Subject: [ipfix] New individual draft draft-trammell-ipfix-file-00.txt

From: Brian Trammell <[email-masked]>
Date: Tue, 9 Aug 2005 13:54:36 -0400

Greetings,

The individual draft addressing a simple approach for IPFIX-based  
flow data serialization mentioned at the WG meeting in Paris is now  
available at:

http://www.ietf.org/internet-drafts/draft-trammell-ipfix-file-00.txt

Put very simply, this 4-page draft discusses using the illegal (on  
the wire) Message Length and Set Length values of 0 to mean "this  
Message or Set persists until the underlying storage medium's end of  
file". Motivations and deeper implications of this are detailed in  
the draft.

Thanks,

Brian

---

From: Paul Aitken <[email-masked]>
Date: Tue, 09 Aug 2005 20:03:27 +0100

Brian,

One thing:

> 4.  Time Delta Information Elements
> 
>    Note that, since an IPFIX File has a single Message Header, it has a
>    single Export Time.  All Data Sets within the IPFIX File are scoped
>    to this Export Time.  Processes creating IPFIX files MUST therefore
>    rewrite all time delta Information Elements in their input IPFIX
>    Messages to the be based on the Export Time in the File's single
>    Message Header.

Delta timestamps have a limited range: flowStartDeltaMicroSeconds and 
flowEndDeltaMicroSeconds have a range of just under 72 minutes.

So it may not actually be possible to rewrite all the delta timestamps.

In which case it would be necessary either to create a new file, or 
convert all the templates and timestamps to absolute times.

Cheers.
-- 
Paul Aitken
Cisco Systems Ltd, Edinburgh, Scotland.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Brian Trammell <[email-masked]>
Date: Tue, 9 Aug 2005 15:30:02 -0400

Paul,

Understood - I thought a bit about how best to handle this, and I was  
in fact hoping exactly this discussion would occur on the list. I  
think I'm comfortable with just making this a limitation of the  
format, but you're absolutely right that I should expand the  
discussion in this section to explicitly note the microsecond range  
limitation, and the various ways around it.

Thanks!

- Brian

On Aug 9, 2005, at 3:03 PM, Paul Aitken wrote:

> Delta timestamps have a limited range: flowStartDeltaMicroSeconds  
> and flowEndDeltaMicroSeconds have a range of just under 72 minutes.
>