[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Question About Task #6 in the Charter
At 02:50 PM 8/4/2002 -0500, Ayyasamy, Senthilkumar (UMKC-Student) wrote:
>I should have asked this when the Charter was out for review,
>but I somehow missed the opportunity. It is not too late
>however, to ask now for clarification. I am confused by the
>need to select or define a new protocol. Should the same protocol
>be used for packet selection, report, and export? Is this
>sampler MIB an SMIv2 MIB?
MIB is not the territory of configuration management alone. There are
lot of stuff in MIB which might be useful in many other places.
The recent interest is measuring application level performance
(for example IP telephony performance measurement.) Hence,will the
group also work on defining MIB objects for such performace
measurements or is it out of scope?
way out of scope. This may be a topic for the RMONMIB WG
or some other WG, but the PSAMP WG is not chartered to create
monitoring MIBs for any specific applications. Hopefully, the reports
generated by PSAMP can drive such applications, but those MIBs
will not be created by this WG.
Dan brought up an issue in the Yokohama meeting about using the
PSAMP reports to populate RMON MIBs. That would something
the RMONMIB WG may be interested in pursuing in the future,
but it's not something this WG needs to worry about.
The frame work document also talks a possible example use of psamp
as observation of network behaviour. For example, some of the packet based
intrusion detection methods (like Bro.) cannot provide all the packets of
interest or do not accurately define the exact format of our interest.
So, should we also come up with some MIB objects for mechanisms like
packet capture?
The RMON MIB already has packet filtering and packet capture. PSAMP
is different because the agent is not expected to capture every packet,
and not expected to store packets for later retrieval via SNMP (or any
other protocol).
It is still unclear how much of a captured packet should be saved and sent
to a collector. There are performance and privacy issues to consider.
I think this should be configurable, based on the application protocol
in the captured packet.
Thanks,
-senthil.
Andy
--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>