Subject: [ipfix] IPFIX Header changes

From: Mark Fullmer <[email-masked]>
Date: Thu, 20 Nov 2003 11:21:40 -0500

1) The Count field should be changed to a Length representing the length
    of the IPFIX message.

2) sysUpTime and UNIX Secs can be removed.  These are fields that only
    need to be sent once, possibly slightly more often due to counter
    wrapping, per observation domain per session.  If we end up always
    using 64 bit timestamps in the flows this issue entirely goes away.
    See http://ipfix.doit.wisc.edu/archive/2147.html

3) Source ID should probably be called Observation Domain ID to
    be consistent with the rest of the document.  Prior versions of
    NetFlow used 16 bits for this field which seems sufficient.
    The v9 document uses 32.

4) I would like to see 8 bits of either the version number or
    observation domain changed to flag bits.

5) Based on the flag bit an optional "extension" for lack of a better
    name right now field can show up.  Alternatively use one of the
    "reserved" FlowSet ID's for extensions.  Extensions would be
    in TLV form.

6) With TCP and SCTP the Observation Domain is also something that
    probably only needs to be sent once but could optionally be sent
    per IPFIX message using extensions.

7) For PSAMP support the Length field (previously Count) may need to be
    extended to 24 bits so 64K packets can be transported via IPFIX.

mark

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/