Re: Packet Selectors and Packet Information

[Ganesh Sadasivan <gsadasiv@cisco.com>]

Andy Bierman wrote:

> At 12:19 AM 8/17/2002 -0700, Ganesh Sadasivan wrote:
> >>....
> >>
> >> Packet selectors are different than sampling algorithms, at least
> >> that is the operational model being proposed. These are pre-sample
> >> filters that potentially reduce the set of eligible packets for
> >> sampling from the set of all packets on an interface.  The sampling
> >> algorithm runs on this potentially reduced set of packets.
> >
> >The above means a  a packet is subject to a set of pre-sampled selectors
> >followed by  a sampling algorithm. Isn't that too restrictive. The charter says:
> >"The focus of the WG will be to (i) specify a set of selection operations by
> >which packets are sampled "
> >The way I interpreted it is to specify a list of  selection operations eg.
> >filters, hash functions or sampling (as it is used today)  to pick the packets.
> >.i.e the packet is subject to one or more of the list of selection
> >operations.
>
> what is too restrictive?
> The use of pre-filters before sampling is consistent with the
> charter text.  It's up to the application to configure them,
> if needed.  They are useful in some cases to help focus on
> specific protocols or hosts, to effectively raise the
> sampling rate and allow for more relevant data in the
> export stream.

Filtering could be done pre- or post- sampling. For example:
One could sample 1 out of 'n' packets from a stream of  packets
appearing at a router interface. This could be followed by filtering
based on say 2 different customer prefixes. There are some
advantages here that not all packets coming on this interface are
subject to full processing. Well one could argue that this is an
implementationd detail. But that applies to using just the pre-filters alone
also.
Thanks
Ganesh

>
>
> >Thanks
> >Ganesh
>
> Andy
>
> --
> to unsubscribe send a message to psamp-request@ops.ietf.org with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/psamp/>


--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>