Subject: [sip-clf] SIP CLF -> IPFIX?

From: Benoit Claise <[email-masked]>
Date: Thu, 30 Jul 2009 15:38:01 +0200

Hi Vijay,

During the OPSAREA, I asked you the following questions regarding your 
work at http://www.ietf.org/proceedings/75/slides/opsarea-2.pdf

QUESTION: if I understand correctly, you want a way to define 
Information Element types?

            Answer: Yes

QUESTION: just want to log the data locally, or if you want a push 
mechanism to a centralized point, or get the log file?

            Answer: So far, only local storing

If the answer to the second question changes to: one day we might want 
to export these Information Element to a centralized management, then 
IPFIX protocol (RFC5101) and IPFIX information model (RFC5102) is the 
right solution.
If the answer to the second question doesn't change: the IPFIX 
Information Model (RFC5102) might be the solution... just in case 
someone else would like to export the information. However, this is a 
less obvious case!

Btw, you should not see IPFIX as export only flow information in the 
sense of the 5 tuple (src IP, dst IP, protocol, src port, dst port), 
IPFIX is becoming a generic push mechanism.

Regards, Benoit.

---

From: Vijay Gurbani <[email-masked]>
Date: Thu, 30 Jul 2009 10:06:49 -0500

> Hi Vijay,

Benoit: Thanks for your interest in this.  One quick clarification
inline.

> Information Element types?

Just to be sure, we want to define a logging format -- which fields
to include, how to ensure extensibility for future fields, etc.
In that vein, it is not so much about Information Element *types*
as it is about the choice and representation of the Information
Elements themselves.  I don't know if that is too fine a distinction
or not, but probably worth a clarification.

Once again, thank you for indulging us.

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
WWW:   http://ect.bell-labs.com/who/vkg

---

From: Benoit Claise <[email-masked]>
Date: Thu, 30 Jul 2009 17:14:46 +0200

Vijay,

>> During the OPSAREA, I asked you the following questions regarding 
>> your work at http://www.ietf.org/proceedings/75/slides/opsarea-2.pdf
>>
> Elements themselves.
Sure. My mistake in choosing words

Regards, Benoit.
> I don't know if that is too fine a distinction