Extreme Networks ExtremeWare Command Reference Manual page 602

Commands for Status Monitoring and Statistics
NetFlow Statistics
NetFlow flow statistics provides a way for a switch to capture and export traffic classification or
precedence information as data traverses, or flows, across portions of a network. A network flow is
defined as a unidirectional sequence of packets between a particular source device and destination
device that share the same protocol and transport-layer information. Flows are defined by the
combination of their source IP address, destination IP address, source port, destination port, and
protocol type.
NetFlow records are unidirectional in nature, which means that two flow records are maintained for a
typical TCP connection: one record for flow in the ingress direction; a second for the flow in the egress
direction. Records are maintained only for TCP and UDP flows. Flow records are grouped together into
UDP datagrams for export to a flow-collector device. A NetFlow Version 1 export datagram can contain
up to 25 flow records.
The IP addresses (or hostnames) and UDP port numbers of the available flow collectors can be
configured on a per-switch basis. The ExtremeWare NetFlow implementation also enables a single port
to distribute statistics across multiple groups of flow-collector devices. The NetFlow distribution feature
is enabled by configuring export distribution groups that contain the addresses of multiple
flow-collector devices. The feature uses a distribution algorithm that ensures all of the records for a
given flow are exported to the same collector. The algorithm also ensures that the flow records of the
ingress direction of a TCP or UDP connection are exported to the same collector. For Ethernet
applications, only ingress traffic is monitored on Ethernet ports.
By default, each Ethernet port configured for flow switching maintains statistics for all the flows
traversing the link in the ingress direction. Generalized filtering options exist that enable you to
configure an Ethernet port to maintain statistics selectively for only those flows that match a specified
filter. Up to eight filters are supported for each Ethernet port, with a total of 128 filters possible per each
I/O module.
NOTE
Some of the NetFlow commands are implemented differently in the version of ExtremeWare that
supports the PoS module, than in ExtremeWare 6.2 or later. Commands or options unique to the PoS
module are indicated in the comments, or are documented separately in Chapter 22.
sFlow® Statistics
sFlow® is a technology for monitoring traffic in data networks containing switches and routers. It relies
on statistical sampling of packets from high-speed networks, plus periodic gathering of the statistics. A
UDP datagram format is defined to send the information to an external entity for analysis. sFlow
consists of a MIB and a specification of the packet format for forwarding information to a remote agent.
Details of sFlow specifications can be found in RFC 3176 and at the following website:
http://www.sflow.org
sFlow is primarily a mechanism that statistically samples a small portion of the traffic from a network,
and extrapolate from this small sample to infer information about the network as a whole. sFlow
defines a packet format, where the sFlow Agent in ExtremeWare collects information from a number of
sampled packets in addition to snapshots of various counters and statistics. The UDP frame is
forwarded to a central monitoring station referred to as the sFlow collector.
602 ExtremeWare Software 7.3.0 Command Reference Guide