Subject: [ipfix] Missing Bytes

From: "K.C. Norseth" <[email-masked]>
Date: Mon, 6 May 2002 08:52:38 -0600

This is a question that has been asked several times when working with
NetFlow, that I have never been able to answer other than "Cisco does it so
we had to". The question is: What bytes are counted and what are dropped in
a packet?

If I pass 100 bytes in 1 packet through a port, only 82 bytes are counted by
NetFlow.  Why?  What are these bytes that are not counted?  In explaining
this in IPFIX terms, are we saying that the onservation point is not at the
port, but deeper down in the device after some bytes are stripped off?

I think that it should be 100 bytes accounted by the IPFIX device.  What do
other people say?

K.C.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Benoit Claise <[email-masked]>
Date: Mon, 06 May 2002 17:10:48 +0200

KC,

The question is: what do you count?
Layer 2 information? Layer 2 header? Layer 3 information only.
Netflow chose not to report any layer 2 packets (retransmission, link set up,
etc...)
So, removing all layer 2 info, we're left with layer 3.
So the number of bytes reported in Netflow is only the layer 3 info, IP header
included.

Regards, Benoit

---

From: "K.C. Norseth" <[email-masked]>
Date: Mon, 6 May 2002 10:32:40 -0600

Hi Benoit,

If I pass an UDP or TCP packet of 100 bytes through the port, 82 is what is
counted.

This will need to be documented in IPFIX, whatever protocol is selected.  It
always bothered me to tell customers that I could not give them a reason
other than Cisco does it.  I could not find any documentation on the Cisco
website for this.

K.C.

----- Original Message -----
From: "Benoit Claise" <[email-masked]>
To: "K.C. Norseth" <[email-masked]>
Cc: "IPFIX" <[email-masked]>
Sent: Monday, May 06, 2002 9:10 AM
Subject: Re: [ipfix] Missing Bytes

| KC,
|
| The question is: what do you count?
| Layer 2 information? Layer 2 header? Layer 3 information only.
| Netflow chose not to report any layer 2 packets (retransmission, link set
up,
| etc...)
| So, removing all layer 2 info, we're left with layer 3.
| So the number of bytes reported in Netflow is only the layer 3 info, IP
header
| included.
|
| Regards, Benoit
|
| > This is a question that has been asked several times when working with
| > NetFlow, that I have never been able to answer other than "Cisco does it
so
| > we had to". The question is: What bytes are counted and what are dropped
in
| > a packet?
| >
| > If I pass 100 bytes in 1 packet through a port, only 82 bytes are
counted by
| > NetFlow.  Why?  What are these bytes that are not counted?  In
explaining
| > this in IPFIX terms, are we saying that the onservation point is not at
the
| > port, but deeper down in the device after some bytes are stripped off?
| >
| > I think that it should be 100 bytes accounted by the IPFIX device.  What
do
| > other people say?
| >
| > K.C.
| >
| > --
| > Help        mailto:[email-masked] and say "help" in message
body
| > Unsubscribe mailto:[email-masked] and say
| > "unsubscribe ipfix" in message body
| > Archive     http://ipfix.doit.wisc.edu/archive/
|
|
| --
| Help        mailto:[email-masked] and say "help" in message
body
| Unsubscribe mailto:[email-masked] and say
| "unsubscribe ipfix" in message body
| Archive     http://ipfix.doit.wisc.edu/archive/
|

---

From: Benoit Claise <[email-masked]>
Date: Wed, 08 May 2002 15:34:00 +0200

Hi KC,

>If I pass an UDP or TCP packet of 100 bytes through the port, 82 is what is
What you told me estonished me, so we made some testing with the same 
traffic generator as yours: IXIA.
We made the test with a data link layer "Ethernet 2"
In IXIA, you can determine the frame size, which by default include the 
CRC (4 bytes).
Generate a UDP packet of 100 bytes actually gives you a packet composed of:
14 bytes: Ethernet header (6 destination MAC + 6 source MAC  + 2 type)
20 bytes: IP header
8 bytes: UDP header
54 bytes: Data
4 bytes: CRC

So, removing the layer 2 information (14 + 4), you end up with NetFlow 
accounting 82 bytes.

Maybe the test you had in mind was to generate a UDP packet with some 
UDP data of 100 bytes.
In that case, NetFlow would have reported 100 + 8 UDP + 20 IP = 128 bytes.

Pay attention that the reported bytes (generating the packets the IXIA 
way) will obvioulsy depend on the Data Link layer encapsulation.

Now, I fully agree that the Data Model draft should clearly explain what 
is meant by "number of  bytes" in a flow .

Regards, Benoit