There are a number of IP flow information export systems in common use. These systems differ significantly, even though some have adopted a common transport mechanism; such differences make it difficult to develop generalized flow analysis tools. As such, there is a need in the industry and the Internet research community for IP devices such as routers to export flow information in a standard way to external systems such as mediation systems, accounting/billing systems, and network management systems to facilitate services such as Internet research, measurement, accounting, and billing.
An IP flow information export system includes a data model which
represents the flow information, and a transport protocol. An
"exporter," which is typically an IP router or IP traffic measurement
device, will employ the IP flow information export system to report
information about "IP flows," these being a series of related IP packets
that have been either forwarded or dropped. The reported flow
information will include both (1) those attributes derived from the IP
packet headers such as source and destination address, protocol, and
port number, and (2) those attributes often known only to the exporter
such as ingress and egress ports, IP (sub)net mask, autonomous system
numbers and perhaps sub-IP-layer information.
This group will select a protocol by which IP flow information can be
transferred in a timely fashion from an "exporter" to a collection
station or stations and define an architecture which employs it. The
protocol must run over an IETF approved congestion-aware transport
protocol such as TCP or SCTP. |