[prev in list] [next in list] [prev in thread] [next in thread] 

List:       openvswitch-discuss
Subject:    [ovs-discuss] How to change sflow sampleType_tag
From:       neil.mckee () inmon ! com (Neil McKee)
Date:       2015-02-24 21:47:51
Message-ID: CAB1FvaKxtiQAfKH8irkdVciYxam0mXoz1-yzzfg7+J5DY4CXbQ () mail ! gmail ! com
[Download RAW message or body]

Sorry for the slow response.

The answer is to add more decoding at the collector.   You could refer to
the "sflowtool" source code for a simple example.

The "struct sampled_ipv4" record (flow sample type 0:3) is only there in
case there is a device somewhere that has that decoded information,  but
somehow cannot access the original packet that was sampled  (believe it or
not,  there was a router once that found itself in this unlikely
predicament).   Since OVS has the original packet it is required to export
that instead.  Much better.  This is how the simplest layer-2 switch can
provide visibility into higher-layers, tunnels, complex relationships etc.
without having to do anything more than sample packets in a stateless way.

In fact,  when OVS sends samples up from the kernel to sFlow it does rather
more packet-decoding work that it strictly needs to.   We could trim a few
cycles there,  but it's hardly worth changing because it only happens for
sampled packets and typical sampling rates are of the order of 1:1000.

Regards,
Neil




------
Neil McKee
InMon Corp.
http://www.inmon.com

On Tue, Feb 17, 2015 at 11:34 AM, Ben Pfaff <blp at nicira.com> wrote:

> I'm adding Neil McKee, who knows much more about sflow than I do.
>
> On Tue, Feb 17, 2015 at 07:28:33PM +0200, George Shuklin wrote:
> > We're playing with sFlow features of OVS. We want to collect sflow
> > with em-sflow <https://github.com/normelton/em-sflow> library (ruby,
> > ttps://github.com/normelton/em-sflow
> > <https://github.com/normelton/em-sflow>). Unfortunately it can not
> > process received sflow packets deep enough.
> >
> > After some research I found there are few types of sFlow packes,
> > with different structure. As far as I understand it parse payload
> > only for the sampleType_tag 0:3, but it leaves unprocessed header in
> > sampleType_tag 0:1 (which is fine according to specs).
> >
> > Is any way to configure OVS to send sFlow samples of type 3?
>
> I don't think OVS has knobs like that.  It's not obvious to me whether
> the correct solution here is to improve the library you're using or to
> change OVS to do something different.  Neil?
>
> Thanks,
>
> Ben.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://openvswitch.org/pipermail/discuss/attachments/20150224/121b2dbe/attachment.html>

[prev in list] [next in list] [prev in thread] [next in thread]