Subject: sending strings data into IPfix stream

From: DESCOMBES Thierry <[email-masked]>
Date: Mon, 01 Jul 2013 11:06:08 +0200

Hello,
Not sure if this is the right list for this type of message ...
I am developing an IPFIX exporter. It exports IP flows, and I'd like now 
to export some extra information (strings) about the machines on the LAN 
(the hostname of the machine, and others information ...)
What is the right way to do that (IPFIX fields to use, template options 
or not ...)
Thank you very much in advance. Regards
T. Descombes

---

From: Brian Trammell <[email-masked]>
Date: Mon, 1 Jul 2013 11:28:25 +0200

Hi, Thierry,

Have a look in the IANA information element registry (http://www.iana.org/assignments/ipfix) to see if there are existing IEs for the information you want to export. 

Hostnames, I think, are not there -- in general, IPFIX exporters deal in addresses taken from observed packets and leave it up to the collector to do reverse resolution, due to (1) the amount of time DNS reverse lookups can take, blocking measurement activity on a (presumably) resource-constrained metering process, as well as (2) the ambiguity inherent within reverse lookups (due to e.g. misconfigured local and/or authoritative resolvers). In an environment where you have a good, internal database of hostnames (e.g. because the metering process is colocated with a DHCP server), this is more likely to be useful, though.

If you'd like to export information _not_ in the IANA Information Element registry, you have two options; (1) defining new enterprise-specific IEs scoped by your Private Enterprise Number (see Section 3.2 and example A.2.2. in http://tools.ietf.org/html/draft-ietf-ipfix-protocol-rfc5101bis) or (2) submitting a new Information Element definition for addition to the IANA registry (see http://tools.ietf.org/html/draft-ietf-ipfix-ie-doctors-07/ for guidelines on writing such a definition).

Keep in mind, for strings, you'll almost certainly be dealing with variable-length IE export; see section 7 of http://tools.ietf.org/html/draft-ietf-ipfix-protocol-rfc5101bis.

Cheers,

Brian

On 1 Jul 2013, at 11:06 , DESCOMBES Thierry <[email-masked]> wrote:

> I am developing an IPFIX exporter. It exports IP flows, and I'd like now to export some extra information (strings) about the machines on the LAN (the hostname of the machine, and others information ...)
> What is the right way to do that (IPFIX fields to use, template options or not ...)

---

From: DESCOMBES Thierry <[email-masked]>
Date: Tue, 02 Jul 2013 15:58:22 +0200

Hi Brian,
Thanks a lot for your answer.
Our IPFIX exporter is a bit specific, and we'd like to export 
periodically a list of hostname, ipaddress and related data (that are 
not available from the collector: owner, serial number, ...)
It should be easier to send this list using IPFIX stream (and this deals 
with all security/filtering policy)...
The transmission frequency of this list will be quite low. What is the 
right way to dothat ? Do I have to use IPFIX option templates to send 
such data, or not ?
Thanks a lot. Cheers
Thierry