Chapter 39. Sflow; Sflow Statistical Counters; Sflow Network Sampling - Lenovo RackSwitch G8264CS Application Manual

Chapter 39. sFlow

sFlow Statistical Counters

sFlow Network Sampling

© Copyright Lenovo 2017
The G8264CS supports sFlow technology for monitoring traffic in data networks.
The switch includes an embedded sFlow agent which can be configured to provide
continuous monitoring information of IPv4 traffic to a central sFlow analyzer.
The switch is responsible only for forwarding sFlow information. A separate sFlow
analyzer is required elsewhere on the network to interpret sFlow data.
Note: Lenovo Enterprise Network Operating System 8.4 does not support IPv6 for
sFlow.
The G8264CS can be configured to send network statistics to an sFlow analyzer at
regular intervals. For each port, a polling interval of 5 to 60 seconds can be
configured, or 0 (the default) to disable this feature.
When polling is enabled, at the end of each configured polling interval, the
G8264CS reports general port statistics and port Ethernet statistics.
In addition to statistical counters, the G8264CS can be configured to collect
periodic samples of the traffic data received on each port. For each sample, 128
bytes are copied, UDP‐encapsulated, and sent to the configured sFlow analyzer.
For each port, the sFlow sampling rate can be configured to occur once each 256 to
65536 packets, or 0 to disable (the default). A sampling rate of 256 means that one
sample will be taken for approximately every 256 packets received on the port. The
sampling rate is statistical, however. It is possible to have slightly more or fewer
samples sent to the analyzer for any specific group of packets (especially under
low traffic conditions). The actual sample rate becomes most accurate over time,
and under higher traffic flow.
sFlow sampling has the following restrictions:
 Sample Rate—The fastest sFlow sample rate is 1 out of every 256 packets.
 ACLs—sFlow sampling is performed before ACLs are processed. For ports
configured both with sFlow sampling and one or more ACLs, sampling will
occur regardless of the action of the ACL.
 Port Mirroring—sFlow sampling will not occur on mirrored traffic. If sFlow
sampling is enabled on a port that is configured as a port monitor, the mirrored
traffic will not be sampled.
Egress traffic—sFlow sampling will not occur on egress traffic.

Note: Although sFlow sampling is not generally a CPU‐intensive operation,
configuring fast sampling rates (such as once every 256 packets) on ports under
heavy traffic loads can cause switch CPU utilization to reach maximum. Use larger
rate values for ports that experience heavy traffic.
589