[ixpmanager] Discrepancies between sflow hosts

[Ian Chilton]

Hi!

Been trawling around the code, debugging this.

Focusing on one example of a dropped flow:

(NOTE: I changed the mac addresses and ips throughout all of this, as 
not to post anything sensitive):

DEBUG: dropped update for: protocol: 4 vlan: 4 srcmac: d46a35311111 
srcvli: 472 dest: 001f9ed20000 dstvli: 0 pktsize: 1057 samplerate: 16384
DEBUG: rejected: 
FLOW,192.168.83.23,1000100,35001,d46a35311111,001f9ed20000,0x0800,4,4,176.1.2.3,212.1.2.3,6,0x00,125,62012,10443,0x18,1057,1039,16384

Debugging sflow-to-rrd-handler first…

sub getvlifrommactable is returning 0 because 
$mactable->{$infra}->{$vlan}->{$mac} is not defined for that destination 
mac.
($mactable->{$infra}->{$vlan} is defined and does not contain that mac).

So, we make a call to: 
https://ixpmanager.example.com/v4/sflow-db-mapper/learned-macs with a 
valid API key.

Sure enough, that mac is not in the returned list!

…but it is in the database - for 2x vlans, which matches what I see in 
the MAC address table on the switch they are connected to:

xxx-sr2#sh mac address-table int Po123
           Mac Address Table
------------------------------------------------------------------

Vlan    Mac Address       Type        Ports      Moves   Last Move
----    -----------       ----        -----      -----   ---------
    4    001f.9ed2.0000    DYNAMIC     Po123      1       11 days, 
10:13:58 ago
  300    001f.9ed2.0000    DYNAMIC     Po123      1       11 days, 
10:13:58 ago
Total Mac Addresses for this criterion: 2

mysql> select * from l2address where mac='001f9ed20000';
+----+-------------------+--------------+---------------------+----------+---------------------+
| id | vlan_interface_id | mac          | firstseen           | lastseen 
| created             |
+----+-------------------+--------------+---------------------+----------+---------------------+
| 62 |                62 | 001f9ed20000 | 2018-06-20 15:44:14 | NULL     
| 2018-06-20 15:47:14 |
| 63 |               243 | 001f9ed20000 | 2018-06-20 15:44:14 | NULL     
| 2018-06-20 15:47:14 |
+----+-------------------+--------------+---------------------+----------+---------------------+
2 rows in set (0.00 sec)

So then we end up at sflowLearnedMacs():
https://github.com/inex/IXP-Manager/blob/f9645b3d1bdcbecd76c24ca7867c3a033cfb017e/app/Http/Controllers/Api/V4/VlanInterfaceController.php#L76

Which in turn uses sflowLearnedMacsHash():
https://github.com/inex/IXP-Manager/blob/f9645b3d1bdcbecd76c24ca7867c3a033cfb017e/database/Repositories/VlanInterface.php#L448

Which uses this query:

         return $this->getEntityManager()->createQuery(
             "SELECT DISTINCT vli.id AS vliid, ma.mac AS mac, vl.number 
as tag, i.id as infrastructure
                     FROM Entities\VirtualInterface vi
                         LEFT JOIN vi.VlanInterfaces vli
                         JOIN vi.MACAddresses ma
                         LEFT JOIN vli.Vlan vl
                         LEFT JOIN vl.Infrastructure i
                     WHERE ma.mac IS NOT NULL
                         AND vli.id IS NOT NULL
                     ORDER BY vliid"
         )->getArrayResult();

How can one print out the SQL that generates as a string??

Unable to work out how to get the exact query, I poked around the 
database and came up with something similar…

mysql> SELECT l2.*, vli.id AS vli_id, vl.id AS vlan_id, vl.name AS vlan, 
vl.number AS vlan_num FROM l2address l2 LEFT JOIN vlaninterface vli on 
l2.vlan_interface_id = vli.id LEFT JOIN vlan vl ON vli.vlanid = vl.id 
LEFT JOIN infrastructure i ON vl.infrastructureid = i.id WHERE 
l2.mac='001f9ed20000';
+----+-------------------+--------------+---------------------+----------+---------------------+--------+---------+----------------------+----------+
| id | vlan_interface_id | mac          | firstseen           | lastseen 
| created             | vli_id | vlan_id | vlan                 | 
vlan_num |
+----+-------------------+--------------+---------------------+----------+---------------------+--------+---------+----------------------+----------+
| 62 |                62 | 001f9ed20000 | 2018-06-20 15:44:14 | NULL     
| 2018-06-20 15:47:14 |     62 |       1 | LONAP Peering LAN #1 |        
4 |
| 63 |               243 | 001f9ed20000 | 2018-06-20 15:44:14 | NULL     
| 2018-06-20 15:47:14 |    243 |      81 | P379                 |      
379 |
+----+-------------------+--------------+---------------------+----------+---------------------+--------+---------+----------------------+----------+
2 rows in set (0.00 sec)

So it seems as if the /v4/sflow-db-mapper/learned-macs call might not be 
returning all the macs it should, but I can’t quite pinpoint why….

Any ideas?

Thanks,

Ian
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.inex.ie/pipermail/ixpmanager/attachments/20210222/f381fc8a/attachment.htm>