Decodes the sFlow packets.




The output fields are as follows:

  • agent_addr: IP address of sFlow agent
  • agent_id: Agent identifier
  • counters: When sample_type is counters, the following map-type information is output.
    • admin_status: Whether the administrator port is enabled (true, false)
    • if_direction(0: unknown, 1: Full-duplex, 2: Half-duplex, 3: Receive, 4: Send)
    • if_index: Interface identifier
    • if_speed: Connection link speed in bps
    • if_type: Ethernet is 6, Refer to the interface type standard number assigned by IANA: "IANAifType ::= TEXTUAL-CONVENTION" and "SYNTAX INTEGER" sections in
    • in_bcast_pkts: Number of broadcast packets received
    • in_discards: Number of discarded packets received
    • in_errors: Number of packets with errors received
    • in_mcast_pkts: Number of multicast packets received
    • in_octets: Total bytes received (bytes)
    • in_ucast_pkts: Number of unicast packets received
    • in_unknown_protos: Number of packets whose protocols are unknown among the received packets
    • oper_status: Whether the actual link is enabled (true, false)
    • out_bcast_pkts: Number of broadcast packets sent
    • out_discards: Number of discarded packets to be sent
    • out_errors: Number of packets with errors among the packets to be sent
    • out_mcast_pkts: Number of multicast packets sent
    • out_octets: Bytes sent
    • out_ucast_pkts: Number of unicast packets sent
    • promisc_mode: Whether promiscuous mode is enabled (true, false)
  • drops: Number of packets lost due to lack of performance. This outputs information when sample_type is flow.
  • dst_ip: Destination IP address. Typically, the address of the sFlow collenction server.
  • dst_port: Destination port number
  • flow: A packet randomly sampled according to sampling_rate
  • flow_seq: Increases by 1 each time a sample created for each src_id
  • flows: Outputs the flow data information sampled when sample_type is flow.
    • counters: Inerface counters that transmit at regular intervals
    • frame_length: Length in byte of the packet before sampling
    • header: Ethernet header octet byte stream
    • protocol: Connection layer protocol (e.g., ethernet)
    • stripped: Number of octets removed from the packet before extracting the data link layer header octets
  • input_if_index: Outputs the interface identifier information received when sample_type is flow
  • output_if_index: Outputs the interface identifier information sent when sample_type is flow
  • protocol: Transport layer protocol. udp only.
  • sample_pool: Number of sources to be sampled. This outputs information when sample_type is flow.
  • sample_type: Type of sampling
  • sampling_rate: Sampling rate. One from the specified number of packets is extracted. This outputs information when sample_type is flow.
  • src_id: Interface identification number
  • src_id_type: Interface type defined in RFC 2613 (0: ifIndex, 1: smonVlanDataSource, 2: entPhysicalEntry). Refer to 3.1.1 DataSource Objects in RFC 2613:
  • src_ip: Source IP address. Typically, the address of the sFlow agent.
  • src_port: Source port number
  • uptime: Uptime after the agetn starts
  • ver: sflow version. Only version 5 supported.


Decode sFlow packets from sflow.pcap file.

pcapfile /opt/logpresso/sonar/sflow.cap | decodesflow