No metrics when using Linux bond with pcap

[MiniPierre]

Hello,

Since release v2.1.14-2, our machines using bond interface do not send metrics anymore, while it works when using the bond slave interfaces.

This does not send metrics anymore:

pcap { dev=bond0 }

This works:

pcap { dev=eth0 }
pcap { dev=eth1 }

[cw-Guo]

the setup logic change a little bit, before if you specify a dev name, it just creates the pcap for it. But right now, even if you specify a devname, they need to pass some validations: https://github.com/sflow/host-sflow/blob/master/src/Linux/mod_pcap.c#L511-L525

[bnerickson]

Is there a way to disable the port speed validation? This breaks capturing Linux vNIC interfaces on the VMs themselves because they don't often report ifSpeed (xen in my case).

[sflow]

Hi,

It's not supposed to consider the ifSpeed unless you mention it in your /etc/hsflowd.conf settings. And if you do need to specify an ifSpeed range, then you can set the lower bound to 0 if you need to, like this:

pcap { speed=0-1T }

Does that answer your question, or is there a bug?

About the bond interfaces -- the sFlow spec has special treatment for bonds / LAGs:
https://sflow.org/sflow_lag.txt

To summarize you are required to send counters and packet samples for the components, but only counters for the bond/LAG. And the counter structures must include the meta-data about the relationship between the components and the bond/LAG. Most obviously the ifIndex numbers, but the MAC address that identifies the LAG is also important because that is also known at the other end of the link.

Why should we go to so much trouble? Well, it's because observations on all ports of a LAG or MLAG need to be summed before any deduplication is attempted. It's necessary information so that the collector can put together the end-to-end, network-wide traffic matrix.

hsflowd has code to put this together automatically by reading the Linux bond state:

host-sflow/src/Linux/readNioCounters.c

Line 248 in 9ff4e65

void readBondState(HSP *sp) {

[bnerickson]

Hi,

It's not supposed to consider the ifSpeed unless you mention it in your /etc/hsflowd.conf settings. And if you do need to specify an ifSpeed range, then you can set the lower bound to 0 if you need to, like this:

pcap { speed=0-1T }

Does that answer your question, or is there a bug?

I'll open a new issue as mine appears unrelated and may be related to eBPF in v2.1.14+ instead.