Re: [IPFIX] layer7OctetDeltaCount / layer7PacketDeltaCount

Brian,

> I would like to hear the community's opinion on the utility of the following two _new_ Information Elements.
>
>
> Element ID: TBA
> Name:       layer7OctetDeltaCount
> Data Type:  unsigned64
> Semantics:  deltaCounter
> Description:
>
> The number of octets, excluding IP header(s) and Layer 4 transport protocol header(s), observed for this Flow at the Observation Point since the previous report (if any).
>
>
> Element ID: TBA
> Name:       layer7PacketDeltaCount
> Data Type:  unsigned64
> Semantics:  deltaCounter
> Description:
>
> The number of packets containing at least one octet beyond the IP header(s) and Layer 4 transport protocol header(s), observed for this Flow at the Observation Point since the previous report (if any).

Using "layer 7" in the name and "layer 4" in the definition leaves it 
unclear whether layer 6 should be included.

Yesterday I got to wondering what exactly a layer 4 packet is. Put 
another way, how often do we send packets which don't have any layer 4 
content? Now I'm wondering the same about layer 7 - ie, what sort of 
packets would - and more importantly _would not_ - be counted by 
layer7PacketDeltaCount ?

BTW, recall the Extended Field Specifier Format? How useful if all these 
IEs could be grouped under a single pair of "packetCount" and 
"octetCount" IEs with multiple extensions, eg 
packetCount.{layerN}.{delta|total}.

P.
_______________________________________________
IPFIX mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipfix