Sflow; Overview; Implementation Information; Important Points To Remember - Dell S4048–ON Configuration Manual

sFlow

sFlow is a standard-based sampling technology embedded within switches and routers which is used to monitor network traffic. It is
designed to provide traffic monitoring for high-speed networks with many switches and routers.

Overview

The Dell Networking Operating System (OS) supports sFlow version 5.
sFlow is a standard-based sampling technology embedded within switches and routers which is used to monitor network traffic. It is
designed to provide traffic monitoring for high-speed networks with many switches and routers. sFlow uses two types of sampling:
• Statistical packet-based sampling of switched or routed packet flows.
• Time-based sampling of interface counters.
The sFlow monitoring system consists of an sFlow agent (embedded in the switch/router) and an sFlow collector. The sFlow agent
resides anywhere within the path of the packet and combines the flow samples and interface counters into sFlow datagrams and
forwards them to the sFlow collector at regular intervals. The datagrams consist of information on, but not limited to, packet header,
ingress and egress interfaces, sampling parameters, and interface counters.
Application-specific integrated circuits (ASICs) typically complete packet sampling. sFlow collector analyses the sFlow datagrams
received from different devices and produces a network-wide view of traffic flows.

Implementation Information

Dell Networking sFlow is designed so that the hardware sampling rate is per line card port-pipe and is decided based on all the ports
in that port-pipe.
If you do not enable sFlow on any port specifically, the global sampling rate is downloaded to that port and is to calculate the port-
pipe's lowest sampling rate. This design supports the possibility that sFlow might be configured on that port in the future. Back-off is
triggered based on the port-pipe's hardware sampling rate.
For example, if port 1 in the port-pipe has sFlow configured with a 16384 sampling rate while port 2 in the port-pipe has sFlow
configured but no sampling rate set, the system applies a global sampling rate of 512 to port 2. The hardware sampling rate on the
port-pipe is then set at 512 because that is the lowest configured rate on the port-pipe. When a high traffic situation occurs, a back-
off is triggered and the hardware sampling rate is backed-off from 512 to 1024. Note that port 1 maintains its sampling rate of 16384;
port 1 is unaffected because it maintains its configured sampling rate of 16484.:
• If the interface states are up and the sampling rate is not configured on the port, the default sampling rate is calculated based on
the line speed.
• If the interface states are shut down, the sampling rate is set using the global sampling rate.
• If the global sampling rate is non-default, for example 256, and if the sampling rate is not configured on the interface, the
sampling rate of the interface is the global non-default sampling rate, that is, 256.
To avoid the back-off, either increase the global sampling rate or configure all the line card ports with the desired sampling rate even
if some ports have no sFlow configured.

Important Points to Remember

• The Dell Networking OS implementation of the sFlow MIB supports sFlow configuration via snmpset.
788
sFlow
50