Add BPF support for sFlow flow samples in collection mode
Nobody has claimed this yet.
- Dominant language
- Lua
- Stars
- 1.8k
- Forks
- 51
- PR merge metrics
- No merged PRs in 30d
Description
We're using nProbe as a collector for sFlow samples from our BGP routers. We would like to only collect and log the remote traffic from and to our networks. This would mean that we need to filter and ignore any traffic from and to our own networks.
To achieve this a BPF filter could be set (src net 1.2.3.4/20 || src net 5.6.7.8/20) and not (dst net 1.2.3.4/20 || dst net 5.6.7.8/20) but it isn't supported: You cannot use BPF filters in collector/proxy mode: BPF filter disabled.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the collector/proxy-mode path that reports “BPF filter disabled” and the code handling sFlow samples. Determine how the requested source and destination network filter should apply to remote traffic, then verify that equivalent BPF expressions are accepted and filtering behaves as described.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100