Subject: [IPFIX] initiatorOctets and responderOctets confusion

From: Andrew Feren <[email-masked]>
Date: Mon, 16 Jul 2012 11:19:46 -0400

Hi All,

I was just looking at initiatorOctets (231) and responderOctets (232) on 
IANA's assignments page 
<https://www.iana.org/assignments/ipfix/ipfix.xml> and I noticed a 
couple of issues.

There are no sematics given.  We should have the correct semantics 
added.  I had thought the semantics would be deltaCounter (like 
octetDeltaCount), but the descriptions talk about "[t]he total number of 
layer 4 payload bytes in a flow [...]".  I hope I am reading that 
incorrectly because if the semantics are not deltaCounter then section 
4.10 in ie-doctors needs to be revisited.

Is deltaCounter the correct semantics?

Should the description be closer to the octetDeltaCount description?  
Something like:
"The number of octets since the previous report (if any) in incoming 
packets from the initiator for this Flow at the Observation Point. The 
number of octets includes IP header(s) and IP payload. The initiator is 
the device which triggered the session creation, and remains the same 
for the life of the session."

Same questions for initiatorPackets (298) and responderPackets (299).

-Andrew

---

From: Paul Aitken <[email-masked]>
Date: Mon, 16 Jul 2012 22:18:58 +0100

Andrew,

> I was just looking at initiatorOctets (231) and responderOctets (232) 
> on IANA's assignments page 
> There are no sematics given.  We should have the correct semantics added.

Agreed.

> I had thought the semantics would be deltaCounter (like 
> octetDeltaCount), but the descriptions talk about "[t]he total number 
> of layer 4 payload bytes in a flow [...]".  I hope I am reading that 

I believe the semantics are "totalCounter" and IE-doctors needs revised.

> Is deltaCounter the correct semantics?

A first glance at the cisco implementation suggests not. However, I'm 
checking with the implementation team to be quite sure.

> packets from the initiator for this Flow at the Observation Point.  
> The number of octets includes IP header(s) and IP payload. The 
> initiator is the device which triggered the session creation, and 
> remains the same for the life of the session."

Not if they're total counters, as suggested by the descriptions and 
cisco definition that I saw.

> Same questions for initiatorPackets (298) and responderPackets (299).

Same answer: the definitions say "total", and I believe the semantics 
should be "totalCounter".

Once I have confirmation, I'll open a case with IANA to have these 
corrected.

Thanks for pointing this out.

P.