VyOS is an open source router operating system based on Linux. This article discusses how to improve network traffic visibility on VyOS based routers using the open source
Host sFlow agent.
VyOS claims sFlow support, so why is it necessary to install an alternative sFlow agent? The following experiment demonstrates that there are significant issues with the VyOS sFlow implementation.
vyos@vyos:~$ show version
Version: VyOS 1.4-rolling-202301260317
Release train: current
Built by: autobuild@vyos.net
Built on: Thu 26 Jan 2023 03:17 UTC
Build UUID: a95385b7-12f9-438d-b49c-b91f47ea7ab7
Build commit ID: d5ea780295ef8e
Architecture: x86_64
Boot via: installed image
System type: KVM guest
Hardware vendor: innotek GmbH
Hardware model: VirtualBox
Hardware S/N: 0
Hardware UUID: 6988d219-49a6-0a4a-9413-756b0395a73d
Copyright: VyOS maintainers and contributors
Install a recent version of VyOS under
VirtualBox and configure routing between two Linux virtual machines connected to
eth1 and
eth2 on the router. Out of band management is configured on
eth0.
set system flow-accounting disable-imt
set system flow-accounting sflow agent-address 10.0.0.50
set system flow-accounting sflow sampling-rate 1000
set system flow-accounting sflow server 10.0.0.30 port 6343
set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting interface eth2
The above commands configure sFlow monitoring on VyOS using the native sFlow agent.
The
sflow/sflow-test tool is used to test the sFlow implementation while generating traffic consisting of a series of
iperf3 tests (each generating approximately 50Mbps). The test fails in a number of significant ways:
- The implementation of sFlow is incomplete, omitting required interface counter export
- The peak traffic reported (3Mbps) is a fraction of the traffic generated by iperf3
- There is an inconsistency in the packet size reported in the sFlow messages
- Tests comparing counters and flow data fail because of missing counter export (1)
Fortunately, VyOS is a Linux based operating system, so we can install the
Host sFlow agent as an alternative to the native sFlow implementation to provide traffic visibility.
delete system flow-accounting
First, disable the native VyOS sFlow agent.
wget https://github.com/sflow/host-sflow/releases/download/v2.0.38-1/hsflowd-ubuntu20_2.0.38-1_amd64.deb
sudo dpkg -i hsflowd-ubuntu20_2.0.38-1_amd64.deb
Next, download and install the Host sFlow agent by typing the above commands in VyOS shell.
# hsflowd configuration file
# http://sflow.net/host-sflow-linux-config.php
sflow {
collector { ip=10.0.0.30 }
pcap { dev = eth0 }
pcap { dev = eth1 }
pcap { dev = eth2 }
}
Edit the
/etc/hsflowd.conf file.
systemctl restart hsflowd
Restart the sFlow agent to pick up the new configuration.
Rerunnig
sflow-test shows that the implementation now passes. The peaks shown in the trend graph are consistent with the traffic generated by
iperf3 and with traffic levels reported in interface counters.
The
sflow/sflow-test Docker image also includes the
Flow Browser application that can be used to monitor traffic flows in real-time. The screen shot above shows traffic from a single
iperf3 test.
The
sflow/sflow-test Docker image also includes the
Metric Browser application that can be used to monitor counters in real-time. The screen shot above shows
cpu_utilization.
The sFlow Test, Browse Flows and Browse Metrics applications run on the sFlow-RT analytics engine. Additional examples include Flow metrics with Prometheus and Grafana and DDoS protection quickstart guide.
