Tanja Zseby, FhG FOKUS Maurizio Molina , DANTE Nick Duffield, AT&T Labs

1. Sampling and Filtering Techniques for IP Packet Selection- Update - draft-ietf-psamp-sample-tech-05.txt Tanja Zseby, FhG FOKUS Maurizio Molina, DANTE Nick Duffield, AT&T Labs Saverio Niccolini, NEC Europe Ltd. Fredric Raspall, EPSC-UPC

2. Changed • Associations • If no IPFIX process specified, packet selector applies to all processes on observation point • Only AND for router state filters • Use of correct terminology in 7.2. • e.g. Hash Selection Range instead of Selection Interval Specification • Address changes • 3 of the 5 authors changed affiliation… • Some clarifications that came up from MIB definition • Some re-wording proposed by Stewart draft-ietf-psamp-sample-tech-05.txt

3. Not Changed • Some proposed changes not addressed: • Simplicity of filter model was criticized • But: substitution of complex by simple model (limitied to AND) was result of last IETF discussion • Terminology remains in both documents • Nothing changed regarding recommended hash function because ongoing discussion • Small TODOs • Change references to documents if titles of other documents change (as proposed by Benoit, e.g. MIB) • Some terminology re-wording proposed by Stewart that need to be consistent with FW draft • Benoit has corrected some typos on his paper version  already done for 07 version draft-ietf-psamp-sample-tech-05.txt

4. Open Issue: Recommended Hash-Function • Some clarification: • PSAMP compliance: MUST implement at least one of the selection method (sampling or filtering) •  Its not mandatory to implement a hash-based selection • But: we want to give a recommendation which hash function to use in case someone decided to use hash-based selection •  IF hash-based selection is chosen, [function] SHOULD be implemented • Current recommendation • IPSX for packet selection • CRC for packet digest • New Proposal: • Recommend BOB for both • IPSX and CRC optional draft-ietf-psamp-sample-tech-05.txt

5. Open Issue: Recommended Hash-Function • Selection Function • Speed important (process each packet) • Collisions not relevant • Pro IPSX • IPSX is 7 times faster than BOB • IPSX is simple • Pro BOB • IPSX limited to 16 bytes input • problem with IPv6 packets • poor uniformity • For all hash functions with 16 bit input • Improvement for BOB and CRC if larger input • Couldn’t be checked with IPSX draft-ietf-psamp-sample-tech-05.txt

6. Open Issue: Recommended Hash-Function • Digest Function • Collisions relevant • Speed less important (only operate on selected packets) • Pro CRC • Faster in hardware ? • But existing implementations cannot be used ? • Pro BOB • BOB is faster than CRC on software implementation • BOB achieves similar good collision probability as CRC • Approaches: • 1. BOB for digest, IPSX for IPv4 selection, BOB for IPv6 selection, others optional • 2. BOB for digest and selection, others optional •  Still ongoing discussion on list draft-ietf-psamp-sample-tech-05.txt

7. Other Issues • Which hash function to recommend for IPv6  depends on hash discussion • Better reference for IPSX ? • Allow NOT operation for filters ? • Seems not difficult to implement • Allow for all or only for some filter types ? draft-ietf-psamp-sample-tech-05.txt

8. Research Topics for IMRG ? • Extend work on hash-based sampling ? • More tests on uniformity and speed • Hash-functions for IPv6 • Flow-state and router-state methods ? • Suitability for PSAMP (criteria ?) • Investigate/Compare different methods • … • Volunteers ? draft-ietf-psamp-sample-tech-05.txt

9. Thank you for your attention ! Questions ?