Re: [IPFIX] initiatorOctets and responderOctets confusion

Andrew,

> I was just looking at initiatorOctets (231) and responderOctets (232) 
> on IANA's assignments page 
> <https://www.iana.org/assignments/ipfix/ipfix.xml> and I noticed a 
> couple of issues.
>
> There are no sematics given.  We should have the correct semantics added.

Agreed.


> I had thought the semantics would be deltaCounter (like 
> octetDeltaCount), but the descriptions talk about "[t]he total number 
> of layer 4 payload bytes in a flow [...]".  I hope I am reading that 
> incorrectly because if the semantics are not deltaCounter then section 
> 4.10 in ie-doctors needs to be revisited.

I believe the semantics are "totalCounter" and IE-doctors needs revised.


> Is deltaCounter the correct semantics?

A first glance at the cisco implementation suggests not. However, I'm 
checking with the implementation team to be quite sure.


> Should the description be closer to the octetDeltaCount description?  
> Something like:
> "The number of octets since the previous report (if any) in incoming 
> packets from the initiator for this Flow at the Observation Point.  
> The number of octets includes IP header(s) and IP payload. The 
> initiator is the device which triggered the session creation, and 
> remains the same for the life of the session."

Not if they're total counters, as suggested by the descriptions and 
cisco definition that I saw.


> Same questions for initiatorPackets (298) and responderPackets (299).

Same answer: the definitions say "total", and I believe the semantics 
should be "totalCounter".

Once I have confirmation, I'll open a case with IANA to have these 
corrected.

Thanks for pointing this out.

P.

_______________________________________________
IPFIX mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipfix