TC-SAMPLE(8)

🎀 TC-SAMPLE(8) 🎀

Packet sample action in tc(8), so this is the page for the sample action of tc 💖

✨ NAME ✨

okay so the name is just sample, which is a packet sampling tc action 🦋

🌸 SYNOPSIS 🌸

tc ... action sample rate RATE group GROUP [ trunc SIZE ] [ index INDEX
        ]

tc ... action sample index INDEX

💅 DESCRIPTION 💅

okay the sample action lets you sample packets that match a classifier, and it's giving precision 😭✨

The packets get picked randomly according to the rate parameter, and they're sampled through the psample generic netlink channel. You can also set up packet truncation to save user-kernel traffic, which is lowkey genius 🧠 Every sample comes with some informative metadata about the original packet. That metadata gets sent as netlink attributes, right alongside the original packet data 🫶

You can either set the sample action parameters the way the first form in SYNOPSIS shows, or reuse an existing sample action by its index, like the second form does. Main character energy either way 👑

🧚 SAMPLED PACKETS METADATA FIELDS 🧚

The metadata gets delivered to userspace apps through the psample generic netlink channel. Each sample includes these netlink attributes, and they are all so useful 🍓

• PSAMPLE_ATTR_IIFINDEX — the input interface index of the packet, if there is one 🌈
• PSAMPLE_ATTR_OIFINDEX — the output interface index of the packet. This field is not relevant on ingress sampling 🙈
• PSAMPLE_ATTR_ORIGSIZE — the size of the original packet, before any truncation 📏
• PSAMPLE_ATTR_SAMPLE_GROUP — the psample group the packet was sent to 🎀
• PSAMPLE_ATTR_GROUP_SEQ — a sequence number for the sampled packet. It goes up by one with each sampled packet of the current psample group 🔢
• PSAMPLE_ATTR_SAMPLE_RATE — the rate the packet was sampled with 💜

🦋 OPTIONS 🦋

• rate RATE — the packet sample rate! RATE is the expected ratio between observed packets and sampled packets. So a RATE of 100 gives you an average of one sampled packet out of every 100 observed 💖
• trunc SIZE — once you set this, it defines the maximum size of the sampled packets and causes truncation if needed ✂️
• group GROUP — the psample group the packet will be sent to. psample has this concept of groups, so when you've got multiple sampling rules you can match specific sampled packets and figure out which rule they came from. Iconic organization 🗂️✨
• index INDEX — a unique ID for an action. When you're creating a new action instance, this sets the new action's index. When you're using an existing action, this lets you specify that existing action's index. The index must be a 32bit unsigned integer greater than zero 🔢🌸

🍓 EXAMPLES 🍓

Sample one of every 100 packets flowing into interface eth0 to psample group 12:

tc qdisc add dev eth0 handle ffff: ingress
tc filter add dev eth0 parent ffff: matchall \
     action sample rate 100 group 12 index 19

Use that same action instance to sample eth1 too 🥰

tc qdisc add dev eth1 handle ffff: ingress
tc filter add dev eth1 parent ffff: matchall \
     action sample index 19

🫶 SEE ALSO 🫶

tc(8), tc-matchall(8), psample(1)

bestie that's the whole thing 💅 iproute2, last updated 31 Jan 2017 🌈 stay sampling, stay slaying 🧚💜