Adaptive Sampling - Juniper JUNOS OS 10.4 - FOR EX REV 1 Manual

Complete Software Guide for Junos
3872
®
OS for EX Series Ethernet Switches, Release 10.4
InMon Corporation's sFlow: A Method for Monitoring Traffic in Switched and Routed
Networks (see
http://faqs.org/rfcs/rfc3176.html
NOTE: sFlow technology on the switches samples only raw packet headers.
A raw Ethernet packet is the complete Layer 2 network frame.
An sFlow monitoring system consists of an sFlow agent embedded in the switch and a
centralized collector. The sFlow agent's two main activities are random sampling and
statistics gathering. It combines interface counters and flow samples and sends them
across the network to the sFlow collector.
EX Series switches adopt the distributed sFlow architecture. The sFlow agent has two
separate sampling entities that are associated with each Packet Forwarding Engine.
These sampling entities are known as subagents. Each subagent has a unique ID that is
used by the collector to identify the data source. A subagent has its own independent
state and forwards its own sample messages to the sFlow agent. The sFlow agent is
responsible for packaging the samples into datagrams and sending them to the sFlow
collector. Because sampling is distributed across subagents, the protocol overhead
associated with sFlow technology is significantly reduced at the collector. If the mastership
assignment changes in a Virtual Chassis setup, sFlow technology continues to function.

Adaptive Sampling

The switches use adaptive sampling to ensure both sampling accuracy and efficiency.
Adaptive sampling is a process of monitoring the overall incoming traffic rate on the
network device and providing intelligent feedback to interfaces to dynamically adapt
their sampling rate to the traffic conditions. Interfaces on which incoming traffic exceeds
the system threshold are checked so that all violations can be regulated without affecting
the traffic on other interfaces. Every 5 seconds the agent checks interfaces to get the
number of samples, and interfaces are grouped based on the slot that they belong to.
The top five interfaces that produce the highest number of samples are selected. Using
the binary backoff algorithm, the sampling load on these interfaces is reduced by half
and allotted to interfaces that have a lower sampling rate. Therefore when the processor
limit is reached, the sampling rate is adapted such that it does not load the processor
any further. If the switch is rebooted, the adaptive sampling rate is reset to the
user-configured sampling rate. Also, if you modify the sampling rate, the adaptive sampling
rate changes.
The advantage of adaptive sampling is that the switch continues to operate at its optimum
level even when there is a change in the traffic patterns in the interfaces. You do not need
to make any changes. Because the sampling rate adapts dynamically to changing network
conditions, the resources are utilized optimally resulting in a high performance network.
Infrequent sampling flows are not reported in the sFlow information, but over time the
majority of flows are reported. Based on a defined sampling rate, 1 out of N packets is
captured and sent to the collector. This type of sampling does not provide a 100 percent
accurate result in the analysis, but it does provide a result with quantifiable accuracy. A
polling interval defines how often the sFlow data for a specific interface are sent to the
collector, but an sFlow agent can also schedule polling.
).
Copyright © 2010, Juniper Networks, Inc.