RE: Link layer headers in reports?

[Andy Bierman <abierman@cisco.com>]

At 08:50 AM 11/26/2002 -0500, albert@research.att.com wrote:
>Hi Peram,
>
>It is important to somehow get link layer header information.  Is your
>suggestion that this information be exported, but without any extraction
>and formating?

I think he is asking for the opposite -- for the sample source to
strip off all headers before L3.  This would make it easier for
the collector to decode the sample slice.  Another option is
to include the byte offset into the captured packet slice of
the L3 header.

I want to make sure that we don't define so much 'baseline' 
functionality that PSAMP will be too hard to implement in HW.
A minimal implementation will select packets without examining
them (e.g., 1 in N) and will only be capable of exporting the
first N bytes of these samples.  

Additional functionality, above this baseline, should not be
mandatory.  The market will decide what features are important.


>-- Albert

Andy



>> Section 5 of the framework document says, "Information 
>> eligible for inclusion in packet reports includes (i)
>>    the packet content itself (including encapsulating headers); "
>> 
>> Is there a need to include link layer headers in this export? 
>> Drawback of this will be that the collector will have to know 
>> which type of interface originated this report and understand 
>> every possible link layer (PPP/HDLC/Ethernet/FR etc) before 
>> the data can be interpreted.
>> 
>> An alternate approach would be to identify the network layer 
>> and provide raw ipv4/ipv6/mpls packet.
>> 
>> Peram
>> 
>> 
>> --
>> to unsubscribe send a message to psamp-request@ops.ietf.org 
>> with the word 'unsubscribe' in a single line as the message text body.
>> archive: <http://ops.ietf.org/lists/psamp/>
>> 
>
>--
>to unsubscribe send a message to psamp-request@ops.ietf.org with
>the word 'unsubscribe' in a single line as the message text body.
>archive: <http://ops.ietf.org/lists/psamp/> 


--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>