Sampling and Filtering Techniques Sampling and Filtering Techniques for IP Packet Selectionfor IP Packet Selection

- Update - - Update - draft-ietf-psamp-sample-tech-02.txtdraft-ietf-psamp-sample-tech-02.txt

Tanja Zseby, FhG FOKUS

Maurizio Molina, NEC Europe Ltd.

Fredric Raspall, NEC Europe Ltd.

Nick Duffield, AT&T Labs

draft-ietf-psamp-sample-tech-02.txt 2

ChangesChanges Terminology

– Aligned with Framework draft– Moved to framework– Terms for describing schemes repeated will be removed

Description of schemes– Aligned with framework draft, agreed on schemes– Aligned with terminology– All detailed descriptions now in sample-tech draft

Restructuring of document Complexity levels removed

– Difficult to agree on levels– Vendors can select scheme(s)

Flow-state sampling added

draft-ietf-psamp-sample-tech-02.txt 3

DefinitionsDefinitions Agreement with framework document: Filtering: deterministic selection based on the packet

content Sampling: everything else

– Content-independent Sampling• Deterministic or random selection independent of packet

content• Examples: systematic, random sampling that is

independent of packet content. – Content-dependent Sampling

• Selection dependent on packet content• Example: pseudorandom selection according to a

probability that depends on the contents of a packet field

draft-ietf-psamp-sample-tech-02.txt 4

Schemes and Parameters: SamplingSchemes and Parameters: Sampling Systematic count-based

– start and stop in accordance to spatial packet position (packet count).– Input parameters:

• Interval length (in number of packets)• Spacing between intervals (in number of packets)

Systematic time-based– start and stop in accordance to temporal packet position (arrival time).– Input parameters:

• Interval length (in µsec)• Spacing (in µsec)

Not covered:– Systematic sampling with combined time- and count based trigger– Non-equal spacing

draft-ietf-psamp-sample-tech-02.txt 5

Schemes and Parameters: SamplingSchemes and Parameters: Sampling Random n-out-of-N

– Random selection of n packets from N– Input parameters:

• List of n (random) sampling positions • Parent size N

Uniform Probabilistic– Same sampling probability for each packet– Input parameters:

• Sampling probability p Non-Uniform Probabilistic

– Sampling probability depends on input– Input parameters:

• Function for calculation probability p Flow State Probabilistic

– Sampling probability depends on flow state (of own flow or other flows)– Input parameters:

• Policy for selecting flows

draft-ietf-psamp-sample-tech-02.txt 6

Schemes and Parameters: FilteringSchemes and Parameters: Filtering Match/Mask

– Apply a bit mask to packet header and/or the first N bytes of the payload– Select packet if the bit string after masking falls within one or more

selection range– Input Parameters

• header/payload masks (as bit strings)• header/payload selection ranges (as bit strings)

Hashing– Apply bit mask to packet header and/or the first N bytes of the payload,

create unique bit string– Optionally, link with another pre-defined bit string (seed)– Apply hash function on the string– Select the packet if the result falls into one or more a selection range(s)– Input Parameters

• Input mask (as bit strings)• Seed • Selection interval• Hashfunction

draft-ietf-psamp-sample-tech-02.txt 7

Schemes and Parameters: FilteringSchemes and Parameters: Filtering Router-state selection

– Select packet on the basis of its route/treatment in the router (e.g. IF to which it is routed, no route found, etc.)

– Input parameters• Router state (when packet should be selected)

Combined Schemes– Combination of the defined sampling and filtering schemes – E.g. for stratified sampling– Coupled via STREAM_ID

[your scheme here]

draft-ietf-psamp-sample-tech-02.txt 8

Schemes and ParametersSchemes and Parameters Scheme | input parameters | functions

---------------+------------------------+--------------------- systematic | packet position | packet counter count-based | sampling pattern | ---------------+------------------------+--------------------- systematic | arrival time | clock or timer time-based | sampling pattern | ---------------+------------------------+--------------------- random | packet position | packet counter, n-out-of-N | sampling pattern | random numbers | (random number list) | ---------------+------------------------+--------------------- uniform | sampling | random function probabilistic | probability | ---------------+------------------------+--------------------- non-uniform |e.g. packet position | selection function, probabilistic |or packet content(parts)| probability calc. ---------------+------------------------+--------------------- non-uniform |e.g. flow state | selection function, flow-state |or packet content(parts)| probability calc. ---------------+------------------------+--------------------- mask/match | packet content(parts) | filter function ---------------+------------------------+--------------------- hash-based | packet content(parts) | hash function ---------------+------------------------+--------------------- router state | router state | router state | | discovery ---------------+------------------------+---------------------

Further clarification needed

draft-ietf-psamp-sample-tech-02.txt 9

Next Steps/Open IssuesNext Steps/Open Issues

Plan– Include description of specific (pre-defined) functions (hash-

functions, non-uniform selection, flow states)– Formal information model in separate document

Open Issues– More/other schemes needed ?– Which hash functions ?– High level filter specification needed ?

• Currently bit level (allows all combinations)• Optionally also support high level definition (fields)• Existing work on this in other groups ?

– Include flow state sampling ?

Thank you for your attention ! Thank you for your attention !

Questions ?