sFlow is a network monitoring technology jointly developed by InMon , HP and Foundry Networks in 2001. It has been standardized and can provide complete second to fourth layer information and can adapt to traffic analysis in extremely large network traffic environments. Allows users to analyze the performance , trends and existing problems of network transmission streams in detail and in real time. sFlow has the following advantages:<\/p>\n
sFlow system composition As shown in the figure, the sFlow system includes an sFlow Agent embedded in the device and a remote sFlow Collector. Among them, sFlow Agent obtains interface statistics and data information through sFlow sampling, and encapsulates the information into sFlow messages. When the sFlow message buffer is full or the sFlow message cache time times out (the cache time is 1 second), sFlow Agent The sFlow message will be sent to the specified sFlow Collector. sFlow Collector analyzes sFlow messages and displays the analysis results. sFlow sampling sFlow Agent provides two sampling methods for users to analyze network traffic conditions from different perspectives, namely Flow sampling and Counter sampling.<\/p>\n
Flow sampling means that the sFlow Agent device performs sampling and analysis on packets on a specified interface according to a specific sampling direction and sampling comparison to obtain information related to the packet data content. This sampling method mainly focuses on the details of traffic, so that the traffic behavior on the network can be monitored and analyzed. Field<\/p>\n
Intercept all or part of the header of the original message (the specific length of the interception is determined by the configuration), encapsulate this part of the original message into an sFlow message and send it to the Collector.<\/p>\n
For Ethernet messages, parse the Ethernet header information of the message, encapsulate the parsed data into sFlow messages and send them to the Collector.<\/p>\n
For forwarded Ethernet packets, record the VLAN conversion and VLAN priority conversion of the packets, encapsulate the forwarding information into sFlow packets and send them to the Collector. When the VLAN ID is 0, it indicates an invalid VLAN.<\/p>\n
Counter sampling allows the sFlow Agent device to periodically obtain traffic statistics information on the interface. Counter sampling supports the acquisition of sampling information as shown in the following table. Compared with Flow sampling, Counter sampling only focuses on the quantity of traffic on the interface, but not on the detailed information of the traffic. Field<\/p>\n
General interface statistics, including basic interface information and general interface traffic statistics.<\/p>\n
For the Ethernet interface, it is used to collect Ethernet-related traffic statistics.<\/p>\n
Used to count device CPU usage and memory usage. sFlow message sFlow messages are encapsulated by UDP, and the default destination port number is the well-known port 6343. There are four header formats for sFlow messages, namely Flow sample, Expanded Flow sample, Counter sample, and Expanded Counter sample. The Expanded Flow sample and Expanded Counter sample are new additions to sFlow version 5 and are extensions of the Flow sample and Counter sample, but are not forward compatible. All Extended sampling content must be encapsulated using the Expanded sampling packet header.<\/p>\n
SWITCH( config )# sflow agent { ip IPV4ADDR | ipv6 IPV6ADDR }<\/code><\/pre>\nSWITCH( config )# no sflow agent { ip | ipv6}<\/code><\/pre>\ndescribe Configure\/delete a gent address; IPV4ADDR: agent\/ device IPv4 address IPV6ADDR: a gent\/device IPv6 address Supports configuring ipv 4 and ipv 6 addresses at the same time, for collectors of ipv 4 and ipv 6 respectively There is no configuration by default. If not configured, the protocol may not send packets.<\/p>\n
Order<\/h2>\nSWITCH(config )# sflow collector <1-2> { ip IPV4ADDR | ipv6 IPV6ADDR } [datagram-size <200-9000> | port <1024-65535> | description STRING ]<\/code><\/pre>\nSWITCH(config )# no sflow collector <1-2><\/code><\/pre>\ndescribe Configure\/delete collector; <1-2>: collector index IPV4ADDR: collector\/ server IPv4 address IPV6ADDR: collector\/ server IPv6 address <200-9000>: Maximum length of data packet, optional, default 1 400 <1024-65535>: Server port number, optional, default 6 343 STRING: c collector description information, optional, default is none<\/p>\n
