<div dir="ltr">As you are receiving "wrong" packets at the agent level you could do a tcpdump at this point to capture packets ?</div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jun 7, 2019 at 4:39 PM Akeem Hamilton <<a href="mailto:AHamilton@greathealthworks.com">AHamilton@greathealthworks.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div lang="EN-US"> <div class="gmail-m_-7818735633619389780WordSection1"> Question how would I generate sflow pcap? Is there a sflow generator that you suggest I could use? I have tried Host sFlow for Windows, but still did not receive any information. From: Sylvain Afchain <<a href="mailto:safchain@redhat.com" target="_blank">safchain@redhat.com</a>> Sent: Friday, June 7, 2019 4:58 AM To: Akeem Hamilton <<a href="mailto:AHamilton@greathealthworks.com" target="_blank">AHamilton@greathealthworks.com</a>> Cc: <a href="mailto:skydive-dev@redhat.com" target="_blank">skydive-dev@redhat.com</a> Subject: Re: [Skydive-dev] sflow error inquiry <div> Hi Akeem, <div> </div> <div> It seems that the issue is due to sFlow packets. I did test the netflow pcap file with success. Can you please send me an sFlow pcap file so that I could test it as well. </div> <div> </div> <div> Thanks, </div> <div> Sylvain </div> </div> <div> <div> On Fri, Jun 7, 2019 at 1:10 AM Akeem Hamilton <<a href="mailto:AHamilton@greathealthworks.com" target="_blank">AHamilton@greathealthworks.com</a>> wrote: </div> <blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in"> <div> <div> According to the web interface its: Analyzer 0.22.0-e9114afe73de Do you need me to run a separate wireshark pcap from device that is sending netflow? From: Sylvain Afchain <<a href="mailto:safchain@redhat.com" target="_blank">safchain@redhat.com</a>> Sent: Thursday, June 6, 2019 7:11 AM To: Akeem Hamilton <<a href="mailto:AHamilton@greathealthworks.com" target="_blank">AHamilton@greathealthworks.com</a>> Cc: <a href="mailto:skydive-dev@redhat.com" target="_blank">skydive-dev@redhat.com</a> Subject: Re: [Skydive-dev] sflow error inquiry <div> Hi, <div> </div> <div> What is the version of Skydive you are using? If you can provide use a pcap file so that we could check why it's not properly decoded. </div> <div> </div> <div> Thanks. </div> <div> Sylvain </div> </div> <div> <div> On Thu, Jun 6, 2019 at 10:06 AM Akeem Hamilton <<a href="mailto:AHamilton@greathealthworks.com" target="_blank">AHamilton@greathealthworks.com</a>> wrote: </div> <blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0in 5pt 4.8pt"> <div> <div> Good day, we are in process of demoing the skydive application. We have deployed both the standalone application and via docker and are experiencing issues receiving flows with the sflow capture. We are getting the following: 2019-06-05T16:16:09.384Z ERROR sflow/agent.go:97 (*Agent).feedFlowTable skydive1: Unable to decode sFlow packet: PACKET: 1416 bytes - Layer 1 (1416 bytes) = DecodeFailure Packet decoding error: SFlow Datagram ha s invalid sample length: 0 2019-06-05T16:16:09.385Z ERROR sflow/agent.go:97 (*Agent).feedFlowTable skydive1: Unable to decode sFlow packet: PACKET: 1416 bytes - Layer 1 (1416 bytes) = DecodeFailure Packet decoding error: SFlow Datagram ha s invalid sample length: 0 2019-06-05T16:16:09.385Z ERROR sflow/agent.go:97 (*Agent).feedFlowTable skydive1: Unable to decode sFlow packet: PACKET: 1416 bytes - Layer 1 (1416 bytes) = DecodeFailure Packet decoding error: SFlow Datagram ha s invalid sample length: 0 2019-06-05T16:16:09.386Z ERROR sflow/agent.go:97 (*Agent).feedFlowTable skydive1: Unable to decode sFlow packet: PACKET: 1176 bytes - Layer 1 (1176 bytes) = DecodeFailure Packet decoding error: SFlow Datagram ha s invalid sample length: 0 2019-06-05T16:16:20.413Z ERROR sflow/agent.go:97 (*Agent).feedFlowTable skydive1: Unable to decode sFlow packet: PACKET: 744 bytes - Layer 1 (744 bytes) = DecodeFailure Packet decoding error: SFlow Datagram ha s invalid sample length: 0 We are currently testing softflowd to export from our Pfsense firewall (2.4.4-RELEASE-p1). We have also tested with a Windows sflow host exported and received similar issue where sflow capture does not show any flow on skydive. Are there any tips that we can try? </div> Akeem Hamilton Systems Engineer Great HealthWorks, Inc. <img border="0" width="250" height="50" style="width: 2.6041in; height: 0.5208in;" id="gmail-m_-7818735633619389780gmail-m_971107721385510486_x005f_x0000_i1025" src="https://mail.greathealthworks.com/sig/GHWLogo_NEW.png"> • 4150 SW 28th Way Fort Lauderdale, FL 33312 • Office Phone: 954-744-7400 ext. 2869 • Toll Free: 800-544-5654 ext. 2869 <a href="https://www.greathealthworks.com" target="_blank">GreatHealthWorks.com</a> follow us: <a href="https://twitter.com/greathealthwks" target="_blank"><img border="0" width="30" height="30" style="width: 0.3125in; height: 0.3125in;" id="gmail-m_-7818735633619389780gmail-m_971107721385510486_x005f_x0000_i1026" src="https://mail.greathealthworks.com/sig/Twitter.png"></a> <a href="https://www.linkedin.com/company/greathealthwks" target="_blank"><img border="0" width="30" height="30" style="width: 0.3125in; height: 0.3125in;" id="gmail-m_-7818735633619389780gmail-m_971107721385510486_x005f_x0000_i1027" src="https://mail.greathealthworks.com/sig/LinkedIn.png"></a> <a href="https://www.facebook.com/greathealthworks" target="_blank"><img border="0" width="30" height="30" style="width: 0.3125in; height: 0.3125in;" id="gmail-m_-7818735633619389780gmail-m_971107721385510486_x005f_x0000_i1028" src="https://mail.greathealthworks.com/sig/Facebook.png"></a> Disclaimer:_-*************************************************-_ This e-mail message contains confidential, privileged information intended solely for the addressee. Please do not read, copy, or disseminate it unless you are the addressee. If you have received it in error, please call and speak with the message sender. Also, we would appreciate your forwarding the message back to us and deleting it from your system. Every effort has been made to ensure that any attachment to this mail does not contain a virus. While we have taken every reasonable precaution to minimize this risk, neither it nor the sender can accept liability for any damage which you sustain as a result of software viruses. Please rely on your own virus check as no responsibility is taken by the sender for any damage arising out of any virus infection this communication may contain. This e-mail and all other electronic (including voice) communications from the sender's firm are for informational purposes only. No such communication is intended by the sender to constitute either an electronic record or an electronic signature or to constitute any agreement by the sender to conduct a transaction by electronic means. Any such intention or agreement is hereby expressly disclaimed unless otherwise specifically indicated. </div> _______________________________________________ Skydive-dev mailing list <a href="mailto:Skydive-dev@redhat.com" target="_blank">Skydive-dev@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/skydive-dev" target="_blank">https://www.redhat.com/mailman/listinfo/skydive-dev</a> </blockquote> </div> </div> </div> </blockquote> </div> </div> </div> </blockquote></div>