vflow icon indicating copy to clipboard operation
vflow copied to clipboard

SourceID should be uint32

Open D3luxee opened this issue 2 years ago • 1 comments

According to https://sflow.org/SFLOW-DATAGRAM5.txt the SourceID should be treated as uint32. The current implementation only allows decoding of one byte instead of the whole data in source_id.

/* sFlowDataSource encoded as follows:
     The most significant byte of the source_id is used to indicate the type
     of sFlowDataSource:
        0 = ifIndex
        1 = smonVlanDataSource
        2 = entPhysicalEntry
     The lower three bytes contain the relevant index value. */

typedef unsigned int sflow_data_source;
struct flow_sample {
   unsigned int sequence_number;  /* Incremented with each flow sample
                                     generated by this source_id.
                                     Note: If the agent resets the
                                           sample_pool then it must
                                           also reset the sequence_number.*/
   sflow_data_source source_id;   /* sFlowDataSource */
   unsigned int sampling_rate;    /* sFlowPacketSamplingRate */
   unsigned int sample_pool;      /* Total number of packets that could have
                                     been sampled (i.e. packets skipped by
                                     sampling process + total number of
                                     samples) */
   unsigned int drops;            /* Number of times that the sFlow agent
                                     detected that a packet marked to be 
                                     sampled was dropped due to
                                     lack of resources. The drops counter
                                     reports the total number of drops
                                     detected since the agent was last reset.
                                     A high drop rate indicates that the 
                                     management agent is unable to process 
                                     samples as fast as they are being 
                                     generated by hardware. Increasing 
                                     sampling_rate will reduce the drop 
                                     rate. Note: An agent that cannot 
                                     detect drops will always report
                                     zero. */

   interface input;               /* Interface packet was received on. */
   interface output;              /* Interface packet was sent on. */

   flow_record flow_records<>;    /* Information about a sampled packet */
}

D3luxee avatar Feb 01 '22 17:02 D3luxee

Actually, the SourceID field should be split into SourceIDType and SourceIDIdx, exactly like was done for flow_counter.go, and should be read in the same way as in flow_counter.go.

dbardbar avatar Jan 05 '23 12:01 dbardbar