[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Link layer headers in reports?

To: Ted Rohling <tedr@instructors.net>
Subject: Re: Link layer headers in reports?
From: Peram Marimuthu <peram@cisco.com>
Date: Wed, 27 Nov 2002 08:52:50 -0800
Cc: psamp@ops.ietf.org
References: <NBBBIGBEGKMGELCBGGOMEEBCDHAA.tedr@instructors.net>
Ted,

Ted Rohling wrote:

> Having reviewed the previous discussions, it would appear to be necessary to
> have the selection include any and all information beginning at the
> specified sampling location, ie. byte n, for a length specified in the
> sampling request.  This would allow all encapsulation information to be
> selected if required by the sample initiator.
>
> Not to pour gasoline on the fire but, is there any thought to allowing
> multiple "output" specifications such as:
>
> Beginning Byte     Length
>
>      0              34
>      50             20
>
> While I cannot think of any situation currently where this would be used, it
> may be useful to provide implementation instructions today "just in case".

Isnt this covered by section 7 of framework document "parallel measurement
process"? You could configure two identical measurements with different export
requirements.

Peram

>
>
> Ted Rohling
>
> ---> -----Original Message-----
> ---> From: owner-psamp@ops.ietf.org [mailto:owner-psamp@ops.ietf.org]On
> ---> Behalf Of Romascanu, Dan (Dan)
> ---> Sent: Wednesday, November 27, 2002 3:05 AM
> ---> To: albert@research.att.com; abierman@cisco.com
> ---> Cc: peram@cisco.com; psamp@ops.ietf.org
> ---> Subject: RE: Link layer headers in reports?
> --->
> --->
> ---> I apologize if I am too opaque - what does 'encapsulation
> ---> header' exactly mean? The framework document mentions
> ---> 'encapsulation' by example - MPLS. What if I am running
> ---> Ethernet in a LAN (no MPLS) - does 'encapsulation' include SA,
> ---> DA, type/length, 802.1Q tag, etc...?
> --->
> ---> Thanks,
> --->
> ---> Dan
> --->
> --->
> ---> > -----Original Message-----
> ---> > From: albert@research.att.com [mailto:albert@research.att.com]
> ---> > Sent: Tuesday, November 26, 2002 11:19 PM
> ---> > To: abierman@cisco.com; Romascanu, Dan (Dan)
> ---> > Cc: peram@cisco.com; psamp@ops.ietf.org
> ---> > Subject: RE: Link layer headers in reports?
> ---> >
> ---> >
> ---> > Hi.
> ---> >
> ---> > Exporting the first n bytes, including the encapsulation
> ---> > headers, would
> ---> > suffice.
> ---> > Stripping out all the encapsulation headers does not.
> ---> >
> ---> > To get utility from the packet header sample, you need to have
> ---> > associations that tell you which stream was sampled.
> ---> >
> ---> > -- Albert
> ---> >
> ---> >
> ---> >
> ---> > > -----Original Message-----
> ---> > > From: Andy Bierman [mailto:abierman@cisco.com]
> ---> > > Sent: Tuesday, November 26, 2002 3:56 PM
> ---> > > To: Romascanu, Dan (Dan)
> ---> > > Cc: Greenberg,Albert G (Albert); peram@cisco.com;
> ---> psamp@ops.ietf.org
> ---> > > Subject: RE: Link layer headers in reports?
> ---> > >
> ---> > >
> ---> > > At 09:41 PM 11/26/2002 +0200, Romascanu, Dan (Dan) wrote:
> ---> > > >How is the 'byte offset' defined?
> ---> > > >(a) from the start of the IP header - which would exclude
> ---> the link
> ---> > > >layer information?
> ---> > > >(b) from the beginning of the packet - which would include
> ---> > > link layer information (like MAC SA and DA, Ethertype, VLAN
> ---> > > tagging - for example for an Ethernet packet)
> ---> > >
> ---> > > (b) -- from the start of the captured packet slice
> ---> > >
> ---> > > >I could probably ask the question in a different manner -
> ---> > > will PSAMP be
> ---> > > >implemented only in routers, or also in layer 2 bridges?
> ---> > >
> ---> > > no -- PSAMP is not specific to any particular HW.
> ---> > >
> ---> > >
> ---> > > >Dan
> ---> > >
> ---> > > Andy
> ---> > >
> ---> > >
> ---> > >
> ---> > >
> ---> > > >> -----Original Message-----
> ---> > > >> From: Andy Bierman [mailto:abierman@cisco.com]
> ---> > > >> Sent: Tuesday, November 26, 2002 7:00 PM
> ---> > > >> To: albert@research.att.com
