Repository navigation
gNPSI-2: gNPSI Packet Sampling for Tunneled Traffic - #6246
jayakumarramisetty wants to merge 4 commits into
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces the gNPSI-2 test plan, which focuses on validating packet sampling accuracy for complex tunneled traffic scenarios. The changes include detailed documentation and configuration for testing how the gNPSI service handles encapsulation headers, metadata, and statistical sampling rates across multiple tunnel types, ensuring robust telemetry accuracy in core network deployments. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new test plan, gNPSI-2: gNPSI Packet Sampling for Tunneled Traffic, along with its metadata and registration. The test plan validates that the gNPSI service accurately samples tunneled packets across various encapsulations (IP-in-IP, GRE, MPLSoUDP, MPLS) and streams valid sFlow v5 records. The review feedback points out that the telemetry counters for interface input and output packets are listed in the coverage section but are not explicitly verified in the test procedure, which violates the repository's style guide on telemetry validation.
- Add gNPSI-2.5: IPv4-in-IPv4 and IPv6-in-IPv4 packets on sampled port1 are steered by a VRF-selection policy (protocol 4/41, src 198.51.100.3/32) to DECAP_TE_VRF and decapsulated by a gRIBI decap NH (NH 201 -> NHG 200 -> 198.51.100.100/32); ingress samples must meet the same 4-sigma rate criterion with pre-decap outer+inner headers, egress samples are inner-only. - Statistics: N = 10,000 (or smallest supported rate above it), P = 400*N packets at 10*N pps per stream, E = D/N from DUT in-pkts/out-pkts deltas, accept [0.8E, 1.2E] (+/-4 sigma; ~6e-5 false-fail per check, ~2e-3 over 31). - Add deterministic accounting checks: gap-free flow-sample and datagram sequence numbers, unchanged drops, sample_pool delta within +/-20% of D. - Verify the 256-byte sample size: header_length = 256, exact frame_length (512/532/492) and a payload signature placed at frame offsets 170-245. - Specify every stream exactly (inner/outer addresses, DSCP/TTL, GRE flags and length, MPLSoUDP ports, MACs) and the expected egress deltas; egress DSCP/ECN are logged rather than compared. - Add MPLSoGRE v4/v6 streams, split MPLSoUDP per address family, and describe gNPSI-2.2 as transit of ATE-built tunnels (drop undefined "policy-forwarding encapsulation" claim). - gNPSI-2.3: replace the gRIBI/UNIMPLEMENTED branch with a fully specified OC static transit LSP (1001 -> 1002 via 192.0.2.6), deviation-gated, with exact ingress/egress label stacks (TC, S, TTL). - gNPSI-2.4: insert NHG 30 between IPv4Entry 203.0.113.128/25 and NH 3; send Flow-Dropped from sampled port1 into an OC static DROP route with a concurrent reference stream; the expected dropped-sample count is selected by the DUT's own sample_pool accounting. - Define sFlow decoding rules: compact and expanded flow samples, source_id partitioning (not output), input = 0 allowed on egress samples, tolerant record decoding (stock gopacket fails datagrams with records 1006-1012). - Add encapsulation-metadata handling for extended records 1023-1028, 1006/1008 (validated when present, absence logged); inner-only egress raw header with a 1023 record does not pass. - Model the gNPSI server with /system/grpc-servers (GNPSI identity from openconfig-gnpsi-types) with gnpsi_oc_unsupported fallback and a TODO for the sFlow-source binding; first Sample must carry sflow_metadata V5. - Name deviation sflow_egress_sampling_rate_unsupported for the egress fallback (global ingress-sampling-rate = N, effective egress rate verified from samples); state that no UDP collector is required. - Apply the setup Canonical OC once, before gRIBI/gNPSI sessions, with scoped REPLACE (no root-level REPLACE); add