Subject: [ipfix-info] PLEASE comment: octet counter semantics

From: Juergen Quittek <[email-masked]>
Date: Wed, 15 Jun 2005 19:05:57 +0200

Dear all,

This open issue of the info model is quite fundamental for IPFIX.

I am surprised, that there so few statements have been posted on this issue.

PLEASE have a look at it and contribute your view on the mailing list!

Concerned are all octet counters for observed packets (incoming, outgoing,
dropped, multicast).

The question is whether these counters should count

  a) exclusively octets contained in observed IP packets or
  b) include in the count also the octets contained in headers/frames
     of some of the layer 2 protocols carrying the IP packets

Thanks,

    Juergen

--On 6/14/2005 3:38 PM +0200 Sven Anderson wrote:

> Dear all,
>
> Benoit Claise schrieb:
>> The last-call finishes on June 15th, so it's time to get a consensus
>> regarding this open issue described in the latest section of [IPFIX-INFO]
>>
>>      octet count including MPLS header: Does the octet count concern IP
>>      packets only or also sub-IP layers such as MPLS?
>
> For the case you are interested in an opinion from "outside" here's my
> comment:
>
> The project is about "IP flows", so I would of course expect, that such a
> flow consists of nothing but IP packets, although it can be defined by
> flow keys from sub-IP layers. I agree, that there are a lot of other
> useful things to count, but these shouldn't be included in the basic octet
> counters of the _IP_flow_ itself.
>
> Imagine the same IP flow is measured at two observation points, and only
> at one of them MPLS is used. These two flow measurements would have
> different sizes, even if the IP packets haven't been altered (like
> fragmented), although the defining attributes are the same. This will be a
> source of confusion, I think.
>
>
> Cheers,
>
> Sven
>
> --
> Sven Anderson
> Institute for Informatics - http://www.ifi.informatik.uni-goettingen.de
> Georg-August-Universitaet Goettingen
> Lotzestr. 16-18, 37083 Goettingen, Germany
>
>
> --
> Help        mailto:[email-masked] and say "help" in message body
> Unsubscribe mailto:[email-masked] and say
> "unsubscribe ipfix" in message body
> Archive     http://ipfix.doit.wisc.edu/archive/

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Andreas Bourges <[email-masked]>
Date: Wed, 15 Jun 2005 19:24:32 +0200

Hi,

...I think it it would be better to *not* include L2 header information. Even 
within an enterprise network this byte count may change - so it doesn't 
really "belong" to the flow monitored. I agree with Sven's opinion, that 
flows measured at two points should have identical byte counts. Imagine a 
customer using ipfix at his site to verify bills from his SP and they have 
different L2 technologies?!

Cheers,

andy

On Wednesday 15 June 2005 19:05, Juergen Quittek wrote:
> > useful things to count, but these shouldn't be included in the basic
> > octet counters of the _IP_flow_ itself.
> >
> > fragmented), although the defining attributes are the same. This will be
> > a source of confusion, I think.
> >
> >
> > Cheers,
> >
> > Sven
> >
> > --
> > Sven Anderson
> > Help        mailto:[email-masked] and say "help" in message
> > body Unsubscribe mailto:[email-masked] and say
> Help        mailto:[email-masked] and say "help" in message
> body Unsubscribe mailto:[email-masked] and say

-- 
 Andreas Bourges
 CCIE #6947 (R&S,C&S)
 GSM: +49 178 7072022
 e-mail: [email-masked]
-----------------------------------
 IsarNet AG
 Terminalstrasse Mitte 18
 85356 München
 Tel.: 07000-isarnet
 Fax : 089-97007-200
 http://www.isarnet.de
-----------------------------------

---

From: Brian Trammell <[email-masked]>
Date: Wed, 15 Jun 2005 14:14:46 -0400

My vote's for a) only counting IP octets. Attempting to handle layer  
2 as well leads to murky semantics, and I've not yet seen a  
compelling case for precise and accurate counting of layer 2 headers  
at the flow level. Layer 2 header traffic volume would seem to be  
readily estimable for capacity planning &c. from layer 3 octet and  
packet counts.

Regards,

Brian Trammell - CERT/NetSA