sFlow agent on Huawei sends too short packets when traffic includes vlans

[pavel-odintsov]

sFlow agent on Huawei sends too short packets when traffic includes vlans

[pavel-odintsov]

We have customer with that exact issue with Huawei NE 8000 F1A.

Software:

Issue:

[pavel-odintsov]

Another very strange thing with Huawei that they do export Ethernet, Raw and IPv4 headers in same time.

[pavel-odintsov]

I actually do not see any advantages in exporting all of them as RAW includes all the things.

As consequence each flow entry is almost 288 bytes and each UDP packet carries just 4 of them:

Other vendors can export 10-15 packets in each UDP packet by exporting only raw.

[pavel-odintsov]

I got some hints from Neil McKee from InMon Corp to look on standard and Standard is pretty clear about this case:

A flow_sample must contain packet header information. The prefered format for reporting packet header information is the sampled_header. However, if the packet header is not available to the sampling process then one or more of sampled_ethernet, sampled_ipv4, sampled_ipv6 may be used.

So raw packet header is more then enough. Ethernet and IPv4 headers are redundant in this case and can be skipped.

[pavel-odintsov]

I re-opened ticket for visibility. Both FastNetMon Advanced and Community can handle such packets but we need to communicate / confirm it with Huawei.

[jackey123-king]

about the packet lenth, you can try this command:
"sflow max-packet-length"
The sflow max-packet-length command configures the maximum length of sFlow packet payload.

[pavel-odintsov]

Hello! Thank you for feedback. It is supported by Huawei?

…

On Fri, 1 Sep 2023 at 11:29, jackey123-king ***@***.***> wrote: about the packet lenth, you can try this command: "sflow max-packet-length" The sflow max-packet-length command configures the maximum length of sFlow packet payload. — Reply to this email directly, view it on GitHub <#990 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAU56ZSNZTDGLNCXZWFELJTXYGMHZANCNFSM6AAAAAA2OYABCY> . You are receiving this because you modified the open/close state.Message ID: ***@***.***>

[jackey123-king]

yes，Huawei‘s router can support this function.

[pavel-odintsov]

I found this option "sflow flow-sampling max-header length": https://support.huawei.com/enterprise/en/doc/EDOC1000178165?section=j04t