Chapter 29. Sflow; Sflow Statistical Counters; Sflow Network Sampling - IBM RackSwitch G8000 Application Manual

Chapter 29. sFlow

sFlow Statistical Counters

sFlow Network Sampling

© Copyright IBM Corp. 2011
The G8000 supports sFlow technology for monitoring traffic in data networks. The
switch includes an embedded sFlow agent which can be configured to provide
continuous monitoring information of IPv4 traffic to a central sFlow analyzer.
The switch is responsible only for forwarding sFlow information. A separate sFlow
analyzer is required elsewhere on the network to interpret sFlow data.
Note: IBM Networking OS 6.8 does not support IPv6 for sFlow.
The G8000 can be configured to send network statistics to an sFlow analyzer at
regular intervals. For each port, a polling interval of 5 to 60 seconds can be
configured, or 0 (the default) to disable this feature.
When polling is enabled, at the end of each configured polling interval, the G8000
reports general port statistics and port Ethernet statistics.
In addition to statistical counters, the G8000 can be configured to collect periodic
samples of the traffic data received on each port. For each sample, 128 bytes are
copied, UDP-encapsulated, and sent to the configured sFlow analyzer.
For each port, the sFlow sampling rate can be configured to occur once each 256 to
65536 packets, or 0 to disable (the default). A sampling rate of 256 means that one
sample will be taken for approximately every 256 packets received on the port. The
sampling rate is statistical, however. It is possible to have slightly more or fewer
samples sent to the analyzer for any specific group of packets (especially under low
traffic conditions). The actual sample rate becomes most accurate over time, and
under higher traffic flow.
sFlow sampling has the following restrictions:
• Sample Rate—The fastest sFlow sample rate is 1 out of every 256 packets.
• ACLs—sFlow sampling is performed before ACLs are processed. For ports
configured both with sFlow sampling and one or more ACLs, sampling will occur
regardless of the action of the ACL.
• Port Mirroring—sFlow sampling will not occur on mirrored traffic. If sFlow
sampling is enabled on a port that is configured as a port monitor, the mirrored
traffic will not be sampled.
Note: Although sFlow sampling is not generally a CPU-intensive operation,
configuring fast sampling rates (such as once every 256 packets) on ports
under heavy traffic loads can cause switch CPU utilization to reach
maximum. Use larger rate values for ports that experience heavy traffic.
339