HTTP response code: 400 for URL: http://127.0.0.1:8080/stats/flowentry/add

[Sneha Pimpley]

Hi Peter,

I am building a project where I am using sflow for ddos detection. I am using https://blog.sflow.com/2018/10/ryu-measurement-based-control.html as a reference. I have used the same ryu.js file. Below is the procedure that I follow:

Start the sflow-rt using the following command:

1)env "RTPROP=-Dscript.file=$PWD/ryu.js" ./start.sh

2)Creating topology:

sudo mn --custom sflow-rt/extras/sflow.py --link tc,bw=10 --controller=remote,ip=127.0.0.1 --topo tree,depth=2,fanout=2

3)Starting Ryu controller

ryu-manager ryu.app.simple_switch_13 ryu.app.ofctl_rest

4)Adding sflow with below command

sudo ovs-vsctl -- --id=@sflow create sflow agent=l0 target=127.0.0.1 sampling=10 polling=10 -- -- set bridge s1 sflow=@sflow

5)staring the attack using hping3

h1 hping3 --flood --udp -k -s 53 h3

HPING 10.0.0.3 (h1-eth0 10.0.0.3): udp mode set, 28 headers + 0 data bytes

hping in flood mode, no replies will be shown

When I start the attack I get the following error on the sflow-RT application

2020-11-27T19:25:54-08:00 WARNING: /home/sneha/sflow-rt/ryu.js /home/sneha/sflow-rt/ryu.js#37 IO error java.io.IOException: Server returned HTTP response code: 400 for URL: http://127.0.0.1:8080/stats/flowentry/add

2020-11-27T19:25:54-08:00 INFO: /home/sneha/sflow-rt/ryu.js stopped

Please let me know where I am going wrong. Eagerly waiting for a response.

[Peter Phaal]

Looking at your steps.

1. Its easier to use:

./sflow-rt/start.sh -Dscript.file=$PWD/ryu.js

2. Looks fine

3. Looks fine

4. Not necessary. The sflow.py custom script configures sFlow as part of the mininet initialization. It also sends the topology to sFlow-RT.

5. You need to wait a minute or two before starting the attack. Mininet first needs to connect to the RYU controller (I have seen the 400 error in cases where the connection hasn't been established, indicating that RYU doesn't know about the switch that is the target of the control). Also sFow-RT needs a little time to learn the OpenFlow configuration via sFlow.

You should check the RYU logging output. It should indicate why it generated a 400 (bad request) error.

I just ran through the example using the multipass VM described in the following article, https://blog.sflow.com/2020/11/multipass.html, and it worked correctly.

[Sneha Pimpley]

I tried this time with the multipass way

Steps taken:

1)multipass exec mininet -- ./sflow-rt/start.sh -Dscript.file=../ryu.js

2)multipass exec mininet -- sudo mn --custom sflow-rt/extras/sflow.py --link tc,bw=10 --topo tree,depth=2

3)multipass exec mininet -- ryu-manager ryu.app.simple_switch,ryu.app.ofctl_rest

4)When i launch attack i see the following in the ryu controller.

mininet> h1 hping3 --flood --udp -k -s 53 h3

HPING 10.0.0.3 (h1-eth0 10.0.0.3): udp mode set, 28 headers + 0 data bytes

hping in flood mode, no replies will be shown

snehas-MacBook-Pro:mininet sneha$ multipass exec mininet -- ./sflow-rt/start.sh -Dscript.file=../ryu.js

2020-12-03T17:55:30-05:00 INFO: Starting sFlow-RT 3.0-1538

2020-12-03T17:55:31-05:00 INFO: Version check, running latest

2020-12-03T17:55:31-05:00 INFO: Listening, sFlow port 6343

2020-12-03T17:55:32-05:00 INFO: Listening, HTTP port 8008

2020-12-03T17:55:32-05:00 INFO: ../ryu.js started

2020-12-03T17:55:32-05:00 INFO: app/mininet-dashboard/scripts/metrics.js started

2020-12-03T17:58:19-05:00 WARNING: ../ryu.js ../ryu.js#37 not found

2020-12-03T17:58:19-05:00 INFO: ../ryu.js stopped

snehas-MacBook-Pro:~ sneha$ multipass exec mininet -- ryu-manager ryu.app.simple_switch,ryu.app.ofctl_rest

loading app ryu.app.simple_switch

loading app ryu.app.ofctl_rest

loading app ryu.controller.ofp_handler

instantiating app None of DPSet

creating context dpset

creating context wsgi

instantiating app ryu.app.simple_switch of SimpleSwitch

instantiating app ryu.app.ofctl_rest of RestStatsApi

instantiating app ryu.controller.ofp_handler of OFPHandler

(12097) wsgi starting up on http://0.0.0.0:8080

(12097) accepted ('127.0.0.1', 44758)

No such Datapath: 2

127.0.0.1 - - [03/Dec/2020 17:58:19] "POST /stats/flowentry/add HTTP/1.1" 404 141 0.070637

[Peter Phaal]

FYI Issue was resolved. See comments in following article:

https://blog.sflow.com/2020/11/multipass.html