sflowtool doesn't process QinQ sampled packets appropriately

[Xagen00]

If the sampled traffic has QinQ (802.1ad and 802.1q) the fields inside the inner vlan in the sample are missing. The fields listed below are ones that I see in regular ipv4 traffic if there is a single vlan present or not:

IPSize
ip.tot_len
srcIP
dstIP
IPProtocol
IPTOS
IPTTL
TCPSrcPort
TCPDstPort
TCPFlags

Once you have and outer vlan, inner vlan, then ip information, the sample no longer has these fields.

[Xagen00]

Just to clarify, the information is present in the traffic (I've verified in a PCAP) that is going into the sflowtool, but the tools output no longer has this information.

[sflow]

Thank you for pointing this out. The packet-decoder in sflowtool is rudimentary: there are dozens of common protocols with thousands of useful fields that we should probably add decodes for. We usually suggest it as an exercise for the user but this one seems worth the effort though because it's necessary just to get to layer3.

I just have one question: in the capture that you have, does the outer (first) tag appear as 0x88A8 (S-TAG) or 0x8100 (C-TAG) or 0x9100 (legacy)?

[Xagen00]

The outer vlan is showing as 0x8100, the inner vlan is showing as 0x0800.

[sflow]

The 0x0800 means "IPv4". I'm interested in the preceding 802.1AD and QinQ ethertype numbers. It sounds like the second one is 0x8100 -- that's expected -- but I'm curious to know if the first one is 0x8100 too. If in doubt, please reply with a hexdump of the packet.

[Xagen00]

You'll find a raw hexdump of the sampled packet header for traffic that isn't sampled appropriately attached below. Please let me know if anything else would help.
sFlow_QinQ.zip

[sflow]

Thanks.

As a test, does it work if you change "if" to "while" on this line:
https://github.com/sflow/sflowtool/blob/master/src/sflowtool.c#L1344

[Xagen00]

It does indeed. I'm getting proper samples now.

[Xagen00]

Is that what you're going to go with for the final fix?

[sflow]

That was just a test. I just checked in what should hopefully be the final fix. Please "git pull" and confirm that this works for you. You should see the outer VLAN announced as "decodedVLAN" and the inner VLAN announced as "decodedVLAN.1".

[sflow]

I believe this is fixed in 5.05.