Collection with sFlow about nfdump HOT 11 CLOSED

Hello,

You can try enabling extensions. See: https://sourceforge.net/p/nfsen/mailman/message/32171818/

Nick

from nfdump.

Your answer is for nfcapd (netflow) but for me it's sfcapd (sflow).
How to extract the tag mpls with sfcapd daemon ?

Thanks.

from nfdump.

According to https://sourceforge.net/p/nfdump/mailman/message/32916245/ you should be able to capture such data using "-T all". If not, it seems the above never underwent troubleshooting, and you should provide "a few minutes of packet dump" to the author, who might find an opportunity to fix things.

from nfdump.

Other question, How to contact the development team for nfdump/nfsen ?

from nfdump.

I guess the developer/author, Dr Peter Haag, is watching these comments. Furthermore, you may want to subscribe to the (low-volume) nfdump-discuss mailing list.

from nfdump.

Right - just post your requests here. I am a bit busy right now, so it could take some time.
.. and .. btw no Dr. !! :)

from nfdump.

Ok thanks for your answer.
Mr P.Haag, how extract the mpls tag in sFlow frames with NFDUMP and NFSEN ? Today, the daemon sfcapd does not allow this extraction. Is what is expected in future updates to the product ?

from nfdump.

I am afraid, but right now, sfcapd does not support mpls. The reason for that is, that I have no trails to test. If sflow supports certain fields, which are not implemented, pls collect some traffic in a pcap, sent to the collector, and send me this pcap. So I can update the collector to these features.
Peter

from nfdump.

Any possibility to share a pcap containing sflow records mpls? Otherwise I close the ticket.

from nfdump.

sflow code has been updated to commit 7322984 of https://github.com/sflow/sflowtool

from nfdump.

In the latest master commit, sfcapd now unwarps correctly the mpls stack and add the labels into nfdump records.

from nfdump.