[ovs-discuss] NetFlow/IPFIX documentation

[Graham, Mark]

I am experiencing something similar. I have tested OVS NetFlow with a bunch of collectors, and experienced no problems at all.

However I have not found a single collectors that supports IPFIX from OVS. Tcpdump and wireshark both show that IPFIX is on the wire. Several collectors will see the stream but omit the timestamp – which I guess is due to the IPFIX template being used?

Do you have any recommendations as to a collector please?

Many thanks
Mark


From: discuss [mailto:discuss-bounces at openvswitch.org] On Behalf Of Romain Lenglet
Sent: 29 October 2014 21:19
To: Martin Vizvary
Cc: discuss at openvswitch.org
Subject: Re: [ovs-discuss] NetFlow/IPFIX documentation

Is your problem that OVS doesn’t send any IPFIX message out?
Or is it that your IPFIX collector doesn’t do anything with the data it received from OVS?

Please give me the command(s) you’ve used to setup IPFIX export for your bridge.
That should be a straightforward one-liner.
Is there anything interesting in ovs-vswitchd's logs?

Also, please check with tcpdump or wireshark whether OVS actually sends IPFIX messages out.

OVS’s IPFIX templates are quite special, so I wouldn’t be surprised if your IPFIX collector didn’t support them.
--
Romain Lenglet


On October 29, 2014 at 12:33:25 PM, Martin Vizvary (vizvary at ics.muni.cz<mailto:vizvary at ics.muni.cz>) wrote:
Hi Romain,

well currently I am trying to export NetFlow and IPFIX. I have NetFlow
data but I can't start export IPFIX. So, I was looking for some more
docs than man pages...

And also I am curious about what is OVS supposed to do with flows when
is overloaded...

Martin

Dne 10/29/2014 06:35 PM, Romain Lenglet napsal(a):
> On October 29, 2014 at 1:02:39 AM, Martin Vizvary (vizvary at ics.muni.cz(mailto:vizvary at ics.muni.cz))<mailto:vizvary at ics.muni.cz(mailto:vizvary at ics.muni.cz))> wrote:
>> Hi,
>>
>> does anybody have any idea where can I find documentation about
>> implementation of NetFlow/IPFIX measurement in OVS?
>
> Hi Martin,
> We don’t have any formal docs AFAIK.
> The NetFlow and IPFIX exporters are implemented quite differently in OVS.
> What do you want to know?
> --
> Romain Lenglet
>

--
Martin Vizvary vizvary at ics.muni.cz<mailto:vizvary at ics.muni.cz>
Network Security Department http://ics.muni.cz/
Institute of Computer Science, Masaryk University, Brno, Czech Republic
PGP Key ID: 0x981AF964

-- 

World-leading research. The Government rated eight areas of our research activity as world-leading in the Research Assessment Exercise (RAE) 2008. They were Allied Health Professions and Studies, Art and Design, English Language and Literature, Geography and Environmental Studies, History, Music, Psychology, and Social Work and Social Policy and Administration.

This e-mail and any attachments are intended for the above named 
recipient(s)only and may be privileged. If they have come to you in 
error you must take no action based on them, nor must you copy or show 
them to anyone please reply to this e-mail to highlight the error and 
then immediately delete the e-mail from your system. Any opinions 
expressed are solely those of the author and do not necessarily 
represent the views or opinions of Anglia Ruskin University.
Although measures have been taken to ensure that this e-mail and attachments are 
free from any virus we advise that, in keeping with good computing 
practice, the recipient should ensure they are actually virus free. 
Please note that this message has been sent over public networks which 
may not be a 100% secure communications
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://openvswitch.org/pipermail/ovs-discuss/attachments/20141030/6dc03b1d/attachment-0002.html>