Re: [sip-clf] draft-niccolini-sipclf-ipfix-04

[Brian Trammell <[e-mail]>]

Hi, Peter,

Thanks! Replies inline...

On Sep 12, 2010, at 10:41 PM, Peter Musgrave wrote:

> Hi IPFIXers,
> 
> (as individual)
> 
> I have started on implementing both formats so I can make a relative
> comparison.
> 
> Some questions about the IPFIX draft:
> 
> In Figure 2 and 3 the base request and response templates are listed.
> Can the order in the response template be altered so protocol
> identifier precedes SIpResponseStatus? This makes the two templates
> common up to this point (and saves an IF stmt in the implementation)?

Certainly. The reordering there is for alignment purposes, to make it easier to specify a template as a C structure. However, the order of information elements is an implementation-specific thing (readers/collectors must support templates in any order, and the only place ordering is significant is when multiple instances of the same IE appear in a template).

> In the example of templates in Figure 6 the template comment and log
> data show 16 data elements. I only count 15 in the template in Figure
> 2 and 3. It seems that sipServerTransaction is provided in the example
> but not
> listed in Fig 2 and 3.

Correct; this is because Figure 2 and 3 define the _base_ templates, the minimum set of IEs that must be in a template for it to be considered a SIPCLF message as per the problem statement. The server transaction is added this base template in the example, because it is available in the example input. However, on review, I see this is a little confusing as explained in the doc. I'll add a clarifying note to the example.

> In the example in figure at 0040: 81 92 should (I think) be followed
> by an entry for 81 a3 (to correspond to 419 sipObservation type) and
> then 81 93 etc.

Indeed it should. (I'm trying to track down exactly how it came _not_ to be there... as the way my workflow for example generation works, it shouldn't work _without_ it). Will fix in the next rev.

Cheers,

Brian