Re: [IPFIX] layer7OctetDeltaCount / layer7PacketDeltaCount
Brian Trammell <[email protected]>
| Newsgroups | gmane.ietf.ipfix |
|---|---|
| Message-ID | <[email protected]> |
Hi, Paul, all, On 23 May 2013, at 11:40, Paul Aitken <[email protected]> wrote: > Brian, > >> I would like to hear the community's opinion on the utility of the following two _new_ Information Elements. >> >> >> Element ID: TBA >> Name: layer7OctetDeltaCount >> Data Type: unsigned64 >> Semantics: deltaCounter >> Description: >> >> The number of octets, excluding IP header(s) and Layer 4 transport protocol header(s), observed for this Flow at the Observation Point since the previous report (if any). >> >> >> Element ID: TBA >> Name: layer7PacketDeltaCount >> Data Type: unsigned64 >> Semantics: deltaCounter >> Description: >> >> The number of packets containing at least one octet beyond the IP header(s) and Layer 4 transport protocol header(s), observed for this Flow at the Observation Point since the previous report (if any). > > Using "layer 7" in the name and "layer 4" in the definition leaves it unclear whether layer 6 should be included. Point. What's layer 6 in the IETF IP stack, though? Let's back off from layering for a moment. How about "transportedOctetDeltaCount"? The packet IE naming is harder though. "nonemptyPacketDeltaCount"? > Yesterday I got to wondering what exactly a layer 4 packet is. Put another way, how often do we send packets which don't have any layer 4 content? Now I'm wondering the same about layer 7 - ie, what sort of packets would - and more importantly _would not_ - be counted by layer7PacketDeltaCount ? All the time. TCP handshakes and pure ACKs, for one (these are the ones I care about). SCTP control chunks. > BTW, recall the Extended Field Specifier Format? How useful if all these IEs could be grouped under a single pair of "packetCount" and "octetCount" IEs with multiple extensions, eg packetCount.{layerN}.{delta|total}. That'd be great. However, I'd like to implement these counters well before the complete revision of the Information Model implied by Extended Field Specifiers is complete. Cheers, Brian _______________________________________________ IPFIX mailing list [email protected] https://www.ietf.org/mailman/listinfo/ipfix