IPFIX Tutorial

Introduction

This two-hour tutorial describes the IP Flow Information eXport (IPFIX) protocol, providing practical knowledge for analysts and researchers in network monitoring, measurement, performance, and security. It focuses on how the emergence of this new standard will impact the Internet measurement community.

IPFIX, which is based on Cisco NetFlow V9, provides several new features that can enable or ease specific network measurement tasks. As the natural successor to NetFlow, it will see wide deployment in the coming years.

The Program

The two-hour tutorial will cover the following topics:

• Motivation, an overview of the IPFIX protocol, a motivation for its design, and a brief overview of specific "new" features in comparison to previous, widely-used flow export methods.
• Technical Protocol Description, an explanation of the details of the protocol at the IPFIX Message level. These details will be covered in sufficient depth to give attendees a basic understanding of how the protocol works at the IPFIX Message level, and how each of the various features can be applied to specific problems in flow export and collection.
• Current Work, an overview of current work in the IETF IPFIX working group, and future extensions to the protocol that are of particular interest to the measurement community.
• Implementation, an overview of existing implementations, focusing on open source implementations, to encourage experimentation, integration, and interoperability within the measurement community.

The time and date of the tutorial will be announced in August. All IMC 2008 attendees interested in attending should sign up through the IMC 2008 registration page.

About the Presenters

Elisa Boschi leads the Secure Systems group of the ICTL research laboratory of Hitachi Europe and is a guest researcher at ETH Zurich. She is an active contributor to the IETF IPFIX and PSAMP working groups where she co-authors several Internet-Drafts and RFCs, including the recently published IPFIX RFCs 5103 and 5153; and to the European Telecommunications Standards Institute (ETSI) where she is rapporteur for the ETSI Guide on Network Performance Metrics and Measurement Methods.

Brian Trammell is a researcher at the Secure Systems group of the ICTL research laboratory of Hitachi Europe and an academic guest at ETH Zurich. Prior to this position, he was Engineering Technical Lead at the CERT Network Situational Awareness group in Pittsburgh, where he led the development of an IPFIX implementation. He is an active contributor to the IETF IPFIX working group; an author of several IPFIX Internet-drafts and RFCs, including the recently-published RFCs 5101 and 5103.