Re: [sip-clf] draft CLF charter

Hadriel Kaplan <HKaplan@acmepacket.com> Tue, 21 July 2009 23:47 UTC

Return-Path: <HKaplan@acmepacket.com>
X-Original-To: sip-clf@core3.amsl.com
Delivered-To: sip-clf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D7F9E3A6AAF for <sip-clf@core3.amsl.com>; Tue, 21 Jul 2009 16:47:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3hazmnAbM1Hc for <sip-clf@core3.amsl.com>; Tue, 21 Jul 2009 16:47:21 -0700 (PDT)
Received: from etmail.acmepacket.com (etmail.acmepacket.com [216.41.24.6]) by core3.amsl.com (Postfix) with ESMTP id 0CD993A67FB for <sip-clf@ietf.org>; Tue, 21 Jul 2009 16:47:21 -0700 (PDT)
Received: from mail.acmepacket.com (216.41.24.7) by etmail.acmepacket.com (216.41.24.6) with Microsoft SMTP Server (TLS) id 8.1.375.2; Tue, 21 Jul 2009 19:47:20 -0400
Received: from mail.acmepacket.com ([127.0.0.1]) by mail ([127.0.0.1]) with mapi; Tue, 21 Jul 2009 19:47:20 -0400
From: Hadriel Kaplan <HKaplan@acmepacket.com>
To: "Vijay K. Gurbani" <vkg@alcatel-lucent.com>, "Romascanu, Dan (Dan)" <dromasca@avaya.com>
Date: Tue, 21 Jul 2009 19:47:19 -0400
Thread-Topic: [sip-clf] draft CLF charter
Thread-Index: AcoKUins/30j881fSJOMwQybw4gOiAACXgjQ
Message-ID: <E6C2E8958BA59A4FB960963D475F7AC3196D06C8EF@mail>
References: <3B33A97D-7E19-4A08-A431-A085D53A2A6E@nostrum.com> <D5E606B8-0811-4D40-AA76-ED989B00FD02@nostrum.com> <EDC652A26FB23C4EB6384A4584434A0401892AF4@307622ANEX5.global.avaya.com> <4A664053.7070603@alcatel-lucent.com>
In-Reply-To: <4A664053.7070603@alcatel-lucent.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "sip-clf@ietf.org" <sip-clf@ietf.org>
Subject: Re: [sip-clf] draft CLF charter
X-BeenThere: sip-clf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <sip-clf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sip-clf>
List-Post: <mailto:sip-clf@ietf.org>
List-Help: <mailto:sip-clf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Jul 2009 23:47:21 -0000

> -----Original Message-----
> From: sip-clf-bounces@ietf.org [mailto:sip-clf-bounces@ietf.org] On Behalf
> Of Vijay K. Gurbani
> Sent: Tuesday, July 21, 2009 6:25 PM
> 
> While pcap is good for capturing network traffic, requiring a SIP
> entity to expressly produce CLF in pcap format will be burdening
> it to spend CPU cycles in converting the SIP message from its
> internal representation to the pcap format -- this may not
> be sustainable in a high transaction volume SIP proxy, for
> instance.  

I disagree with that - or rather, it's not the format conversion from an internal representation to a PCAP format that would burn CPU.  I wrote an example library for (and submitted a draft on) recording CLF in a PCAP format.  While the code was kludgy (because I'm not a programmer and I was trying to make it a generic library and thus internal-representation agnostic)... it could be written better.

But no matter what format we pick, there will be a "conversion" from an internal representation to a CLF format for most everyone, if not actually everyone.

-hadriel