Re: [Sipping] Alternate CLF syntax proposal

[Hadriel Kaplan <[e-mail]>]

Pcap is just a file format. (well, technically it's an API library, but we're just talking about the pcap file format)  

The format of the file and its entries is ridiculously simple binary.  It has a 24 byte file header, and a 16-byte header per record entry.  Each record entry header has a timestamp, which is something I think we'd need for a CLF, and it has a length, which is something people said in the ad-hoc they'd like.

How we use such a format is actually up to us.  The fact that it follows a pcap file format can be purely coincidental.  If we want currently available tools which support pcap files to be able to read this formatted file, right now without any changes, then we'd have to be careful in what we put in each record after the per-record header.

-hadriel

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf
> Of Cullen Jennings
> Sent: Monday, March 30, 2009 3:06 PM
> To: sipping
> 
> I might not understand everything that is possible with pcap but it
> seems to me that the problem with PCAP is that it generally saves the
> whole SIP message if you want to get all the headers - Say for example
> an operator wants to log who sent INVITES to what what numbers and
> when the correlated BYE happened so  that they can debug stuff later.
> But they do not want to capture the IP addresses of the UAs because if
> they save them then they have to respond to court orders to provide
> the logs with IP in them which is just a huge pain for with the
> operator and does not provide any revenue. The other issue is that
> logging the complete messages is often just too much data.
> 
> I like the proposal - mostly I just want something that works in high
> performance systems.
> 
> Cullen in my individual contributor role.
>