Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Collection with sFlow #35

Closed
nicolasfr49 opened this issue Aug 8, 2016 · 11 comments
Closed

Collection with sFlow #35

nicolasfr49 opened this issue Aug 8, 2016 · 11 comments

Comments

@nicolasfr49
Copy link

Hello,

I Would like to know If It was as possible to recover the tag mpls In sFlow flow with sfcapd daemon of nfdump ??

Thank you for your answer.

@noa-appletech
Copy link

Hello,

You can try enabling extensions. See: https://sourceforge.net/p/nfsen/mailman/message/32171818/

Nick

@nicolasfr49
Copy link
Author

Your answer is for nfcapd (netflow) but for me it's sfcapd (sflow).
How to extract the tag mpls with sfcapd daemon ?

Thanks.

@noa-appletech
Copy link

According to https://sourceforge.net/p/nfdump/mailman/message/32916245/ you should be able to capture such data using "-T all". If not, it seems the above never underwent troubleshooting, and you should provide "a few minutes of packet dump" to the author, who might find an opportunity to fix things.

@nicolasfr49
Copy link
Author

Other question, How to contact the development team for nfdump/nfsen ?

@noa-appletech
Copy link

I guess the developer/author, Dr Peter Haag, is watching these comments. Furthermore, you may want to subscribe to the (low-volume) nfdump-discuss mailing list.

@phaag
Copy link
Owner

phaag commented Aug 12, 2016

Right - just post your requests here. I am a bit busy right now, so it could take some time.
.. and .. btw no Dr. !! :)

@nicolasfr49
Copy link
Author

Ok thanks for your answer.
Mr P.Haag, how extract the mpls tag in sFlow frames with NFDUMP and NFSEN ? Today, the daemon sfcapd does not allow this extraction. Is what is expected in future updates to the product ?

@phaag
Copy link
Owner

phaag commented Nov 19, 2016

I am afraid, but right now, sfcapd does not support mpls. The reason for that is, that I have no trails to test. If sflow supports certain fields, which are not implemented, pls collect some traffic in a pcap, sent to the collector, and send me this pcap. So I can update the collector to these features.
Peter

@phaag
Copy link
Owner

phaag commented Dec 27, 2017

Any possibility to share a pcap containing sflow records mpls? Otherwise I close the ticket.

@phaag
Copy link
Owner

phaag commented Dec 27, 2017

sflow code has been updated to commit 7322984 of https://github.com/sflow/sflowtool

@phaag
Copy link
Owner

phaag commented Apr 18, 2021

In the latest master commit, sfcapd now unwarps correctly the mpls stack and add the labels into nfdump records.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants