Flow Tools AS-Path

Tue Apr 4 14:48:29 UTC 2023

Export of destination AS-Path is supported in the sFlow extended_gateway
structure.

/* Extended Gateway Data */
/* opaque = flow_data; enterprise = 0; format = 1003 */

struct extended_gateway {
   next_hop nexthop;           /* Address of the border router that should
                                  be used for the destination network */
   unsigned int as;            /* Autonomous system number of router */
   unsigned int src_as;        /* Autonomous system number of source */
   unsigned int src_peer_as;   /* Autonomous system number of source peer */
   as_path_type dst_as_path<>; /* Autonomous system path to the destination */
   unsigned int communities<>; /* Communities associated with this route */
   unsigned int localpref;     /* LocalPref associated with this route */
}

Arista EOS supports aspath if you enable sflow extension bgp. Cisco
also claims to support the feature on IOS XR platforms.

In addition to BGP, there are a number of MPLS, tunnel encap/decap
etc. sFlow extended structures.

Also optical interface metrics, dropped packet notifications, and more:

https://sflow.org/developers/specifications.php

On Tue, Apr 4, 2023 at 6:06 AM Mike Hammett <nanog at ics-il.net> wrote:

> One of the reasons to analyze flow data is to make purchase\peering
> decisions. The sFlow standard seems to only include source and destination
> AS, though I know some route platforms have extensions to provide
> additional data.
>
> 1) How common is it to have the additional extensions to include that data
> for analysis?
> 2) I have seen flow tools that show the entire AS path. Are they just
> cherry picking which platforms they showcase for the best marketing, or are
> they enriching the data they receive from "lesser" platforms from an
> outside source?
>
> For that purpose, knowing what ASes your data goes to is useful. It's even
> more useful to find an upstream network that includes a bunch of those.
>
>
>
> -----
> Mike Hammett
> Intelligent Computing Solutions
> http://www.ics-il.com
>
> Midwest-IX
> http://www.midwest-ix.com
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20230404/b45e4d14/attachment.html>