> ---> > > >> Cc: peram@cisco.com; psamp@ops.ietf.org
> ---> > > >> Subject: RE: Link layer headers in reports?
> ---> > > >>
> ---> > > >>
> ---> > > >> At 08:50 AM 11/26/2002 -0500, albert@research.att.com wrote:
> ---> > > >> >Hi Peram,
> ---> > > >> >
> ---> > > >> >It is important to somehow get link layer header
> ---> > > >> information.  Is your
> ---> > > >> >suggestion that this information be exported, but without
> ---> > > >> any extraction
> ---> > > >> >and formating?
> ---> > > >>
> ---> > > >> I think he is asking for the opposite -- for the sample
> ---> > source to
> ---> > > >> strip off all headers before L3.  This would make it
> ---> > > easier for the
> ---> > > >> collector to decode the sample slice.  Another option is
> ---> > > to include
> ---> > > >> the byte offset into the captured packet slice of the L3 header.
> ---> > > >>
> ---> > > >> I want to make sure that we don't define so much 'baseline'
> ---> > > >> functionality that PSAMP will be too hard to implement in HW.
> ---> > > >> A minimal implementation will select packets without examining
> ---> > > >> them (e.g., 1 in N) and will only be capable of exporting the
> ---> > > >> first N bytes of these samples.
> ---> > > >>
> ---> > > >> Additional functionality, above this baseline, should not be
> ---> > > >> mandatory.  The market will decide what features are important.
> ---> > > >>
> ---> > > >>
> ---> > > >> >-- Albert
> ---> > > >>
> ---> > > >> Andy
> ---> > > >>
> ---> > > >>
> ---> > > >>
> ---> > > >> >> Section 5 of the framework document says, "Information
> ---> > > >> >> eligible for inclusion in packet reports includes (i)
> ---> > > >> >>    the packet content itself (including encapsulating
> ---> > > headers); "
> ---> > > >> >>
> ---> > > >> >> Is there a need to include link layer headers in this export?
> ---> > > >> >> Drawback of this will be that the collector will
> ---> have to know
> ---> > > >> >> which type of interface originated this report and
> ---> understand
> ---> > > >> >> every possible link layer (PPP/HDLC/Ethernet/FR etc) before
> ---> > > >> >> the data can be interpreted.
> ---> > > >> >>
> ---> > > >> >> An alternate approach would be to identify the network layer
> ---> > > >> >> and provide raw ipv4/ipv6/mpls packet.
> ---> > > >> >>
> ---> > > >> >> Peram
> ---> > > >> >>
> ---> > > >> >>
> ---> > > >> >> --
> ---> > > >> >> to unsubscribe send a message to psamp-request@ops.ietf.org
> ---> > > >> >> with the word 'unsubscribe' in a single line as the
> ---> > > >> message text body.
> ---> > > >> >> archive: <http://ops.ietf.org/lists/psamp/>
> ---> > > >> >>
> ---> > > >> >
> ---> > > >> >--
> ---> > > >> >to unsubscribe send a message to
> ---> > > psamp-request@ops.ietf.org with the
> ---> > > >> >word 'unsubscribe' in a single line as the message text body.
> ---> > > >> >archive: <http://ops.ietf.org/lists/psamp/>
> ---> > > >>
> ---> > > >>
> ---> > > >> --
> ---> > > >> to unsubscribe send a message to
> ---> > > psamp-request@ops.ietf.org with the
> ---> > > >> word 'unsubscribe' in a single line as the message text body.
> ---> > > >> archive: <http://ops.ietf.org/lists/psamp/>
> ---> > > >>
> ---> > > >
> ---> > > >--
> ---> > > >to unsubscribe send a message to
> ---> > psamp-request@ops.ietf.org with the
> ---> > > >word 'unsubscribe' in a single line as the message text body.
> ---> > > >archive: <http://ops.ietf.org/lists/psamp/>
> ---> > >
> ---> > >
> ---> >
> --->
> ---> --
> ---> to unsubscribe send a message to psamp-request@ops.ietf.org with
> ---> the word 'unsubscribe' in a single line as the message text body.
> ---> archive: <http://ops.ietf.org/lists/psamp/>


--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>
References:
- RE: Link layer headers in reports?
  - From: "Ted Rohling" <tedr@instructors.net>
Prev by Date: RE: Link layer headers in reports?
Next by Date: minutes and slides of Atlanta session
Previous by thread: RE: Link layer headers in reports?
Next by thread: minutes and slides of Atlanta session
Index(es):
- Date
- Thread