Re: Packet Selectors and Packet Information

[Peram Marimuthu <peram@cisco.com>]

Albert Greenberg wrote:

> > I think it's okay to keep the packet selection simple (first
> > N bytes), but it might be desirable to allow for configurable
> > data selection (by field name, not byte offset) in the report
> > generation phase.
>
> Hi Andy,  The reverse.  On selection you may want to exclude some fields
> (e.g., ttl) and include others, or want ACL type filtering to drill down
> on certain packet streams.  Reporting on the first N bytes is simple,
> fairly future proof (e.g., you may want to look at ttl's at some data
> after the data is generated), and (the original point I was making)
> allows for simple decoupling of the document on selection from the
> document on which data to make avail to reporting.
>

You can also select packets based on packet properties - Peer AS, Source
AS, packet length etc or as a result of some processing decisions within a
router (failed rpf, no route etc). Are these within the scope of this wg?

Peram


--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>