7

I'm trying to monitor my OpenVswitch via IPFix. But I'm banging my head against a brick wall for two days now :/

According to the ovs-vsctl manpage I need to add a new entry into the config-database, more precisely into the "ipfix"-table. That worked pretty well, and it looks like I got it right:

# ovs-vsctl list ipfix
_uuid               : 2d54982b-6cc5-4a8c-845c-cc7ef701da01
external_ids        : {}
obs_domain_id       : 123
obs_point_id        : 456
sampling            : 64
targets             : ["<collector-ip>:<port>"]

I then downloaded libIPFIX and started the example_collector. But nothing shows up. I don't receive any information. I confirmed it using wireshark ...

Some Google-Research brought up an eMail from the Mailinglist, which states that one needs

OpenFlow actions to cause IPFIX to be sent to the collectors

According to this eMail there are new "sample actions", but I couldn't find any further information how to add them.

My best guess is that I'm missing these OpenFlow Sample-Actions. Can anybody provide me with information how to add those?

/edit: I'm running OpenVswitch Version 1.11.0 on openSUSE 13.1 (x86_64).

To get IPFix to work I tried the following:

# ovs-vsctl -- set Bridge s1 ipfix=@i -- --id=@i create IPFIX targets=\"10.0.0.1:4739\" obs_domain_id=123 obs_point_id=456 sampling=64
2d54982b-6cc5-4a8c-845c-cc7ef701da01

To confirm that I did the ovs-vsctl list ipfix (see above)

A similar command worked as expected to get sFlow to work:

# ovs-vsctl -- set Bridge s1 sflow=@sflow -- --id=@sflow create sflow agent=eth0  target=\"10.0.0.1:6343\" header=128 sampling=32 polling=2
0df2b92b-8a83-4a63-acc4-fecf6f8f492f

Right after entering that line, I got sampling results send to my target computer. Unfortunately no luck with IPFix.

Improve this question
2
  • 1
    @ChristophHaefner What are your log files saying when you pass the failing IPFix command?
    – Ryan Foley
    Jan 22, 2014 at 8:36
  • 1
    @Fizzle: Thanks a million for the hint. I was search previously for log-files, but /var/log/openvswitch/ was empty, so I moved on. But with your push I searched more sophisticated and found a log-file: /var/log/ovs-vswitchd.log! And it's actually stating that he tries to deliver: "2014-01-22T10:09:04Z|1017630|collectors|WARN|sending to collector failed: Connection refused" Must have overlooked it while debugging with wireshark :/
    – Christoph Haefner
    Jan 22, 2014 at 9:12

1 Answer 1

Reset to default
5
+50

The verbiage you're using to setup IPFix is definately right.

This is what you have:

ovs-vsctl -- set Bridge s1 ipfix=@i -- --id=@i create IPFIX targets=\"10.0.0.1:4739\" obs_domain_id=123 obs_point_id=456 sampling=64

And pretty much the same example is outlined in the ovs-vsctl man file:

IPFIX

Configure bridge br0 to send one IPFIX flow record per packet sample to UDP port 4739 on host 192.168.0.34, with Observation Domain ID 123 and Observation Point ID 456:

ovs−vsctl −− set Bridge br0 ipfix=@i −− −−id=@i create IPFIX targets=\"192.168.0.34:4739\" obs_domain_id=123 obs_point_id=456

Based on your log file in the comments section:

2014-01-22T10:09:04Z|1017630|collectors|WARN|sending to collector failed: Connection refused

I think it would be resonable to assume the collector (10.0.0.1) is misconfigured or something is preventing connections inbound to it.

Improve this answer
8
  • You are 100% right with your assumption. I never thought about it because I'm using the example_collector from libipfix (which is supposed to be the reference-implementation).
    – Christoph Haefner
    Jan 22, 2014 at 9:56
  • I quickly wrote a little programm listening on the 4739-port and just dumping what he gets on screen. Debugging that with Wireshark again brings one important thing up: The Exporter doesn't send a template :/ Might also be the reason why the example collector refuses what he gets ...
    – Christoph Haefner
    Jan 22, 2014 at 9:59
  • What are you using for flow collection/analyzing?
    – Ryan Foley
    Jan 22, 2014 at 10:06
  • 3
    Thanks for your suggestion, I will look into it. I found the mistake by now: The example_collector from libipfix is listening on tcp:4739, while OpenVswitch was sending it out on udp:4739. I didn't see it in wireshark, because I was adding a filter "tcp.port == 4739" ... I was missing the template because it was send once at the very beginning and I stopped wireshark several times and restartet the scan without saving.
    – Christoph Haefner
    Jan 22, 2014 at 12:12
  • 1
    @ChristophHaefner, thank you for a good question. Please consider asking again if the need arises
    – Mike Pennington
    Jan 22, 2014 at 12:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.