Site maintenance: Ilka Miloucheva

Scalable and efficient traffic flow monitoring according IETF IPFIX standardisation efforts

• contribution to IPFIX IETF Working group http://www.ietf.org/html.charters/ipfix-charter.html
• standardising the export of IP flow measurement results from a monitoring station (meter) to a collector, i.e. a recipient of the measurements results,
• achieve an acceptable level of interoperability among equipment from different
• vendors (e.g. the meters may be embedded into the routers, and normally a collector will receive messages from more than one meter).

Use cases

• Per-flow traffic volume measurements.
• Volume-based charging based either on the total volume of traffic or distinguishing by class of services.
• Short term Traffic Engineering.
• Long term Network Planning.
• QoS management.

IPFIX meter architecture

• Flexible flow definition (IPFIX), allowing to perform measurements at very different levels of granularity, ranging from the total traffic flowing on a link to the single stream (for instance a single VoIP call).
• Designed to scale with high-speed links, where both packet rate and number of flows might be very high.
• Considering that in Internet the flow size distribution is “heavy tailed”, with few “elephant” flows accounting for a good portion of the overall traffic, and a large number of “mice” flows with negligible contribution
• Main components: “meter” and the “collector”, with the meter sending to the collector messages in the format defined in the IPFIX standard.
• „Meter“: a passive metering tool that has access to the traffic flowing in a network. It can be located inside a network or at the boundary of a domain, e.g. in an IXP. Reports are sent from the meter to the collector at regular intervals.
• Interface between the data collector and the remote INTERMON database is XML-based.

IPFIX meter functional blocks