RE: parsing sflow question (sflowtool.c vs spec)

The SFLOW-DATAGRAM5.txt file contains the structure definitions for the
sFlow datagram, but it doesn't describe the transfer encoding. If you look
at the full sFlow specification (http://www.sflow.org/sflow_version_5.txt)
you will see that sFlow uses XDR to encode these structures (see
http://www.ietf.org/rfc/rfc1832.txt).

The when using XDR to encode a variable length array:
sample_record samples<>;
you need to insert the length of the array as an unsigned 32 bit integer
before transmitting the array contents.

When sending a variable length opaque you also need to insert the length
before sending the content:
opaque sample_data<>;

Peter

-----Original Message-----
From: owner-sflow@sflow.org [mailto:owner-sflow@sflow.org] On Behalf Of Mike
Haberman
Sent: Sunday, September 10, 2006 9:56 PM
To: sflow@sflow.org
Cc: mikeh@ncsa.edu
Subject: [sFlow] parsing sflow question (sflowtool.c vs spec)

Hi,

    I am writing a Java based parser for sFlows. I am having a problem
    resolving what sflowtool.c does and what the SFLOW-DATAGRAM5.txt
    shows.

    1. When sflowtool.c reads in a sample datagram, it does

        ...
       sample->sequenceNo = getData32(sample);
       sample->sysUpTime = getData32(sample);
       samplesInPacket = getData32(sample);

       Where samplesInPacket is even described in SFLOW-DATAGRAM5.txt. ?

     2. When sflowtool.c dispatchs on the sample type ...

       switch(sample->sampleType) {
       case SFLFLOW_SAMPLE: readFlowSample(sample, NO); break;
       case SFLCOUNTERS_SAMPLE: readCountersSample(sample, NO); break;
       case SFLFLOW_SAMPLE_EXPANDED: readFlowSample(sample, YES); break;
       case SFLCOUNTERS_SAMPLE_EXPANDED: readCountersSample(sample, YES);
break;

         Each of those functions first does a read to get the sample length:

          sampleLength = getData32(sample);
          sample->samplesGenerated = getData32(sample);

        Where is sampleLength described in SFLOW-DATAGRAM5.txt ?
         

      I must not be reading something properly.. Thanks to anyone
      who can set me straight.

      thanks

      mike

-- 
----------------------------------
Mike Haberman
Senior Network Research Engineer
NCSA
----------------------------------