2.2.6.3 QosCounterResult Upper-Level Header Format

  • Article

A responder sends a QosCounterResult frame to a cross-traffic analysis initiator in response to a QosCounterSnapshot frame.

At most, each QosCounterResult frame reports as many full 4-tuple snapshots (see Snapshot_List definition following the QosCounterResult header illustration) as are requested in the preceding QosCounterSnapshot request. The sub-second snapshot (section 3.8.5.2) is also returned in the QosCounterResult frame.

The QosCounterResult header immediately follows the Base header, and it MUST have the following format.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

Subsecond_Span

Byte_Scale

Packet_Scale

History_Size

Snapshot_List (variable)

...

Subsecond_Span (1 byte): This field specifies the time span (expressed as 1/256ths of a second) since the last sampling interval, taken at the time that the QosCounterSnapshot request is received. A value of zero means that the time span is less than 1/256 of a second (approximately 3.9 milliseconds).

Byte_Scale (1 byte): This field's value MUST be in the range 0 to 255, where a value of n indicates that all byte counters are expressed in units of (n+1) kilobytes.

Packet_Scale (1 byte): This field's value MUST be in the range 0 to 255, where a value of n indicates that all packet counters are expressed in units of (n+1) packets.

History_Size (1 byte): This field specifies the number of full 4-tuples that the responder can return. This number MUST NOT include the sub-second snapshot that is taken when the QosCounterSnapshot request is received (section 3.8.5.2).

Snapshot_List (variable):  This field MUST include the 4-tuple snapshots that were counted by the History Size field, plus the sub-second snapshot. Entries in the snapshot list MUST be arranged starting with the oldest 4-tuple snapshot and ending with the sub-second 4-tuple snapshot.

Each snapshot has the following format.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

Bytes_Received

Packets_Received

Bytes_Sent

Packets_Sent

Note A 1,500-byte Ethernet frame is large enough to fit 184 entries, which is more than 3 minutes of historical data.