Packet sample action in tc(8)1 Jan 201P7a)cket sample action in tc(8)

     NAME
          sample - packet sampling tc action

     SYNOPSIS
          tc ... action sample rate RATE group GROUP [ trunc SIZE ]  [
                  index INDEX ]

          tc ... action sample index INDEX

     DESCRIPTION
          The sample action allows sampling packets matching classi-
          fier.

          The packets are chosen randomly according to the rate param-
          eter, and are sampled using the psample generic netlink
          channel. The user can also specify packet truncation to save
          user-kernel traffic. Each sample includes some informative
          metadata about the original packet, which is sent using net-
          link attributes, alongside the original packet data.

          The user can either specify the sample action parameters as
          presented in the first form above, or use an existing sample
          action using its index, as presented in the second form.

     SAMPLED PACKETS METADATA FIELDS
          The metadata are delivered to userspace applications using
          the psample generic netlink channel, where each sample
          includes the following netlink attributes:

          PSAMPLE_ATTR_IIFINDEX
               The input interface index of the packet, if there is
               one.

          PSAMPLE_ATTR_OIFINDEX
               The output interface index of the packet. This field is
               not relevant on ingress sampling

          PSAMPLE_ATTR_ORIGSIZE
               The size of the original packet (before truncation)

          PSAMPLE_ATTR_SAMPLE_GROUP
               The psample group the packet was sent to

          PSAMPLE_ATTR_GROUP_SEQ
               A sequence number of the sampled packet. This number is
               incremented with each sampled packet of the current
               psample group

     Page 1                      iproute2            (printed 5/24/22)

     Packet sample action in tc(8)1 Jan 201P7a)cket sample action in tc(8)

          PSAMPLE_ATTR_SAMPLE_RATE
               The rate the packet was sampled with

     OPTIONS
          rate RATE
               The packet sample rate.  RATE is the expected ratio
               between observed packets and sampled packets. For exam-
               ple, RATE of 100 will lead to an average of one sampled
               packet out of every 100 observed.

          trunc SIZE
               Upon set, defines the maximum size of the sampled pack-
               ets, and causes truncation if needed

          group GROUP
               The psample group the packet will be sent to. The
               psample module defines the concept of groups, which
               allows the user to match specific sampled packets in
               the case of multiple sampling rules, thus identify only
               the packets that came from a specific rule.

          index INDEX
               Is a unique ID for an action. When creating new action
               instance, this parameter allows to set the new action
               index. When using existing action, this parameter
               allows to specify the existing action index.  The index
               must 32bit unsigned integer greater than zero.

     EXAMPLES
          Sample one of every 100 packets flowing into interface eth0
          to psample group 12:

               tc qdisc add dev eth0 handle ffff: ingress
               tc filter add dev eth0 parent ffff: matchall \
                    action sample rate 100 group 12 index 19

          Use the same action instance to sample eth1 too:

               tc qdisc add dev eth1 handle ffff: ingress
               tc filter add dev eth1 parent ffff: matchall \
                    action sample index 19

     SEE ALSO
          tc(8), tc-matchall(8) psample(1)

     Page 2                      iproute2            (printed 5/24/22)