[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: Link layer headers in reports?

To: <psamp@ops.ietf.org>
Subject: RE: Link layer headers in reports?
From: "Ted Rohling" <tedr@instructors.net>
Date: Wed, 27 Nov 2002 07:25:06 -0600
Cc: <peram@cisco.com>
In-reply-to: <AAB4B3D3CF0F454F98272CBE187FDE2F017B7406@IS0004AVEXU1.global.avaya.com>

Having reviewed the previous discussions, it would appear to be necessary to
have the selection include any and all information beginning at the
specified sampling location, ie. byte n, for a length specified in the
sampling request.  This would allow all encapsulation information to be
selected if required by the sample initiator.

Not to pour gasoline on the fire but, is there any thought to allowing
multiple "output" specifications such as:

Beginning Byte     Length

     0              34
     50             20

While I cannot think of any situation currently where this would be used, it
may be useful to provide implementation instructions today "just in case".

Ted Rohling


---> -----Original Message-----
---> From: owner-psamp@ops.ietf.org [mailto:owner-psamp@ops.ietf.org]On
---> Behalf Of Romascanu, Dan (Dan)
---> Sent: Wednesday, November 27, 2002 3:05 AM
---> To: albert@research.att.com; abierman@cisco.com
---> Cc: peram@cisco.com; psamp@ops.ietf.org
---> Subject: RE: Link layer headers in reports?
--->
--->
---> I apologize if I am too opaque - what does 'encapsulation
---> header' exactly mean? The framework document mentions
---> 'encapsulation' by example - MPLS. What if I am running
---> Ethernet in a LAN (no MPLS) - does 'encapsulation' include SA,
---> DA, type/length, 802.1Q tag, etc...?
--->
---> Thanks,
--->
---> Dan
--->
--->
---> > -----Original Message-----
---> > From: albert@research.att.com [mailto:albert@research.att.com]
---> > Sent: Tuesday, November 26, 2002 11:19 PM
---> > To: abierman@cisco.com; Romascanu, Dan (Dan)
---> > Cc: peram@cisco.com; psamp@ops.ietf.org
---> > Subject: RE: Link layer headers in reports?
---> >
---> >
---> > Hi.
---> >
---> > Exporting the first n bytes, including the encapsulation
---> > headers, would
---> > suffice.
---> > Stripping out all the encapsulation headers does not.
---> >
---> > To get utility from the packet header sample, you need to have
---> > associations that tell you which stream was sampled.
---> >
---> > -- Albert
---> >
---> >
---> >
---> > > -----Original Message-----
---> > > From: Andy Bierman [mailto:abierman@cisco.com]
---> > > Sent: Tuesday, November 26, 2002 3:56 PM
---> > > To: Romascanu, Dan (Dan)
---> > > Cc: Greenberg,Albert G (Albert); peram@cisco.com;
---> psamp@ops.ietf.org
---> > > Subject: RE: Link layer headers in reports?
---> > >
---> > >
---> > > At 09:41 PM 11/26/2002 +0200, Romascanu, Dan (Dan) wrote:
---> > > >How is the 'byte offset' defined?
---> > > >(a) from the start of the IP header - which would exclude
---> the link
---> > > >layer information?
---> > > >(b) from the beginning of the packet - which would include
---> > > link layer information (like MAC SA and DA, Ethertype, VLAN
---> > > tagging - for example for an Ethernet packet)
---> > >
---> > > (b) -- from the start of the captured packet slice
---> > >
---> > > >I could probably ask the question in a different manner -
---> > > will PSAMP be
---> > > >implemented only in routers, or also in layer 2 bridges?
---> > >
---> > > no -- PSAMP is not specific to any particular HW.
---> > >
---> > >
---> > > >Dan
---> > >
---> > > Andy
---> > >
---> > >
---> > >
---> > >
---> > > >> -----Original Message-----
---> > > >> From: Andy Bierman [mailto:abierman@cisco.com]
---> > > >> Sent: Tuesday, November 26, 2002 7:00 PM
---> > > >> To: albert@research.att.com
---> > > >> Cc: peram@cisco.com; psamp@ops.ietf.org
---> > > >> Subject: RE: Link layer headers in reports?
---> > > >>
---> > > >>
