Re: [sip-clf] New CLF Syntax draft (text with index)

Simon Perreault <> Thu, 07 May 2009 19:22 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 30FBE3A6B69 for <>; Thu, 7 May 2009 12:22:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.312
X-Spam-Status: No, score=-2.312 tagged_above=-999 required=5 tests=[AWL=0.288, BAYES_00=-2.599, NO_RELAYS=-0.001]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id aYt2uRHBo3A5 for <>; Thu, 7 May 2009 12:22:32 -0700 (PDT)
Received: from ( [IPv6:2620:0:230:8000::2]) by (Postfix) with ESMTP id AC26A3A6BEF for <>; Thu, 7 May 2009 12:22:31 -0700 (PDT)
Received: by (Postfix, from userid 8) id BFD0A29E15CE; Thu, 7 May 2009 15:23:59 -0400 (EDT)
Received: from ( [IPv6:2620:0:230:c000::67]) by (Postfix) with ESMTP id B5F6729E15B4; Thu, 7 May 2009 15:23:59 -0400 (EDT)
Message-ID: <>
Date: Thu, 07 May 2009 15:23:59 -0400
From: Simon Perreault <>
User-Agent: Thunderbird (X11/20090320)
MIME-Version: 1.0
To: Adam Roach <>
References: <> <> <>
In-Reply-To: <>
X-Enigmail-Version: 0.95.6
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [sip-clf] New CLF Syntax draft (text with index)
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 07 May 2009 19:22:33 -0000

Adam Roach wrote, on 07/05/09 03:20 PM:
> I considered doing it both ways, but decided that I preferred the slight
> space impact of being able to get to any fixed field by looking at only
> two numbers instead of all the preceding fields. I'm open to doing just
> lengths if people are very sensitive to the size of each record, but
> have a personal preference for what's in the draft currently.

I'm sorry, I don't understand. Why would one need to look at all the preceding

Let's say you want to look at field 3. You look up the third pointer (p3), this
gives you the start of the field. Then you look up the fourth pointer (p4), this
give you the end of the field. If you want the length you compute p4 - p3.

Is it because of a possible overflow in the pointers? They're only 16-bit big,
while each field's length is also 16-bit big...

STUN/TURN server    -->
Interplanetary news -->
vCard 4.0           -->