RE: Link layer headers in reports?

[Andy Bierman <abierman@cisco.com>]

At 09:41 PM 11/26/2002 +0200, Romascanu, Dan (Dan) wrote:
>How is the 'byte offset' defined?
>(a) from the start of the IP header - which would exclude the link layer information?
>(b) from the beginning of the packet - which would include link layer information (like MAC SA and DA, Ethertype, VLAN tagging - for example for an Ethernet packet)

(b) -- from the start of the captured packet slice

>I could probably ask the question in a different manner - will PSAMP be implemented only in routers, or also in layer 2 bridges?

no -- PSAMP is not specific to any particular HW. 


>Dan

Andy




>> -----Original Message-----
>> From: Andy Bierman [mailto:abierman@cisco.com]
>> Sent: Tuesday, November 26, 2002 7:00 PM
>> To: albert@research.att.com
>> Cc: peram@cisco.com; psamp@ops.ietf.org
>> Subject: RE: Link layer headers in reports?
>> 
>> 
>> At 08:50 AM 11/26/2002 -0500, albert@research.att.com wrote:
>> >Hi Peram,
>> >
>> >It is important to somehow get link layer header 
>> information.  Is your
>> >suggestion that this information be exported, but without 
>> any extraction
>> >and formating?
>> 
>> I think he is asking for the opposite -- for the sample source to
>> strip off all headers before L3.  This would make it easier for
>> the collector to decode the sample slice.  Another option is
>> to include the byte offset into the captured packet slice of
>> the L3 header.
>> 
>> I want to make sure that we don't define so much 'baseline' 
>> functionality that PSAMP will be too hard to implement in HW.
>> A minimal implementation will select packets without examining
>> them (e.g., 1 in N) and will only be capable of exporting the
>> first N bytes of these samples.  
>> 
>> Additional functionality, above this baseline, should not be
>> mandatory.  The market will decide what features are important.
>> 
>> 
>> >-- Albert
>> 
>> Andy
>> 
>> 
>> 
>> >> Section 5 of the framework document says, "Information 
>> >> eligible for inclusion in packet reports includes (i)
>> >>    the packet content itself (including encapsulating headers); "
>> >> 
>> >> Is there a need to include link layer headers in this export? 
>> >> Drawback of this will be that the collector will have to know 
>> >> which type of interface originated this report and understand 
>> >> every possible link layer (PPP/HDLC/Ethernet/FR etc) before 
>> >> the data can be interpreted.
>> >> 
>> >> An alternate approach would be to identify the network layer 
>> >> and provide raw ipv4/ipv6/mpls packet.
>> >> 
>> >> Peram
>> >> 
>> >> 
>> >> --
>> >> to unsubscribe send a message to psamp-request@ops.ietf.org 
>> >> with the word 'unsubscribe' in a single line as the 
>> message text body.
>> >> archive: <http://ops.ietf.org/lists/psamp/>
>> >> 
>> >
>> >--
>> >to unsubscribe send a message to psamp-request@ops.ietf.org with
>> >the word 'unsubscribe' in a single line as the message text body.
>> >archive: <http://ops.ietf.org/lists/psamp/> 
>> 
>> 
>> --
>> to unsubscribe send a message to psamp-request@ops.ietf.org with
>> the word 'unsubscribe' in a single line as the message text body.
>> archive: <http://ops.ietf.org/lists/psamp/>
>> 
>
>--
>to unsubscribe send a message to psamp-request@ops.ietf.org with
>the word 'unsubscribe' in a single line as the message text body.
>archive: <http://ops.ietf.org/lists/psamp/> 


--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>