[ovs-discuss] OVS - Netflow/IPFix export of custom metadata.

Peter Phaal peter.phaal at inmon.com
Fri Sep 13 14:04:41 UTC 2019

> On Sep 13, 2019, at 4:45 AM, Rajesh Kumar <rajesh.kumar at certesnetworks.com> wrote:
> The inbuilt OVS netflow export feature seems to export the 5 basic info present in the packet  (src dst mac,src dst IP, port).
> Is there any option to export other data present in a packet.
> Without OVS, I was able to do netflow export using a tool called pmacctd. It supported exporting basic netflow data and custom metadata (this was present as part of the packet itself at specific byte location). There was a way to specify custom data with packet pointer bytes, length in pmacctd tool. Just wanted to check whether any such option in current OVS setup.

You may want to consider enabling sFlow. The OVS implementation exports sampled packet headers, packet metadata, and streams counter telemetry. 

A simple way to configure OVS sFlow in production is to install the open source Host sFlow agent (sflow.net) and enable the ovs {} module. The Host sFlow will augment the sFlow telemetry stream with a standard set host metrics (https://sflow.org/sflow_host.txt <https://sflow.org/sflow_host.txt>).

sflowtool is a simple command line utility that you can use to examine the contents of the sFlow telemetry stream (and can convert the sFlow to NetFlow/IPFIX) https://github.com/sflow/sflowtool <https://github.com/sflow/sflowtool>

If you have Docker installed, then it is a convenient way to run sflowtool: https://blog.sflow.com/2019/09/running-sflowtool-using-docker.html <https://blog.sflow.com/2019/09/running-sflowtool-using-docker.html>

For detailed packet analysis you can run the stream of captured packet headers through a packet analyzer: https://blog.sflow.com/2019/09/packet-analysis-using-docker.html <https://blog.sflow.com/2019/09/packet-analysis-using-docker.html>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openvswitch.org/pipermail/ovs-discuss/attachments/20190913/658c8c1c/attachment.html>

More information about the discuss mailing list