Order<\/h2>\nSWITCH(config -if) #sflow flow -sampling collector <1-2><\/code><\/pre>\nSWITCH(config -if)# no flow-sampling collector<\/code><\/pre>\ndescribe Configure\/delete interface flow sampling; <1-2>: c collector index ss<\/p>\n
Order<\/h2>\nSWITCH(config -if)# sflow counter-sampling collector <1-2><\/code><\/pre>\nSWITCH(config -if)# no counter-sampling collector<\/code><\/pre>\ndescribe Configure\/delete interface counter sampling; <1-2>: collector index ss<\/p>\n
Order<\/h2>\nSWITCH( config-if)# sflow flow-sampling direction { inbound | outbound }<\/code><\/pre>\nSWITCH( config-if)# sflow flow-sampling rate <1024-65536><\/code><\/pre>\nSWITCH( config-if)# sflow flow-sampling max-header <18-256><\/code><\/pre>\nSWITCH( config-if)# no flow-sampling direction<\/code><\/pre>\nSWITCH(config -if)# no flow-sampling rate<\/code><\/pre>\nSWITCH(config -if)# no flow-sampling max-header<\/code><\/pre>\ndescribe Configure\/ reset interface flow sampling parameters; { inbound | outbound } : flow sampling direction, optional, the default is to sample inbound + outbound at the same time <1024-65536>: flow sampling rate, optional, default is 2 048, one sample for every 2 048 flows <18-256> : Flow sampling message length, unit byte, optional, default 6 4<\/p>\n
Order<\/h2>\nSWITCH(config -if)# sflow counter-sampling interval <3-65535><\/code><\/pre>\nSWITCH(config -if)# no sflow counter-sampling interval<\/code><\/pre>\ndescribe Configure\/reset interface counter sampling parameters; <3-65535>: counter sampling period, unit seconds, optional, default 1 0<\/p>\n
Examples<\/h2>\nRequirements<\/h2>\n
sFlow network management server is 2.2.2.2 and the device IP address is 2.2.2.95. The network management server needs to monitor the status of device port 3 through sFlow . It is required to perform flow sampling and counter sampling at the same time. The parameters can be defaulted. Configurations<\/p>\n
Initialize network management configuration<\/h2>\nSWITCH#<\/code><\/pre>\nSWITCH#configure terminal<\/code><\/pre>\nEnter configuration commands, one per line. End with CNTL\/Z.<\/p>\n
SWITCH(config )# sflow -agent- ip 2.2.2.95<\/code><\/pre>\nSWITCH(config )# sflow collector 1 ip 2.2.2.2<\/code><\/pre>\nSWITCH(config )#<\/code><\/pre>\nConfigure sampling for port 3<\/p>\n
SWITCH( config)#int gi 0\/3<\/code><\/pre>\nSWITCH( config-if)#sflow flow-sampling collector 1<\/code><\/pre>\nSWITCH( config-if)#sflow counter-sampling collector 1<\/code><\/pre>\nDisplay Information<\/h2>\n\n- Show sFlow<\/li>\n<\/ul>\n
SWITCH#show sflow<\/code><\/pre>\nCollector 1: Address: 2.2.2.2 Agent: 2.2.2.95 Port: 6343 Datagram-Size: 1400 Description: Fd : 11 Seq: 45 Tx Timer: (nil) Buf : 0xab0d8 Alloc : 1400 Used: 0 ————————————————– ———————————- | Flow | Counter | Interface | ID Rate Direction Max-header Sequence | ID Interval Sequence | ————————————————– ———————————- GiE0\/3 1 2048 both 64 2 1 10 7462<\/p>\n
SWITCH#<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Networking \u203a Switching \u203a Edge \u203a Synapse<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":6349,"menu_order":27,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[115,119,116],"class_list":["post-6376","docs","type-docs","status-publish","hentry","doc_tag-connexite","doc_tag-network","doc_tag-synapse-cli-documentation","no-post-thumbnail"],"acf":[],"_links":{"self":[{"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs\/6376","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=6376"}],"version-history":[{"count":1,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs\/6376\/revisions"}],"predecessor-version":[{"id":6424,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs\/6376\/revisions\/6424"}],"up":[{"embeddable":true,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs\/6349"}],"wp:attachment":[{"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=6376"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/doc_tag?post=6376"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}