Re: [sip-ops] [dispatch] SIP-CLF: Results on ASCII vs. binary representation

"Vijay K. Gurbani" <vkg@alcatel-lucent.com> Wed, 29 April 2009 21:44 UTC

Return-Path: <vkg@alcatel-lucent.com>
X-Original-To: sip-ops@core3.amsl.com
Delivered-To: sip-ops@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9B6493A71C2; Wed, 29 Apr 2009 14:44:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.518
X-Spam-Level:
X-Spam-Status: No, score=-2.518 tagged_above=-999 required=5 tests=[AWL=0.081, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5H2VwhEsNbc8; Wed, 29 Apr 2009 14:44:35 -0700 (PDT)
Received: from ihemail3.lucent.com (ihemail3.lucent.com [135.245.0.37]) by core3.amsl.com (Postfix) with ESMTP id 6FD7C3A71B4; Wed, 29 Apr 2009 14:44:34 -0700 (PDT)
Received: from umail.lucent.com (h135-3-40-61.lucent.com [135.3.40.61]) by ihemail3.lucent.com (8.13.8/IER-o) with ESMTP id n3TLjrVI006430 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 29 Apr 2009 16:45:53 -0500 (CDT)
Received: from [135.185.236.17] (il0015vkg1.ih.lucent.com [135.185.236.17]) by umail.lucent.com (8.13.8/TPES) with ESMTP id n3TLjqIZ007923; Wed, 29 Apr 2009 16:45:53 -0500 (CDT)
Message-ID: <49F8CA90.3000508@alcatel-lucent.com>
Date: Wed, 29 Apr 2009 16:45:52 -0500
From: "Vijay K. Gurbani" <vkg@alcatel-lucent.com>
Organization: Bell Labs Security Technology Research Group
User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
MIME-Version: 1.0
To: Hadriel Kaplan <HKaplan@acmepacket.com>
References: <49F864E8.20005@alcatel-lucent.com> <167dfb9b0904290847u322161d5h3da18771344436ec@mail.gmail.com> <49F8988C.9050900@alcatel-lucent.com> <167dfb9b0904291203m4e74ab39s5f83cfa1be9799a0@mail.gmail.com> <49F8B827.3060501@alcatel-lucent.com> <E6C2E8958BA59A4FB960963D475F7AC31915E3E5B1@mail>
In-Reply-To: <E6C2E8958BA59A4FB960963D475F7AC31915E3E5B1@mail>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.57 on 135.245.2.37
Cc: "sip-ops@ietf.org" <sip-ops@ietf.org>, "dispatch@ietf.org" <dispatch@ietf.org>
Subject: Re: [sip-ops] [dispatch] SIP-CLF: Results on ASCII vs. binary representation
X-BeenThere: sip-ops@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Operations <sip-ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/sip-ops>, <mailto:sip-ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sip-ops>
List-Post: <mailto:sip-ops@ietf.org>
List-Help: <mailto:sip-ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sip-ops>, <mailto:sip-ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Apr 2009 21:44:36 -0000

Hadriel Kaplan wrote:
> Depends on how you plan to disambiguate legal characters in the
> fields from the field separators.  In binary the length field removes
> the need for disambiguation, or a CRLF itself does it (depending on
> the format).  In ascii, if you have to escape characters, then that
> escaping and de-escaping could be a big hit.

Right; this is a nagging problem at the back of my head ever
since Dale pointed it out.  The least impacting way to deal
with this, I believe, will be not to save display-name type
of constructs but only addr-spec for URIs.  The generic-param
construct is another potential problem.  Spaces in it need
to be escaped or generic-param could be simply unallowed.  I
don't know what the right answer should be right now.

> But anyway, I think the real question that needs to be answered
> *first* is "what is the purpose of the CLF?"  What is it going to
> help admins do?  Is it for troubleshooting, or for registration audit
> logging, or for IDS systems, etc?

 From the list above, at least for troubleshooting, logging, and
IDS systems.  What I do not envision CLF being used for is
debugging (distinct from troubleshooting) and CDR.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/