the filter ordering as long as the result is the same, and it may even do the composite Filtering in one single step 🎀
Since encryption changes what encrypted fields mean 🔐, when the Property Match Filtering classification is based on the encrypted field(s) in the packet, it MUST be able to recognize that the field(s) are not available and MUST NOT select those packets unless specifically directed by the Information Element description. Even if they're ignored, the encrypted packets MUST be accounted for in the Selector packetsObserved Information Element [RFC5477], which is part of the Selection Sequence Statistics Report Interpretation. No skipping this one, bestie 💀
Here's an example of a match-based filter Selector, whose rules are:
IPv4 Source Address = 192.0.2.1
IPv4 Next-Hop Address = 192.0.2.129IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 266 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| selectorAlgorithm = 304 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| sourceIPv4Address = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| ipNextHopIPv4Address = 15 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 266 | Length = 11 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 21 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 | 192.0.2 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... .1 | 192.0.2 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... .129 |
+-+-+-+-+-+-+-+-+ Figure L: Example of the Selector Report Interpretation
for Match-Based and Router State FilteringNotes:
- A
selectorAlgorithmvalue of5represents Property Match Filtering. - In this filter, there is a mix of information from the packet and information from the router. main character filter energy 👑
6.5.2.6. Hash-Based Filtering 🔮
okay so in Hash-based Selection, a Hash Function gets run on IPv4 traffic 🧚 and these fields MUST be used as input to that Hash Function:
- IP identification field
- Flags field
- Fragment offset
- Source IP address
- Destination IP address
- A number of bytes from the IP payload. The number of bytes and starting offset MUST be configurable if the Hash Function supports it.
for the bytes taken from the IP payload, IPSX has a fixed offset of 0 bytes and a fixed size of 8 bytes 💅 but the number and offset of payload bytes in the BOB function MUST be configurable ✨
the minimum configuration ranges MUST be as follows:
- Number of bytes: from 8 to 32
- Offset: from 0 to 64
if the selected payload bytes aren't available and the Hash Function can take a variable-sized input, then the Hash Function MUST be run with the information that is available and a shorter size. passing 0 as a substitute for missing payload bytes is only acceptable if the Hash Function takes a fixed size, which is the case with IPSX 🙈
if the Hash Function can take an initialization value, then this value MUST be configurable 🎀
a Hash-based Selection function MAY be configurable as a digest function 🌸 and any Selection Process that's configured as a digest function MUST have the output value included in the basic Packet Report for any selected packet 💜
each Hash Function used as a Hash-based Selection Selector requires its own value for the selectorAlgorithm. right now we've got BOB (6), IPSX (7), and CRC (8) defined, and any of them MAY be used for either Filtering or creating a Packet Digest. only BOB is recommended though, and it SHOULD be used 👑
the REQUIRED algorithm-specific Information Elements for Hash-based Selection are:
hashIPPayloadOffset- The payload offset used by a Hash-based Selection SelectorhashIPPayloadSize- The payload size used by a Hash-based Selection SelectorhashOutputRangeMin- One or more values for the beginning of each potential output range.hashOutputRangeMax- One or more values for the end of each potential output range.hashSelectedRangeMin- One or more values for the beginning of each selected range.hashSelectedRangeMax- One or more values for the end of each selected range.hashDigestOutput- A boolean value, TRUE if the output from this Selector has been configured to be included in the Packet Report as a packet digest.
Note: if more than one selection or output range needs to be sent, then the minimum and maximum elements may be repeated as needed 🍓 these MUST make one or more non-overlapping ranges. the elements SHOULD be sent as pairs of minimum and maximum in ascending order. however, if they're sent out of order, there will only be one way to interpret the ranges to produce a non-overlapping range, and the Collecting Process MUST be prepared to accept and decode this 🫶
the following algorithm-specific Information Element MAY be sent, but it's optional for security considerations:
hashInitialiserValue- The initialiser value to the Hash Function.
