Re: [IPFIX] Cache configuration issues

[Andreas Bourges <andreas.bourges at isarnet.de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Gerhard,

On Monday 08 September 2008, Gerhard Muenz wrote:
> The advantage of 1) is that all generated Flow Records contain all
> configured fields. However, in order to generate ICMP Flow Records, we
> would need to configure a second Cache without port fields. In addition,
> we need a packet filter in front of the ICMP Cache in order to avoid
> that TCP/UDP packets are accounted as well. You see that with 1), even
> simple configurations may become quite complex.

Have you ever thought of daisy-chaining flow-cache processing? You could have 
several cache-groups and within each cache group you could have an ordered 
list of caches to be processed. Once a flow is processed, the caches could be 
checked in their configured order for matching key/value fields. If the flow 
does not match the first cache, try the second cache and so on...

In terms of flexibility this would be a good solution to categorize flows into 
different caches (according to the flow-type, e.g.tcp/udp/icmp/other) without 
explicitly filtering unwanted flows for a cache...


Regards,

Andreas

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkjGHgAACgkQRrny/uOBVy60JACeO57erijVg2eGC3T9DZUgJCpf
40oAniOw6/k6B0tzQ+HhRRMTlIDGh1qH
=Qy0T
-----END PGP SIGNATURE-----
_______________________________________________
IPFIX mailing list
IPFIX at ietf.org
https://www.ietf.org/mailman/listinfo/ipfix