Proposal - support of extended sflow format about vflow HOT 3 OPEN

Hey @dbardbar , can you please link the documentation/rfc that describe the parsing of these 32bits

from vflow.

@akshah - following our conversation - references for encoding:

For the expanded format - AFAIK this is not covered in any RFC, but is explained in the the sflow version 5 standard - https://sflow.org/sflow_version_5.txt

1. SourceID encoding in expanded format as 32/32 bit - see page 31 (sflow_data_source_expanded)
2. Interface encoding in expanded format as 32/32 bit - see page 31 (interface_expanded)

For the compact format, this is covered in RFC 3176 - https://www.rfc-editor.org/rfc/rfc3176

1. SourceID encoding as 8/24 bit composite field - see page 20 (struct flow_sample) and page 24 (struct counters_sample).

2. Output interface encoding as 2/30 bit composite field - see page 20 (search for "unsigned int output")

3. Input interface encoding as 2/30 bit composite field, but actually the top 2 bits are always 0 - that's not in the RFC, but is explained in the sflow5 standard (https://sflow.org/sflow_version_5.txt) , page 27, at the bottom, where it says "Note: Formats 1 & 2"

from vflow.

Also, attaching sflow pcap in expanded and compact format. Use wireshark to see how it parses the fields, especially look at the hex output, and see that it shows which bytes were used to obtain each element, once you click it.
pcaps.zip

from vflow.