🚨 since encryption alters the meaning of encrypted fields, when the Hash-based Filtering classification is based on the encrypted field(s) in the packet, it MUST be able to recognize that the field(s) are not available and MUST NOT select those packets. even if they're ignored, the encrypted packets MUST be accounted for in the Selector packetsObserved Information Element [RFC5477], which is part of the Selection Sequence Statistics Report Interpretation. bestie this one is serious 😭
here's an example of a Hash-based Filter Selector, with this configuration 🦋
Hash Function = BOB
Hash IP Payload Offset = 0
Hash IP Payload Size = 16
Hash Initialiser Value = 0x9A3F9A3F
Hash Output Range = 0 to 0xFFFFFFFF
Hash Selected Range = 100 to 200 and 400 to 500IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 50 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 269 | Field Count = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectorId = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| selectorAlgorithm = 302 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 1 |0| hashIPpayloadOffset = 327 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashIPpayloadSize = 328 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashInitialiserValue = 329 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashOutputRangeMin = 330 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashOutputRangeMax = 331 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashSeletionRangeMin = 332 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashSeletionRangeMax = 333 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashSeletionRangeMin = 332 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| hashSeletionRangeMax = 333 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 266 | Length = 45 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 22 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 6 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 0 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 16 | 0x9A3F9A ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 3F | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... 0 | 0xFFFFFF ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... FF | ... 100 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... 200 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... 400 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... 500 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... |
+-+-+-+-+-+-+-+-+
Figure M: Example of the Selector Report Interpretation
for Hash-based Filteringnotes, bestie 📝
- A selectorAlgorithm value of 6 represents Hash-based Filtering using the BOB algorithm.
6.5.2.7. Other Selection Methods 🌈
new selection methods MAY be added later on ✨ some of the new ones, like non-uniform probabilistic Sampling and flow-state-dependent Sampling, are described in [RFC5475], with further references 📚
each new selection method MUST be assigned a unique value for the selectorAlgorithm Information Element. its configuration parameter(s), along with the way to report it/them with an Options Template, MUST be clearly specified 💖
6.5.3. Selection Sequence Statistics Report Interpretation ✨
okay so a Selector MAY be reused across more than one Selection Sequence 🦋, but every single use has to be totally independent, no sharing the tea 🫖. So each separate logical instance of a Selector MUST maintain its own individual Selection State and statistics 💅.
The Selection Sequence Statistics Report Interpretation MUST include the number of observed packets (Population Size) and the number of packets selected (Sample Size) by each instance of its Primitive Selectors 📊.
Within a Selection Sequence made of several Primitive Selectors, the number of packets selected for one Selector equals the number of packets seen by the next Selector 🔗. The order of the Selectors in the Selection Sequence Statistics Report Interpretation MUST match the order of the Selectors in the Selection Sequence, so nobody gets lost 🙈.
If the full set of statistics is not sent as part of the Basic Packet Reports, the PSAMP Device MUST export a Selection Sequence Statistics Report Interpretation for every Selection Sequence 📤. It does this using an Options Template containing the following Information Elements:
Scope: selectionSequenceId
Non-scope: packetsObserved
packetsSelected (first Selector)
...
packetsSelected (last Selector)The packetsObserved Information Element [RFC5477] MUST contain the number of packets seen at the Observation Point, which then gets passed to the first Selector in the Selection Sequence 👀. The packetsSelected Information Element [RFC5477] holds the number of packets a Selector in the Selection Sequence picked 🎯.
The Attained Selection Fraction for the Selection Sequence is worked out by dividing the packetsSelected Information Element for the last Selector by the packetsObserved Information Element 🧮. You can also get one for each Selector by dividing the packets selected for that Selector by the value for the previous Selector, which is lowkey so satisfying 🍓.
The statistics for the whole sequence SHOULD be taken at a single logical point in time ⏰. On top of that, the input value for a Selector MUST equal the output value of the previous Selector 🫶.
The Selection Sequence Statistics Report Interpretation MUST be exported periodically 🔁.
