Definition

Sampled Flow (sFlow) is a traffic monitoring technology that collects and analyzes traffic statistics based on packet sampling.

Purpose

Enterprise networks are generally smaller and more flexible than carrier networks. However, they are often prone to attacks and service exceptions. To help ensure network stability, enterprises require a traffic monitoring technique that can promptly identify traffic anomalies and the source of attack traffic, allowing them to quickly rectify faults.

sFlow is developed to meet the preceding requirement. sFlow is an interface-based traffic analysis technique that collects packets on an interface based on the sampling rate. In flow sampling, an sFlow agent analyzes the packets including the packet content and forwarding rule, and encapsulates the original packets and parsing result into sFlow packets. The sFlow agent then sends the sFlow packets to an sFlow collector. In counter sampling, an sFlow agent periodically collects traffic statistics on an interface, CPU usage, and memory usage.

sFlow focuses on traffic on an interface, traffic forwarding, and device running. Therefore, sFlow can be used to monitor and diagnose network exceptions. The sFlow collector displays traffic statistics in a report, facilitating preventive maintenance on enterprise networks, especially for enterprises that do not have specialized network administrators.

Currently, devices support only flow sampling.

Benefits

sFlow is comparable to NetStream. In NetStream, network devices collect and analyze traffic statistics. The devices save these statistics to a buffer and export them when they expire or when the buffer overflows. sFlow does not require a flow table. In sFlow, network devices only sample packets, and a remote collector collects and analyzes traffic statistics.

sFlow has the following advantages over NetStream:

• Fewer resources and lower costs. sFlow requires no flow table and uses only a small number of network devices, lowering costs.
• Flexible collector deployment. The collector can be deployed flexibly, enabling traffic statistics to be collected and analyzed according to various traffic characteristics.

Architecture of an sFlow System

As shown in Figure 1-4268, the sFlow system involves an sFlow agent embedded in a device and a remote sFlow collector. The sFlow agent obtains traffic statistics from an interface using sampling and encapsulates the statistics into sFlow packets. When an sFlow packet buffer overflows or an sFlow packet expires (expiry period of 1 second), the agent sends the sFlow packets to the collector. The collector analyzes these sFlow packets and displays traffic statistics in a report.

Figure 1-4268 sFlow system

An sFlow agent is usually deployed on a network device. This section describes its implementation.

An sFlow collector is a PC or server that receives sFlow packets from an sFlow agent. The client software, for example, sFlow Trend, must be installed on an sFlow collector to analyze sFlow packets. To obtain the sFlow Trend client and download the usage guide, visit www.sflow.org.

sFlow Packet Format

Currently, devices support only sFlow version 5.

sFlow Sampling

An sFlow agent provides flow sampling and counter sampling.

Currently, devices support only flow sampling.

Flow sampling

With flow sampling, an agent samples ingress packets, egress packets, or both on an interface based on a sampling rate, and parses the packets to obtain information about packet data content. Table 1-1414 describes the main fields in flow sampling packets. Data in these fields is encapsulated into an sFlow packet and then sent to a collector. Flow sampling focuses on traffic attributes to monitor and parse traffic behaviors on the network. Flow sampling samples packets on an interface, and currently supports only random sampling. In random sampling mode, every N packets are sampled randomly.

Counter sampling

With counter sampling, an agent periodically obtains traffic statistics on an interface. Table 1-1415 describes the main fields in counter sampling packets. Compared with flow sampling, counter sampling focuses on traffic statistics on an interface rather than traffic attributes.

Flow sampling and counter sampling are independent of each other. Flow sampling obtains information about flows of a specified service, whereas counter sampling obtains traffic statistics on an interface. You can configure either or both sampling modes.

To monitor enterprise networks, maintenance personnel often use traffic monitoring techniques.

Users of these networks often have specific requirements for traffic on an interface and expect devices to be reliable. Therefore, enterprises require a traffic monitoring technique on device interfaces to promptly identify traffic anomalies and the source of attack traffic so that they can quickly rectify faults to ensure network stability. sFlow collects traffic, forwarding, and device status information to enable real-time network monitoring and fault location on enterprise networks.

As shown in Figure 1-4269, an sFlow agent is connected to an sFlow collector so that traffic statistics can be collected and analyzed based on interfaces.

Figure 1-4269 Networking diagram for sFlow application

Terms

Acronyms and Abbreviations

Definition

Sampled Flow (sFlow) is a traffic monitoring technology that collects and analyzes traffic statistics based on packet sampling.

Purpose

Enterprise networks are generally smaller and more flexible than carrier networks. However, they are often prone to attacks and service exceptions. To help ensure network stability, enterprises require a traffic monitoring technique that can promptly identify traffic anomalies and the source of attack traffic, allowing them to quickly rectify faults.

sFlow is developed to meet the preceding requirement. sFlow is an interface-based traffic analysis technique that collects packets on an interface based on the sampling rate. In flow sampling, an sFlow agent analyzes the packets including the packet content and forwarding rule, and encapsulates the original packets and parsing result into sFlow packets. The sFlow agent then sends the sFlow packets to an sFlow collector. In counter sampling, an sFlow agent periodically collects traffic statistics on an interface, CPU usage, and memory usage.

sFlow focuses on traffic on an interface, traffic forwarding, and device running. Therefore, sFlow can be used to monitor and diagnose network exceptions. The sFlow collector displays traffic statistics in a report, facilitating preventive maintenance on enterprise networks, especially for enterprises that do not have specialized network administrators.

Currently, devices support only flow sampling.

Benefits

sFlow is comparable to NetStream. In NetStream, network devices collect and analyze traffic statistics. The devices save these statistics to a buffer and export them when they expire or when the buffer overflows. sFlow does not require a flow table. In sFlow, network devices only sample packets, and a remote collector collects and analyzes traffic statistics.

sFlow has the following advantages over NetStream:

• Fewer resources and lower costs. sFlow requires no flow table and uses only a small number of network devices, lowering costs.
• Flexible collector deployment. The collector can be deployed flexibly, enabling traffic statistics to be collected and analyzed according to various traffic characteristics.

Feature Requirements