Re: [sip-clf] SIPCLF - Questions from implementations...

Gonzalo Salgueiro <gsalguei@cisco.com> Tue, 21 September 2010 07:07 UTC

Return-Path: <gsalguei@cisco.com>
X-Original-To: sip-clf@core3.amsl.com
Delivered-To: sip-clf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D5CE13A6957 for <sip-clf@core3.amsl.com>; Tue, 21 Sep 2010 00:07:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.42
X-Spam-Level:
X-Spam-Status: No, score=-9.42 tagged_above=-999 required=5 tests=[AWL=1.179, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O878sMKMkLye for <sip-clf@core3.amsl.com>; Tue, 21 Sep 2010 00:07:10 -0700 (PDT)
Received: from av-tac-rtp.cisco.com (hen.cisco.com [64.102.19.198]) by core3.amsl.com (Postfix) with ESMTP id A4EF83A67FA for <sip-clf@ietf.org>; Tue, 21 Sep 2010 00:07:10 -0700 (PDT)
X-TACSUNS: Virus Scanned
Received: from rooster.cisco.com (localhost.cisco.com [127.0.0.1]) by av-tac-rtp.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id o8L77RNo027242; Tue, 21 Sep 2010 03:07:28 -0400 (EDT)
Received: from rtp-gsalguei-8714.cisco.com (rtp-gsalguei-8714.cisco.com [10.116.61.53]) by rooster.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id o8L77J8S007620; Tue, 21 Sep 2010 03:07:25 -0400 (EDT)
Mime-Version: 1.0 (Apple Message framework v1081)
Content-Type: text/plain; charset="us-ascii"
From: Gonzalo Salgueiro <gsalguei@cisco.com>
In-Reply-To: <4C97694F.6090105@bell-labs.com>
Date: Tue, 21 Sep 2010 03:07:19 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <3DF055E0-9E20-4545-895B-AD3C88189DCF@cisco.com>
References: <AANLkTimAr+F4iUfhgnj4j0JdUT_PWfYVXYFWmFmLA3-S@mail.gmail.com> <4C97694F.6090105@bell-labs.com>
To: Peter Musgrave <peter.musgrave@magorcorp.com>, "Vijay K. Gurbani" <vkg@bell-labs.com>
X-Mailer: Apple Mail (2.1081)
Cc: sip-clf@ietf.org
Subject: Re: [sip-clf] SIPCLF - Questions from implementations...
X-BeenThere: sip-clf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <sip-clf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sip-clf>
List-Post: <mailto:sip-clf@ietf.org>
List-Help: <mailto:sip-clf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Sep 2010 07:07:11 -0000

Peter - 

Please excuse the delayed response but we just welcomed our third child on Wednesday and that has consumed my days and (sadly) my nights.

Adding to Vijay's comments, please see inline....

> 
>> 3) Indexed ASCII Example
>> The example shows comma delimiters in the pointer block as well as in
>> the uuencoded snippet (but the text and definition do not). Are the
>> commas intended (to facilitate processing)?
> 
> Offhand, I do not recall why the header block is comma delimited.
> I will check with Gonzalo.

This was a manual decoding error in the last draft and has since been corrected in the -02 draft that I have not published yet.  Here is proper decode of that same message in case you need it for your implementation of indexed-ASCII CLF:

A000174,Ros,
0070000D007800120091001300A5001400BA001800D3002C0100000E01090001011100010113000E0122

1278629563.323  314159 INVITE   sip:bob@biloxi.com      
biloxi.com:5060:udp     atlanta.com:5060:udp    
Bob <sip:bob@biloxi.com>        
Alice <sip:alice@atlanta.com>;tag=1928301774    
a84b4c76e66710  -       -       z9hG4bKnashds8  
0000,001C,<sip:alice@pc33.atlanta.com>  
0001,000C,192.168.1.15


begin-base64 644 sip_clf.txt
QTAwMDE2MCxSb3MsMDA3MDAwMEQwMDc4MDAxMjAwOTEwMDEzMDBBNTAwMTQwMEJBMDAxODAwRDMw
MDJDMDEwMDAwMEUwMTA5MDAwMTAxMTEwMDAxMDExMzAwMEUwMTIyCjEyNzg2Mjk1NjMuMzIzCTMx
NDE1OSBJTlZJVEUJc2lwOmJvYkBiaWxveGkuY29tCWJpbG94aS5jb206NTA2MDp1ZHAJYXRsYW50
YS5jb206NTA2MDp1ZHAJQm9iIDxzaXA6Ym9iQGJpbG94aS5jb20+CUFsaWNlIDxzaXA6YWxpY2VA
YXRsYW50YS5jb20+O3RhZz0xOTI4MzAxNzc0CWE4NGI0Yzc2ZTY2NzEwCS0JLQl6OWhHNGJLbmFz
aGRzOAkwMDAwLDAwMUMsPHNpcDphbGljZUBwYzMzLmF0bGFudGEuY29tPgkwMDAxLDAwMEMsMTky
LjE2OC4xLjE1Cg==
====

> 
>> 4) Retransmission flag in Indexed ASCII
>> I could not find a requirement for this in the problem statement.
>> Since it appears to be optional should it be in the TLV block and not
>> the flags block?
> 
> The original indexed-ASCII draft from Adam always had the retransmission
> flag.  When I had proposed SIPCLF, I did not see the need to log
> retransmissions.  Since the current indexed-ASCII approach is
> based on the old version from Adam, the retransmission flag is
> carried over.
> 
> I am open to whether or not we need to log the retransmission bit.

I have no real preference for whether the we want the retransmission bit present in the flags field or not. I will note that I see little to no need to log that information, but am open to the group decision.

Regards,

Gonzalo

> 
> Thanks,