Example of Selection Sequence Statistics Report Interpretation:
Selection Sequence 7 (Filter->Sampling):
Observed 100 (observationPointId 1, Interface 5)
Selected 50 (selectorId 5, match IPV4SourceAddress 192.0.2.1)
Selected 6 (selectorId 10, Sampler: Random one out-of ten)
Selection Sequence 9 (Sampling->Filtering):
Observed 100 (observationPointId 1, Interface 5)
Selected 10 (selectorId 10, Sampler: Random one out-of ten)
Selected 3 (selectorId 5, match IPV4SourceAddress 192.0.2.1)IPFIX Options Template Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 26 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 267 | Field Count = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| selectionSequenceId = 301 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 4 |0| packetsObserved = 318 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| packetsSelected = 319 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |0| packetsSelected = 319 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The associated IPFIX Data Record:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 267 | Length = 36 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 7 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 100 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 50 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 6 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 9 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 100 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 3 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure N: Example of the Selection Sequence Statistics
Report InterpretationNotes:
- The Attained Selection Fractions for Selection Sequence 7 are:
Filter 10: 50/100Sampler 5: 6/50Number of samples selected: 6
- The Attained Selection Fractions for Selection Sequence 9 are:
Sampler 5: 10/100Filter 10: 3/10Number of samples selected: 3
6.5.4. Accuracy Report Interpretation 🎯✨
okay bestie, so the Collecting Process needs to know how accurate the reported numbers are (timestamps especially, obviously 🕰️). That's why the PSAMP Device SHOULD send an Accuracy Report Interpretation 💅
The Accuracy Report Interpretation MUST be exported by an Options Template Record whose scope contains the Information Element the accuracy is for 🫶 If the accuracy only applies to one specific template, you MUST add a second scope holding the templateId value to that Options Template Record. And the accuracy SHOULD be reported with either the absoluteError Information Element [RFC5477] or the relativeError Information Element [RFC5477] 🎀
Here are the four ways it can look:
Accuracy Report Interpretation using the absoluteError Information
Element:
Scope: informationElementId
Non-scope: absoluteError
Accuracy Report Interpretation using the absoluteError Information
Element and a double scope:
Scope: templateId
informationElementId
Non-scope: absoluteError
Accuracy Report Interpretation using the relativeError Information
Element:
Scope: informationElementId
Non-scope: relativeError
Accuracy Report Interpretation using the relativeError Information
Element and a double scope:
Scope: templateId
informationElementId
Non-scope: relativeErrorLet's talk examples, because they make it click 🧚
First up, an Information Element with the Abstract Data Type dateTimeMilliseconds [RFC5102], where the unit is milliseconds. Its accuracy can be given with absoluteError, also in milliseconds. So the error interval is the Information Element value +/- whatever absoluteError says 💖
Second, an Information Element that estimates how accurate a sampled flow is, where the unit is octets. Its accuracy can be given with relativeError, in octets too 📦 Here the error interval is the Information Element value +/- the relativeError value times the reported Information Element value. Very math, very cute 🤓
Another option is to report both absoluteError and relativeError in the Accuracy Report Interpretation. If you do that, whatever is least accurate for the reported value should be used 🙈
If the accuracy of a reported quantity changes on the Metering Process, a new Accuracy Report Interpretation MUST be generated. The Collecting Process MUST keep the accuracy of the latest Accuracy Report Interpretation. No stale accuracy allowed, bestie 🚫
Example one is an Accuracy Report Interpretation using absoluteError with a double scope. The timeMicroseconds in Template 5 has an accuracy of +/- 2 ms, which is represented by the absoluteError Information Element ⏱️
Scope: templateId = 6
informationElementId = timeMicroseconds
Non-scope: absoluteError = 2 msHere's the IPFIX Options Template Record for it 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 22 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 267 | Field Count = 3 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 2 |0| templateId = 145 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 2 |0| InformationElementId = 303 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 2 Length = 2 |0| absoluteError = 320 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+And the associated IPFIX Data Record 📝
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 267 | Length = 12 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 | 324 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 2 (encoded as a float32) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure O: Example of the Selection Sequence
Statistics Report InterpretationNotes: * absoluteError is of type float64 but is compressed down to a float32 here.
Example two is an Accuracy Report Interpretation using relativeError with a single scope. The timeMicroseconds has an error of 5%, represented by the proportionalAccuracy Information Element 🌈
Scope: informationElementId = timeMicroseconds
Non-scope: relativeError = 0.05IPFIX Options Template Record, coming in hot 🔥
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 3 | Length = 18 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID = 268 | Field Count = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope Field Count = 1 |0| InformationElementId = 303 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Length = 2 |0| relativeError= 321 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The associated IPFIX Data Record 🧾
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Set ID = 267 | Length = 10 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 324 | 0.05 ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ...(encoded as a float32) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure P: Example of the Selection Sequence
Statistics Report InterpretationNotes: * relativeError is of type float64 but is compressed down to a float32 here.
