Defining Flows with Discard

[Mahmut Aydın]

Hello All,

I am creating new flow via API. I would like to learn that if  I can add metricName for parameter?

For example, keys are ipsource,ipdestination,tcpsourceport,tcpdestinationport.

I will also add some parameters like drop or discar to see of this flow.

thank you

[Peter Phaal]

The new sFlow Dropped Packet Notification Structure spec is currently supported by the Host sFlow agent, but should be available from switches going forward. Real-time trending of dropped packets describes the sFlow-RT Discard Browser app that can be used to analyze dropped packets. If you are writing your own flow definitions, add dropped:true to the definition to select the packet discard events, see Defining Flows.

Some sFlow agents will report if a sampled packet was dropped (most commonly Open vSwitch / Mininet). In this case the value of the outputifindex field will be "discard" if the packet was dropped. You can include outputifindex as a key in your flow definition, or add a filter to select dropped packets, e.g. outputifindex=discard. Discarded packets tend to be rare events and so unlikely to be sampled. The new Dropped Packet Notification Structure spec provides much better visibility since each dropped packet generates a notification.

[Mahmut Aydın]

Thank you so much

Peter Phaal <peter...@gmail.com>, 11 Kas 2020 Çar, 02:37 tarihinde şunu yazdı:

--
You received this message because you are subscribed to the Google Groups "sFlow-RT" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sflow-rt+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sflow-rt/ae67508c-bd71-46f1-93b7-442d25405a03n%40googlegroups.com.

[Mahmut Aydın]

Dear Peter,

When I add below payload, my response is empty. However, when remove "dropped", our response are good. Do you guesss the reason of  that?

payload = '''{                    
    "value": "bytes",
    "keys" :"ipsource,ipdestination,tcpsourceport,tcpdestinationport",
    "filter" : "ipsource=10.34.82.5",
    "dropped": "True",
   
   
}'''

C:\Users\asus\PycharmProjects\SFLOW\venv\Scripts\python.exe C:/Users/asus/PycharmProjects/SFLOW/sflow.py
204

***************************************************

  payload = '''{
"value": "bytes",
"keys" :"ipsource,ipdestination,tcpsourceport,tcpdestinationport",
"filter" : "ipsource=10.34.82.5",
}'''  

C:\Users\asus\PycharmProjects\SFLOW\venv\Scripts\python.exe C:/Users/asus/PycharmProjects/SFLOW/sflow.py
204
<tr><td>2020-11-13 02:38:00.120300</td><td>172.20.10.30</td><td>369099751</td><td>10.34.82.5</td><td>172.20.10.91</td><td>43092</td><td>9388</td><td>35017333.421853706</td></tr>

<tr><td>2020-11-13 02:38:00.120300</td><td>172.20.10.32</td><td>436210688</td><td>10.34.82.5</td><td>172.20.10.91</td><td>24172</td><td>9388</td><td>28952579.304700896</td></tr>

<tr><td>2020-11-13 02:38:00.120300</td><td>172.20.10.32</td><td>369098752</td><td>10.34.82.5</td><td>172.20.10.91</td><td>24166</td><td>9388</td><td>25952576.28075537</td></tr>

<tr><td>2020-11-13 02:38:00.120300</td><td>172.20.10.33</td><td>369098752</td><td>10.34.82.5</td><td>172.20.10.91</td><td>24178</td><td>9388</td><td>24663972.804443005</td></tr>

<tr><td>2020-11-13 02:38:00.120300</td><td>172.20.10.30</td><td>369098904</td><td>10.34.82.5</td><td>172.20.10.91</td><td>24158</td><td>9388</td><td>21087057.2662768</td></tr>

Mahmut Aydın <mahmuta...@gmail.com>, 13 Kas 2020 Cum, 02:20 tarihinde şunu yazdı:

[Peter Phaal]

Your sFlow agent probably doesn't support / isn't configured to export dropped packet notifications. When setting dropped:true in the flow definition only drop notification are analyzed.