From owner-freebsd-net@FreeBSD.ORG  Wed Sep  9 02:05:15 2009
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 919C21065672;
	Wed,  9 Sep 2009 02:05:15 +0000 (UTC)
	(envelope-from grarpamp@gmail.com)
Received: from mail-fx0-f210.google.com (mail-fx0-f210.google.com
	[209.85.220.210])
	by mx1.freebsd.org (Postfix) with ESMTP id F37D58FC17;
	Wed,  9 Sep 2009 02:05:14 +0000 (UTC)
Received: by fxm6 with SMTP id 6so2936005fxm.43
	for <multiple recipients>; Tue, 08 Sep 2009 19:05:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:mime-version:received:in-reply-to:references
	:date:message-id:subject:from:to:content-type;
	bh=noSEXORYk0fqpv880QgYGo33AVnJQC+JytP50QbDLMk=;
	b=WF+E9WDfezTAmFvbfpoU3aofr1XuW2HLtW98ZTYMJnNFKbGeQS79HlxEt9IOSrgMPQ
	cwAY6INhztXvksDTSLax7DdIFli15Q87fx97xX4zcyoOb74rV4Zpj5ivP+FkwuE7orjH
	Rl77v//cw+CPJ1DomLoxVc3QmoVXG7STIRy9A=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:content-type;
	b=sqa56HRdipYgsB+ecviBupimlKg/tKwbu8xxkqksP2BvGJNFzopl3BS5ux7Bji3u1h
	/GG8T17gXuy6Q9bDu4WfZa1VkidQ1Q2IDy80yVlzw1fnOxcAd2pryY+enn9OOLT52o1Z
	0isDH5iy9s1Rv6BnQCCR8boW3De7HeO3Vnkfg=
MIME-Version: 1.0
Received: by 10.223.1.10 with SMTP id 10mr6374037fad.94.1252461913243; Tue, 08 
	Sep 2009 19:05:13 -0700 (PDT)
In-Reply-To: <4AA6A4C8.4090200@ipfw.ru>
References: <d2e731a10909061511q35447425s6cec18460fb48bd1@mail.gmail.com>
	<4AA6A4C8.4090200@ipfw.ru>
Date: Tue, 8 Sep 2009 22:05:13 -0400
Message-ID: <d2e731a10909081905l2ebc6d0dredda67a885df96d0@mail.gmail.com>
From: grarpamp <grarpamp@gmail.com>
To: freebsd-net@freebsd.org, freebsd-isp@freebsd.org
Content-Type: text/plain; charset=ISO-8859-1
Cc: 
Subject: Re: Call for testers: ng_netflow with v9 and IPv6 support
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Sep 2009 02:05:15 -0000

>  Thanks for pointing out those RFCs.

Sure. There are more I probably missed.
Search rfc-editor or ietf for netflow or ipfix.

>  can v5 count ipv6 ? No, what's next netflow version can ? v9? Ok, let's
> implement v9.

Yep, ipv6 is becoming really important, definitely on backbones. nProbe
has had it for a while. nProbe is a bpf flow sniffer and exporter. I don't
know about any other open source ones that do, besides your patch :)

>  However, IPFIX seems to be very much like v9 at a first glance.

v9 was the first that came out, mostly a defacto cisco proprietary
thing as was v5. Netflow needed to be opened up / standardized. So
ipfix group was started.
cisco v9 was submitted to ietf ipfix working group as one of proposed
ipfix methods. v9 was then modified in the group a bit and called
IPFIX. Some of
this is in rfc 3955.

Ipfix is probably the way to go. Of course others on the lists could
input whether they see more of v9 or ipfix now and in future.