Re: PSAMP: ipHeaderPacketSection and mplsLabelStackSection

[Juergen Quittek <quittek@netlab.nec.de>]

--On 3/6/06 11:43 AM +0000 Paul Aitken wrote:

> Dear psampers,
>
> We have a new open issue in PSAMP-INFO:
>
>    Should the ipHeaderPacketSection and mplsLabelStackSection also
>    report payload contents if the specified section length is longer
>    than the IP header or stack size, respectively?
>
>
> ipHeaderPacketSection is currently defined as:
>
>        This information element carries a series of octets from the start
>        of the IP header of a sampled packet.
>
>
> mplsLabelStackSection is currently defined as:
>
>        This information element carries the first n octets from the MPLS
>        label stack of a sampled packet.

Whatever we choose, we should add a few words on this issue in the IE description.

Thanks,

   Juergen
> Potential resolutions include:
>
> (1) We define the behaviour when the requested ipHeaderPacketSection
> or mplsLabelStackSectionsection size is larger than the actual amount of
> IP header / label stack data available.
>
>    (1a) We define that only IP header / label stack octets are included.
>
>    (1b) We define that the section contains a series of octets starting
>         from the beginning of the IP header / label stack and continuing
>         through the payload up to the limit of the available data.
>
> (2) We say nothing, and leave it as implimentation defined behaviour.
>
>
> I believe that allowing these sections to continue into the payload per (1b) is potentially the most useful solution.
>
> It saves configuring the capture of seperate header and payload elements where capture of the header and first few octets of the payload are desired for packet identification and analysis.
>
> --
> Paul Aitken
> Cisco Systems Ltd, Edinburgh, Scotland.
>
> --
> to unsubscribe send a message to psamp-request@ops.ietf.org with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/psamp/>



--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>