RE: Link layer headers in reports?

[<albert@research.att.com>]

Hi.

Exporting the first n bytes, including the encapsulation headers, would
suffice.
Stripping out all the encapsulation headers does not.

To get utility from the packet header sample, you need to have
associations that tell you which stream was sampled.   

-- Albert



> -----Original Message-----
> From: Andy Bierman [mailto:abierman@cisco.com] 
> Sent: Tuesday, November 26, 2002 3:56 PM
> To: Romascanu, Dan (Dan)
> Cc: Greenberg,Albert G (Albert); peram@cisco.com; psamp@ops.ietf.org
> Subject: RE: Link layer headers in reports?
> 
> 
> At 09:41 PM 11/26/2002 +0200, Romascanu, Dan (Dan) wrote:
> >How is the 'byte offset' defined?
> >(a) from the start of the IP header - which would exclude the link 
> >layer information?
> >(b) from the beginning of the packet - which would include 
> link layer information (like MAC SA and DA, Ethertype, VLAN 
> tagging - for example for an Ethernet packet)
> 
> (b) -- from the start of the captured packet slice
> 
> >I could probably ask the question in a different manner - 
> will PSAMP be 
> >implemented only in routers, or also in layer 2 bridges?
> 
> no -- PSAMP is not specific to any particular HW. 
> 
> 
> >Dan
> 
> Andy
> 
> 
> 
> 
> >> -----Original Message-----
> >> From: Andy Bierman [mailto:abierman@cisco.com]
> >> Sent: Tuesday, November 26, 2002 7:00 PM
> >> To: albert@research.att.com
> >> Cc: peram@cisco.com; psamp@ops.ietf.org
> >> Subject: RE: Link layer headers in reports?
> >> 
> >> 
> >> At 08:50 AM 11/26/2002 -0500, albert@research.att.com wrote:
> >> >Hi Peram,
> >> >
> >> >It is important to somehow get link layer header
> >> information.  Is your
> >> >suggestion that this information be exported, but without
> >> any extraction
> >> >and formating?
> >> 
> >> I think he is asking for the opposite -- for the sample source to 
> >> strip off all headers before L3.  This would make it 
> easier for the 
> >> collector to decode the sample slice.  Another option is 
> to include 
> >> the byte offset into the captured packet slice of the L3 header.
> >> 
> >> I want to make sure that we don't define so much 'baseline'
> >> functionality that PSAMP will be too hard to implement in HW.
> >> A minimal implementation will select packets without examining
> >> them (e.g., 1 in N) and will only be capable of exporting the
> >> first N bytes of these samples.  
> >> 
> >> Additional functionality, above this baseline, should not be 
> >> mandatory.  The market will decide what features are important.
> >> 
> >> 
> >> >-- Albert
> >> 
> >> Andy
> >> 
> >> 
> >> 
> >> >> Section 5 of the framework document says, "Information
> >> >> eligible for inclusion in packet reports includes (i)
> >> >>    the packet content itself (including encapsulating 
> headers); "
> >> >> 
> >> >> Is there a need to include link layer headers in this export?
> >> >> Drawback of this will be that the collector will have to know 
> >> >> which type of interface originated this report and understand 
> >> >> every possible link layer (PPP/HDLC/Ethernet/FR etc) before 
> >> >> the data can be interpreted.
> >> >> 
> >> >> An alternate approach would be to identify the network layer
> >> >> and provide raw ipv4/ipv6/mpls packet.
> >> >> 
> >> >> Peram
> >> >> 
> >> >> 
> >> >> --
> >> >> to unsubscribe send a message to psamp-request@ops.ietf.org
> >> >> with the word 'unsubscribe' in a single line as the 
> >> message text body.
> >> >> archive: <http://ops.ietf.org/lists/psamp/>
> >> >> 
> >> >
> >> >--
> >> >to unsubscribe send a message to 
> psamp-request@ops.ietf.org with the 
> >> >word 'unsubscribe' in a single line as the message text body.
> >> >archive: <http://ops.ietf.org/lists/psamp/>
> >> 
> >> 
> >> --
> >> to unsubscribe send a message to 
> psamp-request@ops.ietf.org with the 
> >> word 'unsubscribe' in a single line as the message text body.
> >> archive: <http://ops.ietf.org/lists/psamp/>
> >> 
> >
> >--
> >to unsubscribe send a message to psamp-request@ops.ietf.org with the 
> >word 'unsubscribe' in a single line as the message text body.
> >archive: <http://ops.ietf.org/lists/psamp/>
> 
> 

--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>