Re: [pmacct-discussion] Cisco NCS - IPFIX 315 - sampling_rate and outer qtag not detected
Hi Paolo, Thanks for the prompt answer and support as usual, we really appreciate it. I’ll forward the pcap directly to you. Thanks again, and have a nice week! > On 29 Jul 2023, at 23:43, Paolo Lucente wrote: > > > Hi Tiago, > > Great to read from you, about your issues: > > 1) can you send me a pcap with a data packet and the templates, both > data and sampling option? Being able to replay it will give me a chance > to understand what may be wrong. > > 2) vlan_out refers to the vlan after, say, some re-tagging took place. > It does not refer to outer vs inner vlan. What you are looking for is > cvlan. Problem being cvlan is not currently supported as an aggregation > primitive but only as a filter in the pre_tag_map. Implementing this > would not be a biggie & can squeeze in the dev cycles pretty easily; > just as above, i'd just ask you if you can send me some sample data so > not to perform the coding blindly. > > Paolo > > > On Thu, Jul 27, 2023 at 08:41:17PM +, Tiago Felipe Gonçalves wrote: >> Hi, >> >> I’m using sfacctd, and nfacctd to collect/digest flows, but I’m having two >> issues with IPFIX 315 being exported by Cisco NCSs on my lab environment. >> >> === >> 1. The router is sending sampling rate template, but nfacctd is unable to >> detect it: >> Cisco NetFlow/IPFIX >>Version: 10 >>Length: 140 >>Timestamp: Jul 27, 2023 21:23:32.0 CEST >>ExportTime: 1690485812 >>FlowSequence: 4603756 >>Observation Domain Id: 4096 >>Set 1 [id=257] (1 flows) >>FlowSet Id: (Data) (257) >>FlowSet Length: 124 >>[Template Frame: 3] >>Flow 1 >>Selector Id: 1 >>Sampling Packet Interval: 32000 >>Selector Algorithm: Random n-out-of-N Sampling (3) >>Sampling Size: 1 >>Sampling Population: 32000 >>SamplerName: ipfix_sm >>Selector Name: ipfix_sm >>String_len_short: 8 >>Padding: 00 >> >> Seems that nfacctd understand the template: >> >> DEBUG ( default/core ): Received NetFlow/IPFIX packet from >> [192.168.245.145:21660] version [10] seqno [4621414] >> DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [3] from >> [192.168.245.145:21660] seqno [4621414] >> DEBUG ( default/core ): NfV10 agent : 192.168.245.145:4096 >> DEBUG ( default/core ): NfV10 template type : options >> DEBUG ( default/core ): NfV10 template ID : 338 >> DEBUG ( default/core ): >> - >> DEBUG ( default/core ): |pen | field type | offset | >> size | >> DEBUG ( default/core ): | 0 | 149[149 ] | 0 | >> 4 | >> DEBUG ( default/core ): | 0 | 160[160 ] | 4 | >> 8 | >> DEBUG ( default/core ): >> - >> DEBUG ( default/core ): Netflow V9/IPFIX record size : 12 >> DEBUG ( default/core ): >> DEBUG ( default/core ): Received NetFlow/IPFIX packet from >> [192.168.245.145:21660] version [10] seqno [4621414] >> DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [338] from >> [192.168.245.145:21660] seqno [4621414] >> DEBUG ( default/core ): Received NetFlow/IPFIX packet from >> [192.168.245.145:21660] version [10] seqno [4621415] >> DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [3] from >> [192.168.245.145:21660] seqno [4621415] >> DEBUG ( default/core ): NfV10 agent : 192.168.245.145:4096 >> DEBUG ( default/core ): NfV10 template type : options >> DEBUG ( default/core ): NfV10 template ID : 257 >> DEBUG ( default/core ): >> - >> DEBUG ( default/core ): |pen | field type | offset | >> size | >> DEBUG ( default/core ): | 0 | 302[302 ] | 0 | >> 4 | >> DEBUG ( default/core ): | 0 | 305[305 ] | 4 | >> 4 | >> DEBUG ( default/core ): | 0 | 304[304 ] | 8 | >> 2 | >> DEBUG ( default/core ): | 0 | 309[309 ] | 10 | >> 4 | >> DEBUG ( default/core ): | 0 | 310[310 ] | 14 | >> 4 | >> DEBUG ( default/core ): | 0 | sampler name [84 ] | 18 | >> 90 | >> DEBUG ( default/core ): | 0 | 335[335 ] |108 | >> 65535 | >> DEBUG ( default/core ): >> - >> DEBUG ( default/core ): Netflow V9/IPFIX record size : 107 >> DEBUG ( default/core ): >> DEBUG ( default/core ): Received NetFlow/IPFIX packet from >> [192.168.245.145:21660] version [10] seqno [4621415] >> DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [257] from >>
