Subject: [IPFIX] Question about tcpSequenceNumber, tcpAcknowledgementNumber, tcpUrgentPointer, tcpWindowSize

From: Hitoshi Irino <[email-masked]>
Date: Fri, 01 Dec 2006 19:00:56 +0900

Dear Jurgen, and all

I have a question about some IEs relate TCP, tcpSequenceNumber, 
tcpAcknowledgeNumber, tcpUrgentPointer, tcpWindowSize.
How do an exporter decide these values?
Exporter has several choices: first packet of TCP flow or last packet of 
TCP flow etc...
Are these values a difference between value of first packet and value of 
last packet(, or minimum and maximum)?

The descriptions of these IEs in IPFIX-INFO-14 do not provide these 
Information.
It is better to provide more description about value, I think.

regards,
Hitoshi Irino

-- 
Hitoshi Irino
NTT Network Service Systems Laboratories
9-11 Midori-cho 3-Chome, Musashino-shi, Tokyo 180-8585 Japan
Tel: +81-422-59-4403  Fax: +81-422-59-4549

_______________________________________________
IPFIX mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipfix

---

From: Andrew Johnson <[email-masked]>
Date: Fri, 01 Dec 2006 10:56:20 +0000

>From IPFIX INFO:
   If they do not serve as Flow Keys, their value may change from packet
   to packet within a single Flow.  For Information Elements with values
   that are derived from fields of packets or from packet treatment and
   for which the value may change from packet to packet within a single
   Flow, the IPFIX information model defines that their value is
   determined by the first packet observed for the corresponding Flow,
   unless the description of the Information Element explicitly
   specifies a different semantics.

Andrew

---

From: Andrew Johnson <[email-masked]>
Date: Fri, 01 Dec 2006 10:56:20 +0000

Andrew

---

From: Hitoshi Irino <[email-masked]>
Date: Fri, 01 Dec 2006 20:22:11 +0900

Dear Andrew and all,

Thank you for reply,
and I am sorry that I wrote "IPFIX-INFO-14 do not provide" by just 
reading description of these IEs (section 5.5.8-5.5.11).

Andrew Johnson wrote:
>> Exporter has several choices: first packet of TCP flow or last packet 
>> of TCP flow etc...
>> Are these values a difference between value of first packet and value 
>> of last packet(, or minimum and maximum)?
>>

regards,
Hitoshi Irino

---

From: Hitoshi Irino <[email-masked]>
Date: Fri, 01 Dec 2006 20:22:11 +0900

Dear Andrew and all,

Thank you for reply,

regards,
Hitoshi Irino

---

From: Paul Aitken <[email-masked]>
Date: Fri, 01 Dec 2006 12:12:19 +0000

Hitoshi,

> How do an exporter decide these values?

The Exporter doesn't decide the values at all. It's fed with data from 
the Metering Process.

-- 
Paul Aitken
Cisco Systems Ltd, Edinburgh, Scotland.

---

From: Paul Aitken <[email-masked]>
Date: Fri, 01 Dec 2006 12:12:19 +0000

Hitoshi,

---

From: Hitoshi Irino <[email-masked]>
Date: Sat, 02 Dec 2006 01:30:53 +0900

Dear Paul

> The Exporter doesn't decide the values at all. It's fed with data from 

Thanks, I have understood, however I wrote a sentence which makes 
confusion. I wanted to represent a device which contains exporting 
process and metering process.
I should write metering process instead of exporter.

regards,
Hitoshi Irino

---

From: Hitoshi Irino <[email-masked]>
Date: Sat, 02 Dec 2006 01:30:53 +0900

Dear Paul

regards,
Hitoshi Irino