-
Notifications
You must be signed in to change notification settings - Fork 110
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add srv6 #306
Open
door7302
wants to merge
41
commits into
netsampler:main
Choose a base branch
from
door7302:add-srv6
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Add srv6 #306
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Jul 31, 2024
lspgn
reviewed
Aug 4, 2024
flowMessage.FragmentId = identification | ||
flowMessage.FragmentOffset = uint32(fragOffset) >> 3 | ||
flowMessage.IpFlags = uint32(fragOffset) & 7 | ||
// limit the maximum number of loop to avoid infinit loop |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
need to fix typo
Would you be able to test the version in #342 using the following mapping file:
where formatter:
fields:
- type
- time_received_ns
- sequence_num
- sampling_rate
- sampler_address
- time_flow_start_ns
- time_flow_end_ns
- bytes
- packets
- src_addr
- src_net
- dst_addr
- dst_net
- etype
- proto
- in_if
- out_if
- src_mac
- dst_mac
- layer_stack
- layer_size
# srv6 fields
- ipv6_routing_header_seg_left
- srhLastEntryIPv6
- srhFlagsIPv6
- srhTagIPv6
- ipv6_routing_header_addresses
# inner frame
- innerFrame_src_addr
- innerFrame_dst_addr
- innerFrame_proto
- innerFrame_src_port
- innerFrame_dst_port
- innerFrame_icmp_type
- innerFrame_icmp_code
key:
- sampler_address
protobuf:
# srv6 fields
- name: srhLastEntryIPv6
index: 151
type: varint
- name: srhFlagsIPv6
index: 152
type: varint
- name: srhTagIPv6
index: 153
type: varint
# inner frame
- name: innerFrame_src_addr
index: 160
type: string
- name: innerFrame_dst_addr
index: 161
type: string
- name: innerFrame_proto
index: 162
type: varint
- name: innerFrame_src_port
index: 163
type: varint
- name: innerFrame_dst_port
index: 164
type: varint
# icmp
- name: innerFrame_icmp_type
index: 172
type: varint
- name: innerFrame_icmp_code
index: 173
type: varint
rename:
ipv6_routing_header_addresses: srhSegmentIPv6BasicList
ipv6_routing_header_seg_left: srhSegmentsIPv6Left
render:
innerFrame_src_addr: ip
innerFrame_dst_addr: ip
innerFrame_proto: proto
sflow:
mapping:
# srv6
- layer: "ipv6eh_routing"
offset: 32
length: 8
destination: srhLastEntryIPv6
- layer: "ipv6eh_routing"
offset: 40
length: 8
destination: srhFlagsIPv6
- layer: "ipv6eh_routing"
offset: 48
length: 16
destination: srhTagIPv6
# src/dst addresses
- layer: "ipv6"
encap: true
offset: 64
length: 128
destination: innerFrame_src_addr
- layer: "ipv6"
encap: true
offset: 192
length: 128
destination: innerFrame_dst_addr
- layer: "ipv4"
encap: true
offset: 96
length: 32
destination: innerFrame_src_addr
- layer: "ipv4"
encap: true
offset: 128
length: 32
destination: innerFrame_dst_addr
# proto
- layer: "ipv6"
encap: true
offset: 48
length: 8
destination: innerFrame_proto
- layer: "ipv4"
encap: true
offset: 72
length: 8
destination: innerFrame_proto
# ports
- layer: "udp"
encap: true
offset: 0
length: 16
destination: innerFrame_src_port
- layer: "udp"
encap: true
offset: 16
length: 16
destination: innerFrame_dst_port
- layer: "tcp"
encap: true
offset: 0
length: 16
destination: innerFrame_src_port
- layer: "tcp"
encap: true
offset: 16
length: 16
destination: innerFrame_dst_port
# icmp
- layer: "icmp"
encap: true
offset: 0
length: 8
destination: innerFrame_icmp_type
- layer: "icmp"
encap: true
offset: 8
length: 8
destination: innerFrame_icmp_code I didn't add:
and |
#342 was merged. Will likely close this one |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello
This is the first version that decodes the SRV6 SRH header (if present) and Tunneled Payload aka. inner frame (DT4 and DT6 encap are supported as of now). Raw flows are exported by using the Juniper Inline Monitoring solution which is a standard solution: IPFIX 315. Sflow is also supported as this is the same decoding functions used for both sFlow and IPFIX 315.
I attached a sample output when goflow2 exports flow records as JSON :
srv6-dt4-goflow2-decoding.pdf
David