[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: Packet Selectors and Packet Information



> I think it's okay to keep the packet selection simple (first 
> N bytes), but it might be desirable to allow for configurable 
> data selection (by field name, not byte offset) in the report 
> generation phase. 

Hi Andy,  The reverse.  On selection you may want to exclude some fields
(e.g., ttl) and include others, or want ACL type filtering to drill down
on certain packet streams.  Reporting on the first N bytes is simple,
fairly future proof (e.g., you may want to look at ttl's at some data
after the data is generated), and (the original point I was making)
allows for simple decoupling of the document on selection from the
document on which data to make avail to reporting.  

-- Albert


--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>