Re: multiple flows in one sflow packet ?

Thanks Neil. That helps a lot.

- Ashok

--- Neil McKee <neil.mckee@inmon.com> wrote:
> Hello Ashok,
>
> A single sFlow datagram may have multiple
> flow-samples and/or
> counter-samples in it.
>
> From the spec (
> http://sflow.org/SFLOW-DATAGRAM5.txt ) the
> definition
> of "sample_datagram_v5" includes an array of type
> "sample_record".
> Each sample_record is a tag-length-value field.
> These fields can be
> flow-samples or counter-samples (or anything else
> the vendor wants to
> tag and include there).
>
> If you are looking at the sflowtool.c source code
> ( see under
> sflowtool on
> http://www.inmon.com/technology/sflowVersion5.php )
> the
> function "readSFlowDatagram()" shows some example
> code for unpacking.
> The powerpoint slides that describe the example
> agent source code (on
> the same page) include illustrations that might be
> helpful too.
>
> Note that nested within a flow-sample there can be
> multiple
> tag-length-value structures. Typically you will see
> the sampled packet
> header as one of these, along with others indicating
> more about what
> happened to that particular packet as it traversed
> the switch/router.
> Vendor extensions are allowed here too, so you
> should always be ready
> to skip over something that has a tag you don't
> recognize.
>
> The standard states that a sample should not
> languish for more than a
> second on the agent before being sent out, so
> typically you will only
> see multiple flow-samples in one datagram when the
> packet rate through
> the switch/router exceeds the configured sampling
> rate.
>
> Is this clear?
>
> regards,
> neil
>
>
> On Mar 28, 2005, at 9:07 PM, Ashok Mandala wrote:
>
> > Hello,
> >
> > I am trying to add sflow collection capability in
> our
> > collector that already collects netflow and was
> > wondering if a single sflow datagram packet
> received
> > by the collector can contain information on
> multiple
> > flows ? (Netflow V5 allows upto 30 flows to be
> > reported in one netflow packet).
> >
> > Looking at sflowtool.c , it doesn't seem like
> there
> > can be multiple flows in one sflow packet. Am I
> right
> > in making this assumption ?
> >
> > Thank you in advance.
> >
> > Ashok
> >
> >
> >
> > __________________________________
> > Do you Yahoo!?
> > Yahoo! Small Business - Try our new resources
> site!
> > http://smallbusiness.yahoo.com/resources/
> >
> >
> ----------
> Neil McKee
> http://www.inmon.com
>
>

                
__________________________________
Do you Yahoo!?
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/
Received on Tue Mar 29 06:00:56 2005