[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Link layer headers in reports?
I apologize if I am too opaque - what does 'encapsulation header' exactly mean? The framework document mentions 'encapsulation' by example - MPLS. What if I am running Ethernet in a LAN (no MPLS) - does 'encapsulation' include SA, DA, type/length, 802.1Q tag, etc...?
Thanks,
Dan
> -----Original Message-----
> From: albert@research.att.com [mailto:albert@research.att.com]
> Sent: Tuesday, November 26, 2002 11:19 PM
> To: abierman@cisco.com; Romascanu, Dan (Dan)
> Cc: peram@cisco.com; psamp@ops.ietf.org
> Subject: RE: Link layer headers in reports?
>
>
> Hi.
>
> Exporting the first n bytes, including the encapsulation
> headers, would
> suffice.
> Stripping out all the encapsulation headers does not.
>
> To get utility from the packet header sample, you need to have
> associations that tell you which stream was sampled.
>
> -- Albert
>
>
>
> > -----Original Message-----
> > From: Andy Bierman [mailto:abierman@cisco.com]
> > Sent: Tuesday, November 26, 2002 3:56 PM
> > To: Romascanu, Dan (Dan)
> > Cc: Greenberg,Albert G (Albert); peram@cisco.com; psamp@ops.ietf.org
> > Subject: RE: Link layer headers in reports?
> >
> >
> > At 09:41 PM 11/26/2002 +0200, Romascanu, Dan (Dan) wrote:
> > >How is the 'byte offset' defined?
> > >(a) from the start of the IP header - which would exclude the link
> > >layer information?
> > >(b) from the beginning of the packet - which would include
> > link layer information (like MAC SA and DA, Ethertype, VLAN
> > tagging - for example for an Ethernet packet)
> >
> > (b) -- from the start of the captured packet slice
> >
> > >I could probably ask the question in a different manner -
> > will PSAMP be
> > >implemented only in routers, or also in layer 2 bridges?
> >
> > no -- PSAMP is not specific to any particular HW.
> >
> >
> > >Dan
> >
> > Andy
> >
> >
> >
> >
> > >> -----Original Message-----
> > >> From: Andy Bierman [mailto:abierman@cisco.com]
> > >> Sent: Tuesday, November 26, 2002 7:00 PM
> > >> To: albert@research.att.com
> > >> Cc: peram@cisco.com; psamp@ops.ietf.org
> > >> Subject: RE: Link layer headers in reports?
> > >>
> > >>
> > >> At 08:50 AM 11/26/2002 -0500, albert@research.att.com wrote:
> > >> >Hi Peram,
> > >> >
> > >> >It is important to somehow get link layer header
> > >> information. Is your
> > >> >suggestion that this information be exported, but without
> > >> any extraction
> > >> >and formating?
> > >>
> > >> I think he is asking for the opposite -- for the sample
> source to
> > >> strip off all headers before L3. This would make it
> > easier for the
> > >> collector to decode the sample slice. Another option is
> > to include
> > >> the byte offset into the captured packet slice of the L3 header.
> > >>
> > >> I want to make sure that we don't define so much 'baseline'
> > >> functionality that PSAMP will be too hard to implement in HW.
> > >> A minimal implementation will select packets without examining
> > >> them (e.g., 1 in N) and will only be capable of exporting the
> > >> first N bytes of these samples.
> > >>
> > >> Additional functionality, above this baseline, should not be
> > >> mandatory. The market will decide what features are important.
> > >>
> > >>
> > >> >-- Albert
> > >>
> > >> Andy
> > >>
> > >>
> > >>
> > >> >> Section 5 of the framework document says, "Information
> > >> >> eligible for inclusion in packet reports includes (i)
> > >> >> the packet content itself (including encapsulating
> > headers); "
> > >> >>
> > >> >> Is there a need to include link layer headers in this export?
> > >> >> Drawback of this will be that the collector will have to know
> > >> >> which type of interface originated this report and understand
> > >> >> every possible link layer (PPP/HDLC/Ethernet/FR etc) before
> > >> >> the data can be interpreted.
> > >> >>
> > >> >> An alternate approach would be to identify the network layer
> > >> >> and provide raw ipv4/ipv6/mpls packet.
> > >> >>
> > >> >> Peram
> > >> >>
> > >> >>
> > >> >> --
> > >> >> to unsubscribe send a message to psamp-request@ops.ietf.org
> > >> >> with the word 'unsubscribe' in a single line as the
> > >> message text body.
> > >> >> archive: <http://ops.ietf.org/lists/psamp/>
> > >> >>
> > >> >
> > >> >--
> > >> >to unsubscribe send a message to
> > psamp-request@ops.ietf.org with the
> > >> >word 'unsubscribe' in a single line as the message text body.
> > >> >archive: <http://ops.ietf.org/lists/psamp/>
> > >>
> > >>
> > >> --
> > >> to unsubscribe send a message to
> > psamp-request@ops.ietf.org with the
> > >> word 'unsubscribe' in a single line as the message text body.
> > >> archive: <http://ops.ietf.org/lists/psamp/>
> > >>
> > >
> > >--
> > >to unsubscribe send a message to
> psamp-request@ops.ietf.org with the
> > >word 'unsubscribe' in a single line as the message text body.
> > >archive: <http://ops.ietf.org/lists/psamp/>
> >
> >
>
--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>