Re: [sip-clf] draft-salgueiro-sipclf-indexed-ascii /draft-niccolini-sipclf-ipfix Tuning for Implementation

Peter - 

Thanks for your efforts on implementing these different encodings.

Some comments Inline...

On Oct 17, 2010, at 10:54 AM, Peter Musgrave wrote:

> Hi all, 
> 
> I have running ipfix and indexed ascii logging for 1000's of messages. 
> 
> Before I start to measure and summarize I want to make sure I have tuned each properly. 
> 
> ASCII
> =====
> 
> I have made some assumptions about indexed ASCII (and I may have exceeded the groups intent here):
> - the length fields will be dropped. Pointers only
> - src/dest do not have protocol 
> - to/from and to_tag/from_tag
> 

No issues with any of these previously discussed changes.

> I would suggest we re-add protocol in the sent/received flags field. How about u, t, l for received udp, tcp, tls and U, T, L for sent?

Moving it from src/dst field to the flags field seems a logical choice since we only need one protocol value for the whole message. We can implement a separate flag for protocol or we can combine it with the send/receive flag as you mention. I'm open to either.

> 
> In looking at the output I think it would aid manual examination to put the response code immediately after the CSeq. This makes it very easy to see which lines are requests responses (especially for those who crush out the pointer line and want the more "apache-like" view of the info. 

Moving the response code after the CSeq makes good sense to me.

> 
> It might be worth discussing whether a user which nukes every pointer line can still make sense enough of the activity...I think they might need a few of the fields in the Flags. Could this be moved to the next "line" ?

We have the benefit of flexibility to move fields as desired. Let's get group consensus on whether we need to move the entire flags field or simply individual flag(s) from the pointer line.

Regards,

Gonzalo

> 
> IPFIX
> =====
> 
> The recommended templates provided have IPv4 addresses. I'll assume this is ok for comparison purposes (as my sample logs are all IP4). 
> 
> I will double-check my output against Hadriel's wireshark plugin. He did find that I can't count bytes - but I think I have corrected the output. 
> 
> Are there any other changes I should include?
> 
> Cheers, 
> 
> Peter Musgrave
> (as individual)
> _______________________________________________
> sip-clf mailing list
> sip-clf@ietf.org
> https://www.ietf.org/mailman/listinfo/sip-clf