---> > > >> At 08:50 AM 11/26/2002 -0500, albert@research.att.com wrote:
---> > > >> >Hi Peram,
---> > > >> >
---> > > >> >It is important to somehow get link layer header
---> > > >> information.  Is your
---> > > >> >suggestion that this information be exported, but without
---> > > >> any extraction
---> > > >> >and formating?
---> > > >>
---> > > >> I think he is asking for the opposite -- for the sample
---> > source to
---> > > >> strip off all headers before L3.  This would make it
---> > > easier for the
---> > > >> collector to decode the sample slice.  Another option is
---> > > to include
---> > > >> the byte offset into the captured packet slice of the L3 header.
---> > > >>
---> > > >> I want to make sure that we don't define so much 'baseline'
---> > > >> functionality that PSAMP will be too hard to implement in HW.
---> > > >> A minimal implementation will select packets without examining
---> > > >> them (e.g., 1 in N) and will only be capable of exporting the
---> > > >> first N bytes of these samples.
---> > > >>
---> > > >> Additional functionality, above this baseline, should not be
---> > > >> mandatory.  The market will decide what features are important.
---> > > >>
---> > > >>
---> > > >> >-- Albert
---> > > >>
---> > > >> Andy
---> > > >>
---> > > >>
---> > > >>
---> > > >> >> Section 5 of the framework document says, "Information
---> > > >> >> eligible for inclusion in packet reports includes (i)
---> > > >> >>    the packet content itself (including encapsulating
---> > > headers); "
---> > > >> >>
---> > > >> >> Is there a need to include link layer headers in this export?
---> > > >> >> Drawback of this will be that the collector will
---> have to know
---> > > >> >> which type of interface originated this report and
---> understand
---> > > >> >> every possible link layer (PPP/HDLC/Ethernet/FR etc) before
---> > > >> >> the data can be interpreted.
---> > > >> >>
---> > > >> >> An alternate approach would be to identify the network layer
---> > > >> >> and provide raw ipv4/ipv6/mpls packet.
---> > > >> >>
---> > > >> >> Peram
---> > > >> >>
---> > > >> >>
---> > > >> >> --
---> > > >> >> to unsubscribe send a message to psamp-request@ops.ietf.org
---> > > >> >> with the word 'unsubscribe' in a single line as the
---> > > >> message text body.
---> > > >> >> archive: <http://ops.ietf.org/lists/psamp/>
---> > > >> >>
---> > > >> >
---> > > >> >--
---> > > >> >to unsubscribe send a message to
---> > > psamp-request@ops.ietf.org with the
---> > > >> >word 'unsubscribe' in a single line as the message text body.
---> > > >> >archive: <http://ops.ietf.org/lists/psamp/>
---> > > >>
---> > > >>
---> > > >> --
---> > > >> to unsubscribe send a message to
---> > > psamp-request@ops.ietf.org with the
---> > > >> word 'unsubscribe' in a single line as the message text body.
---> > > >> archive: <http://ops.ietf.org/lists/psamp/>
---> > > >>
---> > > >
---> > > >--
---> > > >to unsubscribe send a message to
---> > psamp-request@ops.ietf.org with the
---> > > >word 'unsubscribe' in a single line as the message text body.
---> > > >archive: <http://ops.ietf.org/lists/psamp/>
---> > >
---> > >
---> >
--->
---> --
---> to unsubscribe send a message to psamp-request@ops.ietf.org with
---> the word 'unsubscribe' in a single line as the message text body.
---> archive: <http://ops.ietf.org/lists/psamp/>


--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>

Follow-Ups:
- Re: Link layer headers in reports?
  - From: Peram Marimuthu <peram@cisco.com>

References:
- RE: Link layer headers in reports?
  - From: "Romascanu, Dan (Dan)" <dromasca@avaya.com>

Prev by Date: RE: Link layer headers in reports?
Next by Date: Re: Link layer headers in reports?
Previous by thread: RE: Link layer headers in reports?
Next by thread: Re: Link layer headers in reports?
Index(es):
- Date
- Thread