Session

Network wide visibility with Linux networking and sFlow

Speakers

Peter Phaal
Neil McKee
Ido Schimmel
Roopa Prabhu
Andy Roulin

Label

Nuts and Bolts

Session Type

Talk

Contents

Description

Network traffic control requires real-time traffic monitoring, analysis, anomaly detection and response. There are many real time network analytics tools available on Linux and networking hardware today. In this paper we talk about sFlow, an industry standard for real-time network monitoring. We will look at how sFlow can be used to monitor a data center fabric consisting of networking hardware running Linux (switches and routers) and Linux virtual nodes. We will dive into the details of sflow integration into the Linux stack, Linux kernel, ecosystem and oss software. 
sFlow is supported by most networking hardware vendors. Linux native support for packet sampling was introduced in the kernel followed by integrations into hardware support for packet sampling [1,2]. We will look at sFlow data formats, recent extensions to include drops, latency and queue depth and use these to detect and respond to events in the network fabric. 
 
Real-time sFlow analytics can be used to rapidly detect DDoS attacks and filter them (e.g. with BGP FlowSpec or tc rules) before they even ramp up. Buffer-depth and transit-delay as measurements more commonly associated with in-band telemetry,  are now also available out-of-band in standard sFlow. 

[1] netlink psample introduced in the kernel: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/include/net/psample.h?id=6ae0a6286171154661b74f7f550f9441c6008424
[2] additional metadata for psample https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2117fce81f6b862aac0673abe8df0c60dca64bfa