CURRENT MEETING REPORT


Reported by Cyndi Mills, BBN Planet

Minutes of the Realtime Traffic Flow Measurement BOF (RTFM)


Fifty-seven people attended the BOF, including participants 
representing views from service providers, implementors and consumers 
of Internet services.

Peter Lothberg put the service provider view, explaining what he 
wants from a Flow Measurement system.  This included the 
measurement of traffic patterns, performance data, bottleneck data, 
changes in user behavior due to backpressure, etc.

Nevil Brownlee gave a summary of the existing Internet Drafts 
(architecture and MIB) and an overview of NetraMet, a flow 
measurement implementation with meters running on several platforms 
ranging from low-end PCs under DOS to workstations under Unix.  Nevil 
outlined how NeTraMet is being used in New Zealand, Australia and 
elsewhere for network analysis and planning as well as live network 
troubleshooting, and talked about operational experience and uses.

Sig Handelman presented IBM Research's implementation of the MIB 
and plans for extending this to the measurement of IBM Global 
Network and server performance.

Bob Moskowitz outlined the Automotive Industry Action Group's desire 
that they be able to independently use tools such as these to measure 
the network performance and management capabilities of Internet 
service providers in order to qualify them for participation in virtual 
private networks running over public network facilities.

The initial RTFM proposal was discussed in some detail.  It differs from 
other probe efforts in that instead of trying to collect a mass of data and 
post-analyze it, data reduction is done at the point of measurement. 
Interesting (or uninteresting) flows can be aggregated as "summary 
flows."  For example, a set of 1,700,000 flows might be summarized 
within the meter as follows:

o  200,000 packets in flows of type "uninteresting,"
o  1,400,000 packets in flows of type "special interest a,"
o  20 packets in specified flow b, for each flow fulfulling characteric c, a 
   dynamically allocated ennumerated list of flows, e.g. 10 packets in a 
   flow with the following value of c, 12 packets in a separate flow 
   with another value of c, etc.

The ability to do this reduces the data at an early stage with a very 
small level of effort.  Counting can be done in parallel with a packet-
forwarding decision at a level of effort which is roughly comparable to 
forwarding calculations.  The meter may be in a server, standalone 
(probe), or in a switching device.

The BOF reached consensus that a Traffic Measurement working group 
should be formed in the Operations Area to standardise traffic 
measurement.  Traffic measurement requirements and concerns will be 
posted to the mailing list: rtfm@auckland.ac.nz (send a subscribe 
message to rtfm-request...).

A charter for the proposed working group was discussed.  The resulting 
draft charter is as follows:

Draft Charter:  Real Time Traffic Flow Measurement (RTFM)

Co-chairs:
Nevil Brownlee, The University of Auckland
Barry Greene, Singapore Telecom
Sig Handelman, IBM Research

o  Review existing work in traffic flow measurement, including that of 
   the RMON and Internet Accounting working groups and published 
   work from independent researchers.

o  Produce an improved Traffic Flow Model considering at least the 
   following:
   - efficient hardware implementation
   - effect of IPv6 on traffic measurement
   - extension of the accounting model to widen the  range of measurable 
     quantities
   - simpler ways to specify flows of interest
   - maintain existing focus on data reduction capabilities

o  Develop the Flow Meter MIB as a 'standards track' document with 
   the IETF.


Goals and Milestones:

February 1996	Resubmit set of revised 
                documents to RFC Editor for
                publication as experimental 
                RFCs.  1) Traffic Flow 
                Measurement Background: 
                revised document based on 
                RFC1272; 2) Traffic Flow 
                Measurement Architecture 
                Document: revised document 
                based on draft-brownlee-acct-
                arch-report-02.txt; 3) Traffic 
                Flow Meter MIB: revised 
                document based on draft-
                brownlee-acct-meter-mib-
                03.txt; and, 4) Traffic Flow 
                Examples: new document 
                recording experience with 
                Meter MIB, number three 
                above.

                Circulate list of references to 
                earlier work to mailing list  for 
                information and discussion.

                Solicit opinions and requests for 
                additional quantities to be 
                measured, ways to measure 
                them, and issues for future 
                high-speed networks.

March 1996	Produce outline for 'New 
                Traffic Flow Model' document

July 1996	Publish 'New Traffic Flow 
                Model' document as Internet 
                Draft and begin work on 
                ÒimplementationÓ document for 
                new traffic flow model

Novembewr 1996	Submit 'New Traffic Flow 
                Model' to IESG as RFC and 
                publish 'implementation' 
                document as Internet Draft