CURRENT MEETING REPORT Reported by Cyndi Mills, BBN Planet Minutes of the Realtime Traffic Flow Measurement BOF (RTFM) Fifty-seven people attended the BOF, including participants representing views from service providers, implementors and consumers of Internet services. Peter Lothberg put the service provider view, explaining what he wants from a Flow Measurement system. This included the measurement of traffic patterns, performance data, bottleneck data, changes in user behavior due to backpressure, etc. Nevil Brownlee gave a summary of the existing Internet Drafts (architecture and MIB) and an overview of NetraMet, a flow measurement implementation with meters running on several platforms ranging from low-end PCs under DOS to workstations under Unix. Nevil outlined how NeTraMet is being used in New Zealand, Australia and elsewhere for network analysis and planning as well as live network troubleshooting, and talked about operational experience and uses. Sig Handelman presented IBM Research's implementation of the MIB and plans for extending this to the measurement of IBM Global Network and server performance. Bob Moskowitz outlined the Automotive Industry Action Group's desire that they be able to independently use tools such as these to measure the network performance and management capabilities of Internet service providers in order to qualify them for participation in virtual private networks running over public network facilities. The initial RTFM proposal was discussed in some detail. It differs from other probe efforts in that instead of trying to collect a mass of data and post-analyze it, data reduction is done at the point of measurement. Interesting (or uninteresting) flows can be aggregated as "summary flows." For example, a set of 1,700,000 flows might be summarized within the meter as follows: o 200,000 packets in flows of type "uninteresting," o 1,400,000 packets in flows of type "special interest a," o 20 packets in specified flow b, for each flow fulfulling characteric c, a dynamically allocated ennumerated list of flows, e.g. 10 packets in a flow with the following value of c, 12 packets in a separate flow with another value of c, etc. The ability to do this reduces the data at an early stage with a very small level of effort. Counting can be done in parallel with a packet- forwarding decision at a level of effort which is roughly comparable to forwarding calculations. The meter may be in a server, standalone (probe), or in a switching device. The BOF reached consensus that a Traffic Measurement working group should be formed in the Operations Area to standardise traffic measurement. Traffic measurement requirements and concerns will be posted to the mailing list: rtfm@auckland.ac.nz (send a subscribe message to rtfm-request...). A charter for the proposed working group was discussed. The resulting draft charter is as follows: Draft Charter: Real Time Traffic Flow Measurement (RTFM) Co-chairs: Nevil Brownlee, The University of Auckland Barry Greene, Singapore Telecom Sig Handelman, IBM Research o Review existing work in traffic flow measurement, including that of the RMON and Internet Accounting working groups and published work from independent researchers. o Produce an improved Traffic Flow Model considering at least the following: - efficient hardware implementation - effect of IPv6 on traffic measurement - extension of the accounting model to widen the range of measurable quantities - simpler ways to specify flows of interest - maintain existing focus on data reduction capabilities o Develop the Flow Meter MIB as a 'standards track' document with the IETF. Goals and Milestones: February 1996 Resubmit set of revised documents to RFC Editor for publication as experimental RFCs. 1) Traffic Flow Measurement Background: revised document based on RFC1272; 2) Traffic Flow Measurement Architecture Document: revised document based on draft-brownlee-acct- arch-report-02.txt; 3) Traffic Flow Meter MIB: revised document based on draft- brownlee-acct-meter-mib- 03.txt; and, 4) Traffic Flow Examples: new document recording experience with Meter MIB, number three above. Circulate list of references to earlier work to mailing list for information and discussion. Solicit opinions and requests for additional quantities to be measured, ways to measure them, and issues for future high-speed networks. March 1996 Produce outline for 'New Traffic Flow Model' document July 1996 Publish 'New Traffic Flow Model' document as Internet Draft and begin work on ÒimplementationÓ document for new traffic flow model Novembewr 1996 Submit 'New Traffic Flow Model' to IESG as RFC and publish 'implementation' document as Internet Draft