per-subtest Canonical OC for MPLS, static DROP route and VRF-selection decap. - Verify oper-status UP and use in-pkts/out-pkts; state link speed (>= 10GE), no LAG and stream concurrency; enumerate cleanup items with t.Cleanup(). - Update path coverage (grpc-server, MPLS static LSP, policy-forwarding, static route, global sampling rate, MAC, AFT decap paths). Validators: canonicalocspec=PASS, readme_spec=PASS Follow-ups (V1-V4): - gNPSI-2.3 stays mandatory: mpls_unsupported, static_mpls_unsupported and static_mpls_lsp_oc_unsupported configure the same MPLS enablement and 1001 -> 1002 swap through the platform's alternate configuration method; only a platform without MPLS label-switching capability skips. - Identify samplers by source_id plus direction (input/output equal to the source_id index); port2 ingress / port1 egress control-frame samples are logged and excluded, sequence gaps are allowed only when filled by opposite-direction samples of the same source_id, and the header_length / frame_length rule applies only to samples attributed to a test stream. - Reuse an existing gRPC server that already serves openconfig-gnpsi-types:GNPSI on the binding port; create grpc-server[name=gnpsi] only if absent (never on an occupied port); platforms without grpc-server GNPSI support use the gnpsi_oc_unsupported method; the identity is module-qualified per RFC 7951. - Cap the per-stream rate at R = min(10*N, R_max), with R_max = 0.5*L/(k*(532+20)*8), and stretch the duration T = P/R, so links stay at or below 50% load for any N. Validators (after follow-ups): canonicalocspec=PASS, readme_spec=PASS
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces a new test plan (gNPSI-2) for gNPSI Packet Sampling for Tunneled Traffic, which includes a detailed README, metadata, and registration in the test registry. The review feedback correctly identifies a directory structure violation of the repository style guide, noting that the test should be nested under the existing 'feature/gnpsi' directory rather than creating a new top-level 'feature/sampling' folder. Additionally, the readme path in the test registry must be updated to match this corrected path.
…rify shared-port grpc-server setup - Move test plan from feature/sampling/gnpsi/otg_tests/tunneled_sampling_test/ to feature/gnpsi/otg_tests/tunneled_sampling_test/ (matching gNPSI-1 and CODEOWNERS) and update testregistry.textproto. - Set network_instance = DEFAULT by default on decapsulating NextHop 201 in gNPSI-2.5 Step 2, omitting it only under decap_nh_with_nexthop_ni_unsupported, and batch NH 201 + NHG 200 + DECAP_TE_VRF prefix in NH -> NHG -> prefix order. - Add the shared-port grpc-server branch (UPDATE config/services appending openconfig-gnpsi-types:GNPSI and restore in Cleanup) when an existing server already owns the introspect.GNPSI port.
e0ae680 to
a7fc197
Compare
Summary
gNPSI-2(feature/sampling/gnpsi/otg_tests/tunneled_sampling_test)gNPSI.SubscribesFlow v5 packet sampling across IP-in-IP (IPv4-in-IPv4,IPv6-in-IPv4,IPv6-in-IPv6), GRE,MPLSoUDP, and MPLS label-switched traffic, verifying256-byte outer and inner header integrity partitioned by samplersource_id,ifindexmetadata,1:10,000statistical rate accuracy, and negative isolation on unsampled interfaces and dropped routes.gNPSI,gRIBI,gNMI, sFlow v5, OTG (TESTBED_DUT_ATE_4LINKS)gNPSI-2.1: IP-in-IP Tunneled Traffic Sampling (IPv4 and IPv6)gNPSI-2.2: GRE, MPLSoGRE and MPLSoUDP Transit Tunnel SamplinggNPSI-2.3: MPLS Label-Switched Packet SamplinggNPSI-2.4: Negative Validation: Unsampled Ports and Dropped TrafficgNPSI-2.5: Sampling of Tunneled Traffic Decapsulated after VRF SelectionRevision 2 (review feedback addressed)
Both README validators used by CI (
validate_readme_canonicalocspec,validate_readme_spec) pass locally on this revision.