gNPSI export for sFlow
Overview
The gRPC Network Packet Sampling Interface (gNPSI) is a gRPC-based interface for streaming sFlow samples from network devices to collection systems. It standardizes how devices export packet samples, replacing fragmented, vendor-specific approaches with a single programmatic API. gNPSI operates over a mutually authenticated, TLS-encrypted gRPC channel, enabling real-time delivery of sampled packet data as soon as it is generated.
Architecture
The following figure shows the gNPSI architecture.
-
The forwarding complex extracts sFlow samples and forwards them to the CPM (Control Processor Module) CPU.
-
The CPM CPU supports up to two concurrent gNPSI sessions to separate collectors and forwards the samples to both collectors in parallel.
-
Only the sFlow payload is transmitted through gNPSI. Any encapsulating IP or UDP transport headers are stripped before transmission.
gNPSI operates in a mutually exclusive mode with traditional IP-based flow export. When gNPSI transport is enabled:
-
You cannot configure the IP collector.
-
If no active gNPSI session exists, no samples are exported.
-
DSCP marking and UDP checksum options do not apply.
gNPSI service
To use gNPSI as the sFlow transport, you must first configure system grpc-server <name> services option to gnpsi and bring up the gNPSI service, because this service acts as the endpoint for all subscription-based sample streaming. After the service is active, any existing sFlow collectors under the sFlow configuration must be removed. Finally, to ensure that the samples are exported through the gNPSI session, configure the system sflow transport mode to gnpsi.
Congestion handling
gNPSI uses an acknowledged streaming model, where each transmitted message requires confirmation from the collector. Under high sampling rates, this model may introduce local congestion. To manage the congestion, you can configure a maximum size limit for the local buffer. gNPSI discards new samples when the buffer reaches the configured capacity.
gNPSI considerations
When configuring gNPSI transport, consider the following:
- 7250 IXR Gen 3
-
- Sample size configurations of 256 B and 512 B are supported.
- With 256 B configuration, captured samples is 256 B.
- With 512 B configuration, captured samples is 414 B
- 7250 IXR Gen 2c+
-
- Only 256 B sample size configuration is supported.
- Actual captured sample size is limited to 205 B.
- gNPSI egress sampling
-
- Supported for flow sampling of GUE packets
- With 256 B configuration, captured samples is 192 B.
- With 512 B configuration, captured samples is 448 B.
Sampling GUE traffic
Overview
This feature extends flow monitoring to provide visibility into traffic carried over GUE (Generic UDP Encapsulation) tunnels on SR Linux devices. The system samples packets that traverse GUE tunnels and exports additional telemetry information, allowing collectors to interpret both the tunnel headers and the original encapsulated traffic.
Based on the sampling point and tunnel-processing stage, the system automatically selects and exports the appropriate flow structure.
Encapsulation node sampling
On devices that perform encapsulation, the system exports different flow structures depending on where it samples the packet.
- Sampling at ingress before encapsulation
- See sampling described in sFlow sampling.
- Sampling at egress after encapsulation
-
Egress sampling occurs after GUE encapsulation. The system includes GUE tunnel header information in the exported sFlow sample. Each exported sFlow packet contains two flow records:
- The first flow record contains the GUE tunnel headers followed by the sFlow sample of the inner traffic.
- The second flow record contains the header offset information used to locate the inner packet within the encapsulated frame.
The system exports the following structure:/* opaque = flow_data; enterprise = 0; format = 1028 */ struct extended_decapsulate_ingress ( unsigned int inner_header_offset; );
Decapsulation node sampling
On devices that perform decapsulation, the system includes the appropriate structure depending on the sampling stage.
- Sampling at egress after decapsulation
- See sampling described in sFlow sampling.
- Sampling at ingress before decapsulation
-
Ingress sampling occurs before GUE decapsulation. The system includes GUE tunnel header information in the exported sFlow sample. Each sFlow packet contains two flow records:
- The first flow record contains the GUE tunnel headers along with the sFlow sample of the inner traffic.
- The second flow record contains the header offset information used to identify the location of the inner packet within the GUE-encapsulated frame.
The system exports the following structure:/* opaque = flow_data; enterprise = 0; format = 1027 */ struct extended_decapsulate_egress ( unsigned int inner_header_offset; );
Egress sampling
On 7250 IXR Gen 3 platforms, egress sampling is supported only with the gNPSI collector in conjunction with GUE configuration. The device supports a maximum sample size of 512 bytes. The configuration is as follows:
--{ + candidate shared default }--[ ]--
# info with-context system sflow
system {
sflow {
admin-state enable
transport gnpsi
sample-rate 50
egress-sample-rate 50
sample-size 512
dscp CS6
}
}Configuring gNPSI services
Configure a gNPSI service
The following example configures a gNPSI service
--{ + candidate shared default }--[ ]--
# info with-context system grpc-server test1
system {
grpc-server test1 {
admin-state enable
network-instance mgmt
port 57405
services [
gnpsi
]
}
}Configuring gNPSI transport for sFlow
- Specify gnpsi as the value for the transport parameter.
- Specify a value for the gnpsi-max-datagram-size parameter. The range is from 576 to 9446 bytes and the default value is 1468 bytes.
Configure gNPSI for sFlow
The following example configures the sFlow samples to export through a gNPSI connection.
--{ + candidate shared default }--[ ]--
# info with-context system sflow
system {
sflow {
transport gnpsi
gnpsi-max-datagram-size 586
}
}