RE: Link layer headers in reports?

[Andy Bierman <abierman@cisco.com>]

At 04:18 PM 11/26/2002 -0500, albert@research.att.com wrote:
>Hi.
>
>Exporting the first n bytes, including the encapsulation headers, would
>suffice.
>Stripping out all the encapsulation headers does not.
>
>To get utility from the packet header sample, you need to have
>associations that tell you which stream was sampled.   

Agreed -- at a minimum, an integer identifying the sample stream
and an integer identifying the sample (sequence ID) would be 
included.  There's probably more fields that a minimal implementation
would include, like maybe a capture timestamp, or the actual length of
the captured packet.  These details are still TBD.


>-- Albert

Andy





>> -----Original Message-----
>> From: Andy Bierman [mailto:abierman@cisco.com] 
>> Sent: Tuesday, November 26, 2002 3:56 PM
>> To: Romascanu, Dan (Dan)
>> Cc: Greenberg,Albert G (Albert); peram@cisco.com; psamp@ops.ietf.org
>> Subject: RE: Link layer headers in reports?
>> 
>> 
>> At 09:41 PM 11/26/2002 +0200, Romascanu, Dan (Dan) wrote:
>> >How is the 'byte offset' defined?
>> >(a) from the start of the IP header - which would exclude the link 
>> >layer information?
>> >(b) from the beginning of the packet - which would include 
>> link layer information (like MAC SA and DA, Ethertype, VLAN 
>> tagging - for example for an Ethernet packet)
>> 
>> (b) -- from the start of the captured packet slice
>> 
>> >I could probably ask the question in a different manner - 
>> will PSAMP be 
>> >implemented only in routers, or also in layer 2 bridges?
>> 
>> no -- PSAMP is not specific to any particular HW. 
>> 
>> 
>> >Dan
>> 
>> Andy
>> 
>> 
>> 
>> 
>> >> -----Original Message-----
>> >> From: Andy Bierman [mailto:abierman@cisco.com]
>> >> Sent: Tuesday, November 26, 2002 7:00 PM
>> >> To: albert@research.att.com
>> >> Cc: peram@cisco.com; psamp@ops.ietf.org
>> >> Subject: RE: Link layer headers in reports?
>> >> 
>> >> 
>> >> At 08:50 AM 11/26/2002 -0500, albert@research.att.com wrote:
>> >> >Hi Peram,
>> >> >
>> >> >It is important to somehow get link layer header
>> >> information.  Is your
>> >> >suggestion that this information be exported, but without
>> >> any extraction
>> >> >and formating?
>> >> 
>> >> I think he is asking for the opposite -- for the sample source to 
>> >> strip off all headers before L3.  This would make it 
>> easier for the 
>> >> collector to decode the sample slice.  Another option is 
>> to include 
>> >> the byte offset into the captured packet slice of the L3 header.
>> >> 
>> >> I want to make sure that we don't define so much 'baseline'
>> >> functionality that PSAMP will be too hard to implement in HW.
>> >> A minimal implementation will select packets without examining
>> >> them (e.g., 1 in N) and will only be capable of exporting the
>> >> first N bytes of these samples.  
>> >> 
>> >> Additional functionality, above this baseline, should not be 
>> >> mandatory.  The market will decide what features are important.
>> >> 
>> >> 
>> >> >-- Albert
>> >> 
>> >> Andy
>> >> 
>> >> 
>> >> 
>> >> >> Section 5 of the framework document says, "Information
>> >> >> eligible for inclusion in packet reports includes (i)
>> >> >>    the packet content itself (including encapsulating 
>> headers); "
>> >> >> 
>> >> >> Is there a need to include link layer headers in this export?
>> >> >> Drawback of this will be that the collector will have to know 
>> >> >> which type of interface originated this report and understand 
>> >> >> every possible link layer (PPP/HDLC/Ethernet/FR etc) before 
>> >> >> the data can be interpreted.
>> >> >> 
>> >> >> An alternate approach would be to identify the network layer
>> >> >> and provide raw ipv4/ipv6/mpls packet.
>> >> >> 
>> >> >> Peram
>> >> >> 
>> >> >> 
>> >> >> --
>> >> >> to unsubscribe send a message to psamp-request@ops.ietf.org
>> >> >> with the word 'unsubscribe' in a single line as the 
>> >> message text body.
>> >> >> archive: <http://ops.ietf.org/lists/psamp/>
>> >> >> 
>> >> >
>> >> >--
>> >> >to unsubscribe send a message to 
>> psamp-request@ops.ietf.org with the 
>> >> >word 'unsubscribe' in a single line as the message text body.
>> >> >archive: <http://ops.ietf.org/lists/psamp/>
>> >> 
>> >> 
>> >> --
>> >> to unsubscribe send a message to 
>> psamp-request@ops.ietf.org with the 
>> >> word 'unsubscribe' in a single line as the message text body.
>> >> archive: <http://ops.ietf.org/lists/psamp/>
>> >> 
>> >
>> >--
>> >to unsubscribe send a message to psamp-request@ops.ietf.org with the 
>> >word 'unsubscribe' in a single line as the message text body.
>> >archive: <http://ops.ietf.org/lists/psamp/>
>> 
>> 


--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>