7. Security Considerations 🔐
okay this section is SERIOUS bestie, so listen up 👀
As IPFIX has been picked as the PSAMP export protocol, and the PSAMP security requirements are not stricter than the IPFIX ones, you go check the IPFIX export protocol [RFC5101] for the security considerations 📚
In the basic Packet Report, a PSAMP Device exports some number of contiguous bytes from the start of the packet. That includes the packet header (link layer, network layer, and other encapsulation headers) plus some of the bytes after it in the payload 📦
The PSAMP Device SHOULD NOT export the full payload of conversations, because that would mean wiretapping [RFC2804] 😱 And the PSAMP Device MUST respect local privacy laws. Non-negotiable, periodt 💅⚖️
8. IANA Considerations 🦋
The PSAMP protocol, as laid out in this document, has two sets of assigned numbers 🔢 This section talks about how to assign them, using the example policies from [RFC5226], "Guidelines for IANA Considerations" 📋
8.1. IPFIX-Related Considerations 🌸
Since PSAMP uses the IPFIX protocol, check the IANA considerations section in [RFC5101] for the assignments of the numbers used in the protocol, and for the numbers used in the information model 🧠
8.2. PSAMP-Related Considerations 💜
Each new selection method MUST be assigned a unique value for the selectorAlgorithm Information Element [RFC5477] 🫶 The initial contents of this registry are in Section 8.2.1 in [RFC5477]. And its configuration parameter(s), plus how to report them with an Options Template, MUST be clearly specified ✨
New assignments for the PSAMP selection method will be handled by IANA, on a First Come First Served basis [RFC5226], subject to Expert Review [RFC5226] 🧐 The group of experts must double check the Information Elements definitions against the already defined ones for completeness, accuracy, and redundancy. At the start, these experts will come from the Working Group Chairs and document editors of the IPFIX and PSAMP Working Groups 👑
9. References 📚
9.1. Normative References 🎀
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC5101] Claise, B., Ed., "Specification of the IP Flow Information
Export (IPFIX) Protocol for the Exchange of IP Traffic Flow
Information", RFC 5101, January 2008.
[RFC5102] Quittek, J., Bryant, S., Claise, B., Aitken, P., and J.
Meyer, "Information Model for IP Flow Information Export",
RFC 5102, January 2008.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 5226, May
2008.
[RFC5475] Zseby, T., Molina, M., Duffield, N., Niccolini, S., and F.
Raspall, "Sampling and Filtering Techniques for IP Packet
Selection", RFC 5475, March 2009.
[RFC5477] Dietz, T., Claise, B., Aitken, P., Dressler, F., and G.
Carle, "Information Model for Packet Sampling Exports", RFC
5477, March 2009.9.2. Informative References 🌈
[RFC2804] IAB and IESG, "IETF Policy on Wiretapping", RFC 2804, May
2000.
[RFC3917] Quittek, J., Zseby, T., Claise, B., and S. Zander,
"Requirements for IP Flow Information Export (IPFIX)", RFC
3917, October 2004.
[RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A Border
Gateway Protocol 4 (BGP-4)", RFC 4271, January 2006.
[RFC5470] Sadasivan, G., Brownlee, N., Claise, B., and J. Quittek,
"Architecture for IP Flow Information Export" RFC 5470,
March 2009.
[RFC5474] Duffield, N., Ed., "A Framework for Packet Selection and
Reporting", RFC 5474, March 2009.10. Acknowledgments 💖
The authors would like to thank the PSAMP group, especially Paul Aitken, for fruitful discussions and for proofreading the document several times 🙌
Authors' Addresses 🧚
Benoit Claise
Cisco Systems
De Kleetlaan 6a b1
1831 Diegem
Belgium
Phone: +32 2 704 5622
EMail: bclaise@cisco.comJuergen Quittek
NEC Europe Ltd.
Network Laboratories
Kurfuersten-Anlage 36
69115 Heidelberg
Germany
Phone: +49 6221 90511-15
EMail: quittek@nw.neclab.euAndrew Johnson
Cisco Systems
96 Commercial Quay
Edinburgh EH6 6LX
Scotland
Phone: +44 131 561 3641
EMail: andrjohn@cisco.com📦 where this page comes from
- ietf: rfc5476 2009-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms