Tanja Zseby, FhG FOKUS Maurizio Molina , NEC Europe Ltd. Fredric Raspall , NEC Europe Ltd.

1. Sampling and Filtering Techniques for IP Packet Selection- Update - draft-ietf-psamp-sample-tech-02.txt Tanja Zseby, FhG FOKUS Maurizio Molina, NEC Europe Ltd. Fredric Raspall, NEC Europe Ltd. Nick Duffield, AT&T Labs

2. Changes • Terminology • Aligned with Framework draft • Moved to framework • Terms for describing schemes repeated  will be removed • Description of schemes • Aligned with framework draft, agreed on schemes • Aligned with terminology • All detailed descriptions now in sample-tech draft • Restructuring of document • Complexity levels removed • Difficult to agree on levels • Vendors can select scheme(s) • Flow-state sampling added draft-ietf-psamp-sample-tech-02.txt

3. Definitions • Agreement with framework document: • Filtering: deterministic selection based on the packet content • Sampling: everything else • Content-independent Sampling • Deterministic or random selection independent of packet content • Examples: systematic, random sampling that is independent of packet content. • Content-dependent Sampling • Selection dependent on packet content • Example: pseudorandom selection according to a probability that depends on the contents of a packet field draft-ietf-psamp-sample-tech-02.txt

4. Schemes and Parameters: Sampling • Systematic count-based • start and stop in accordance to spatial packet position (packet count). • Input parameters: • Interval length (in number of packets) • Spacing between intervals (in number of packets) • Systematic time-based • start and stop in accordance to temporal packet position (arrival time). • Input parameters: • Interval length (in µsec) • Spacing (in µsec) • Not covered: • Systematic sampling with combined time- and count based trigger • Non-equal spacing draft-ietf-psamp-sample-tech-02.txt

5. Schemes and Parameters: Sampling • Random n-out-of-N • Random selection of n packets from N • Input parameters: • List of n (random) sampling positions • Parent size N • Uniform Probabilistic • Same sampling probability for each packet • Input parameters: • Sampling probability p • Non-Uniform Probabilistic • Sampling probability depends on input • Input parameters: • Function for calculation probability p • Flow State Probabilistic • Sampling probability depends on flow state (of own flow or other flows) • Input parameters: • Policy for selecting flows draft-ietf-psamp-sample-tech-02.txt

6. Schemes and Parameters: Filtering • Match/Mask • Apply a bit mask to packet header and/or the first N bytes of the payload • Select packet if the bit string after masking falls within one or more selection range • Input Parameters • header/payload masks (as bit strings) • header/payload selection ranges (as bit strings) • Hashing • Apply bit mask to packet header and/or the first N bytes of the payload, create unique bit string • Optionally, link with another pre-defined bit string (seed) • Apply hash function on the string • Select the packet if the result falls into one or more a selection range(s) • Input Parameters • Input mask (as bit strings) • Seed • Selection interval • Hashfunction draft-ietf-psamp-sample-tech-02.txt

7. Schemes and Parameters: Filtering • Router-state selection • Select packet on the basis of its route/treatment in the router (e.g. IF to which it is routed, no route found, etc.) • Input parameters • Router state (when packet should be selected) • Combined Schemes • Combination of the defined sampling and filtering schemes • E.g. for stratified sampling • Coupled via STREAM_ID [your scheme here] draft-ietf-psamp-sample-tech-02.txt

8. Schemes and Parameters Scheme | input parameters | functions ---------------+------------------------+--------------------- systematic | packet position | packet counter count-based | sampling pattern | ---------------+------------------------+--------------------- systematic | arrival time | clock or timer time-based | sampling pattern | ---------------+------------------------+--------------------- random | packet position | packet counter, n-out-of-N | sampling pattern | random numbers | (random number list) | ---------------+------------------------+--------------------- uniform | sampling | random function probabilistic | probability | ---------------+------------------------+--------------------- non-uniform |e.g. packet position | selection function, probabilistic |or packet content(parts)| probability calc. ---------------+------------------------+--------------------- non-uniform |e.g. flow state | selection function, flow-state |or packet content(parts)| probability calc. ---------------+------------------------+--------------------- mask/match | packet content(parts) | filter function ---------------+------------------------+--------------------- hash-based | packet content(parts) | hash function ---------------+------------------------+--------------------- router state | router state | router state | | discovery ---------------+------------------------+--------------------- Further clarification needed draft-ietf-psamp-sample-tech-02.txt

9. Next Steps/Open Issues • Plan • Include description of specific (pre-defined) functions (hash-functions, non-uniform selection, flow states) • Formal information model in separate document • Open Issues • More/other schemes needed ? • Which hash functions ? • High level filter specification needed ? • Currently bit level (allows all combinations) • Optionally also support high level definition (fields) • Existing work on this in other groups ? • Include flow state sampling ? draft-ietf-psamp-sample-tech-02.txt

10. Thank you for your attention ! Questions ?