sFlow Packet Inspector

When run against a growing sFlow sampling file, this tool will attempt to identify cases of poorly constructed IP traffic.

This is intended for operation on small private networks.

Issues Detected

• Sending to an incorrect MAC address for a given multicast IP
• Sending to a multicast MAC address without a multicast IP
• Sending to or from an all 0x00 MAC address
• Sending to or from common testing MACs such as 'deadbeef'
• Error and discard counts increasing on switch ports

TODO

• Sending high volume multicast to groups not in the 232 or 239 ranges

Further issue detection may be added at a later date.

Requirements

• Linux (untested on Windows and Mac)
• Python 2.7

Usage

$ python inspector.py <sflow-filename>