[ovs-discuss] Questions about IPFIX

[Greg Rose]

On 06/21/2017 05:21 AM, Felix Konstantin Maurer wrote:
> Hi Greg,
>
> Just a small update. I tried to find the problem myself, and it seems to
> me that there is only ever one packet received per sampling period.
> In dpif_ipfix_bridge_sample there is:
>
> 2113 /* Use the sampling probability as an approximation of the number
> 2114  * of matched packets. */
> 2115 packet_delta_count = UINT32_MAX / di->bridge_exporter.probability;
>
> which is why the IPFIX packet contains a number of packets greater than
> one, even though only one is received by vswitch.
>
> So my guess would be (I don't really know how openvswitch works) that
> the kernel module only ever sends one packet per configured sampling period?
>
> Regards
> Felix

Argh... I keep wanting to get back to this but events conspire to prevent me.

In fact, at the point I left off working on IPFIX I felt that there were issues that
prevented it from working correctly with the IPFIX collector I was using.  Finally,
I switched to wireshark to decode the packets and noticed some thing I couldn't
explain to myself there as well.  That being said, I am new to the IPFIX code in
OVS and might not be the best person to say for sure what is working right or
not.  But I never did get it working well enough for a collector to recognize it.

I still have a higher priority issue that I have to put all my time into right now
but I hope to get back to this and I do appreciate the time you've put into
this.  It has been helpful for sure!

Thanks and regards,

- Greg

>
> On 06/08/2017 10:32 PM, Greg Rose wrote:
> > On 06/06/2017 05:18 AM, Felix Konstantin Maurer wrote:
> >> I accidentally only responded to you, so here again what I wrote.
> >> Thanks for the quick response! If tested it now but so far I see no
> >> difference. All IPFIX packets have the same flowStartDelta and
> >> flowEndDelta.
> >>
> >> Furthermore, about the first lines in ipfix_cache_aggregate_entries?
> >>
> >> line 1457
> >>       to_start = &to_entry->flow_start_timestamp_usec;
> >>       to_end = &to_entry->flow_end_timestamp_usec;
> >>       from_start = &from_entry->flow_start_timestamp_usec;
> >>       from_end = &from_entry->flow_end_timestamp_usec;
> >>
> >>       if (*to_start > *from_start) {
> >>           *to_start = *from_start;
> >>       }
> >>       if (*to_end < *from_end) {
> >>           *to_end = *from_end;
> >>       }
> >>
> >> Is that not supposed to update the timestamps of the old entry, into
> >> which the new stats are merged?
> >>
> >> Regards
> >> Felix
> >>
> >
> > Felix,
> >
> > I've been doing further testing on this and noticed that the code in the
> > patch I
> > submitted is never even being touched.
> >
> > I'm debugging it but I am also working on some other bugs.  I'll work on
> > this as I
> > find time to do so.
> >
> > Thanks,
> >
> > - Greg
>