Subject: [ipfix] bytes and packet counters, tstamp of last report

From: Maurizio Molina <[email-masked]>
Date: Wed, 08 Oct 2003 16:33:40 +0200

Hi,
the IPFIX info model states (sec. 6.10) that

    The packet count can be a running counter and is the count from the
   beginning of the flow establishment.

   The packet count can be a delta counter and is the count since the
   last report for this flow.

(There's the same statement for byte counts in 6.11).

To me, this doesn't clarify wheter it is both...and  (2 counters) or 
either .... or (1 counter).
 
Moreover, there is currently no room for a field containing the 
timestamp of the last report of a flow. I think that keeping this 
timestamp is helpful for many applications and the info model should 
support it.
Regards,
Maurizio

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Stewart Bryant <[email-masked]>
Date: Wed, 08 Oct 2003 16:09:06 +0100

>   last report for this flow.

I would prefer that we only supported running counters because:

a) Supporting two types is more scope for non-interworking, and
    you can always convert from one to the other at the collector.

b) Running counters also work over an unreliable transport
    whereas delta counters mandate the use of a reliable transport.

c) Running counters are most likely what the hardware is keeping
    anyway, therefore delta counters are more work and more storage
    at the exporter.

If we decide that we need both then we have to represent them
as two different information elements because the info model does
not support sub-typing.

Stewart

---

From: "Tal Givoly" <[email-masked]>
Date: Wed, 8 Oct 2003 09:13:56 -0700

Both counters have value (running and delta). Obviously, they must be kept
discrete from an information model perspective as they represent different
information. Devices sometimes maintain one, sometimes the other, and
sometimes both. Just as an example, as far as I recall, NetFlow v5-8 doesn't
maintain running counters (counter to your suggestion) EVEN THOUGH it
operates over a non-reliable and non-congestion-aware transport. Our probe
product emits both for various different purposes.

Tal

-----Original Message-----
From: majordomo listserver [mailto:[email-masked]]On Behalf
Of Stewart Bryant
Sent: Wednesday, October 08, 2003 8:09 AM
To: Maurizio Molina
Cc: [email-masked]'
Subject: Re: [ipfix] bytes and packet counters, tstamp of last report

Stewart

--
Help        mailto:[email-masked] and say "help" in message
body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Ganesh Sadasivan <[email-masked]>
Date: Thu, 09 Oct 2003 11:51:36 -0700

IMHO, we should have running (or cumulative) and delta counters as 
separate IE as they feed
different apps and implementations. This is true for all counters. Both 
these are applicable when
a flow is persistent or sticky in the exporter . In such a case one may 
wish to sent the running
counter if they have enough memory to store a big counter value or may 
prefer to sent the delta,
clearing the counts every time it is exported.

-Ganesh