Post Syndicated from Anonymous original http://deliantech.blogspot.com/2014/06/simple-example-for-nodejs-sflow.html
Tag Archives: sflow
SFlow version 5 module for Node.JS
Post Syndicated from Anonymous original http://deliantech.blogspot.com/2014/06/sflow-version-5-module-for-nodejs.html
var Collector = require('node-sflow');
Collector(function(flow) {
console.log(flow);
}).listen(3000);
However, the SFlow support in the agents – the networking equipment is usually extremely simplified – far from the richness and complexity the SFlow protocol may provide. Most of the vendors just do packet sampling and send them over SFlow as raw packet/frame header with an associated unclear counter.
In case of you having the issue specified above, this module cannot help much. You will just get the raw packet header (usually Ethernet + IP header) as a Node.JS buffer and then you have to decode it on your own. I want to keep the node-sflow module simple and I don’t plan to decode raw packet headers there as this feature is not a feature of the SFlow itself.
If you need to decode the raw packet header I can suggest one easy solution for you. You can use the pcap module from the npm repository and decode the raw header with it:
var Collector = require('node-sflow');
var pcap = require('pcap');
Collector(function(flow) {
if (flow && flow.flow.records && flow.flow.records.length>0) {
flow.flow.records.forEach(function(n) {
if (n.type == 'raw') {
if (n.protocolText == 'ethernet') {
try {
var pkt = pcap.decode.ethernet(n.header, 0);
if (pkt.ethertype!=2048) return;
console.log('VLAN',pkt.vlan?pkt.vlan.id:'none','Packet',pkt.ip.protocol_name,pkt.ip.saddr,':',pkt.ip.tcp?pkt.ip.tcp.sport:pkt.ip.udp.sport,'->',pkt.ip.daddr,':',pkt.ip.tcp?pkt.ip.tcp.dport:pkt.ip.udp.dport)
} catch(e) { console.log(e); }
}
}
});
}
}).listen(3000);