[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: PSAMP: ipHeaderPacketSection and mplsLabelStackSection



--On 3/6/06 11:43 AM +0000 Paul Aitken wrote:


Dear psampers,

We have a new open issue in PSAMP-INFO:

   Should the ipHeaderPacketSection and mplsLabelStackSection also
   report payload contents if the specified section length is longer
   than the IP header or stack size, respectively?


ipHeaderPacketSection is currently defined as:

       This information element carries a series of octets from the start
       of the IP header of a sampled packet.


mplsLabelStackSection is currently defined as:

       This information element carries the first n octets from the MPLS
       label stack of a sampled packet.


Whatever we choose, we should add a few words on this issue in the IE description.

Thanks,

   Juergen


Potential resolutions include:

(1) We define the behaviour when the requested ipHeaderPacketSection
or mplsLabelStackSectionsection size is larger than the actual amount of
IP header / label stack data available.

   (1a) We define that only IP header / label stack octets are included.

   (1b) We define that the section contains a series of octets starting
        from the beginning of the IP header / label stack and continuing
        through the payload up to the limit of the available data.

(2) We say nothing, and leave it as implimentation defined behaviour.


I believe that allowing these sections to continue into the payload per (1b) is potentially the most useful solution.

It saves configuring the capture of seperate header and payload elements where capture of the header and first few octets of the payload are desired for packet identification and analysis.

--
Paul Aitken
Cisco Systems Ltd, Edinburgh, Scotland.

--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>




--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>