Thread Links Date Links
Thread Prev Thread Next Thread Index Date Prev Date Next Date Index

Re: [802.3AZ] about trace files



Rob,

Hays, Robert wrote:
> Mike,
>
> Your proposal looks good.  Removing payload and keeping the MAC, IP, TCP
> packet headers with corresponding time-stamps and frame lengths gives us
> enough information to model system/network performance vs. energy
> consumption (for LPI and subset PHY).
>
>   
Actually, with a capture length of 14 Bytes, you would only be able to 
tell what the network layer was using, e.g. IP, IPX, etc.  It sounds 
like you and Lachlan would like captures with enough of the header to 
get the transport layer.  That is reasonable, but it will take up more 
space. 

What do think of having text files with the time-stamps and frame sizes 
and if you need the actual pcap file you could get it from an archive?  
Just to give you a sense of the file sizes, I ran a 2-hr capture between 
11AM-1PM yesterday on a 10G link connecting two routers.  The resulting 
packet capture file , only capturing 14B, was 4 GB and I was able to 
reduce it to ~ 300 MB by creating a text file with delta time and frame 
size.  I received a comment suggesting 1-hr captures over a 24-hour 
period would be very useful.  I think that is a reasonable goal, but we 
may not be able to get that from everyone who is willing to contribute a 
trace.

> If possible, it might be valuable to collect some additional bytes from
> the payload for future study of the potential benefits of treating
> applications (e.g. HTTP, DNS, VOIP)differently via EEE policy decisions
> aligned with QoS priorities.  The TCP/IP headers won't be enough to
> infer the application but logging some number of bytes from the payload
> should allow us to reconstruct most of the application-layer headers
> without compromising data privacy.
>   
Also, as Ken pointed out, the ICIR tools are good.  I'm sure anyone who 
considers sharing their traces would likely want some way to make the 
trace available with minimum risk.  There are also dozens of 
switch-to-office traces at the same site: 
http://www.icir.org/enterprise-tracing/download.html  in case anyone is 
interested in using them.

If anyone would like the text file from my 2-hour capture yesterday,  
reply to me directly and I'll make it available to you.

Mike