Re: [IPFIX] Mail regarding draft-trammell-ipfix-sip-msg

Hi Aamer,
comments inline...

On Mar 29, 2012, at 5:42 PM, Aamer Akhter (aakhter) wrote:

Please find my comments regarding draft-trammell-ipfix-sip-msg-02 below:

A1) Are the IEs below (and perhaps others) really SIP specific. It would be good to have generic DialFrom and DialTo for example that apply outside of SIP.

Well… for sipFromURI/sipToURI they wouldn't be "DialFrom" or "DialTo" because the ones in this draft encode the literal value of the SIP From or To header field URIs from the SIP Message.  They don't, for example, necessarily represent the calling or called parties of a SIP INVITE request.  And also they were meant to capture the whole From or To URI, not just the user digits (since in SIP the rest of it matters too, and it may not be digits).

ISUP, for example has a Calling-Party-Number but it's not syntactically the same, and even from a semantics perspective they're not equivalent (ISUP CgPN has screening info for example, that is not in SIP From header URIs).  For H.323 I suppose you could take the calling party and convert it to an H.323 URL (ie, RFC 3508), but it would be unnatural/weird.

Having said that, both the To and From headers in SIP (RFC 3261) really originated in HTTP (RFC 2616), so I guess in theory we could call them httpFromAddrSpec and httpToAddrSpec.  Personally I think that would be super confusing to administrators, though.

I agree with you that the sipObservationType should be generic and not SIP-specific.  I guess my question is if it should be something like observationType with what values exactly?


sipFromURI
sipToURI
observationtype


A2) I did not see anything the represents the contact (aka Display Information). This is sometimes useful, and there are several examples (the stuff in quotes) below  (in the case of SIP) :

contact From/To. This would be the items (in the case of SIP) in the quotes. (3 examples below)
P-Asserted-Identity: "Cullen Jennings" <sip:[email protected]>
Remote-Party-ID: "John Doe" <sip:[email protected]>;party=calling;id-type=subscriber;privacy=full;screen=yes
From: "A. G. Bell" <sip:[email protected]> ;tag=a48s

I don't think you mean the "contact" - there's a "Contact" header in SIP os it confuses me to use that word. :)

I think what you're looking for is one IE field for the "source" of the SIP message, regardless of which header is used to determine who/what the source is?

So far we haven't wanted to make the SIP IEs require interpretation or much intelligence on the monitor/exporter.  Instead we've just described them as being literal copies of SIP fields (header fields or URIs).  For example, in any given SIP Request, it can have the above headers as you show (well, technically Remote-Party-ID is a proprietary Cisco header, not a well-known header).  Which one of those the IPFIX exporter decides to use for a generic "source" information is up to a bunch of logic - for example whether the P-Asserted-Identity is trusted, then it should supersede the From URI; but if you support the Cisco header you may prefer it to identify the "source" over the others, or not.

Or do you actually mean the display-name portion of the above headers? (the part inside the double-quotes would be the display-name)

-hadriel

_______________________________________________
IPFIX mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipfix