Subject: RE: [ipfix-req] Ipfix features

From: "Cottrell, Les" <[email-masked]>
Date: Tue, 11 Jun 2002 14:59:19 -0700

I would guess the closest I will get to max window size would be to report the window scaling option factor and window size specified in the SYN and SYN/ACK when a TCP flow is opened.

NETFLOW appears to look at each packet seprately, thus if a packet is not the first of a fragmentation set, then Netflow reports spurious port numbers etc.  For applications such as AFS which uses UDP with big block sizes this makes it hard to identify the amount of AFS traffic.

> -----Original Message-----
> From: K.C. Norseth [mailto:[email-masked]] 
> Sent: Tuesday, June 11, 2002 10:33 AM
> To: Cottrell, Les; req
> Cc: Logg, Connie A.
> Subject: Re: [ipfix-req] Ipfix features
> 
> 
> Discusssion is healthy. Please elaborate on what you mean.
> 
> K.C.
> ----- Original Message -----
> From: "Cottrell, Les" <[email-masked]>
> To: "req" <[email-masked]>
> Cc: "Logg, Connie A." <[email-masked]>
> Sent: Tuesday, June 11, 2002 11:16 AM
> Subject: [ipfix-req] Ipfix features
> 
> 
> | I hope this is not too off-subject, but in future realeases 
> of ipfix 
> | ttols
> such as Netflow, I would like to see:
> |
> | Max window size reported
> | Correct handling of fragmented packets
> |
> | --
> | Help        mailto:[email-masked] and say 
> "help" in message
> body
> | Unsubscribe mailto:[email-masked] and say "unsubscribe 
> | ipfix" in message body
> | Archive     http://ipfix.doit.wisc.edu/archive/
> |
> 

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: "Cottrell, Les" <[email-masked]>
Date: Tue, 11 Jun 2002 15:00:47 -0700

As an example of IP fragmentation see:

http://www.slac.stanford.edu/comp/net/netflow/afsexample.html