Re: sFlow parsing troubles...

From: Elisa Jasinska <>
Date: 11/23/06
Message-Id: <>


On Nov 23, 2006, at 8:37 PM, Mandip S Sangha wrote:
> Is there documentation to tell us at what byte within the
> headerBytes to find
> srcIP, dstIP IPProtocol, IPTOS, TCPSrcPort, TCPDstPort?

That is, like the name says, a raw packet header, so you have to look
into how the headers of an ethernet frame look like (IP, TCP, etc.).

> Also where in this data is the actual bytes transfered by each of
> the flows?

'Flow' is a bit incorrect in case of sFlow, because it's actually not
showing you flows (like NetFlow does) but packet samples. You can
find out the packet size by looking into the length field of the IP


Elisa Jasinska - AMS-IX NOC
Received on Thu Nov 23 14:55:59 2006

This archive was generated by hypermail 2.1.8 : 11/23/06 PST