Filter
Top Products
68 Switching Configuration
The advantages of using sFlow are:
• It is possible to monitor all ports of the switch continuously, with no impact on the distributed
switching performance.
• Minimal memory/CPU is required. Samples are not aggregated into a flow-table on the switch; they are
forwarded immediately over the network to the sFlow collector.
• System is tolerant to packet loss in the network (statistical model means loss is equivalent to slight
change in sampling rate).
• sFlow collector can receive data from multiple switches, providing a real-time synchronized view of the
whole network.
• The Collector can analyze traffic patterns based on protocols found in the headers (e.g., TCP/IP, IPX,
Ethernet, AppleTalk…). This alleviates the need for a layer 2 switch to decode and understand all
protocols.
sFlow Agents
sFlow Agents use two forms of sampling:
• Statistical packet-based sampling of switched or routed Packet Flows
• Time-based sampling of counters
Packet Flow Sampling and Counter Sampling are performed by sFlow Instances associated with
individual Data Sources within an sFlow Agent. Both types of samples are combined in sFlow datagrams.
Packet Flow Sampling creates a steady, but random, stream of sFlow datagrams that are sent to the sFlow
Collector. Counter samples may be taken opportunistically to fill these datagrams.
To perform Packet Flow Sampling, an sFlow Sampler Instance is configured with a Sampling Rate. Packet
Flow sampling results in the generation of Packet Flow Records. To perform Counter Sampling, an sFlow
Poller Instance is configured with a Polling Interval. Counter Sampling results in the generation of
Counter Records. sFlow Agents collect Counter Records and Packet Flow Records and send them as
sFlow datagrams to sFlow Collectors.
Packet Flow Sampling
Packet Flow Sampling, carried out by each sFlow instance, ensures that any packet observed at a Data
Source has an equal chance of being sampled, irrespective of the Packet Flow(s) to which it belongs.
Packet Flow Sampling is accomplished as follows:
1.
A packet arrives on an interface.
2.
The Network Device makes a filtering decision to determine whether the packet should be dropped.
3.
If the packet is not filtered (dropped) a destination interface is assigned by the switching/routing
function.
4.
A decision is made on whether or not to sample the packet.