0
It can be very useful to capture sFlow telemetry from production networks so that it can be replayed later to perform off-line analysis, or to develop or evaluate sFlow collection tools.
sudo tcpdump -i any -s 0 -w sflow.pcap udp port 6343
Run the command above on the system you are using to collect sFlow data (if you aren't yet collecting sFlow, see
Agents for suggested configuration settings). Type
Control-C to end the capture after 5 to 10 minutes. Copy the resulting
sflow.pcap file to your laptop.
docker run --rm -it -v $PWD/sflow.pcap:/sflow.pcap sflow/sflowtool \
-r /sflow.pcap -P 1
Either compile the latest version of
sflowtool or, as shown above, use
Docker to run the pre-built
sflow/sflowtool image. The
-P (Playback) option replays the trace in real-time and displays the contents of each sFlow message.
Running sflowtool using Docker provides additional examples, including converting the sFlow messages into JSON format for processing by a Python script.
docker run --rm -it -v $PWD/sflow.pcap:/sflow.pcap sflow/sflowtool \
-r /sflow.pcap -f 192.168.4.198/6343 -P 1
The -
f (forwarding) option takes an IP address and UDP port number as arguments, in this
Continue reading