search

sflow / host-sflow

host-sflow agent
http://sflow.net
Other
149 stars 55 forks source link

NIC sflow stream per collector #24

Open nidotech opened 7 years ago

nidotech commented 7 years ago

The current hsflowd allows multiple network interfaces and multiple collectors. However, it doesn't allow allocation of NIC sflow stream per collector, I would like to have that implemented to allow separate streams for data collection.

Current: collector { ip=x.x.x.1 udpport=6343, ip=x.x.x.2 udpport=6343} pcap { dev = eth1 } pcap { dev = eth2 }

Enhancement: pcap { dev = eth1, collector_ip=x.x.x.1:6343 } pcap { dev = eth2, collector_ip=x.x.x.2:6343 }

sflow commented 7 years ago

Thanks for posting, but please can you indicate why you would like to see this feature?

To avoid pushing too much "hidden state" out into the system it can be better to send everything to each collector and let each ignore what they don't want to see. Or, if there is some security restriction (so that one collector may NOT see the data for another) then you can send everything to one trusted collector who can then forward separate filtered feeds to the others. Do either of those approaches sound workable for your situation?

nidotech commented 7 years ago

I've a box with multiples uplinks running BGP. All the traffics have been aggregated from all NICs, and I cannot easily find out how much traffics are running on each individual uplink.

sflow commented 7 years ago

The feed allows you to distinguish. hsflowd will report each NIC's packet+counter samples from a distinct sflow datasource id (equal to the ifIndex of the NIC).

It may be called different things on different collector tools. sflowtool calls it "sourceId": https://github.com/sflow/sflowtool/blob/master/src/sflowtool.c#L2827

You could also filter packet-samples by the input/output ifindex fields. Those are known as "inputifindex" and "outputifindex" when defining flows in sFlow-RT: http://sflow-rt.com/define_flow.php#keys