Collection with sFlow

[nicolasfr49]

Hello,

I Would like to know If It was as possible to recover the tag mpls In sFlow flow with sfcapd daemon of nfdump ??

Thank you for your answer.

[noa-appletech]

Hello,

You can try enabling extensions. See: https://sourceforge.net/p/nfsen/mailman/message/32171818/

Nick

[nicolasfr49]

Your answer is for nfcapd (netflow) but for me it's sfcapd (sflow).
How to extract the tag mpls with sfcapd daemon ?

Thanks.

[noa-appletech]

According to https://sourceforge.net/p/nfdump/mailman/message/32916245/ you should be able to capture such data using "-T all". If not, it seems the above never underwent troubleshooting, and you should provide "a few minutes of packet dump" to the author, who might find an opportunity to fix things.

[nicolasfr49]

Other question, How to contact the development team for nfdump/nfsen ?

[noa-appletech]

I guess the developer/author, Dr Peter Haag, is watching these comments. Furthermore, you may want to subscribe to the (low-volume) nfdump-discuss mailing list.

[phaag]

Right - just post your requests here. I am a bit busy right now, so it could take some time.
.. and .. btw no Dr. !! :)

[nicolasfr49]

Ok thanks for your answer.
Mr P.Haag, how extract the mpls tag in sFlow frames with NFDUMP and NFSEN ? Today, the daemon sfcapd does not allow this extraction. Is what is expected in future updates to the product ?

[phaag]

I am afraid, but right now, sfcapd does not support mpls. The reason for that is, that I have no trails to test. If sflow supports certain fields, which are not implemented, pls collect some traffic in a pcap, sent to the collector, and send me this pcap. So I can update the collector to these features.
Peter

[phaag]

Any possibility to share a pcap containing sflow records mpls? Otherwise I close the ticket.

[phaag]

sflow code has been updated to commit 7322984 of https://github.com/sflow/sflowtool

[phaag]

In the latest master commit, sfcapd now unwarps correctly the mpls stack and add the labels into nfdump records.