如何从 sFlow 数据报计算流量(以字节为单位)?

网络工程 UDP 监控 流量
2022-02-21 18:51:38

我想通过编写一个接收 sFlow 数据报、解析它们、仅提取关键信息并应用一个公式来总结特定 IP 源的流量(以字节为单位)的 sFlow 收集器来近似以字节为单位的网络流量。我感兴趣的是公式和我必须提取的关键信息。

2个回答

frame_length 字段在 sFlow 版本 5 规范的第 35 页上定义,https://sflow.org/sflow_version_5.txt

 unsigned int frame_length;      /* Original length of packet before
                                      sampling.
                                      Note: For a layer 2 header_protocol,
                                            length is total number of octets
                                            of data received on the network
                                            (excluding framing bits but
                                            including FCS octets).
                                            Hardware limitations may
                                            prevent an exact reporting
                                            of the underlying frame length,
                                            but an agent should attempt to
                                            be as accurate as possible. Any
                                            octets added to the frame_length
                                            to compensate for encapsulations
                                            removed by the underlying hardware
                                            must also be added to the stripped
                                            count. */

该字段由 sflowtool 打印为 sampledPacketSize,https://github.com/sflow/sflowtool

采样率字段在上述文档的第 29 页上定义。此外,开关上还配置了采样率。

   unsigned int sampling_rate;    /* sFlowPacketSamplingRate */

为 sFlow 数据源计算字节的一种简单方法是将 frame_length 值相加并乘以采样率。

sFlow 收集以 1/ n分数指定的样本。轮询以为单位指定。

基本上,您只需将样本乘以n并除以s即可获得估计的数据包/秒。