RFC 2724 (rfc2724) - Page 2 of 18

RTFM: New Attributes for Traffic Flow Measurement

RFC 2724                  RTFM: New Attributes              October 1999


      2.5 Group Attributes  . . . . . . . . . . . . . . . . . . . . . 8
      2.6 Actions on Exceptions . . . . . . . . . . . . . . . . . . .10
   3  Extensions to the 'Basic' RTFM Meter  . . . . . . . . . . . . .10
      3.1 Flow table extensions . . . . . . . . . . . . . . . . . . .10
      3.2 Specifying Distributions in RuleSets  . . . . . . . . . . .11
      3.3 Reading Distributions . . . . . . . . . . . . . . . . . . .13
   4  Extensions to the Rules Table, Attribute Numbers  . . . . . . .13
   5  Security Considerations . . . . . . . . . . . . . . . . . . . .15
   6  References  . . . . . . . . . . . . . . . . . . . . . . . . . .16
   7  Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . .17
   8  Full Copyright Statement  . . . . . . . . . . . . . . . . . . .18

1  Introduction

   The Real-Time Flow Measurement (RTFM) Working Group (WG) has
   developed a system for measuring and reporting information about
   traffic flows in the Internet.  This document explores the definition
   of extensions to the flow measurements as currently defined in
   [RTFM-ARC]. The new attributes described in this document will be
   useful for monitoring network performance and will expand the scope
   of RTFM beyond simple measurement of traffic volumes.  A companion
   document to this memo will be written to define MIB structures for
   the new attributes.

   This memo was started in 1996 to advance the work of the RTFM group.
   The goal of this work is to produce a simple set of abstractions,
   which can be easily implemented and at the same time enhance the
   value of RTFM Meters.  This document also defines a method for
   organizing the flow abstractions to augment the existing RTFM flow
   table.

   Implementations of the RTFM Meter have been done by Nevil Brownlee in
   the University of Auckland, NZ, and Stephen Stibler and Sig Handelman
   at IBM in Hawthorne, NY, USA. The RTFM WG has also defined the role
   of the Meter Reader whose role is to retrieve flow data from the
   Meter.

   Note on flows and positioning of meters:

      A flow as it traverses the Internet may have some of its
      characteristics altered as it travels through Routers, Switches,
      and other network units.  It is important to note the spatial
      location of the Meter when referring to attributes of a flow.  An
      example, a server may send a sequence of packets with a definite
      order, and inter packet timing with a leaky bucket algorithm.  A
      meter reading downstream of the leaky bucket would record a set
      with minimal inter packet timing due to the leaky bucket.  At the
      client's location, the packets may arrive out of sequence, with



Handelman, et al.             Experimental