Packet Sampling (PSAMP) Protocol Specifications
Extracted elements (25)
IPFIX was chosen as the PSAMP export protocol because the IPFIX and PSAMP architectures match very well and the means provided by IPFIX are sufficient for PSAMP export. PSAMP export can be viewed as a special IPFIX Flow Record containing information about a single packet rather than aggregated flows.
The hashInitialiserValue Information Element is optional rather than required. The rationale stated is security considerations: making the hash initializer value optional avoids mandatory disclosure of state that could be exploited.
Export Packet compression (mentioned as an option in the PSAMP framework [RFC5474] Section 8.5) is the only PSAMP framework requirement not met by the IPFIX-based PSAMP protocol specification.
Logical OR operations across multiple filter criteria are not supported in the PSAMP Property Match Filtering specification; multiple Information Elements in the same Options Template Record represent a logical AND. Implementations needing OR semantics cannot rely on the basic PSAMP filtering mechanism.
A Basic Packet Report MUST contain the selectionSequenceId Information Element and some number of contiguous bytes from the start of the packet (or start of payload) using one of the defined packet-section Information Elements. If a digest function is in the Selection Sequence, the digestHashValue MUST also be included.
An Exporting Process MUST be able to limit the export rate according to a configurable value, and MAY limit the export rate on a per-Collecting-Process basis.
Configuration details of every Selector MUST be exported using an IPFIX Data Record defined by an Options Template Record with selectorId as scope field and selectorAlgorithm followed by algorithm-specific Information Elements as non-scope fields.
Each new selection method MUST be assigned a unique value for the selectorAlgorithm Information Element, and its configuration parameters and the Options Template used to report them MUST be clearly specified.
Each Primitive Selector MUST have a unique Selector ID within the Observation Domain. The Selector ID is represented by the selectorId Information Element [RFC5477].
Each separate logical instance of a Selector used across multiple Selection Sequences MUST maintain its own individual Selection State and statistics. The Selection Sequence Statistics Report Interpretation MUST be exported periodically and MUST include packetsObserved and packetsSelected for each Primitive Selector in sequence order.
For each Selection Sequence, a Packet Report MUST be created for each selected packet. The format of the Packet Report is specified in a Template Record contained in a Template Set.
For every selectionSequenceId in use, the PSAMP Device MUST export a Selection Sequence Report Interpretation via an Options Template with selectionSequenceId as scope and non-scope fields for the Observation Point and one or more selectorId values listed in their usage order.
For Hash-based Filtering on IPv4, the input to the Hash Function MUST include IP identification, flags, fragment offset, source IP address, destination IP address, and a configurable number of bytes from the IP payload. Minimum configuration ranges MUST support 8–32 bytes and offsets 0–64.
If a contiguous-bytes Information Element is encoded with a fixed-length field that is too long for the selected packet, padding MUST NOT be used; instead the Exporting Process MUST export a new Template Record with the correct fixed-length or a variable-length field.
Of the defined hash functions BOB (selectorAlgorithm=6), IPSX (7), and CRC (8), only BOB is recommended and SHOULD be used for Hash-based Selection.
The Accuracy Report Interpretation MUST be exported using an Options Template with a scope containing the Information Element for which accuracy is required; if accuracy is template-specific a second scope containing templateId MUST be added. The accuracy SHOULD be reported using absoluteError or relativeError Information Elements [RFC5477].
The entire IPFIX protocol specification [RFC5101] MUST be implemented for PSAMP; PSAMP cannot rely on a subset, because it requires all three Set types (Data Set, Template Set, Options Template Set) and both Template Record types.
The Property Match Filtering Options Template Record MUST NOT contain multiple identical Information Elements; when multiple different IEs are defined the filter acts as a logical AND. OR operations are explicitly not supported by PSAMP.
When Property Match Filtering or Hash-based Filtering is based on encrypted fields, the Selector MUST recognize that the fields are not available and MUST NOT select those packets; encrypted packets MUST still be counted in the packetsObserved Information Element.
A Selection Sequence is a unique value per Observation Domain identifying the combination of an Observation Point and one or more Selector IDs through which packets are selected. It is represented by the selectionSequenceId Information Element defined in [RFC5477].
An Extended Packet Report MAY contain other Information Elements related to protocol fields (e.g., source/destination IP addresses), packet treatment (e.g., output interface, BGP AS), or Selection State (e.g., hash value), and MAY omit the raw packet content bytes that are mandatory in the basic report.
Four types of Report Interpretation are defined: Selection Sequence Report Interpretation (identifies Observation Points and Selectors per sequence), Selector Report Interpretation (configuration of each Selector), Selection Sequence Statistics Report Interpretation (packet counts observed and selected), and Accuracy Report Interpretation (field accuracy).
The selectorAlgorithm Information Element [RFC5477] identifies the selection method. Values currently defined: 1 = systematic count-based sampling, 2 = systematic time-based sampling, 3 = random n-out-of-N sampling, 4 = uniform probabilistic sampling, 5 = property match filtering, 6 = BOB hash-based filtering, 7 = IPSX hash-based filtering, 8 = CRC hash-based filtering.
PSAMP security relies on the security mechanisms of the underlying IPFIX protocol [RFC5101]. The hashInitialiserValue is designated optional (MAY be omitted) so that implementations are not forced to expose hash state that could enable an adversary to predict or reverse-engineer packet selection decisions.
Basic Packet Report uses an IPFIX Template Record (Set ID=2) with fields selectionSequenceId (IE 301, 4 bytes), digestHashValue (IE 326, 4 bytes), a packet-section field such as dataLinkFrameSection (IE 315, fixed or variable length), and observationTimeMicroseconds (IE 324, 4 bytes). The Data Record carries the actual packet bytes.