Skip to content

Latest commit

 

History

History
30 lines (19 loc) · 795 Bytes

README.md

File metadata and controls

30 lines (19 loc) · 795 Bytes
Raw

sFlow Packet Inspector

When run against a growing sFlow sampling file, this tool will attempt to identify cases of poorly constructed IP traffic.

This is intended for operation on small private networks.

Issues Detected

  • Sending to an incorrect MAC address for a given multicast IP
  • Sending to a multicast MAC address without a multicast IP
  • Sending to or from an all 0x00 MAC address
  • Sending to or from common testing MACs such as 'deadbeef'
  • Error and discard counts increasing on switch ports

TODO

  • Sending high volume multicast to groups not in the 232 or 239 ranges

Further issue detection may be added at a later date.

Requirements

  • Linux (untested on Windows and Mac)
  • Python 2.7

Usage

$ python inspector.py <sflow-filename>