Subject: [sip-clf] draft-niccolini-sipclf-ipfix-04

From: Peter Musgrave <[email-masked]>
Date: Sun, 12 Sep 2010 16:41:53 -0400

Hi IPFIXers,

(as individual)

I have started on implementing both formats so I can make a relative
comparison.

Some questions about the IPFIX draft:

In Figure 2 and 3 the base request and response templates are listed.
Can the order in the response template be altered so protocol
identifier precedes SIpResponseStatus? This makes the two templates
common up to this point (and saves an IF stmt in the implementation)?

In the example of templates in Figure 6 the template comment and log
data show 16 data elements. I only count 15 in the template in Figure
2 and 3. It seems that sipServerTransaction is provided in the example
but not
listed in Fig 2 and 3.

In the example in figure at 0040: 81 92 should (I think) be followed
by an entry for 81 a3 (to correspond to 419 sipObservation type) and
then 81 93 etc.

Regards,

Peter Musgrave

---

From: Brian Trammell <[email-masked]>
Date: Mon, 13 Sep 2010 12:18:03 +0200

Hi, Peter,

Thanks! Replies inline...

> common up to this point (and saves an IF stmt in the implementation)?

Certainly. The reordering there is for alignment purposes, to make it easier to specify a template as a C structure. However, the order of information elements is an implementation-specific thing (readers/collectors must support templates in any order, and the only place ordering is significant is when multiple instances of the same IE appear in a template).

> 2 and 3. It seems that sipServerTransaction is provided in the example

Correct; this is because Figure 2 and 3 define the _base_ templates, the minimum set of IEs that must be in a template for it to be considered a SIPCLF message as per the problem statement. The server transaction is added this base template in the example, because it is available in the example input. However, on review, I see this is a little confusing as explained in the doc. I'll add a clarifying note to the example.

> by an entry for 81 a3 (to correspond to 419 sipObservation type) and

Indeed it should. (I'm trying to track down exactly how it came _not_ to be there... as the way my workflow for example generation works, it shouldn't work _without_ it). Will fix in the next rev.

Cheers,

Brian