Hi. Last Friday during the IPPM meeting, after the "Explicit Flow Measurements" draft presentation (https://tools.ietf.org/html/draft-mdt-ippm-explicit-flow-measurements-01), Greg Mirsky raised an issue that I think is very important. The question is about differences and similarities between the two types of production traffic packet marking for performance measurements, proposed in IETF and initiated in the IPPM WG: Alternate Marking and Explicit Flow Measurements.
The first technique known as Alternate Marking or AM/PM (Alternate Marking Performance Monitoring) is defined, in general terms, in RFC8321 (the point-to-point version) and RFC8889 (the multipoint version). It is essentially a Telco measurement, born to measure packet delay and loss between the input and output of a network, or between 2 internal points of the network, in order to identify and localize a problem. It is a network measure and it is the network operator that performs the marking by modifying packets on the fly. The strength of this technique comes from the decoupling of marking and measurement. We can mark all traffic, using a fixed marking interval (typically "big": from 1 second up to 5 minutes), then we decide what to measure based on the resources I want to use. In case of packet loss measurement we can start from a single packet counter for all traffic for each measurement point (possibility described in RFC8889), to have a network measurement, to arrive to a counter for each point-to-point connection you want to monitor (as described in RFC8321). In order to obtain the measurement it is necessary to compare the data collected from at least 2 measurement points (counters for packet loss, timestamps for delay). Then a "communication" between measurement points, or with a Network Measurement Center, is needed. There are already commercial implementations of this technique (also for IPv4) and IETF drafts that are standardizing it for various protocols (IPv6, MPLS, Segment Routing, BIER, ...). The Alternate Marking methodology is evolving into the draft "Big Data AltMark" (https://tools.ietf.org/html/draft-c2f-ippm-big-data-alt-mark-01) that defines point-to-point flows measurements applying post processing to performance data collected by sampling a single network multipoint flow. The second marking technique for performance monitoring of packet networks has been called Explicit Flow Measurements (EFM), and is more recent because it's born with the Spin bit RTT measurement. And it came about primarily to have an end-to-end performance measure, from the terminal, on which an application is running, to the server at the opposite end of the network. EFM can be seen as complementary measures to Alternate Marking. It requires certain characteristics of the protocols to which it can be applied, which are client-server, and it is particularly convenient for protocols that prevent the marking of packets on the fly (e.g. QUIC), because the marking occurs only on the end-points of the connection. The disadvantage with respect to the previous technique is that it always works for client-server point-to-point connection, it is not possible to aggregate measurements saving on monitoring resources as described in RFC8889. The advantage is that it can also work with a single monitoring point, even if having more points enhances it and allows intradomain measurements. With a single measurement point you can obtain end-to-end measures (Spin bit, Delay bit for delay and Loss bit, rT loss bit for packet loss) or end-to-observer measures (sQuare bit and Reflection bit for packet loss). End-to-observer measurements and scalability considerations make it particularly convenient to place a measurement point on the client (see https://tools.ietf.org/html/draft-cnbf-ippm-user-devices-explicit-monitoring-01). Best Regards. Mauro _____________________ Mauro Cociglio TIM - Telecom Italia Via G. Reiss Romoli, 274 10148 - Torino (Italy) Tel.: +390112285028 Mobile: +393357669751 _____________________ TIM - Uso Interno - Tutti i diritti riservati. Questo messaggio e i suoi allegati sono indirizzati esclusivamente alle persone indicate. La diffusione, copia o qualsiasi altra azione derivante dalla conoscenza di queste informazioni sono rigorosamente vietate. Qualora abbiate ricevuto questo documento per errore siete cortesemente pregati di darne immediata comunicazione al mittente e di provvedere alla sua distruzione, Grazie. This e-mail and any attachments is confidential and may contain privileged information intended for the addressee(s) only. Dissemination, copying, printing or use by anybody else is unauthorised. If you are not the intended recipient, please delete this message and any attachments and advise the sender by return e-mail, Thanks. Rispetta l'ambiente. Non stampare questa mail se non è necessario.
