Re: [Sipping] Alternate CLF syntax proposal

[Hadriel Kaplan <[e-mail]>]

That depends on what you think a "Common Log Format" would be useful for.  The premise was that it's for troubleshooting and analysis systems.  AFAICT, nothing short of the entire SIP message sequence, including contents, and even IP/UDP or TCP headers, would be sufficient for that in practice.

But anyway, attached is an example CLF file using only the currently defined fields from draft-gurbani-sipping-clf-01, I think, encoded in a different format from the draft.  It just happens to be that there are already tools which can even read this file and allow the user to view its contents in a meaningful way.  For example, you can open this attachment in wireshark.

-hadriel

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf
> Of Theo Zourzouvillys
> Sent: Sunday, March 29, 2009 10:51 PM
> To: Jiri Kuthan
> Cc: Jason Fischl; sipping WG; [e-mail];
> Adam Roach
> Subject: Re: [Sipping] Alternate CLF syntax proposal
> 
> On Sun, Mar 29, 2009 at 8:35 PM, Jiri Kuthan <[e-mail]> wrote:
> 
> > Why aren't we happy then just with PCAP -- that's a de-facto standard.
> 
> what does the pcap format give us? see:
> 
>   http://wiki.wireshark.org/Development/LibpcapFileFormat
> 
> ... it doesn't really solve any of the problems except provide a
> struct header and record header, much of which we don't even need (and
> missing stuff we do need).
> 
> We'd just be shoving whatever formats we defined into a record in
> them.  None of the pcap tools would work on records except raw
> packets, which most of the time i don't want to be collecting or
> sending across the network to a collector - a port mirror already does
> that pretty well :-)
> 
>  ~ Theo
> _______________________________________________
> Sipping mailing list  https://www.ietf.org/mailman/listinfo/sipping
> This list is for NEW development of the application of SIP
> Use [e-mail] for questions on current sip
> Use [e-mail] for new developments of core SIP