[ovs-discuss] OVS - Netflow/IPFix export of custom metadata.

Rajesh Kumar rajesh.kumar at certesnetworks.com
Fri Sep 13 14:09:48 UTC 2019


Thanks for the info Peter

________________________________
From: Peter Phaal <peter.phaal at inmon.com>
Sent: Friday, September 13, 2019 7:34:41 PM
To: Rajesh Kumar
Cc: ovs-discuss at openvswitch.org
Subject: Re: [ovs-discuss] OVS - Netflow/IPFix export of custom metadata.


On Sep 13, 2019, at 4:45 AM, Rajesh Kumar <rajesh.kumar at certesnetworks.com<mailto:rajesh.kumar at certesnetworks.com>> wrote:
The inbuilt OVS netflow export feature seems to export the 5 basic info present in the packet  (src dst mac,src dst IP, port).
Is there any option to export other data present in a packet.

Without OVS, I was able to do netflow export using a tool called pmacctd. It supported exporting basic netflow data and custom metadata (this was present as part of the packet itself at specific byte location). There was a way to specify custom data with packet pointer bytes, length in pmacctd tool. Just wanted to check whether any such option in current OVS setup.


You may want to consider enabling sFlow. The OVS implementation exports sampled packet headers, packet metadata, and streams counter telemetry.

A simple way to configure OVS sFlow in production is to install the open source Host sFlow agent (sflow.net<http://sflow.net>) and enable the ovs {} module. The Host sFlow will augment the sFlow telemetry stream with a standard set host metrics (https://sflow.org/sflow_host.txt).

sflowtool is a simple command line utility that you can use to examine the contents of the sFlow telemetry stream (and can convert the sFlow to NetFlow/IPFIX) https://github.com/sflow/sflowtool

If you have Docker installed, then it is a convenient way to run sflowtool: https://blog.sflow.com/2019/09/running-sflowtool-using-docker.html

For detailed packet analysis you can run the stream of captured packet headers through a packet analyzer: https://blog.sflow.com/2019/09/packet-analysis-using-docker.html

Peter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openvswitch.org/pipermail/ovs-discuss/attachments/20190913/6c7436ed/attachment.html>


More information about the discuss mailing list