Re: multiple flows in one sflow packet ?

Hello Ashok,

A single sFlow datagram may have multiple flow-samples and/or
counter-samples in it.

 From the spec ( http://sflow.org/SFLOW-DATAGRAM5.txt ) the definition
of "sample_datagram_v5" includes an array of type "sample_record".
Each sample_record is a tag-length-value field. These fields can be
flow-samples or counter-samples (or anything else the vendor wants to
tag and include there).

  If you are looking at the sflowtool.c source code ( see under
sflowtool on http://www.inmon.com/technology/sflowVersion5.php ) the
function "readSFlowDatagram()" shows some example code for unpacking.
The powerpoint slides that describe the example agent source code (on
the same page) include illustrations that might be helpful too.

Note that nested within a flow-sample there can be multiple
tag-length-value structures. Typically you will see the sampled packet
header as one of these, along with others indicating more about what
happened to that particular packet as it traversed the switch/router.
Vendor extensions are allowed here too, so you should always be ready
to skip over something that has a tag you don't recognize.

The standard states that a sample should not languish for more than a
second on the agent before being sent out, so typically you will only
see multiple flow-samples in one datagram when the packet rate through
the switch/router exceeds the configured sampling rate.

Is this clear?

regards,
neil

On Mar 28, 2005, at 9:07 PM, Ashok Mandala wrote:

> Hello,
>
> I am trying to add sflow collection capability in our
> collector that already collects netflow and was
> wondering if a single sflow datagram packet received
> by the collector can contain information on multiple
> flows ? (Netflow V5 allows upto 30 flows to be
> reported in one netflow packet).
>
> Looking at sflowtool.c , it doesn't seem like there
> can be multiple flows in one sflow packet. Am I right
> in making this assumption ?
>
> Thank you in advance.
>
> Ashok
>
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Small Business - Try our new resources site!
> http://smallbusiness.yahoo.com/resources/
>
>
----------
Neil McKee
http://www.inmon.com
Received on Tue Mar 29 03:37:51 2005