Hi Philip,
On 01/11/2016 16:08, Philip Homburg wrote:
Did you consider not (partially) decoding the DNS payload and instead just
storing DNS payloads directly as binary blobs?
We did, and we entirely appreciate the advantages of having the binary.
But from a processing point of view, this seemed to us to be equivalent to
using PCAP. Our aim was to produce files that are as small as possible,
but while
consuming minimal machine resources. We expect files in our format to be
run through
general purpose compression. Our measurements indicated that compressing
raw PCAP
is much more expensive in terms of CPU and working set size, and
delivers files that
are still twice the size of our format after compression. We concluded that
any format shipping binary blobs would not meet our goals.
Another issue is to consider whether the format would benefit from local
extensions. For example, enrichtment of data according to local specifications.
If so, then BSON would be another format to consider.
We deliberately specified CBOR maps for most of the data structures to allow
other fields to be added, either in later versions or in local
modifications. We intend
that decoders should just ignored any fields they don't recognise.
We looked at a variety of binary forms, and I think I did at least look
briefly
at BSON. It didn't seem to have any major advantages over CBOR, though
obviously I may have missed something. We looked closer at Apache Avro
and Protocol
Buffers; Avro was the closest competition, but in the end did not offer any
significant advantage, so we went with the format with the IETF standard.
--
Jim Hague - j...@sinodun.com Never trust a computer you can't lift.
_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop
