Single port for all flow types?

netsampler / goflow2

High performance sFlow/IPFIX/NetFlow Collector

BSD 3-Clause "New" or "Revised" License

466 stars 110 forks source link

Single port for all flow types? #187

Closed lamoni closed 1 year ago

lamoni commented 1 year ago

Hey all,

I'm curious what the best approach is to having a single port that handles sflow/netflow, instead of having two separate ports. I know there will be some performance hit as we would need to parse and figure out what the flow type is before passing it further down the pipeline, but assuming I'm okay with that, any suggestions?

lspgn commented 1 year ago

Hi @lamoni, I wasn't sure how much I should be decoding per packet but after looking at the samples, looks like it's doable by reading 5 bytes. Will implement something.

NetFlow v5 0x00 0x05
NetFlow v9 0x00 0x09
IPFIX 0x00 0x0A
sFlow v5 0x00 0x00 0x00 0x05

lamoni commented 1 year ago

Amazing, thank you @lspgn !