delian / node-sflow Goto Github PK

Hi there,

Would you consider the LGPL or BSD license for your project? It's a great piece of work and seems to work very nicely, I've gone ahead and made a proposed (work in progress) prototype for SFlow support in the node-logstash project (https://github.com/bpaquet/node-logstash) bpaquet/node-logstash#102. This will allow logging SFlow records straight into an ELK stack.

Hope you will consider this request.

Kind regards,

Hi I'm using host-sflow will the following config:
pcap { dev = docker_gwbridge }

My js code has this:
Collector(function(flow) {
if (flow && flow.flow.records && flow.flow.records.length>0) {
flow.flow.records.forEach(function(n) {
console.log(n);
});
}
}).listen(6343);

After a few flows, it consistently fails with "unknown format" err. Following is out with debug turned on:

[root@ip-10-227-81-88 scripts]# DEBUG=sflow,sflow:packet node swarm-metrics.js
sflow got a packet +0ms
sflow:packet header: {"sflowVersion":5,"ipVersion":1,"ipVersionText":"IPv4","ipAddress":"10.227.81.88","subAgentId":100000,"sequence":14,"uptimeMS":81255,"samples":5} +3ms
sflow:packet sample 0:{"enterprise":0,"format":1,"length":112} +1ms
sflow:packet reading flow 0 with enterprise 0, format 1 and length 72 +0ms
sflow gow a flow 25 from packet with sequence 14 +1ms
sflow:packet sample 1:{"enterprise":0,"format":1,"length":112} +7ms
sflow:packet reading flow 0 with enterprise 0, format 1 and length 72 +0ms
sflow gow a flow 26 from packet with sequence 14 +0ms
sflow:packet sample 2:{"enterprise":0,"format":1,"length":184} +2ms
sflow:packet reading flow 0 with enterprise 0, format 1 and length 144 +0ms
sflow gow a flow 27 from packet with sequence 14 +0ms
sflow:packet sample 3:{"enterprise":0,"format":1,"length":112} +0ms
sflow:packet reading flow 0 with enterprise 0, format 1 and length 72 +0ms
sflow gow a flow 28 from packet with sequence 14 +0ms
sflow:packet sample 4:{"enterprise":0,"format":1,"length":184} +1ms
sflow:packet reading flow 0 with enterprise 0, format 1 and length 144 +0ms
sflow gow a flow 29 from packet with sequence 14 +0ms
sflow got a packet +7s
sflow:packet header: {"sflowVersion":5,"ipVersion":1,"ipVersionText":"IPv4","ipAddress":"10.227.81.88","subAgentId":100000,"sequence":15,"uptimeMS":81255,"samples":1} +0ms
sflow:packet sample 0:{"enterprise":0,"format":2,"length":680} +0ms
sflow:packet unknown format +1ms { format: 2001, length: 4 }
/etc/chef/compose-stacks/sflow-rt/node_modules/node-sflow/lib/packet.js:335
throw new Error('unknown format');
^

Error: unknown format
at Object.internal.readCounterRecords (/etc/chef/compose-stacks/sflow-rt/node_modules/node-sflow/lib/packet.js:335:23)
at /etc/chef/compose-stacks/sflow-rt/node_modules/node-sflow/lib/packet.js:428:50
at _combinedTickCallback (internal/process/next_tick.js:131:7)
at process._tickCallback (internal/process/next_tick.js:180:9)
[root@ip-10-227-81-88 scripts]#

Any idea what is happening here?

In sflow.js there are a loop over the samples and that stores the flow in the parameter o.flow.
That parameter is owerwritten in each loop, wouldn't that mean that you would only get the last one?
If you pass on a callback you would of course get each with the callback but if you don't...

for (var n = hdr.samples;n;n--) {
    var sHdr = buf.readUInt32BE(0);
    o.flow = {};
    ....