[ovs-discuss] OVS - Netflow/IPFix export of custom metadata.

Peter Phaal peter.phaal at inmon.com
Fri Sep 13 14:04:41 UTC 2019


> On Sep 13, 2019, at 4:45 AM, Rajesh Kumar <rajesh.kumar at certesnetworks.com> wrote:
> The inbuilt OVS netflow export feature seems to export the 5 basic info present in the packet  (src dst mac,src dst IP, port).
> Is there any option to export other data present in a packet.
> 
> Without OVS, I was able to do netflow export using a tool called pmacctd. It supported exporting basic netflow data and custom metadata (this was present as part of the packet itself at specific byte location). There was a way to specify custom data with packet pointer bytes, length in pmacctd tool. Just wanted to check whether any such option in current OVS setup.
> 

You may want to consider enabling sFlow. The OVS implementation exports sampled packet headers, packet metadata, and streams counter telemetry. 

A simple way to configure OVS sFlow in production is to install the open source Host sFlow agent (sflow.net) and enable the ovs {} module. The Host sFlow will augment the sFlow telemetry stream with a standard set host metrics (https://sflow.org/sflow_host.txt <https://sflow.org/sflow_host.txt>).

sflowtool is a simple command line utility that you can use to examine the contents of the sFlow telemetry stream (and can convert the sFlow to NetFlow/IPFIX) https://github.com/sflow/sflowtool <https://github.com/sflow/sflowtool>

If you have Docker installed, then it is a convenient way to run sflowtool: https://blog.sflow.com/2019/09/running-sflowtool-using-docker.html <https://blog.sflow.com/2019/09/running-sflowtool-using-docker.html>

For detailed packet analysis you can run the stream of captured packet headers through a packet analyzer: https://blog.sflow.com/2019/09/packet-analysis-using-docker.html <https://blog.sflow.com/2019/09/packet-analysis-using-docker.html>

Peter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openvswitch.org/pipermail/ovs-discuss/attachments/20190913/658c8c1c/attachment.html>


More information about the discuss mailing list