Subject: [IPFIX] IPFIX layer 2 packet count

From: Paul Aitken <[email-masked]>
Date: Fri, 18 Apr 2014 22:30:13 +0100

Dear IPFIX experts,

There are some layer 2 octet count IEs, but no layer 2 frame count IE.

Is it acceptable to report the number of layer 2 frames with Information 
Element #2 "packetDeltaCount" ?

If not, then I'll request new delta + total IEs.

Thanks,
P.

---

From: Andrew Feren <[email-masked]>
Date: Fri, 18 Apr 2014 17:44:29 -0400

Hi Paul,

On 04/18/2014 05:30 PM, Paul Aitken wrote:
> Is it acceptable to report the number of layer 2 frames with
> Information Element #2 "packetDeltaCount" ?

Seems OK to me.  At least I don't see what new information two new IES
would communicate.

Is there a situation where a hypothetical  flow with both
packetDeltaCount(2) and frameDeltaCount(#TBD) would have different values?

-Andrew

> _______________________________________________
> IPFIX mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipfix

---

From: Paul Aitken <[email-masked]>
Date: Fri, 18 Apr 2014 22:50:28 +0100

Andrew,

> packetDeltaCount(2) and frameDeltaCount(#TBD) would have different values?

If any of the observed layer 2 frames don't contain layer 3 packets, 
frameDeltaCount would be > packetDeltaCount.

P.

---

From: Brian Trammell <[email-masked]>
Date: Sat, 19 Apr 2014 09:04:01 +0200

hi Paul, all,

Given that we did the same thing with transportPacketDeltaCount (i.e. only packets with transport layer content), where (for TCP) transportPacketDeltaCount < packetDeltaCount less bare SYNs/ACKs (or other transport layer control), it makes a lot of sense to have new frame count IEs.

We'd probably want the description to note that this should only be exported by EPs attached to MPs that can actually see layer 2 (i.e., that aren't working only on the IP layer and above)... though on second thought that's a little obvious...

For naming, layer2PacketDeltaCount would be more consistent with other IE naming, but I think frameDeltaCount is a better, more precise name. So I'm good with either actually.

Thanks, cheers,

Brian

On 18 Apr 2014, at 23:50, Paul Aitken <[email-masked]> wrote:

> Andrew,
> 
>> Is there a situation where a hypothetical flow with both packetDeltaCount(2) and frameDeltaCount(#TBD) would have different values?
> 
> If any of the observed layer 2 frames don't contain layer 3 packets, frameDeltaCount would be > packetDeltaCount.
> 
> P.
>