Re: [IPFIX] initiatorOctets/initiatorPackets/responderOctets/responderPackets change

Paul Aitken <[email protected]> Wed, 22 May 2013 12:57:33 +0100
Newsgroups	gmane.ietf.ipfix
Message-ID	<[email protected]>
Brian,

The existing IANA definitions and cisco definitions of these fields are 
in terms of "layer 4". I believe it's wrong to rename them to "layer7".

There would be a difference between the "layer 4" and "layer 7" 
definitions if there's layer 6 encryption or EBCDIC/ASCII conversion.

These fields were requested by cisco; they're documented in Appendix A here:
http://www.cisco.com/en/US/docs/ios/solutions_docs/avc/ios_xe3_8/avc_soln_guide_iosxe3_8_full.pdf

Although that doesn't give us ownership of these fields, if you change 
them then we'll no longer be compliant with the fields we requested :-(

P.


On 17/05/13 15:33, Brian Trammell wrote:
> Hi, Andrew.
>
> Hm... Good point. Thanks.
>
> (Pedantically: "everything under Layer 4" might also include layer 5 -- if you're of the opinion that HTTP is really a session layer nowadays -- but I think most everyone will understand what is meant.)
>
> So I amend my proposal to:
>
> Element ID: 231
> Name:       layer7OctetDeltaCount
> Data Type:  unsigned64
> Semantics:  deltaCounter
> Description:
>
> The number of octets, excluding IP header(s) and Layer 4 transport protocol header(s), observed for this Flow at the Observation Point since the previous report (if any).
>
>
> Element ID: 232
> Name:       reverseLayer7OctetDeltaCount
> Data Type:  unsigned64
> Semantics:  deltaCounter
> Description:
>
> The number of octets, excluding IP header(s) and Layer 4 transport protocol header(s), observed for the reverse direction of this Flow, as defined in RFC 5103, at the Observation Point since the previous report (if any). If present in a Flow Record along with layer7OctetDeltaCount, causes layer7OctetDeltaCount to refer to the forward direction of the Flow. If present in a Flow Record, implies that that Flow Record is exported with direction assigned by the initiator (as in section 5.1 of RFC 5103), unless contradicted by a biflowDirection Information Element present in the Flow Record or otherwise applicable to the Flow Record's scope.
>
>
> Element ID: 298
> Name:       layer7PacketDeltaCount
> Data Type:  unsigned64
> Semantics:  deltaCounter
> Description:
>
> The number of packets containing at least one octet beyond the IP header(s) and Layer 4 transport protocol header(s), observed for this Flow at the Observation Point since the previous report (if any).
>
>
> Element ID: 299
> Name:       reverseLayer7PacketDeltaCount
> Data Type:  unsigned64
> Semantics:  deltaCounter
> Description:
>
> The number of packets containing at least one octet beyond the IP header(s) and Layer 4 transport protocol header(s), observed for the reverse direction of this Flow, as defined in RFC 5103, at the Observation Point since the previous report (if any). If present in a Flow Record along with layer7PacketDeltaCount, causes layer7PacketDeltaCount to refer to the forward direction of the Flow. If present in a Flow Record, implies that that Flow Record is exported with direction assigned by the initiator (as in section 5.1 of RFC 5103), unless contradicted by a biflowDirection Information Element present in the Flow Record or otherwise applicable to the Flow Record's scope.
>
> Cheers,
>
> Brian
>
> On May 17, 2013, at 4:10 PM, Andrew Feren <[email protected]> wrote:
>
>> Hi Brian,
>>
>> If you are looking for consistency I'd go with "layer7".  There are already 3 "layer2" IEs including 2 octet counts (layer2OctetDeltaCount and layer2OctetTotalCount).
>>
>> Also the the table of values for  classificationEngineId (101) all use L# or layer # in their descriptions.
>>
>> -Andrew
>>
>>
>>
>> On 05/17/2013 03:45 AM, Brian Trammell wrote:
>>> Oops, hit reply instead of reply all...
>>>
>>> Begin forwarded message:
>>>
>>>
>>>> From: Brian Trammell <[email protected]>
>>>>
>>>> Subject: Re: [Sender:
>>>> [email protected]
>>>> ] [IPFIX] initiatorOctets/initiatorPackets/responderOctets/responderPackets change
>>>> Date: 16 May 2013 19:22:10 GMT+02:00
>>>> To: Paul Aitken
>>>> <[email protected]>
>>>>
>>>>
>>>> Hi, Paul,
>>>>
>>>> Indeed, decrement the numbers in the definition.
>>>>
>>>> "app" is intended to abbreviate "application". Not a huge fan of this name, but I can't come up with anything more precise that isn't significantly longer. "layer7"? "overTransport"? "transported"?
>>>>
>>>> Regards,
>>>>
