It is possible, through IPFIX, take each size packet in a flow? It seems to exist only the sum of the sizes and the number of packets.
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.– Ron Maupin ♦Commented Aug 16, 2017 at 21:38
Add a comment
|
1 Answer
The premise of the protocol is to provide flow-level telemetry information. As such the specific size of each packet isn't really in-scope. For reference a full list of fields potentially captured in IPFIX can be found here.
That said - you can obviously get a pretty good idea by taking the average size of a packet (total flow volume / number of packets) during a given interval. From a statistical point of view this is generally more than sufficient for capacity planning/traffic characterization purposes. It's also generally find for [D]DoS detection as a relative drop in average packet size compared with growth in total packets is trivial to alert on.
The thing to remember is that there are some pretty stark limitations that show up at the scale of PPS on 10, 40 and 100GE links and the only way to realistically address these is to both statistically sample and aggregate information. This unfortunately implies a necessary loss of granularity in the service of maintaining visibility at scale. The good news is that there are some novel mechanisms emerging to allow for much deeper traffic analysis. The bad news is that these will likely be substantially different than what's seen with IPFIX/Netflow/sFlow.
