Subject: Re: [ippm] Next version of the duplicate draft

From: Henk Uijterwaal <[email-masked]>
Date: Tue, 01 Jul 2008 14:51:40 +0200

Hi,

> so this says that the source and destination IP address need to be the 
> same for packet to be duplicates, but it's still vague about which 
> fields in the next header ("transport" header, usually) need to be 
> identical. I'm not convinced that this text will lead to implementations 
> that will come up with the same measurement results for the same packet 
> sequence. Can we be more precise?

I think it does as long as you don't look at any other fields than source,
destination and information.

Each packet has source, destination, a bunch of other headers and finally
the information that it carries.  On the receiving side, one records the
packets and for each arriving packet, one checks if one has arrived before
with the same source, destination and information (within  the time-out
interval).  If so, it is a duplicate.  If not, it isn't.

The real question, I think, is whether there can be cases where the source
intentionally sends multiple packets with the same src, dst and information
(but something different in the other headers).

Henk

-- 
------------------------------------------------------------------------------
Henk Uijterwaal                           Email: henk.uijterwaal(at)ripe.net
RIPE Network Coordination Centre          http://www.amsterdamned.org/~henk
P.O.Box 10096          Singel 258         Phone: +31.20.5354414
1001 EB Amsterdam      1016 AB Amsterdam  Fax: +31.20.5354445
The Netherlands        The Netherlands    Mobile: +31.6.55861746
------------------------------------------------------------------------------

Is one of the choices leaving the office open?
                                       Alan Greenspan on the next elections
_______________________________________________
ippm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ippm

---

From: Lars Eggert <[email-masked]>
Date: Tue, 1 Jul 2008 16:04:55 +0300

Hi,

On 2008-7-1, at 15:51, ext Henk Uijterwaal wrote:
>> so this says that the source and destination IP address need to be  
>> the same for packet to be duplicates, but it's still vague about  
>> which fields in the next header ("transport" header, usually) need  
>> to be identical. I'm not convinced that this text will lead to  
>> implementations that will come up with the same measurement results  
>> for the same packet sequence. Can we be more precise?
>

so what if there is no information, such as with pure TCP ACKs?

I wonder - since IPPM is doing metrics for IP - if we can define  
duplication only in terms of the IP header fields?

Lars

---

From: Henk Uijterwaal <[email-masked]>
Date: Tue, 01 Jul 2008 16:55:17 +0200

Hi Lars,

 > duplication only in terms of the IP header fields?

Well, if there is nothing to distinguish two packets that were
intentionally sent over a packet that has been replicated along
the way, then one cannot use this metric.  For active measurements
between two hosts, this won't be an issues as one generates his own
packets and can  easily put something in to make them unique.
For other metrics, we haven't defined the packet format or how to
do this either.

If one wants to apply the metric for other cases (say, passive monitoring
of TCP sequences), then one will have to find something in the packets
to distinguish two packets from one packet sent twice.  I'm open to
suggestions here.

Henk

---

From: Henk Uijterwaal <[email-masked]>
Date: Wed, 09 Jul 2008 11:54:26 +0200

Hi all,

> to distinguish two packets from one packet sent twice.  I'm open to

This discussion seems to have stopped here.

The text says that active measurement systems MUST NOT send packets with
identical information fields, in order to avoid that all packets are
declared duplicates.   That is sufficient to use this metric in this
case.  The metric will also work for passive methods where one is sure
that each packet is different.  The metric won't work for cases where
multiple identical packets are intentionally sent.

In order to move forward:

a) We accept this (and add text to make this clear to everybody).

b) We don't accept this.  In that case, one will have to find something
    to distinguish two packets from one packet sent twice.

My preference is for the former, but I like to hear other opinions.  I'm
afraid that if we don't accept this and don't come up with good suggestions
to distinguish packets, we'll never end up with a duplication metric.

Henk

---

From: Lars Eggert <[email-masked]>
Date: Mon, 14 Jul 2008 12:01:56 +0300

> to distinguish packets, we'll never end up with a duplication metric.

I'd personally prefer to come up with a definition of what a duplicate  
is that uses only IP header information, rather than having  
dependencies on higher layers. Source and destination IP address plus  
the IP ID field ought to do it? (For non-fragments, at least.) Also  
see http://tools.ietf.org/html/draft-touch-intarea-ipv4-unique-id

Lars

PS: This is a comment as an individual contributor. If there's WG  
consensus for (a), I'm OK with being on the rough side of it.
_______________________________________________
ippm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ippm

---

From: Lars Eggert <[email-masked]>
Date: Mon, 14 Jul 2008 12:14:05 +0300

On 2008-7-14, at 12:01, ext Lars Eggert wrote:
> Source and destination IP address plus the IP ID field ought to do it?

I don't know what I was thinking. The check would need to look at  
pretty much all header fields other than the TTL and checksum. (And  
possibly DSCP, because a duplicate could have been routed along a  
different path and gotten remarked.)

Lars