Paul Aitken wrote:
Gerhard,I think Paul's concerns are important. Example: The standard IP header is 20 bytes long, but may be longer with options. You use a template with ipHeaderPacketSection and length 40 and want to export an IP packet that has a standard header only. There is payload which is indicated by the total length in the IP header. If the monitor now "blanks" the IP payload, your collector does not know if the payload originally was blank or not. The capability to decode the IP header information does not help.Blanking the payload is not allowed. See my reply to Thomas.Instead, the application would have been configured to only export header information (no payload info), so it would have to create a new template either with the necessary fixed length, or with a variable length.
I think something for implementers to consider, would be to allow a configurable amount of IP payload in the header packet section. If you want the first 8 bytes of payload + all of the IPv4 or IPv6 packet, then you couldn't pick a fixed size to cover all cases without it being large enough to grab a large part of the payload in some cases. regards Andrew -- to unsubscribe send a message to psamp-request@ops.ietf.org with the word 'unsubscribe' in a single line as the message text body. archive: <http://ops.ietf.org/lists/psamp/>