Subject: [sip-clf] Implementation Experiment: Further Details

From: Peter Musgrave <[email-masked]>
Date: Mon, 4 Oct 2010 06:49:05 -0400

Hi Folks,

I had hoped to have this done by the end of Sept. It is (gasp) a
software project behind schedule.

I'm close though - and I should be able to get done in another week.
My plan is to log a reasonable amount of traffic (1000's of messages)
from a B2BUA and then make the results available so people can look at
the sizes and forms of some concrete logs. I will also report on the
implementation issues and make the code available.

A few details I'd like to confirm:

1) It has been agreed To/From become ToUri/FromUri/ToTag/FromTag ?
- this is already reflected in the current IPFIX doc

2) Indexed ASCII
Simplifying the pointer block to just show offsets (and to get length
by subtracting the next offset) was discussed. Was there a desire to
do this? (Personally having both offset/length seems to just clutter
up the header).

3) The protocol field does not need to apply to both To and From. It
reflects the protocol in which a transmitted packet was sent OR a
received packet was received.

4) Are source/dest. in general IP addresses taken from the IP packet -
or could they be DNS names?

Thanks in advance,

Peter Musgrave
(as individual)

---

From: Hadriel Kaplan <[email-masked]>
Date: Mon, 4 Oct 2010 09:36:15 -0400

> - this is already reflected in the current IPFIX doc

+1
> received packet was received.

right
> or could they be DNS names?

I think they should just be the L3 addresses of the packet/socket.

-hadriel

---

From: Hadriel Kaplan <[email-masked]>
Date: Mon, 4 Oct 2010 09:52:53 -0400

BTW, if you want to view your IPFIX file in Wireshark, I've written and submitted a patch to do that:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5242

Once the IPFIX numbers are assigned for the fields, I'll update the dissector to show them as their parsed SIP info. (right now it'll show them as opaque field blobs)

-hadriel

On Oct 4, 2010, at 6:49 AM, Peter Musgrave wrote:

> _______________________________________________
> sip-clf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sip-clf

---

From: Gonzalo Salgueiro <[email-masked]>
Date: Mon, 4 Oct 2010 11:31:44 -0400

Peter - 

See inline....

> - this is already reflected in the current IPFIX doc

This is my understanding and I have no problem with it.

> do this? (Personally having both offset/length seems to just clutter

This was something you brought up some time ago and I think it was never discussed by the group. My view is that simply providing the offset to a particular field gives you all the information you need and that length of the specific field is superfluous. I'm open to hear the comments of others though.

> received packet was received.

Sounds good to me. My understanding is that we agreed on this already.

> or could they be DNS names?

I'm fine with only allowing the IP address.