<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p><span>Thanks for the info Peter</span><br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Peter Phaal <peter.phaal@inmon.com><br>
<b>Sent:</b> Friday, September 13, 2019 7:34:41 PM<br>
<b>To:</b> Rajesh Kumar<br>
<b>Cc:</b> ovs-discuss@openvswitch.org<br>
<b>Subject:</b> Re: [ovs-discuss] OVS - Netflow/IPFix export of custom metadata.</font>
<div> </div>
</div>
<div><br class="">
<div class="">
<div>
<blockquote type="cite" class="">
<div class="">On Sep 13, 2019, at 4:45 AM, Rajesh Kumar <<a href="mailto:rajesh.kumar@certesnetworks.com" class="">rajesh.kumar@certesnetworks.com</a>> wrote:</div>
<div class="">
<div id="divtagdefaultwrapper" dir="ltr" style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;" class="">
<div class="">The inbuilt OVS netflow export feature seems to export the 5 basic info present in the packet (src dst mac,src dst IP, port).<br class="">
Is there any option to export other data present in a packet.<br class="">
<br class="">
Without OVS, I was able to do netflow export using a tool called pmacctd. It supported exporting basic netflow data and custom metadata (this was present as part of the packet itself at specific byte location). There was a way to specify custom data with packet
pointer bytes, length in pmacctd tool. Just wanted to check whether any such option in current OVS setup.</div>
<div class=""><br class="">
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
<div class="">You may want to consider enabling sFlow. The OVS implementation exports sampled packet headers, packet metadata, and streams counter telemetry.
<div class=""><br class="">
</div>
<div class="">A simple way to configure OVS sFlow in production is to install the open source Host sFlow agent (<a href="http://sflow.net" class="">sflow.net</a>) and enable the ovs {} module. The Host sFlow will augment the sFlow telemetry stream with a standard
set host metrics (<a href="https://sflow.org/sflow_host.txt" class="">https://sflow.org/sflow_host.txt</a>).</div>
<div class=""><br class="">
</div>
<div class="">sflowtool is a simple command line utility that you can use to examine the contents of the sFlow telemetry stream (and can convert the sFlow to NetFlow/IPFIX) <a href="https://github.com/sflow/sflowtool" class="">https://github.com/sflow/sflowtool</a></div>
<div class=""><br class="">
</div>
<div class="">If you have Docker installed, then it is a convenient way to run sflowtool: <a href="https://blog.sflow.com/2019/09/running-sflowtool-using-docker.html" class="">https://blog.sflow.com/2019/09/running-sflowtool-using-docker.html</a></div>
<div class=""><br class="">
</div>
<div class="">For detailed packet analysis you can run the stream of captured packet headers through a packet analyzer: <a href="https://blog.sflow.com/2019/09/packet-analysis-using-docker.html" class="">https://blog.sflow.com/2019/09/packet-analysis-using-docker.html</a></div>
<div class=""><br class="">
</div>
<div class="">Peter</div>
</div>
</div>
</body>
</html>