Re: sFlow parsing troubles...

Hi,

On Nov 23, 2006, at 8:37 PM, Mandip S Sangha wrote:
> Is there documentation to tell us at what byte within the
> headerBytes to find
> srcIP, dstIP IPProtocol, IPTOS, TCPSrcPort, TCPDstPort?

That is, like the name says, a raw packet header, so you have to look
into how the headers of an ethernet frame look like (IP, TCP, etc.).

>
> Also where in this data is the actual bytes transfered by each of
> the flows?

'Flow' is a bit incorrect in case of sFlow, because it's actually not
showing you flows (like NetFlow does) but packet samples. You can
find out the packet size by looking into the length field of the IP
header.

Cheers

--
Elisa Jasinska - AMS-IX NOC
http://www.ams-ix.net