search

Edgio / vflow

Enterprise Network Flow Collector (IPFIX, sFlow, Netflow)
http://www.verizonmedia.com
Apache License 2.0
1.07k stars 226 forks source link

Support sflow Cisco Nexus #113

Open meatlayer opened 5 years ago

meatlayer commented 5 years ago

Hey. sflow data not decoded from the device Cisco Nexus Question. Planned to support devices in this series?

The same issues:

55 #53

changkyu-kim commented 4 years ago

Hello,

You have attached a pcap file in the issue #55. Is this the correct pcap for Cisco Nexus sflow issue? We will look into the issue if that is the correct pcap.

Thank you.

canghai908 commented 3 years ago

I have same problems.

[vflow] 2020/10/22 15:11:03 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 484 bytes
[vflow] 2020/10/22 15:11:05 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 484 bytes
[vflow] 2020/10/22 15:11:08 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 436 bytes
[vflow] 2020/10/22 15:11:11 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 540 bytes
[vflow] 2020/10/22 15:11:12 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 444 bytes
[vflow] 2020/10/22 15:11:13 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 428 bytes
[vflow] 2020/10/22 15:11:14 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 224 bytes
[vflow] 2020/10/22 15:11:16 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 288 bytes
[vflow] 2020/10/22 15:11:17 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 288 bytes
[vflow] 2020/10/22 15:11:18 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 532 bytes
[vflow] 2020/10/22 15:11:19 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 460 bytes
[vflow] 2020/10/22 15:11:20 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 696 bytes
[vflow] 2020/10/22 15:11:23 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 232 bytes
[vflow] 2020/10/22 15:11:24 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 288 bytes
[vflow] 2020/10/22 15:11:25 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 288 bytes
[vflow] 2020/10/22 15:11:26 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 256 bytes
[vflow] 2020/10/22 15:11:29 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 224 bytes
[vflow] 2020/10/22 15:11:30 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 484 bytes
[vflow] 2020/10/22 15:11:31 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 224 bytes
[vflow] 2020/10/22 15:11:36 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 224 bytes
[vflow] 2020/10/22 15:11:37 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 232 bytes
[vflow] 2020/10/22 15:11:40 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 240 bytes
[vflow] 2020/10/22 15:11:41 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 428 bytes
[vflow] 2020/10/22 15:11:44 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 696 bytes
[vflow] 2020/10/22 15:11:45 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 672 bytes
[vflow] 2020/10/22 15:11:47 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 224 bytes
[vflow] 2020/10/22 15:11:48 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 664 bytes
[vflow] 2020/10/22 15:11:49 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 420 bytes
[vflow] 2020/10/22 15:11:50 sflow.go:186: rcvd sflow data from: 123.103.121.202:60000, size: 232 bytes

this is the cap bb.cap.zip

ttrading commented 3 years ago

Are there any updates on this issue? We are having the same problem with Cisco Nexus 3K. We see expanded sflow packets coming in but vflow is not processing them. Please let me know if you need any pcaps.

Is it safe to assume that vflow only support compact sflow?

Thanks

jansyren commented 3 years ago

Hi, I have access to a bunch of Nexus 9k series switches that I think will benefit from this patch as well. I will try and patch the files and compile and see if it will decode our sflow data. Unfortunately I can't provide and pcap right now, maybe once I get a traffic generator going that I can share the sflow from.