Packet sample action in tc(8)1 Jan 201P7a)cket sample action in tc(8)

          sample - packet sampling tc action

          tc ... action sample rate RATE group GROUP [ trunc SIZE ]  [
                  index INDEX ]

          tc ... action sample index INDEX

          The sample action allows sampling packets matching classi-

          The packets are chosen randomly according to the rate param-
          eter, and are sampled using the psample generic netlink
          channel. The user can also specify packet truncation to save
          user-kernel traffic. Each sample includes some informative
          metadata about the original packet, which is sent using net-
          link attributes, alongside the original packet data.

          The user can either specify the sample action parameters as
          presented in the first form above, or use an existing sample
          action using its index, as presented in the second form.

          The metadata are delivered to userspace applications using
          the psample generic netlink channel, where each sample
          includes the following netlink attributes:

               The input interface index of the packet, if there is

               The output interface index of the packet. This field is
               not relevant on ingress sampling

               The size of the original packet (before truncation)

               The psample group the packet was sent to

               A sequence number of the sampled packet. This number is
               incremented with each sampled packet of the current
               psample group

     Page 1                      iproute2            (printed 5/24/22)

     Packet sample action in tc(8)1 Jan 201P7a)cket sample action in tc(8)

               The rate the packet was sampled with

          rate RATE
               The packet sample rate.  RATE is the expected ratio
               between observed packets and sampled packets. For exam-
               ple, RATE of 100 will lead to an average of one sampled
               packet out of every 100 observed.

          trunc SIZE
               Upon set, defines the maximum size of the sampled pack-
               ets, and causes truncation if needed

          group GROUP
               The psample group the packet will be sent to. The
               psample module defines the concept of groups, which
               allows the user to match specific sampled packets in
               the case of multiple sampling rules, thus identify only
               the packets that came from a specific rule.

          index INDEX
               Is a unique ID for an action. When creating new action
               instance, this parameter allows to set the new action
               index. When using existing action, this parameter
               allows to specify the existing action index.  The index
               must 32bit unsigned integer greater than zero.

          Sample one of every 100 packets flowing into interface eth0
          to psample group 12:

               tc qdisc add dev eth0 handle ffff: ingress
               tc filter add dev eth0 parent ffff: matchall \
                    action sample rate 100 group 12 index 19

          Use the same action instance to sample eth1 too:

               tc qdisc add dev eth1 handle ffff: ingress
               tc filter add dev eth1 parent ffff: matchall \
                    action sample index 19

          tc(8), tc-matchall(8) psample(1)

     Page 2                      iproute2            (printed 5/24/22)