Re: [sip-clf] draft-salgueiro-sipclf-indexed-ascii /draft-niccolini-sipclf-ipfix Tuning for Implementation

[Peter Musgrave <[e-mail]>]

Hi all,

I have running ipfix and indexed ascii logging for 1000's of messages.

Before I start to measure and summarize I want to make sure I have tuned
each properly.

ASCII
=====

I have made some assumptions about indexed ASCII (and I may have exceeded
the groups intent here):
- the length fields will be dropped. Pointers only
- src/dest do not have protocol
- to/from and to_tag/from_tag

I would suggest we re-add protocol in the sent/received flags field. How
about u, t, l for received udp, tcp, tls and U, T, L for sent?

In looking at the output I think it would aid manual examination to put the
response code immediately after the CSeq. This makes it very easy to see
which lines are requests responses (especially for those who crush out the
pointer line and want the more "apache-like" view of the info.

It might be worth discussing whether a user which nukes every pointer line
can still make sense enough of the activity...I think they might need a few
of the fields in the Flags. Could this be moved to the next "line" ?

IPFIX
=====

The recommended templates provided have IPv4 addresses. I'll assume this is
ok for comparison purposes (as my sample logs are all IP4).

I will double-check my output against Hadriel's wireshark plugin. He did
find that I can't count bytes - but I think I have corrected the output.

Are there any other changes I should include?

Cheers,

Peter Musgrave
(as individual)