sFlow Library for EventMachine

Summary

This gem collects, parses, and optionally proxies sampled flow records from network switches and routers. For information about sFlow, refer to www.sflow.org.

Features

Version 1.0.0

• Ability to parse the following sFlow messages: Raw Packet Header, Generic Interface Counter, Ethernet Interface Counter

• All other sFlow messages are stubbed out. Their implementation should take no more than a few minutes for someone with access to an sFlow-capable device exporting these message types.

• Ability to proxy a copy of the sFlow packet to a secondary collector.

Examples

Collector:

c = EventMachine::SFlow::Collector.new(:host => "127.0.0.1")

c.on_sflow do |pkt|
  puts "Got #{pkt.samples.count} samples"

  pkt.samples.each do |sample|
    sample.records.each do |record|
      if record.is_a? EM::SFlow::RawPacketHeader
        puts "Received a sampled packet from #{pkt.agent} of length #{record.header.size}"
      elsif record.is_a? EM::SFlow::GenericInterfaceCounters
        puts "Interface #{record.if_index} on #{pkt.agent} has seen #{record.if_in_octets} inbound bytes, #{record.if_out_octets} outbound bytes"
      end
    end
  end
end

Proxy:

c = EventMachine::SFlow::Collector.new(:host => "127.0.0.1")
c.proxy_to "192.168.1.1"

Multiple callbacks and proxy targets can be defined simultaneously

Change Log

Version 1.0.0:

• Initial release

Credits

Author: Norman Elton normelton@gmail.com