Session
Network wide visibility with Linux networking and sFlow
Speakers
Peter Phaal
Neil McKee
Ido Schimmel
Roopa Prabhu
Andy Roulin
Label
Nuts and Bolts
Session Type
Talk
Contents
Description
Network traffic control requires real-time traffic monitoring, analysis, anomaly detection and response. There are many real time network analytics tools available on Linux and networking hardware today. In this paper we talk about sFlow, an industry standard for real-time network monitoring. We will look at how sFlow can be used to monitor a data center fabric consisting of networking hardware running Linux (switches and routers) and Linux virtual nodes. We will dive into the details of sflow integration into the Linux stack, Linux kernel, ecosystem and oss software. sFlow is supported by most networking hardware vendors. Linux native support for packet sampling was introduced in the kernel followed by integrations into hardware support for packet sampling [1,2]. We will look at sFlow data formats, recent extensions to include drops, latency and queue depth and use these to detect and respond to events in the network fabric. Real-time sFlow analytics can be used to rapidly detect DDoS attacks and filter them (e.g. with BGP FlowSpec or tc rules) before they even ramp up. Buffer-depth and transit-delay as measurements more commonly associated with in-band telemetry, are now also available out-of-band in standard sFlow. [1] netlink psample introduced in the kernel: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/include/net/psample.h?id=6ae0a6286171154661b74f7f550f9441c6008424 [2] additional metadata for psample https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2117fce81f6b862aac0673abe8df0c60dca64bfa
Recent News
Please take our Poll Regarding next Conference Interest
[Mon, 24, Jan. 2022]
Videos are up
[Tue, 31, Aug. 2021]
Session slides and papers posted
[Tue, 10, Aug. 2021]
Update on Industry Perspectives Panel
[Mon, 12, Jul. 2021]
Attendee and Speaker Guides for Conference Added
[Tue, 06, Jul. 2021]
Important Dates
March 16th, 2021 | Call For Submissions Open |
April 15th, 2021 | Conference Registration Open |
June 10th, 2021 | Call For Submissions closed |
June 15th, 2021 | Acceptance Notifications complete |
July 15th, 2021 | Slides and papers for talks are due. Recordings start! |
July 7th - 23rd, 2021 |
Netdev 0x15 Conference |