search

path-network / logstash-codec-sflow

Logstash codec plugin to decrypt sflow
Other
35 stars 17 forks source link

Feature request: MPLS support #12

Open jakunow opened 6 years ago

jakunow commented 6 years ago

On main page it is stated

it is able to decode Ethernet, 802.1Q VLAN, IPv4, UDP and TCP header

I've inspected decoded logs and it seems plugin is unable to analyze MPLS packets. Is there a plan to add support for it?

ashangit commented 6 years ago

Hi @jakunow on my side I didn't have any access to some sflow trame with MPLS header packet, to be able to add it I would need a network capture so I can test any future development with it. Let me know if you can provide me such a capture

jakunow commented 6 years ago

Hi @ashangit I've had a look on packet_header.rb code and I don't think implementing MPLS decoding is easy to implement. MPLS frames don't have any field that describe underlying payload and because MPLS traffic can carry multiple type of traffic it's not that straightforward to determine that payload's protocol. Without some more complex analysis it won't work.