Sflow - Alcatel-Lucent OmniSwitch 9900 Series Network Configuration Manual

Diagnosing Switch Problems

sFlow

sFlow is a network monitoring technology that gives visibility in to the activity of the network, by
providing network usage information. It provides the data required to effectively control and manage the
network usage. sFlow is a sampling technology that meets the requirements for a network traffic
monitoring solution.
sFlow is an industry standard with many vendors delivering products with this support. Some of the
applications of the sFlow data include:
•
Detecting, diagnosing, and fixing network problems
•
Real-time congestion management
•
Detecting unauthorized network activity
•
Usage accounting and billing
•
Understanding application mix
•
Route profiling and peer optimization
•
Capacity planning
sFlow is a sampling technology embedded within switches/routers. It provides the ability to monitor the
traffic flows. It requires a sFlow agent software process running as part of the switch software and a sFlow
collector which receives and analyses the monitored data. The sFlow collector makes use of SNMP to
communicate with a sFlow agent in order to configure sFlow monitoring on the device (switch).
sFlow agent running on the switch/router, combines interface counters and traffic flow (packet) samples
preferably on all the interfaces into sFlow datagrams that are sent across the network to an sFlow
collector.
Packet sampling on the switch/router is typically performed by the switching/routing ASICs, providing
wire-speed performance. In this case, sFlow agent does very little processing, by packaging data into
sFlow datagrams that are immediately sent on network. This minimizes the memory and CPU utilization
by sFlow agent.
sFlow Manager
The sFlow manager is the controller for all the modules. It initializes all other modules. It interfaces with
the Ethernet driver to get the counter samples periodically and reads sampled packets. The counter
samples are given to the poller and sampled packets are given to the sampler to format a UDP packet.
Each sFlow manager instance has multiples of receiver, sampler, and poller instances. Each user
programmed port has an individual sampler and poller. The sampler and poller could be potentially
pointing to multiple receivers if the user has configured multiple destination hosts.
Receiver
The receiver module has the details about the destination hosts where the sFlow datagrams are sent out. If
there are multiple destinations then each destination has an instance of the receiver. All these receivers are
attached to the sFlow manager instance and to an associated sample/poller.
OmniSwitch AOS Release 8 Network Configuration Guide December 2017
sFlow
page 34-23