Re: [pmacct-discussion] Cisco NCS - IPFIX 315 - sampling_rate and outer qtag not detected
Hi Tiago, Great to read from you, about your issues: 1) can you send me a pcap with a data packet and the templates, both data and sampling option? Being able to replay it will give me a chance to understand what may be wrong. 2) vlan_out refers to the vlan after, say, some re-tagging took place. It does not refer to outer vs inner vlan. What you are looking for is cvlan. Problem being cvlan is not currently supported as an aggregation primitive but only as a filter in the pre_tag_map. Implementing this would not be a biggie & can squeeze in the dev cycles pretty easily; just as above, i'd just ask you if you can send me some sample data so not to perform the coding blindly. Paolo On Thu, Jul 27, 2023 at 08:41:17PM +, Tiago Felipe Gonçalves wrote: > Hi, > > I’m using sfacctd, and nfacctd to collect/digest flows, but I’m having two > issues with IPFIX 315 being exported by Cisco NCSs on my lab environment. > > === > 1. The router is sending sampling rate template, but nfacctd is unable to > detect it: > Cisco NetFlow/IPFIX > Version: 10 > Length: 140 > Timestamp: Jul 27, 2023 21:23:32.0 CEST > ExportTime: 1690485812 > FlowSequence: 4603756 > Observation Domain Id: 4096 > Set 1 [id=257] (1 flows) > FlowSet Id: (Data) (257) > FlowSet Length: 124 > [Template Frame: 3] > Flow 1 > Selector Id: 1 > Sampling Packet Interval: 32000 > Selector Algorithm: Random n-out-of-N Sampling (3) > Sampling Size: 1 > Sampling Population: 32000 > SamplerName: ipfix_sm > Selector Name: ipfix_sm > String_len_short: 8 > Padding: 00 > > Seems that nfacctd understand the template: > > DEBUG ( default/core ): Received NetFlow/IPFIX packet from > [192.168.245.145:21660] version [10] seqno [4621414] > DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [3] from > [192.168.245.145:21660] seqno [4621414] > DEBUG ( default/core ): NfV10 agent : 192.168.245.145:4096 > DEBUG ( default/core ): NfV10 template type : options > DEBUG ( default/core ): NfV10 template ID : 338 > DEBUG ( default/core ): > - > DEBUG ( default/core ): |pen | field type | offset | > size | > DEBUG ( default/core ): | 0 | 149[149 ] | 0 | > 4 | > DEBUG ( default/core ): | 0 | 160[160 ] | 4 | > 8 | > DEBUG ( default/core ): > - > DEBUG ( default/core ): Netflow V9/IPFIX record size : 12 > DEBUG ( default/core ): > DEBUG ( default/core ): Received NetFlow/IPFIX packet from > [192.168.245.145:21660] version [10] seqno [4621414] > DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [338] from > [192.168.245.145:21660] seqno [4621414] > DEBUG ( default/core ): Received NetFlow/IPFIX packet from > [192.168.245.145:21660] version [10] seqno [4621415] > DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [3] from > [192.168.245.145:21660] seqno [4621415] > DEBUG ( default/core ): NfV10 agent : 192.168.245.145:4096 > DEBUG ( default/core ): NfV10 template type : options > DEBUG ( default/core ): NfV10 template ID : 257 > DEBUG ( default/core ): > - > DEBUG ( default/core ): |pen | field type | offset | > size | > DEBUG ( default/core ): | 0 | 302[302 ] | 0 | > 4 | > DEBUG ( default/core ): | 0 | 305[305 ] | 4 | > 4 | > DEBUG ( default/core ): | 0 | 304[304 ] | 8 | > 2 | > DEBUG ( default/core ): | 0 | 309[309 ] | 10 | > 4 | > DEBUG ( default/core ): | 0 | 310[310 ] | 14 | > 4 | > DEBUG ( default/core ): | 0 | sampler name [84 ] | 18 | >90 | > DEBUG ( default/core ): | 0 | 335[335 ] |108 | > 65535 | > DEBUG ( default/core ): > - > DEBUG ( default/core ): Netflow V9/IPFIX record size : 107 > DEBUG ( default/core ): > DEBUG ( default/core ): Received NetFlow/IPFIX packet from > [192.168.245.145:21660] version [10] seqno [4621415] > DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [257] from > [192.168.245.145:21660] seqno [4621415] > DEBUG ( default/core ): Received NetFlow/IPFIX packet from > [172.31.31.162:63625] version [10] seqno [2092073163] > DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [335] from > [172.31.31.162:63625] seqno [2092073163] > > But when printing the data, seems that sampling_rate
