Packet counts for each flow

[srag...@princeton.edu]

From the "Performance-Aware SDN" post, I see that it is possible to define thresholds for a given flow so that an application can receive events when the packets/second for that flow exceeds a certain number. Then the application can change forwarding policies accordingly via the Floodlight REST API. 

I was wondering whether it was possible to use sFlow-RT to specify certain flows for which we want the number of packets/second. For example, if we wanted to estimate the distribution of packets over each source ip / dest ip flow, I was wondering if it was possible to define sFlow-RT metrics so that sFlow-RT would periodically send the application events that tell the application the number of packets that have been sampled belonging to a given source ip - dest ip flow.

Thanks!

[Peter Phaal]

You can specify a filter: expression when you define a flow that will allow you to selectively monitor flows.

If you specify log:true when you define the flow, then you can track completed flows using the REST API:

http://blog.sflow.com/2013/08/restflow.html

You can also use sFlow-RT's internal JavaScript API to maintain totals based on completed flows. The setFlowHandler() function is used to register a callback that will receive completed flows.

http://blog.sflow.com/2013/10/embedding-sdn-applications.html

Code from the different examples is in sFlow-RT's extras directory.

[srag...@princeton.edu]

Thanks for your response!

I was also wondering if it were possible to maintain total flow counts even while the flows have not yet completed. This would be helpful in writing an SDN application that changes its policy based on the distribution of packet counts over each flow.

[Peter Phaal]

If you set the activeTimeout: when you define the flow you will force flow records to be generated for active flows.

What is the use case you are thinking of? Flow records (with packet / byte counts) can be used to accumulate totals over time, but they aren't very responsive. The following article compares sFlow and NetFlow, but the analysis is the same for flows exported from sFlow-RT's flow cache.

http://blog.sflow.com/2013/01/rapidly-detecting-large-flows-sflow-vs.html

Note: If you set log:true and flowStart: true when you define a flow, the flow records are generated for the start of flows. You don't get quantitative data, but you get a fast response. This data can be useful when you are primarily interested in the flow keys:

http://blog.sflow.com/2013/11/exporting-events-using-syslog.html

If you want fast updating estimates of the current packets / bytes per second for largest active flows then the /activeflows/ REST calls (or using setIntervalHandler() to register a callback that polls the flow cache using the activeFlows() function) provide the best estimates. The fastest response is delivered using the asynchronous threshold mechanism.

http://blog.sflow.com/2013/06/large-flow-detection-script.html

Fast response times are important if you want to act on large flows and have the maximum impact:

http://blog.sflow.com/2013/02/sdn-and-large-flows.html

--
You received this message because you are subscribed to the Google Groups "sFlow-RT" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sflow-rt+u...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

[srag...@princeton.edu]

Getting fast updating estimates of current packets/bytes per second for the largest active flows definitely makes sense. I have managed to get the data that I want (flow key and bytes per second) by typing 'curl "http://localhost:8008/activeflows/ALL/incoming/json"' in the command line.

However, when I try using the jsonGet method to get the activeflows data in a javascript application, the returned metrics array does not specify which key is associated with each metric. I was wondering if there was a good way to get each flow key and value. You also mentioned an activeFlows() function, and I was wondering if there were any examples of how to call this function.

Thanks very much!

[Peter Phaal]

I don't see how there would be any difference between the JSON response you would get using cURL or node.js - the URL is the same and so the response will be the same. There must be a bug in the jsonGet() function in the example script, could you use JSON.stringify() to print the results so that I can see what you are getting?

[srag...@princeton.edu]

I figured it out - I had not written the JSON request correctly. Thanks so much for your help!

Just wanted to clarify how the estimates work - does the estimate of the packets/bytes per second of a given flow simply equal the rate at which the sFlow-RT collector receives sFlow datagrams containing a header belonging to that flow, multiplied by the inverse of the sampling rate?

[Peter Phaal]

That is basically correct. The following article describes the basics of how packet samples are scaled and how to calculate variances:

http://www.sflow.org/packetSamplingBasics/

sFlow-RT applies a number of additional techniques to increase the speed of response so that large flows can be detected quickly and accurately enough to drive stable SDN control actions. You can verify the accuracy by generating known test patterns:

http://blog.sflow.com/2013/06/large-flow-detection.html

http://blog.sflow.com/2013/06/large-flow-detection-script.html