decodesflow
Decodes the sFlow packets.
Syntax
decodesflow
Description
The output fields are as follows:
- agent_addr: IP address of sFlow agent
- agent_id: Agent identifier
- counters: When sample_type is
counters
, the following map-type information is output.- admin_status: Whether the administrator port is enabled (
true
,false
) - if_direction(
0
: unknown,1
: Full-duplex,2
: Half-duplex,3
: Receive,4
: Send) - if_index: Interface identifier
- if_speed: Connection link speed in bps
- if_type: Ethernet is
6
, Refer to the interface type standard number assigned by IANA: "IANAifType ::= TEXTUAL-CONVENTION" and "SYNTAX INTEGER" sections in https://ietf.org/assignments/ianaiftype-mib/ianaiftype-mib - in_bcast_pkts: Number of broadcast packets received
- in_discards: Number of discarded packets received
- in_errors: Number of packets with errors received
- in_mcast_pkts: Number of multicast packets received
- in_octets: Total bytes received (bytes)
- in_ucast_pkts: Number of unicast packets received
- in_unknown_protos: Number of packets whose protocols are unknown among the received packets
- oper_status: Whether the actual link is enabled (
true
,false
) - out_bcast_pkts: Number of broadcast packets sent
- out_discards: Number of discarded packets to be sent
- out_errors: Number of packets with errors among the packets to be sent
- out_mcast_pkts: Number of multicast packets sent
- out_octets: Bytes sent
- out_ucast_pkts: Number of unicast packets sent
- promisc_mode: Whether promiscuous mode is enabled (
true
,false
)
- admin_status: Whether the administrator port is enabled (
- drops: Number of packets lost due to lack of performance. This outputs information when sample_type is
flow
. - dst_ip: Destination IP address. Typically, the address of the sFlow collenction server.
- dst_port: Destination port number
- flow: A packet randomly sampled according to sampling_rate
- flow_seq: Increases by 1 each time a sample created for each src_id
- flows: Outputs the flow data information sampled when sample_type is
flow
.- counters: Inerface counters that transmit at regular intervals
- frame_length: Length in byte of the packet before sampling
- header: Ethernet header octet byte stream
- protocol: Connection layer protocol (e.g.,
ethernet
) - stripped: Number of octets removed from the packet before extracting the data link layer header octets
- input_if_index: Outputs the interface identifier information received when sample_type is
flow
- output_if_index: Outputs the interface identifier information sent when sample_type is
flow
- protocol: Transport layer protocol.
udp
only. - sample_pool: Number of sources to be sampled. This outputs information when sample_type is
flow
. - sample_type: Type of sampling
- sampling_rate: Sampling rate. One from the specified number of packets is extracted. This outputs information when sample_type is
flow
. - src_id: Interface identification number
- src_id_type: Interface type defined in RFC 2613 (
0
: ifIndex,1
: smonVlanDataSource,2
: entPhysicalEntry). Refer to 3.1.1 DataSource Objects in RFC 2613: https://tools.ietf.org/html/rfc2613 - src_ip: Source IP address. Typically, the address of the sFlow agent.
- src_port: Source port number
- uptime: Uptime after the agetn starts
- ver: sflow version. Only version 5 supported.
Usage
Decode sFlow packets from sflow.pcap file.
pcapfile /opt/logpresso/sonar/sflow.cap | decodesflow