1Packet sample action in tc(8)        Linux       Packet sample action in tc(8)
2
3
4

NAME

6       sample - packet sampling tc action
7

SYNOPSIS

9       tc ... action sample rate RATE group GROUP [ trunc SIZE ] [ index INDEX
10               ]
11
12       tc ... action sample index INDEX
13
14

DESCRIPTION

16       The sample action allows sampling packets matching classifier.
17
18       The packets are chosen randomly according to the  rate  parameter,  and
19       are  sampled  using  the  psample generic netlink channel. The user can
20       also specify packet truncation to save user-kernel traffic. Each sample
21       includes  some informative metadata about the original packet, which is
22       sent using netlink attributes, alongside the original packet data.
23
24       The user can either specify the sample action parameters  as  presented
25       in the first form above, or use an existing sample action using its in‐
26       dex, as presented in the second form.
27
28

SAMPLED PACKETS METADATA FIELDS

30       The metadata are delivered to userspace applications using the  psample
31       generic  netlink  channel,  where  each  sample  includes the following
32       netlink attributes:
33
34       PSAMPLE_ATTR_IIFINDEX
35              The input interface index of the packet, if there is one.
36
37       PSAMPLE_ATTR_OIFINDEX
38              The output interface index of the packet. This field is not rel‐
39              evant on ingress sampling
40
41       PSAMPLE_ATTR_ORIGSIZE
42              The size of the original packet (before truncation)
43
44       PSAMPLE_ATTR_SAMPLE_GROUP
45              The psample group the packet was sent to
46
47       PSAMPLE_ATTR_GROUP_SEQ
48              A  sequence  number of the sampled packet. This number is incre‐
49              mented with each sampled packet of the current psample group
50
51       PSAMPLE_ATTR_SAMPLE_RATE
52              The rate the packet was sampled with
53
54

OPTIONS

56       rate RATE
57              The packet sample rate.  RATE is the expected ratio between  ob‐
58              served  packets  and  sampled  packets. For example, RATE of 100
59              will lead to an average of one sampled packet out of  every  100
60              observed.
61
62       trunc SIZE
63              Upon  set,  defines the maximum size of the sampled packets, and
64              causes truncation if needed
65
66       group GROUP
67              The psample group the packet will be sent to. The psample module
68              defines  the  concept  of groups, which allows the user to match
69              specific sampled packets in the case of multiple sampling rules,
70              thus identify only the packets that came from a specific rule.
71
72       index INDEX
73              Is a unique ID for an action. When creating new action instance,
74              this parameter allows one to set the new action index. When  us‐
75              ing  existing  action,  this parameter allows one to specify the
76              existing action index.  The index must  32bit  unsigned  integer
77              greater than zero.
78

EXAMPLES

80       Sample  one of every 100 packets flowing into interface eth0 to psample
81       group 12:
82
83              tc qdisc add dev eth0 handle ffff: ingress
84              tc filter add dev eth0 parent ffff: matchall \
85                   action sample rate 100 group 12 index 19
86
87       Use the same action instance to sample eth1 too:
88
89              tc qdisc add dev eth1 handle ffff: ingress
90              tc filter add dev eth1 parent ffff: matchall \
91                   action sample index 19
92
93

SEE ALSO

95       tc(8), tc-matchall(8) psample(1)
96
97
98
99iproute2                          31 Jan 2017    Packet sample action in tc(8)