RE: Link layer headers in reports?

["Romascanu, Dan (Dan)" <dromasca@avaya.com>]

How is the 'byte offset' defined?
(a) from the start of the IP header - which would exclude the link layer information?
(b) from the beginning of the packet - which would include link layer information (like MAC SA and DA, Ethertype, VLAN tagging - for example for an Ethernet packet)

I could probably ask the question in a different manner - will PSAMP be implemented only in routers, or also in layer 2 bridges?

Dan


> -----Original Message-----
> From: Andy Bierman [mailto:abierman@cisco.com]
> Sent: Tuesday, November 26, 2002 7:00 PM
> To: albert@research.att.com
> Cc: peram@cisco.com; psamp@ops.ietf.org
> Subject: RE: Link layer headers in reports?
> 
> 
> At 08:50 AM 11/26/2002 -0500, albert@research.att.com wrote:
> >Hi Peram,
> >
> >It is important to somehow get link layer header 
> information.  Is your
> >suggestion that this information be exported, but without 
> any extraction
> >and formating?
> 
> I think he is asking for the opposite -- for the sample source to
> strip off all headers before L3.  This would make it easier for
> the collector to decode the sample slice.  Another option is
> to include the byte offset into the captured packet slice of
> the L3 header.
> 
> I want to make sure that we don't define so much 'baseline' 
> functionality that PSAMP will be too hard to implement in HW.
> A minimal implementation will select packets without examining
> them (e.g., 1 in N) and will only be capable of exporting the
> first N bytes of these samples.  
> 
> Additional functionality, above this baseline, should not be
> mandatory.  The market will decide what features are important.
> 
> 
> >-- Albert
> 
> Andy
> 
> 
> 
> >> Section 5 of the framework document says, "Information 
> >> eligible for inclusion in packet reports includes (i)
> >>    the packet content itself (including encapsulating headers); "
> >> 
> >> Is there a need to include link layer headers in this export? 
> >> Drawback of this will be that the collector will have to know 
> >> which type of interface originated this report and understand 
> >> every possible link layer (PPP/HDLC/Ethernet/FR etc) before 
> >> the data can be interpreted.
> >> 
> >> An alternate approach would be to identify the network layer 
> >> and provide raw ipv4/ipv6/mpls packet.
> >> 
> >> Peram
> >> 
> >> 
> >> --
> >> to unsubscribe send a message to psamp-request@ops.ietf.org 
> >> with the word 'unsubscribe' in a single line as the 
> message text body.
> >> archive: <http://ops.ietf.org/lists/psamp/>
> >> 
> >
> >--
> >to unsubscribe send a message to psamp-request@ops.ietf.org with
> >the word 'unsubscribe' in a single line as the message text body.
> >archive: <http://ops.ietf.org/lists/psamp/> 
> 
> 
> --
> to unsubscribe send a message to psamp-request@ops.ietf.org with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/psamp/>
> 

--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>