Skydive uses the Gremlin traversal language as a topology and flow request language.
Requests on the topology can be done as following :
Refer to the Gremlin section for further explanations about the syntax and the functions available.
A typical Gremlin request on Flows will return a JSON version of the Flow structure.
The Flow Schema is described in a protobuf file .
The following command starts a capture on all docker0 interfaces :
The Gremlin expression is continuously evaluated which means that it is possible to define a capture on nodes that do not exist yet. It useful when you want to start a capture on all OpenvSwitch whatever the number of Skydive agents you will start.
While starting the capture, you can specify the capture name, capture description and capture type optionally.
At this time, the following capture types are supported :
ovssflow, for interfaces managed by OpenvSwitch such as OVS bridges
ovsnetflow, for interfaces managed by OpenvSwitch such as OVS bridges
afpacket, for interfaces suchs as Linux bridges, veth, devices, …
pcap, same as
sFlow, Socket reading sFlow frames
dpdk, for interfaces managed by DPDK
pcapsocket. This capture type allows you to inject traffic from a PCAP file.
ovsmirror, leverages OpenvSwitch port mirroring.
eBPF, flow capture within kernel
Delete a capture
If the flow probe
pcapsocket is enabled, you can create captures with the
pcapsocket. Skydive will create a TCP socket where you can copy PCAP
nc for instance). Traffic injected into this socket will have
its capture point set to the selected node. The TCP socket address can be
retrieved using the
PCAPSocket attribute of the node or using the
PCAPSocket attribute of the capture.
Skydive provides a way to send packets or flows from the agent to an external tool/endpoint. Multiple protocols are supported to transport the flows or the packets:
- NetFlow v5
- ERSpan type II
Not all the protocol are supported by all the capture type. Bellow a matrix of what is available per capture type.
The following examples show how to specify the target at capture creation time.
sFlow on OpenvSwitch bridge :
NetFlow on OpenvSwitch bridge :
NetFlow v5 on other interfaces :
ERSpan II on other interfaces :
Skydive provides a Packet injector, which is helpful to verify the successful packet flow between two network devices by injecting a packet from one device and capture the same in the other device.
Create packet injector
To use the packet injector we need to provide the below parameters,
- Source node, needs to be expressed in gremlin query format.
- Destination node, needs to be expressed in gremlin query format, optional if dstIP and dstMAC given.
- Source IP of the packet, optional if source node given.
- Source MAC of the packet, optional if source node given.
- Destination IP of the packet, optional if destination node given.
- Destination MAC of the packet, optional if destination node given.
- Type of packet. currently ICMP, TCP and UDP are supported.
- Number of packets to be generated, default is 1.
- IMCP ID, used only for ICMP type packets.
- Interval, the delay between two packets in milliseconds.
- Source port, used only for TCP and UDP packets, if not given generates one randomly.
- Destination port, used only for TCP and UDP packets, if not given generates one randomly.
Delete packet injection
Deleting the active packet injector can be done by using the
delete sub-command with the UUID of the injector.
UUID of the injection will be returned as a response of
Skydive allows you to create alerts, based on queries on both topology graph and flows.
- a non empty string
- a number different from zero
- a non empty array
- a non empty map
The alert is triggered only if the evaluation result differs from the previous evaluation.
With the following command, the alert is triggered as soon as the Gremlin query returns something new (i.e. a new node returned by the query, an updated metadata in the returned nodes…).
With the following command, the alert is triggered when the bandwidth of the flow bypass 1Mbps. It gets trigerred again the next time the bandwidth bypass this threshold.
Name, the alert name (optional)
Description, a description for the alert (optional)
Action, URL to trigger. Can be a local file or a WebHook
Trigger, event that triggers the alert evaluation. Periodic alerts can be specified with
duration:5s, for an alert that will be evaluated every 5 seconds.
When an alert is triggered, all the WebSocket clients will be notified with a
message of type
Alert with a JSON object with the attributes:
UUID, ID of the triggered alert
Timestamp, timestamp of trigger
ReasonData, the result of the alert evaluation. If
expressionis a Gremlin query, it will be the result of the query. If
In addition to the WebSocket message, an alert can trigger different kind of actions.
A POST request is issued with the JSON message as payload.
A local file (prefixed by file://) to execute a script. It receives the JSON message through stdin
Skydive allows you to create and delete Nodes, update node metadata and create and delete Edges with the help of Topology rules API. It provides two seperate rule for node and edge
node-rule you can create and delete nodes and update node metadata.
node-rule contain following fields
action, action: create or update
description, rule description (optional)
name, rule name (optional)
node-name, node name only for create node
node-type, node type only for create node
metadata, node metadata, key value pairs. ‘k1=v1, k2=v2’
query, gremlin query only for update
To create a new node, you have to specify the
create and provide the node name and node type.
To update a node metadata, you have to specify the
update and query to select nodes.
Delete node rule
Deleting the node rule can be done by using the
delete sub-command with the UUID of the node rule.
UUID of the node rule will be returned as a response of
By deleting the done rule, it will delete the node from the graph.
edge-rule you can create ans delete edges.
edge-rule contain following fields
name, the rule name
description, the rule description
src, source node gremlin query
dst, destination node gremlin query
relationtype, relation type of the link
metadata, edge metadata, key value pairs. ‘k1=v1, k2=v2’
To create a edge rule, you have to provide the source and destination nodes and the relation type of the edge
Delete edge rule
Deleting the edge rule can be done by using the
delete sub-command with the UUID of the edge rule.
UUID of the edge rule will be returned as a response of