Subject: [ipfix] Window size option in ipfix-info

From: "Håvard Mork" <[email-masked]>
Date: Fri, 28 Jul 2006 15:53:03 +0200

Hi,

I am working with an ipfix implementation reporting on QoS. For this
purpose, it is interesting to observe various tcp parameters in flows,
especially the tcp window size. Currently, the tcpWindowSize
information element is a 16-bit integer. This limits the reporting of
i.e. the window scaling option (wsopt, RFC1323), where window sizes
are 32-bit entities.

What do you think about extending the semantics of tcpWindowSize to
report on the precise 32-bit window size instead of copying the th_win
field from the tcp header?

Reporting on the window size for wsopt is made difficult since it
requires observing flows bidirectionally. This is due to wsopt being
an "offer", and acknowledgement should be observed. Implementations
are likely to handle this differently. The advantage, however, is that
the reported value may correctly represent the flow's window size.

-- 
Best regards,
  Håvard Mork
  http://havard.mork.no/

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Brian Trammell <[email-masked]>
Date: Fri, 28 Jul 2006 11:22:48 -0400

Håvard,

One question... as the reported window size will change over the  
lifetime of the flow, should the real window size (i.e. that taking  
wsopt into account) not be reportable as a maximum, or a median?  
Simply reporting the wsopt-derived window from the first packet of  
the flow (as the tcpWindowSize IE is presently specified to do for  
th_win) would seem to be insufficient, for the reason (negotiation)  
you state below.

Another question: is there value in keeping tcpWindowSize as is  
presently defined, without wsopt support?

Regards,

Brian