Packet sample action in tc(8) Linux Packet sample action in tc(8)
sample - packet sampling tc action
tc ... action sample rate RATE group GROUP [ trunc SIZE ] [ index INDEX
tc ... action sample index INDEX
The sample action allows sampling packets matching classifier.
The packets are chosen randomly according to the rate parameter, and
are sampled using the psample generic netlink channel. The user can
also specify packet truncation to save user-kernel traffic. Each sample
includes some informative metadata about the original packet, which is
sent using netlink attributes, alongside the original packet data.
The user can either specify the sample action parameters as presented
in the first form above, or use an existing sample action using its
index, as presented in the second form.
SAMPLED PACKETS METADATA FIELDS
The metadata are delivered to userspace applications using the psample
generic netlink channel, where each sample includes the following
The input interface index of the packet, if there is one.
The output interface index of the packet. This field is not rel-
evant on ingress sampling
The size of the original packet (before truncation)
The psample group the packet was sent to
A sequence number of the sampled packet. This number is incre-
mented with each sampled packet of the current psample group
The rate the packet was sampled with
The packet sample rate. RATE is the expected ratio between
observed packets and sampled packets. For example, RATE of 100
will lead to an average of one sampled packet out of every 100
Upon set, defines the maximum size of the sampled packets, and
causes truncation if needed
The psample group the packet will be sent to. The psample module
defines the concept of groups, which allows the user to match
specific sampled packets in the case of multiple sampling rules,
thus identify only the packets that came from a specific rule.
Is a unique ID for an action. When creating new action instance,
this parameter allows to set the new action index. When using
existing action, this parameter allows to specify the existing
action index. The index must 32bit unsigned integer greater
Sample one of every 100 packets flowing into interface eth0 to psample
tc qdisc add dev eth0 handle ffff: ingress
tc filter add dev eth0 parent ffff: matchall \
action sample rate 100 group 12 index 19
Use the same action instance to sample eth1 too:
tc qdisc add dev eth1 handle ffff: ingress
tc filter add dev eth1 parent ffff: matchall \
action sample index 19
tc(8), tc-matchall(8) psample(1)
iproute2 31 Jan 2017 Packet sample action in tc(8)
Man Pages Copyright Respective Owners. Site Copyright (C) 1994 - 2022
All Rights Reserved.