sFlow packet frame length is truncated

Bugs
1

Hello team,

I’ve encountered an issue while using sFlow. UDP 1470 bytes datagrams are sent through the Vyos at a rate of 40 Mb/s, however the sFlow packets report the wrong frame length, as seen below:

image
image816×789 37.8 KB

As you can see, the frame length is 10x inferior than it’s supposed to be.

Here’s an example of another router brand’s sFlow packet:

image
image1037×623 91.6 KB

Frame length value is supposed to be the following:

unsigned int frame_length;      /* Original length of packet before
                                      sampling.
                                      Note: For a layer 2 header_protocol,
                                            length is total number of octets
                                            of data received on the network 
                                            (excluding framing bits but
                                            including FCS octets).
                                            Hardware limitations may
                                            prevent an exact reporting
                                            of the underlying frame length,
                                            but an agent should attempt to
                                            be as accurate as possible. Any
                                            octets added to the frame_length
                                            to compensate for encapsulations
                                            removed by the underlying hardware
                                            must also be added to the stripped
                                            count. */

Thanks

2

Has anyone noticed a similar issue ?

3

The first difference is UDP vs TCP

4

Right, it was just an example of a different flow on a different device. Here is a TCP flow from my Vyos:

image
image804×813 37.2 KB

You can see that “Frame length” is still at 146.
You’ll also notice the small payload size of 80 bytes, during this test I was uploading at 6 MB/s, but every flow received had the same payload size, so the end result was wrong. But this might be a different issue altogether.

Going back to the “Frame length = 146”, I have further experimented since then. I have tried reducing the size of the UDP datagrams to 1000 and 100, here are the PCAP results:

image
image779×343 15.9 KB

image
image780×341 17.8 KB

Frame length seems to be stuck at the value 146 whatever the length of the packet.

Here is my config:
set system flow-accounting disable-imt
set system flow-accounting buffer-size 64
set system flow-accounting enable-egress
set system flow-accounting interface eth0
set system flow-accounting sflow agent-address xxxxxx.217
set system flow-accounting sflow sampling-rate 64
set system flow-accounting sflow server xxxxxx.221

5

at first look, I did not find anything regarding configurable config key

6

I don’t think frame_length is a config key, shouldn’t it be a value determined automatically from the headers and payload sizes ? Or am I mistaken ?