Hi,
I have setup Sflow to send traffik to a server. I started Wireshark, hoping that i could start analyzing the packets, only to find out, that Wireshark doesnt extract the data from the Sflow. It only shows the actual sflow packet. How can i extract/convert the data to look like normal data?
I think you have a misunderstanding of sFlow, it's a sampling of traffic and does not contain the entire traffic flow.
See the SharkFest US 18 presentation from Simone Mainardi on sFlow: Theory and Practice of a Sampling Technology for more info, particularly the slides on when sFlow is not useful.
Asked: 2020-08-19 09:14:14 +0000
Seen: 310 times
Last updated: Aug 19 '20
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
What would "normal data" be? Are you looking for collector stats or something else?
(Note to future readers: the presentation @grahamb linked to shows wireshark-ntop , which includes a Lua plugin for Wireshark to display collector stats.)