hsflowd

Docker Swarm: the appearance and disappearance of short-lived containers is now handled smoothly, with per-container network stats picked up directly from /proc.
Each mod-pcap tap is now reported as just one sFlow data-source which means that if the container-to-vport mapping fails the traffic is still reported (with inputPort or outputPort field missing) and can still be attributed to the service. It also means that the sFlow collector can de-duplicate correctly if the same traffic is monitored via two taps. This brings mod-pcap into line with the way that Open vSwitch sends packets samples with one data-source per bridge. A new "vport" option in the pcap configuration looks like this:
pcap { dev=eth0 vport=on }
This forces hsflowd to report counter-samples for any vport interfaces detected. If the device being tapped is in fact a bridge:
pcap { dev=virbr0 }
then vport=on is the default.