>>>> Brian
>>>>
>>>> Sent from my iPhone
>>>>
>>>> On 16.05.2013, at 18:10, Paul Aitken
>>>> <[email protected]>
>>>>   wrote:
>>>>
>>>>
>>>>> Brian,
>>>>>
>>>>> 1. Some mistake in the numbering in your new definitions: you've written 232 and 233 instead of 231 and 232.
>>>>>
>>>>> 2. What's the significance of "app" in these names? "Applicable"? "Application"? "Appearing"? "Appended"? "Approved"? "Appropriate"? "Approximate"? ...
>>>>>
>>>>> P.
>>>>>
>>>>>
>>>>> On 16/05/13 16:45, Brian Trammell wrote:
>>>>>
>>>>>> Greetings, all,
>>>>>>
>>>>>> Following a previous suggestion to update  propose we modify the names and definitions of the initiatorOctets(231), responderOctets(232), initiatorPackets(298), and responderPackets(299) as follows, (1) to bring them in line with the naming of other IPFIX Information Elements, (2) to allow them to be used by RFC 5103-compliant biflow Exporting Processes, and (3) to ensure (especially in the case of 298 and 299) that the descriptions are interoperably implemented.
>>>>>>
>>>>>> I think the proposed descriptions reflect the intent of the present descriptions, within the context of RFC 5103 terminology, and should therefore not have any impact on interoperability; I note that the description of IEs 298 and 299 are, however, not decipherable as written, so I may be taking some necessary liberty with my interpretation.
>>>>>>
>>>>>>
>>>>>> Element ID: 232
>>>>>> Name:       appOctetDeltaCount
>>>>>> Data Type:  unsigned64
>>>>>> Semantics:  deltaCounter
>>>>>> Description:
>>>>>>
>>>>>> The number of octets, excluding IP header(s) and Layer 4 transport protocol header(s), observed for this Flow at the Observation Point since the previous report (if any).
>>>>>>
>>>>>>
>>>>>> Element ID: 233
>>>>>> Name:       reverseAppOctetDeltaCount
>>>>>> Data Type:  unsigned64
>>>>>> Semantics:  deltaCounter
>>>>>> Description:
>>>>>>
>>>>>> The number of octets, excluding IP header(s) and Layer 4 transport protocol header(s), observed for the reverse direction of this Flow, as defined in RFC 5103, at the Observation Point since the previous report (if any). If present in a Flow Record along with appOctetDeltaCount, causes appOctetDeltaCount to refer to the forward direction of the Flow. If present in a Flow Record, implies that that Flow Record is exported with direction assigned by the initiator (as in section 5.1 of RFC 5103), unless contradicted by a biflowDirection Information Element present in the Flow Record or otherwise applicable to the Flow Record's scope.
>>>>>>
>>>>>>
>>>>>> Element ID: 298
>>>>>> Name:       appPacketDeltaCount
>>>>>> Data Type:  unsigned64
>>>>>> Semantics:  deltaCounter
>>>>>> Description:
>>>>>>
>>>>>> The number of packets containing at least one octet beyond the IP header(s) and Layer 4 transport protocol header(s), observed for this Flow at the Observation Point since the previous report (if any).
>>>>>>
>>>>>>
>>>>>> Element ID: 299
>>>>>> Name:       reverseAppPacketDeltaCount
>>>>>> Data Type:  unsigned64
>>>>>> Semantics:  deltaCounter
>>>>>> Description:
>>>>>>
>>>>>> The number of packets containing at least one octet beyond the IP header(s) and Layer 4 transport protocol header(s), observed for the reverse direction of this Flow, as defined in RFC 5103, at the Observation Point since the previous report (if any). If present in a Flow Record along with appPacketDeltaCount, causes appPacketDeltaCount to refer to the forward direction of the Flow. If present in a Flow Record, implies that that Flow Record is exported with direction assigned by the initiator (as in section 5.1 of RFC 5103), unless contradicted by a biflowDirection Information Element present in the Flow Record or otherwise applicable to the Flow Record's scope.
>>>>>>
>>>>>>
>>>>>> Following discussion on the list, I intend to submit this proposed change to the IE-DOCTORS for review.
>>>>>>
>>>>>> Thoughts?
>>>>>>
>>>>>> Many thanks, best regards,
>>>>>>
>>>>>> Brian
>>>>>> _______________________________________________
>>>>>> IPFIX mailing list
>>>>>>
>>>>>> [email protected]
>>>>>> https://www.ietf.org/mailman/listinfo/ipfix
>>> _______________________________________________
>>> IPFIX mailing list
>>>
>>> [email protected]
>>> https://www.ietf.org/mailman/listinfo/ipfix
> _______________________________________________
> IPFIX mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/ipfix

_______________________________________________
IPFIX mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipfix