Subject: [ipfix] export packet length

From: Maurizio Molina <[email-masked]>
Date: Fri, 25 Apr 2003 17:50:25 +0200

Hi all,
I hope not to rise an issue already discussed in the WG. If yes, I
apologise in advance.
If an IPFIX export packet is carried over TCP, it's not unusual that it
gets split across multiple TCP segments.
At the collector side, on the contrary, the implementation of the
parsing is much simpler if only full export packet are parsed.
If the information about the WHOLE export packet were contained in the
header, it would be simple to wait until all the bytes composing an
export packets are read from the TCP socket before beginning the
parsing.
Unfortunately, this information isn't currently contained in  Netflow 9
packet header (I suppose, due to Netflow's 9 "bias" towards UDP...).
Therefore, a parsing implementation having to deal with this
"fragentation" problem without this information needs to be much more
complicated (e.g. getting step by step the lenght of each flow set, see
if it's all there, parse it and go on....).
In summary: if IPFIX has to be carried over tcp, having the length of
the export packet in the packet header would be beneficial.
Regards,
Maurizio

--
Maurizio Molina
Research Staff member
Network Laboratories Heidelberg
NEC Europe Ltd.
Kurfuersten-Anlage 36, 69115 Heidelberg, Germany.
Tel. (49)6221 90511-18 Fax: (49)6221 90511-55
e-mail: [email-masked]
Web: www.ccrle.nec.de

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/