SFlow

sFlow, short for "sampled flow", is an industry standard for packet export at Layer 2 of the OSI model. sFlow was originally developed by InMon Corp.[1] It provides a means for exporting truncated packets, together with interface counters for the purpose of network monitoring. Maintenance of the protocol is performed by the sFlow.org consortium,[2] the authoritative source of the sFlow protocol specifications. The current version of sFlow is v5.

Operation

sFlow uses mandatory sampling to achieve scalability[3] and is, for this reason, applicable to high speed networks (gigabit per second speeds and higher).[4] sFlow is supported by multiple network device manufacturers[5] and network management software vendors.[6]

An sFlow system consists of multiple devices performing two types of sampling: random sampling of packets[7] or application layer operations,[8] and time-based sampling of counters.[7] The sampled packet/operation and counter information, referred to as flow samples and counter samples respectively, are sent as sFlow datagrams to a central server running software that analyzes and reports on network traffic; the sFlow collector.[9]

Flow samples

Based on a defined sampling rate, an average of 1 out of n packets/operations is randomly sampled. This type of sampling does not provide a 100% accurate result, but it does provide a result with quantifiable accuracy.[10]

Counter samples

A polling interval defines how often the network device sends interface counters. sFlow counter sampling is more efficient than SNMP polling when monitoring a large number of interfaces.[11]

sFlow datagrams

The sampled data is sent as a UDP packet to the specified host and port. The official port number for sFlow is port 6343.[12] The lack of reliability in the UDP transport mechanism does not significantly affect the accuracy of the measurements obtained from an sFlow agent. If counter samples are lost then new values will be sent when the next polling interval has passed. The loss of packet flow samples results in a slight reduction of the effective sampling rate.

The UDP payload contains the sFlow datagram. Each datagram provides information about the sFlow version, the originating device’s IP address, a sequence number, the number of samples it contains and one or more flow and/or counter samples.

sFlow versions

Version Comment
v1 Initial version
v2 (Unknown)
v3 Adds support for extended_url information.[13]
v4 Adds support BGP communities.[13]
v5 Several protocol enhancements.[14] This is the current version, which is globally supported.

A well known alternative is NetFlow[15] (see below). Moreover, depending on the IT resources available it could be possible to perform full packet captures[16] using dedicated network taps (which are then subsequently analysed).


NetFlow, IPFIX

  • NetFlow and IPFIX are flow export protocols that aim at aggregating packets into flows. After that, flow records are sent to a collection point for storage and analysis.[15] sFlow, however, has no notion of flows or packet aggregation at all.
  • sFlow allows for exporting packet data chunks and interface counters, which are non-typical features of flow export protocols. Note however that (recent) IPFIX developments provide a means for exporting SNMP MIB variables[17] and packet data chunks.[18]
  • While flow export can be performed with 1:1 sampling (i.e., considering every packet), this is typically not possible with sFlow, as it was not designed to do so. Sampling forms an integral part of sFlow, aiming to provide scalability for network-wide monitoring.[19]

See also

References

  1. ^ "InMon: SFlow".
  2. ^ "sFlow.org - Making the Network Visible". sFlow.org. Retrieved 2016-03-09.
  3. ^ Jedwab, Jonathan; Phaal, Peter; Pinna, Bob (March 1992). "Traffic Estimation for the Largest Sources on a Network, Using Packet Sampling with Limited Storage" (PDF). HP Labs. Retrieved 2016-03-09.
  4. ^ Jasinska, Elisa (December 2006). "sFlow, I can feel your traffic" (PDF). Amsterdam Internet Exchange (AMS-IX). Retrieved 2016-03-09.
  5. ^ "sFlow Products: Network Equipment". sFlow.org. Retrieved 2016-03-09.
  6. ^ "sFlow Products: sFlow Collectors". sFlow.org. Retrieved 2016-03-09.
  7. ^ a b Phaal, Peter; Lavine, Marc (July 2004). "sFlow Version 5". sFlow.org. Retrieved 2014-06-26.
  8. ^ Phaal, Peter; Jordan, Robert (July 2010). "sFlow Host Structures". sFlow.org. Retrieved 2010-10-23.
  9. ^ "Traffic Monitoring using sFlow" (PDF). sFlow.org. 2003. Retrieved 2010-10-23.
  10. ^ Phaal, Peter; Panchen, Sonia (2002). "Packet Sampling Basics". sFlow.org. Retrieved 2010-10-23.
  11. ^ Liu, G.; Neufeld, N. (December 2009). "Management of the LHCb network based on SCADA system" (PDF). CERN. Retrieved 2010-10-23.
  12. ^ "Port Numbers". IANA. Retrieved 2010-10-23.
  13. ^ a b Phaal, Peter; Panchen, Sonia; McKee, Neil (September 2001). "sFlow Datagram Format". InMon Corporation's sFlow: A Method for Monitoring Traffic in Switched and Routed Networks. IETF. doi:10.17487/RFC3176. RFC 3176. Retrieved 2014-06-20.
  14. ^ "sFlow Version 5". sFlow.org. Retrieved 2014-06-20.
  15. ^ a b Hofstede, Rick; Celeda, Pavel; Trammell, Brian; Drago, Idilio; Sadre, Ramin; Sperotto, Anna; Pras, Aiko (2014). "Flow Monitoring Explained: From Packet Capture to Data Analysis with NetFlow and IPFIX" (PDF). IEEE Communications Surveys & Tutorials. 16 (4): 2037–2064. doi:10.1109/COMST.2014.2321898. S2CID 14042725.
  16. ^ "Packet capture". sFlow.org. Retrieved 2019-07-13.
  17. ^ "Exporting MIB Variables using the IPFIX Protocol". IETF. Retrieved 2014-06-19.
  18. ^ "IP Flow Information Export (IPFIX) Entities". IANA. Retrieved 2014-06-19.
  19. ^ "Scalability and accuracy of packet sampling". sFlow.org. Retrieved 2014-06-19.