Showing posts with label sFlow. Show all posts
Showing posts with label sFlow. Show all posts

Wednesday, February 27, 2013

[sFlow] Use sflowtool to parse sFlow datagram

In order to test and understand sFlow more in details, I prepare the following environment below. Switch 1 and 2 are emulated using Open vSwitch. In the previous sFlow article, there is a sFlow setting on Open vSwitch. Please check it out.

            192.168.12.201           10.3.207.244           192.168.12.202
            +------------+        +-----------------+       +------------+
            |  PC1       |        | sFlow Collector |       |  PC2       |
            |            |        |                 |       |            |
            |            |        |                 |       |            |
            +-----+------+        +---^--------^----+       +-----+------+
                  |                   |        |                  |
                  |                   |        |                  |
                  |                   ^ sFlow  ^                  |
                  +---------+         | Data   |       +----------+
                            |         ^        ^       |
                            |         |        |       |
                            |         ^        ^       |
                            |         |        |       |
                   +--------+---------++      ++-------++---------+
                   |    Switch 1       |      |   Switch 2        |
                   | 10.3.207.142      +------+ 10.3.207.143      |
                   +-------------------+      +-------------------+

sFlowtool is an open source toolkit for us to leverage the functionality of parsing sFlow datagram. In my environment, when I ping PC2 from PC1, then Switch 1 and 2 will send sFlow Counter and Flow Sample datagram to the sFlow collector. Now, I will use sFlowtool to parse  the information that it gets.

> ./sflowtool
Counter Sample:startDatagram =================================
datagramSourceIP 0.0.0.0
datagramSize 144
unixSecondsUTC 1359534209
datagramVersion 5
agentSubId 0
agent 10.3.207.142
packetSequenceNo 403
sysUpTime 947000
samplesInPacket 1
startSample ----------------------
sampleType_tag 0:2
sampleType COUNTERSSAMPLE
sampleSequenceNo 95
sourceId 0:4
counterBlock_tag 0:1
ifIndex 4
networkType 6
ifSpeed 1000000000
ifDirection 1
ifStatus 3
ifInOctets 126361
ifInUcastPkts 1072
ifInMulticastPkts 0
ifInBroadcastPkts 4294967295
ifInDiscards 0
ifInErrors 0
ifInUnknownProtos 4294967295
ifOutOctets 137350
ifOutUcastPkts 1135
ifOutMulticastPkts 4294967295
ifOutBroadcastPkts 4294967295
ifOutDiscards 0
ifOutErrors 0
ifPromiscuousMode 0
endSample   ----------------------
endDatagram   =================================
startDatagram =================================
datagramSourceIP 0.0.0.0
datagramSize 144
unixSecondsUTC 1359534210
datagramVersion 5
agentSubId 0
agent 10.3.207.244
packetSequenceNo 404
sysUpTime 948000
samplesInPacket 1
startSample ----------------------
sampleType_tag 0:2
sampleType COUNTERSSAMPLE
sampleSequenceNo 95
sourceId 0:5
counterBlock_tag 0:1
ifIndex 5
networkType 6
ifSpeed 100000000
ifDirection 2
ifStatus 1
ifInOctets 0
ifInUcastPkts 0
ifInMulticastPkts 0
ifInBroadcastPkts 4294967295
ifInDiscards 0
ifInErrors 0
ifInUnknownProtos 4294967295
ifOutOctets 0
ifOutUcastPkts 0
ifOutMulticastPkts 4294967295
ifOutBroadcastPkts 4294967295
ifOutDiscards 0
ifOutErrors 0
ifPromiscuousMode 0
endSample   ----------------------
endDatagram   =================================

Flow Sample:startDatagram =================================
datagramSourceIP 10.3.207.244
datagramSize 216
unixSecondsUTC 1359597631
datagramVersion 5
agentSubId 0
agent 10.3.207.142
packetSequenceNo 941
sysUpTime 2174000
samplesInPacket 1
startSample ----------------------
sampleType_tag 0:1
sampleType FLOWSAMPLE
sampleSequenceNo 72
sourceId 0:4
meanSkipCount 64
samplePool 4010
dropEvents 0
inputPort 4
outputPort 3
flowBlock_tag 0:1001
extendedType SWITCH
in_vlan 0
in_priority 0
out_vlan 0
out_priority 0
flowBlock_tag 0:1
flowSampleType HEADER
headerProtocol 1
sampledPacketSize 102
strippedBytes 4
headerLen 98
headerBytes 00-AB-77-E3-4B-00-00-AB-71-13-2D-00-08-00-45-00-00-54-00-00-40-00-40-01-9F-C5-C0-A8-0C-CA-C0-A8-0C-C9-08-00-C4-0E-55-06-08-57-28-96-AD-FD-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
dstMAC 00ab77e34b00
srcMAC 00ab71132d00
IPSize 84
ip.tot_len 84
srcIP 192.168.12.202
dstIP 192.168.12.201
IPProtocol 1
IPTOS 0
IPTTL 64
ICMPType 8
ICMPCode 0
endSample   ----------------------
endDatagram   =================================

If you use this, then you will get another format of data:
> ./sflowtool -l
Counter Sample:
CNTR,10.3.207.142,3,6,1000000000,1,3,112616,955,1,4294967295,0,0,4294967295,123043,1012,4294967295,4294967295,0,0,0

Flow Sample:
FLOW,10.3.207.142,4,3,00ab71132d00,00ab77e34b00,0x0800,0,0,192.168.12.202,192.168.12.201,1,0x00,64,0,0,0x00,102,84,64