Chapter 41. Sflow; Sflow Statistical Counters; Sflow Network Sampling - Lenovo Flex System Fabric CN4093 Application Manual

Chapter 41. sFLOW

sFlow Statistical Counters

sFlow Network Sampling

© Copyright Lenovo 2017
The CN4093 supports sFlow technology for monitoring traffic in data networks.
The switch includes an embedded sFlow agent which can be configured to sample
network traffic and provide continuous monitoring information of IPv4 traffic to a
central sFlow analyzer.
The switch is responsible only for forwarding sFlow information. A separate sFlow
analyzer is required elsewhere on the network in order to interpret sFlow data.
Note: Enterprise NOS 8.4 does not support IPv6 for sFLOW.
The CN4093 can be configured to send network statistics to an sFlow analyzer at
regular intervals. For each port, a polling interval of 5 to 60 seconds can be
configured, or 0 (the default) to disable this feature.
When polling is enabled, at the end of each configured polling interval, the
CN4093 reports general port statistics and port Ethernet statistics.
In addition to statistical counters, the CN4093 can be configured to collect periodic
samples of the traffic data received on each port. For each sample, 128 bytes are
copied, UDP‐encapsulated, and sent to the configured sFlow analyzer.
For each port, the sFlow sampling rate can be configured to occur once each 256 to
65536 packets, or 0 to disable (the default). A sampling rate of 256 means that one
sample will be taken for approximately every 256 packets received on the port. The
sampling rate is statistical, however. It is possible to have slightly more or fewer
samples sent to the analyzer for any specific group of packets (especially under
low traffic conditions). The actual sample rate becomes most accurate over time,
and under higher traffic flow.
sFlow sampling has the following restrictions:
 Sample Rate—The fastest sFlow sample rate is 1 out of every 256 packets.
 ACLs—sFlow sampling is performed before ACLs are processed. For ports
configured both with sFlow sampling and one or more ACLs, sampling will
occur regardless of the action of the ACL.
Port Mirroring—sFlow sampling will not occur on mirrored traffic. If sFlow

sampling is enabled on a port that is configured as a port monitor, the mirrored
traffic will not be sampled.
Note: Although sFlow sampling is not generally a CPU‐intensive operation,
configuring fast sampling rates (such as once every 256 packets) on ports under
heavy traffic loads can cause switch CPU utilization to reach maximum. Use larger
rate values for ports that experience heavy traffic.
605