The IPFIX working group has specified the Information Model (to describe IP flows) and the IPFIX protocol (to transfer IP flow data from IPFIX exporters to collectors). The PSAMP working group has specified the usage of the IPFIX protocol for exporting packet records. With both specifications available, several implementers have started building applications using the IPFIX protocol. At two interoperability testing events, several IPFIX protocol implementations were tested. The experiences made at these events were fed back to IPFIX protocol specification, particularly for removing ambiguities. In addition, several lessons were learned about how to implement and use IPFIX correctly and efficiently. The exchange among different implementers further led to new ideas for advanced usage of IPFIX. Many of these ideas are currently documented in individual Internet drafts. The goal of the IPFIX working group is now to produce 'best current practice' and 'guideline' documents concerning implementation, application and usage of the IPFIX protocol. Modifications to the core IPFIX and PSAMP protocol specifications is out of scope for this charter. However, the definition of new IPFIX and PSAMP information elements is within the scope of this charter. Specific Goals o Develop guidelines for implementers based on experiences gained individually by implementers and jointly at interoperability testing events. The guidelines will give recommendations for integrating IPFIX observation points, metering processes, exporting processes and collecting processes into the packet flow at different kinds of IPFIX devices. They will make suggestions for efficient implementation of the IPFIX protocol features and identify parts of the IPFIX specification that have already been misunderstood by several implementors. For some implementation choices that the protocol specification leaves to the implementer, the guidelines will discuss advantages and disadvantages of the different choices. Several recent individual drafts call for new Information Elements; The implementation guidelines will explain procedures for requesting, reviewing and approving new IEs. Deliverables: 1. IPFIX Implementation Guidelines draft, to be an Informational RFC (6 months) 2. IPFIX Testing draft, to be an Informational RFC (6 months) o Develop methods and means for an efficient use of the IPFIX protocol by reducing redundancy in flow reports. The basic idea to be followed is very simple. For multiple flow records that all report the same value in one or more of the contained IPFIX information elements, those values are removed from the flow records and instead reported once for all in a separate record. Such an approach integrates very well with the IPFIX protocol and only needs a few simple methods for expressing the relationship between flow records and corresponding separate records. Deliverable: 3. IPFIX Reducing Redundancy, to be an Informational RFC (6 months) o Create an IPFIX MIB, for reporting information and statistics of IPFIX metering, exporting and collecing processes. Much of this work has already been done by the PSAMP working group, and by individuals working on IPFIX collectors. Deliverable: 4. IPFIX MIB, to be a Standards Track RFC (12 months) o Develop an effective method for exporting information about bidirectional flows ('biflows'). The IP security community has expressed a strong need to collect data on bidrectional flows. A recent individual draft discusses several different ways to support biflows in IPFIX - this work will produce a single, best-practice method for handling them, without requiring changes to the IPFIX protocol. Deliverable: 5. IPFIX Biflow draft, to be an Informational RFC (12 months)