Re: [IPFIX] TCP flags?
Brian Trammell <[email protected]>
| Newsgroups | gmane.ietf.ipfix |
|---|---|
| Message-ID | <[email protected]> |
hi Paul, another idea inline. On 19 Jul 2013, at 14:48 , Paul Aitken <[email protected]> wrote: > >>> Q2: how should the ECN Nonce Sum be reported? >> My suggestion would be to define this field as an unsigned16: >> >> MSb LSb >> +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ >> | | N | C | E | U | A | P | R | S | F | >> | Reserved | S | W | C | R | C | S | S | Y | I | >> | | | R | E | G | K | H | T | N | N | >> +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ >> >> with a specific note that when the IE is encoded as an unsigned8 using reduced-length encoding, it has the following layout: >> >> MSb LSb >> +---+---+---+---+---+---+---+---+ >> | C | E | U | A | P | R | S | F | >> | W | C | R | C | S | S | Y | I | >> | R | E | G | K | H | T | N | N | >> +---+---+---+---+---+---+---+---+ >> >> and a further specific note that Collecting Processes should not assume that CWR and ECE were not set simply because they're exported as 0, as previous revisions of the Information Element did not include them. >> >> Yes, it's kludgy, but it has the advantage of describing the reality of the status quo. > > I'm happy with that, except for enlarging the size from u8 to u16. Is that acceptable to collectors? As far as I can tell, that's the only open question. Another possibility: expand this one to the full 8 bits (with a note about CWR and ECE being potentially unsupported by old EPs), and define a new unsigned8 IE for the high four bits of the increasingly inaccurately named TCP flags byte, to futureproof against use of those three bits. This has the advantage of having the same record encoding as the unsigned16 version (if you follow tcpHighControlFlags with tcpControlFlags in the template) at the expense of 4 extra template bytes, while not having any possibility to break collectors that aren't expecting it. Cheers, Brian _______________________________________________ IPFIX mailing list [email protected] https://www.ietf.org/mailman/listinfo/ipfix