Complete Rust sFlow v5 parser lib

22 views

Skip to first unread message

Matthieu

unread,

Jan 27, 2026, 4:17:44 PM (2 days ago) Jan 27

to sFlow

Hi folks,

I wanted to share this Rust sFlow parser library with you: https://github.com/nxthdr/sflow-parser. I went down the rabbit hole of implementing all the structure numbers from the official structure registry. This means that all RFCs are implemented, including obsolete or unused structures (errata also included).

I got help from LLMs to implement the parser, but I quickly realized that even with the RFCs as context, there was a significant amount of hallucination. As a result, in addition to code review, I developed a “specification validation” tool. The tool parses the RFCs using regexes to decode the XDR definitions, and then parses the code structures to ensure that the RFCs are respected. Funny enough, it allowed me to uncover some additional RFC issues that were not already present in the errata.

Aside from RFC validation, the library is unit tested, fuzz tested, and performance-benchmarked. I also have a few “real-life” integration tests, although I’m missing PCAPs from multiple vendors. If you have any, I’d be interested.

It’s still relatively new, but I’ve used the library to decode sFlow messages in a couple of places and so far things look good. That said, only a fraction of the structures are actually seen in practice.