PSAMP: ipHeaderPacketSection and mplsLabelStackSection

[Paul Aitken <paitken@cisco.com>]

Dear psampers,

We have a new open issue in PSAMP-INFO:

  Should the ipHeaderPacketSection and mplsLabelStackSection also
  report payload contents if the specified section length is longer
  than the IP header or stack size, respectively?


ipHeaderPacketSection is currently defined as:

      This information element carries a series of octets from the start
      of the IP header of a sampled packet.


mplsLabelStackSection is currently defined as:

      This information element carries the first n octets from the MPLS
      label stack of a sampled packet.


Potential resolutions include:

(1) We define the behaviour when the requested ipHeaderPacketSection
or mplsLabelStackSectionsection size is larger than the actual amount of
IP header / label stack data available.

  (1a) We define that only IP header / label stack octets are included.

  (1b) We define that the section contains a series of octets starting
       from the beginning of the IP header / label stack and continuing
       through the payload up to the limit of the available data.

(2) We say nothing, and leave it as implimentation defined behaviour.


I believe that allowing these sections to continue into the payload per 
(1b) is potentially the most useful solution.

It saves configuring the capture of seperate header and payload elements 
where capture of the header and first few octets of the payload are 
desired for packet identification and analysis.

--
Paul Aitken
Cisco Systems Ltd, Edinburgh, Scotland.

--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>