[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: PSAMP: ipHeaderPacketSection and mplsLabelStackSection



Paul Aitken wrote:
Gerhard,

I think Paul's concerns are important.

Example:
The standard IP header is 20 bytes long, but may be longer with options.
You use a template with ipHeaderPacketSection and length 40 and want to
export an IP packet that has a standard header only. There is payload
which is indicated by the total length in the IP header.
If the monitor now "blanks" the IP payload, your collector does not know
if the payload originally was blank or not. The capability to decode the
IP header information does not help.

Blanking the payload is not allowed. See my reply to Thomas.

Instead, the application would have been configured to only export header information (no payload info), so it would have to create a new template either with the necessary fixed length, or with a variable length.

I think something for implementers to consider, would be to allow a
configurable amount of IP payload in the header packet section.  If
you want the first 8 bytes of payload + all of the IPv4 or IPv6
packet, then you couldn't pick a fixed size to cover all cases
without it being large enough to grab a large part of the payload
in some cases.

regards

Andrew

--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>