10 months ago
Flow Ingest: Support for MPLS Label 3
Kentik now supports collection of the NetFlow and IPFIX fields for position 3 MPLS Label in the label stack , which we previously not collected from the received flows. The related fields is shown in tables below:
NetFlow v9 VLAN fields:
| Field Type | Value | Length (bytes) | Description |
|---|---|---|---|
| MPLS_LABEL_3 | 72 | 3 | MPLS label at position 3 in the stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit. |
Resource: https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html
IPFIX VLAN fields:
| ElementID | Name | Abstract Data Type | Description |
|---|---|---|---|
| 72 | mplsLabelStackSection3 | octetArray | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection2. See the definition of mplsTopLabelStackSection for further details. |
Resource: https://www.iana.org/assignments/ipfix/ipfix.xhtml
This field is collected from NetFlow/IPFIX protocols and stored in the Kentik’s MPLS Label 3 and MPLS Label 3 EXP dimensions.
The support is available in kproxy starting from version v7.37.0. The example of the Data Explorer query is shown below:
