Subject: Re: [PSAMP] completing the PSAMP protocol

From: "Juergen Quittek" <[email-masked]>
Date: Fri, 10 Nov 2006 10:24:05 +0100

Hi Gerhard,

--On 10.11.06 09:47 +0100 Gerhard Muenz wrote:
>
> Dear Juergen,
>
> I would say it is not a problem since a flow template/record usually
> contains a packet counter.

Yes, most time it is not a problem.
But I am concerned about the cases where you do not have a packet counter
or another clear indicator in the report.  But even if you have an indicator
that tells a human observer "This looks like a flow record", I do not want
to implement all the required intelligence into a collector in order to
have him distinguish between flow record and packet record by smart reflections
on the IEs in the record.  A simple and clear indicator should not be costly
and avoid any confusion.

> However, we could recommend to export the packet counter within flow
> records if PSAMP and IPFIX data are exported by the same Exporter (or
> from the same Observation Domain).

What about sending a packet counter with value 1 in an option template
for packet reports?

> A related question is if it is allowed having packet counter and payload
> in the same record. If yes, how do you interprete the payload? Is it the
> payload of the first packet in the flow?

Yes.

> Or is this issue already clarified in the PSAMP specifications?

No. This is already addressed by the IPFIX info model document.

> Regards,
> Gerhard
>
> Juergen Quittek wrote:
>> Dear all,
>>
>> I am very happy that the IPFIX protocol has passed IESG evaluation and will
>> enter the RFC editor queue.  Now we can have the PSAMP protocol following
>> quickly.
>>
>> I think that draft-ietf-psamp-protocol-07.txt is in very good shape.
>> There is only one issue I would like to discuss before submitting it
>> to our AD with a request for publication.  Please send a message to
>> this list if yo see further issues.
>>
>> The issue is distinguishing PSAMP and IPFIX reports.
>>
>> An IPFIX flow report contains information about one or more packets
>> while a PSAMP report contains information about exactly one packet.
>> There is no problem with this if the report contains a packet counter.
>> But if not, it might be unclear if, for example, an octet counter
>> indicates the number of octets of a flow or the number of octets of
>> a single packet.  Therefore, I would like to have a means to distinguish
>> packet reports from flow reports.
>>
>> Does anyone have a good suggestion for solving this problem?
>>
>> Or does anyone think that is not a problem?
>>
>> Input is highly appreciated, because it will help completing
>> the PSAMP protocol soon.
>>
>> Thanks,
>>
>>     Juergen
>>
>>
>> _______________________________________________
>> PSAMP mailing list
>> [email-masked]
>> https://www1.ietf.org/mailman/listinfo/psamp
>
> --
> Dipl.-Ing. Gerhard Münz
> Computer Networks and Internet
> Wilhelm Schickard Institute for Computer Science
> University of Tuebingen
> Sand 13 (Room B309), D-72076 Tuebingen, Germany
> Phone: +49 7071 29-70534 / Fax: +49 7071 29-5220
> E-mail: [email-masked]
> WWW:    http://net.informatik.uni-tuebingen.de/~muenz

_______________________________________________
PSAMP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/psamp