Re: [sip-clf] draft-salgueiro-sipclf-indexed-ascii /draft-niccolini-sipclf-ipfix Tuning for Implementation

["Vijay K. Gurbani" <[e-mail]>]

On 10/17/2010 09:54 AM, Peter Musgrave wrote:
> Hi all,
>
> I have running ipfix and indexed ascii logging for 1000's of
> messages.
>
> Before I start to measure and summarize I want to make sure I have
> tuned each properly.

Peter: Thanks for your initiative.  More inline.

> ASCII =====
>
> I have made some assumptions about indexed ASCII (and I may have
> exceeded the groups intent here): - the length fields will be
> dropped. Pointers only - src/dest do not have protocol - to/from and
> to_tag/from_tag

OK.

> I would suggest we re-add protocol in the sent/received flags field.
> How about u, t, l for received udp, tcp, tls and U, T, L for sent?

I am not sure I follow (but that is due to loosing context on the above;
I need to catch up on what we decided on the list.)  In any case, I note
that Gonzalo Salgueiro responded in the affirmative to this, so I will
defer to his recollection.  Although, given that TLS can ride on top
of UDP or TCP, we may want to think of a second letter added to "L" to
denote TLS-over-TCP and TLS-over-UDP (I doubt any implementations are
using TLS-over-UDP for signaling only, but given that SCTP is starting
to appear in kernels, maybe our flags ought to be "u, t, s, lu, lt, ls,
U, T, S, LU, LT, LS").

> In looking at the output I think it would aid manual examination to
> put the response code immediately after the CSeq. This makes it very
> easy to see which lines are requests responses (especially for those
> who crush out the pointer line and want the more "apache-like" view
> of the info.

Interesting ... is it possible to share your indexed-ASCII corpus to
see how these fields line up?  This may help determine an answer to your
next question:

> It might be worth discussing whether a user which nukes every pointer
> line can still make sense enough of the activity...I think they might
> need a few of the fields in the Flags. Could this be moved to the
> next "line" ?

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/