[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Link layer headers in reports?
How is the 'byte offset' defined?
(a) from the start of the IP header - which would exclude the link layer information?
(b) from the beginning of the packet - which would include link layer information (like MAC SA and DA, Ethertype, VLAN tagging - for example for an Ethernet packet)
I could probably ask the question in a different manner - will PSAMP be implemented only in routers, or also in layer 2 bridges?
> -----Original Message-----
> From: Andy Bierman [mailto:email@example.com]
> Sent: Tuesday, November 26, 2002 7:00 PM
> To: firstname.lastname@example.org
> Cc: email@example.com; firstname.lastname@example.org
> Subject: RE: Link layer headers in reports?
> At 08:50 AM 11/26/2002 -0500, email@example.com wrote:
> >Hi Peram,
> >It is important to somehow get link layer header
> information. Is your
> >suggestion that this information be exported, but without
> any extraction
> >and formating?
> I think he is asking for the opposite -- for the sample source to
> strip off all headers before L3. This would make it easier for
> the collector to decode the sample slice. Another option is
> to include the byte offset into the captured packet slice of
> the L3 header.
> I want to make sure that we don't define so much 'baseline'
> functionality that PSAMP will be too hard to implement in HW.
> A minimal implementation will select packets without examining
> them (e.g., 1 in N) and will only be capable of exporting the
> first N bytes of these samples.
> Additional functionality, above this baseline, should not be
> mandatory. The market will decide what features are important.
> >-- Albert
> >> Section 5 of the framework document says, "Information
> >> eligible for inclusion in packet reports includes (i)
> >> the packet content itself (including encapsulating headers); "
> >> Is there a need to include link layer headers in this export?
> >> Drawback of this will be that the collector will have to know
> >> which type of interface originated this report and understand
> >> every possible link layer (PPP/HDLC/Ethernet/FR etc) before
> >> the data can be interpreted.
> >> An alternate approach would be to identify the network layer
> >> and provide raw ipv4/ipv6/mpls packet.
> >> Peram
> >> --
> >> to unsubscribe send a message to firstname.lastname@example.org
> >> with the word 'unsubscribe' in a single line as the
> message text body.
> >> archive: <http://ops.ietf.org/lists/psamp/>
> >to unsubscribe send a message to email@example.com with
> >the word 'unsubscribe' in a single line as the message text body.
> >archive: <http://ops.ietf.org/lists/psamp/>
> to unsubscribe send a message to firstname.lastname@example.org with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/psamp/>
to unsubscribe send a message to email@example.com with
the word 'unsubscribe' in a single line as the message text body.