On 11/24/25 3:00 PM, Brendan Doyle via discuss wrote:
> Hi Folks,
>
> An OVN IPFIX log collected with nfcapd and displayed with nfdump is
> shown below.
> A lot of fields are displayed as '0' or "" are these ever populated by
> OVN, or
> is it that nfcapd/nfdump just doe snot understand the OVN IPFIX template?
>
Hi Brendan,
I only looked at some random fields below.
>
> Thanks
>
>
> Brendan.
>
>
>
>
> {
>
> "cnt" : 1,
>
> "type" : "FLOW",
>
> "ident" : "253-255-2-5",
>
> "export_sysid" : 6,
>
> "first" : "1969-12-31T19:04:59.000",
>
> "last" : "1969-12-31T19:04:59.000",
>
> "received" : "2025-11-04T12:11:27.703",
>
> "in_packets" : 218,
>
> "in_bytes" : 30645,
>
> "proto" : 6,
>
> "tcp_flags" : "........",
>
> "src_port" : 40000,
>
> "dst_port" : 513,
>
> "fwd_status" : 0,
>
> "src_tos" : 0,
>
> "src4_addr" : "192.16.1.5",
>
> "dst4_addr" : "192.16.1.6",
>
> "src4_geo" : "",
>
> "dst4_geo" : "",
These two are populated by nfdump based on src4_addr/dst4_addr and its
configuration file:
https://github.com/phaag/nfdump/blob/423b6c9fb0e95ad665f26064c11a29bfd5a10791/src/maxmind/geolookup.c#L176
>
> "input_snmp" : 33,
> >
> "output_snmp" : 0,
>
> "src_mask" : 0,
>
> "dst_mask" : 0,
>
> "src_net" : "",
>
> "dst_net" : "",
>
These seem to always be set to 0 by nfdump for IPv4:
https://github.com/phaag/nfdump/blob/423b6c9fb0e95ad665f26064c11a29bfd5a10791/src/output/output_json.c#L252
> "direction" : 0,
>
> "dst_tos" : 0,
>
> "ip4_router" : "253.255.2.5",
>
> "in_src_mac" : "52:54:00:e6:4f:46",
>
> "out_dst_mac" : "00:00:00:00:00:00",
>
> "in_dst_mac" : "52:54:00:be:06:16",
>
> "out_src_mac" : "00:00:00:00:00:00",
>
> "observationDomainID" : 738197511,
>
> "observationPointID" : 17625,
>
> "vlanID" : 0,
>
> "post_vlanID" : 0,
>
> "cust_vlanID" : 0,
>
> "post_cust_vlanID" : 0,
>
> "phys_ingress" : 0,
>
> "phys_egress" : 0,
>
> "ethertype" : 0,
>
I think these might not be populated by OVS, e.g., ethertype:
https://github.com/phaag/nfdump/blob/423b6c9fb0e95ad665f26064c11a29bfd5a10791/src/output/output_json.c#L691
> "ip_version" : 4,
>
> "ip_minttl" : 64,
>
> "ip_maxttl" : 0,
>
> "sampled" : 0
>
> },
>
>
Regards,
Dumitru
_______________________________________________
discuss mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-discuss
