Subject: RE: [ipfix] Missing Bytes

From: "Carter Bullard" <[email-masked]>
Date: Wed, 8 May 2002 09:54:02 -0400

Hey Guys,
   Any chance that there could be a 'capabilities'
indication as to what layers the IPFIX data applies
to.  The three cases I can think of as a start would
be Layer 2, Sub-Layer 3 (mpls), and Layer 3.  These
seem generic enough to handle even appletalk ;o)
While Layer 4 maybe unambiguous in some cases, it
seems that the IPFIX model can't generate just Layer
4 flow data, so these may be reasonable?

   And when reporting bytes, it may be important to
specify if the value is derived (extracted from the
packet header itself) or realized (true wire length).

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

[email-masked]
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com

> -----Original Message-----
> From: majordomo listserver 
> [mailto:[email-masked]] On Behalf Of Benoit Claise
> Sent: Wednesday, May 08, 2002 9:34 AM
> To: K.C. Norseth
> Cc: IPFIX; [email-masked]
> Subject: Re: [ipfix] Missing Bytes
> 
> 
> Hi KC,
> 
> >Hi Benoit,
> >
> >If I pass an UDP or TCP packet of 100 bytes through the port, 82 is 
> >what is counted.
> >
> What you told me estonished me, so we made some testing with the same 
> traffic generator as yours: IXIA.
> We made the test with a data link layer "Ethernet 2"
> In IXIA, you can determine the frame size, which by default 
> include the 
> CRC (4 bytes).
> Generate a UDP packet of 100 bytes actually gives you a 
> packet composed of: 14 bytes: Ethernet header (6 destination 
> MAC + 6 source MAC  + 2 type) 20 bytes: IP header 8 bytes: 
> UDP header 54 bytes: Data 4 bytes: CRC
> 
> So, removing the layer 2 information (14 + 4), you end up 
> with NetFlow 
> accounting 82 bytes.
> 
> Maybe the test you had in mind was to generate a UDP packet with some 
> UDP data of 100 bytes.
> In that case, NetFlow would have reported 100 + 8 UDP + 20 IP 
> = 128 bytes.
> 
> Pay attention that the reported bytes (generating the packets 
> the IXIA 
> way) will obvioulsy depend on the Data Link layer encapsulation.
> 
> Now, I fully agree that the Data Model draft should clearly 
> explain what 
> is meant by "number of  bytes" in a flow .
> 
> Regards, Benoit
> 
> >
> >This will need to be documented in IPFIX, whatever protocol is 
> >selected.  It always bothered me to tell customers that I could not 
> >give them a reason other than Cisco does it.  I could not find any 
> >documentation on the Cisco website for this.
> >
> >K.C.
> >
> >
> >----- Original Message -----
> >From: "Benoit Claise" <[email-masked]>
> >To: "K.C. Norseth" <[email-masked]>
> >Cc: "IPFIX" <[email-masked]>
> >Sent: Monday, May 06, 2002 9:10 AM
> >Subject: Re: [ipfix] Missing Bytes
> >
> >
> >| KC,
> >|
> >| The question is: what do you count?
> >| Layer 2 information? Layer 2 header? Layer 3 information only. 
> >| Netflow chose not to report any layer 2 packets 
> (retransmission, link 
> >| set
> >up,
> >| etc...)
> >| So, removing all layer 2 info, we're left with layer 3.
> >| So the number of bytes reported in Netflow is only the 
> layer 3 info, 
> >| IP
> >header
> >| included.
> >|
> >| Regards, Benoit
> >|
> >| > This is a question that has been asked several times 
> when working 
> >| > with NetFlow, that I have never been able to answer other than 
> >| > "Cisco does it
> >so
> >| > we had to". The question is: What bytes are counted and what are 
> >| > dropped
> >in
> >| > a packet?
> >| >
> >| > If I pass 100 bytes in 1 packet through a port, only 82 bytes are
> >counted by
> >| > NetFlow.  Why?  What are these bytes that are not counted?  In
> >explaining
> >| > this in IPFIX terms, are we saying that the onservation point is 
> >| > not at
> >the
> >| > port, but deeper down in the device after some bytes are 
> stripped 
> >| > off?
> >| >
> >| > I think that it should be 100 bytes accounted by the 
> IPFIX device.  
> >| > What
> >do
> >| > other people say?
> >| >
> >| > K.C.
> >| >
> >| > --
> >| > Help        mailto:[email-masked] and say 
> "help" in message
> >body
> >| > Unsubscribe mailto:[email-masked] and say 
> "unsubscribe 
> >| > ipfix" in message body
> >| > Archive     http://ipfix.doit.wisc.edu/archive/
> >|
> >|
> >| --
> >| Help        mailto:[email-masked] and say 
> "help" in message
> >body
> >| Unsubscribe mailto:[email-masked] and say 
> "unsubscribe 
> >| ipfix" in message body
> >| Archive     http://ipfix.doit.wisc.edu/archive/
> >|
> >  
> >
> 
> 
> 
> 
> --
> Help        mailto:[email-masked] and say "help" 
> in message body
> Unsubscribe mailto:[email-masked] and say 
> "unsubscribe ipfix" in message body
> Archive     http://ipfix.doit.wisc.edu/archive/
> 
> 

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/