Re: [sip-clf] draft-ietf-sipclf-format-01, Flag field

[Anders Nygren <[e-mail]>]

On Tue, Mar 15, 2011 at 12:38 PM, Gonzalo Salgueiro <[e-mail]> wrote:
>
> On Mar 15, 2011, at 1:49 PM, Anders Nygren wrote:
>
> Hi
> I will start writing one email for each issue in order to make it
> easier to track the different discussions.
>
> Thanks. That should help.
>
> I would like to propose that the Flag Field is moved from the
> <IndexPointers> to <MandatoryFields>. That way the <IndexPointers>
> will be pure metadata that can be ignored if wanted and all interesting
> data about the message is in the second line of the record.
>
> I have no real preference on this one. I'll let others weigh in with their
> thoughts.
>

Just one more comment on this. In draft-01 ch. 4 it says

  "1.  Index Pointers - The first 64-bytes of this format.  This
      portion is primarily composed of a list of pointers that indicate
      the beginning of both the variable length mandatory and optional
      fields that are logged as part of this record.  These pointers are
      implemented as a mechanism to improve processing of these records
      and to allow a reader to expeditiously skip right to the desired
      field without unnecessarily going through the entire record."

and ch 4.1.  Index Pointers

   "The <IndexPointers> portion of the SIP CLF record (shown in Figure 3)
   is a 64-byte header that indicates meta-data about the record."

And finally ch 6.  Text Tool Considerations

"Index lines may be rapidly discarded by checking the first character
 of the line: index lines will always start with an alphabetical character..."

All these sections together gives the impression that the  <IndexPointers>
portion only contains meta data and can safely ignored if wanted.

So I would prefer that the flags field is moved to the <MandatoryFields>
part. And if not then I think that the descriptions in ch 4, ch 4.1 and ch 6
should be updated.

/Anders

> Also I think it would be good to change the Sent/Received flag from
>
> Sent/Received flag
>
>         u = received UDP mesage
>         t = received TCP mesage
>         l = received TLS mesage
>         U = sent UDP mesage
>         T = sent TCP mesage
>         L = sent TLS mesage
>
> To
> Sent/Received flag [1 byte]
>         r = received message
>         s = sent message
>
> And add
> Protocol [1 byte]
>         u = UDP
>         t = TCP
>         l = TLS
>
> Since the proposed CLF already requires quite a lot of space there is
> little reason to
> try to pack different parameters into the same byte.
>
> This is what was proposed early on, but the group decided on consolidating
> the two. I'm not violently opposed or in favor of either, but I don't see
> any real benefit to separating the two out since all permutations are
> covered in a single easy byte.
> Regards,
> Gonzalo
>
> /Anders
> _______________________________________________
> sip-clf mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sip-clf
>
>