Contents

Configuring sFlow· 1

Protocols and standards· 1

sFlow configuration task list 1

Configuring the sFlow agent and sFlow collector information· 2

Configuring flow sampling· 2

Configuring counter sampling· 3

Displaying and maintaining sFlow·· 3

sFlow configuration example· 3

Network requirements· 3

Configuration procedure· 4

Verifying the configuration· 4

Troubleshooting sFlow configuration· 5

The remote sFlow collector cannot receive sFlow packets· 5

 

Configuring sFlow

Sampled Flow (sFlow) is a traffic monitoring technology.

As shown in Figure 1, the sFlow system involves an sFlow agent embedded in a device and a remote sFlow collector. The sFlow agent collects interface counter information and packet information and encapsulates the sampled information in sFlow packets. When the sFlow packet buffer is full, or the aging timer (fixed to 1 second) of sFlow packets expires, the sFlow agent sends the sFlow packets in UDP datagrams to the specified sFlow collector. The sFlow collector analyzes the information and displays the results.

sFlow provides the following sampling mechanisms:

·          Flow sampling—Obtains packet information.

·          Counter sampling—Obtains interface counter information.

Figure 1 sFlow system

 

As a traffic monitoring technology, sFlow has the following advantages:

·          Supports traffic monitoring on Gigabit and higher-speed networks.

·          Provides good scalability to allow one sFlow collector to monitor multiple sFlow agents.

·          Saves money by embedding the sFlow agent in a device, instead of using a dedicated sFlow agent device.

Protocols and standards

·          RFC 3176, InMon Corporation's sFlow: A Method for Monitoring Traffic in Switched and Routed Networks

·          sFlow.org, sFlow Version 5

sFlow configuration task list

Tasks at a glance
(Required.) Configuring the sFlow agent and sFlow collector information
Perform at least one of the following tasks: ·         Configuring flow sampling ·         Configuring counter sampling

 

Configuring the sFlow agent and sFlow collector information

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       (Optional.) Configure an IP address for the sFlow agent.	sflow agent ip ip-address	By default, no IP address is configured for the sFlow agent. The device periodically checks whether the sFlow agent has an IP address. If not, the device automatically selects an IPv4 address for the sFlow agent but does not save the IPv4 address in the configuration file. NOTE: ·         As a best practice, manually configure an IP address for the sFlow agent. ·         Only one IP address can be configured for the sFlow agent on the device, and a newly configured IP address overwrites the existing one.
3.       Configure the sFlow collector information.	sflow collector collector-id [ vpn-instance vpn-instance-name ] ip ip-address [ port port-number | datagram-size size | time-out seconds | description text ] *	By default, no sFlow collector information is configured.
4.       (Optional.) Specify the source IP address of sFlow packets.	sflow source ip ip-address	By default, the source IP address is determined by routing.

 

Configuring flow sampling

Perform this task to configure flow sampling on an Ethernet interface. The sFlow agent samples packets on that interface according to the configured parameters, encapsulates them into sFlow packets, and sends them in UDP packets to the specified sFlow collector.

To configure flow sampling:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Enter Ethernet interface view.	interface interface-type interface-number	N/A
3.       (Optional.) Set the flow sampling mode.	sflow sampling-mode { determine | random }	The default setting is random. The switch does not support the determine mode.
4.       Enable flow sampling and specify the number of packets out of which flow sampling samples a packet on the interface.	sflow sampling-rate rate	By default, flow sampling samples no packet. As a best practice, set the sampling interval to 2n that is greater than or equal to 8192, for example, 32768.
5.       (Optional.) Set the maximum number of bytes of a packet (starting from the packet header) that flow sampling can copy.	sflow flow max-header length	The default setting is 128 bytes.
6.       Specify the sFlow collector for flow sampling.	sflow flow collector collector-id	By default, no sFlow collector is specified for flow sampling.

 

Configuring counter sampling

Perform this task to configure counter sampling on an Ethernet interface. The sFlow agent periodically collects the counter information on that interface, encapsulates the information into sFlow packets, and sends them in UDP packets to the specified sFlow collector.

To configure counter sampling:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Enter Ethernet interface view.	interface interface-type interface-number	N/A
3.       Enable counter sampling and set the counter sampling interval.	sflow counter interval interval-time	By default, counter sampling is disabled.
4.       Specify the sFlow collector for counter sampling.	sflow counter collector collector-id	By default, no sFlow collector is specified for counter sampling.

 

Displaying and maintaining sFlow

Execute display commands in any view.

 

Task	Command
Display sFlow configuration.	display sflow

 

sFlow configuration example

Network requirements

As shown in Figure 2, perform the following tasks:

·          Configure flow sampling in random mode and counter sampling on FortyGigE 1/0/1 of the device to monitor traffic on the port.

·          Configure the device to send sampled information in sFlow packets through FortyGigE 1/0/3 to the sFlow collector.

Figure 2 Network diagram

 

Configuration procedure

1.        Configure the IP addresses and subnet masks for interfaces, as shown in Figure 2. (Details not shown.)

2.        Configure the sFlow agent and configure information about the sFlow collector:

# Configure the IP address for the sFlow agent.

<Sysname> system-view

[Sysname] sflow agent ip 3.3.3.1

# Configure information about the sFlow collector: specify the sFlow collector ID as 1, IP address as 3.3.3.2, port number as 6343 (default), and description as netserver.

[Sysname] sflow collector 1 ip 3.3.3.2 description netserver

3.        Configure counter sampling:

# Enable counter sampling and set the counter sampling interval to 120 seconds on FortyGigE 1/0/1.

[Sysname] interface fortygige 1/0/1

[Sysname-FortyGigE1/0/1] sflow counter interval 120

# Specify sFlow collector 1 for counter sampling.

[Sysname-FortyGigE1/0/1] sflow counter collector 1

4.        Configure flow sampling:

# Enable flow sampling and set the flow sampling mode to random and sampling interval to 32768.

[Sysname-FortyGigE1/0/1] sflow sampling-mode random

[Sysname-FortyGigE1/0/1] sflow sampling-rate 32768

# Specify sFlow collector 1 for flow sampling.

[Sysname-FortyGigE1/0/1] sflow flow collector 1

Verifying the configuration

# Verify that FortyGigE 1/0/1 enabled with sFlow is active, and sFlow is operating correctly.

[Sysname-FortyGigE1/0/1] display sflow

sFlow datagram version: 5

Global information:

Agent IP: 3.3.3.1(CLI)

Source address:

Collector information:

ID    IP              Port  Aging      Size VPN-instance Description

1     3.3.3.2         6343  N/A        1400              netserver

Port information:                                                              

Interface      CID   Interval(s) FID   MaxHLen Rate     Mode      Status

FGE1/1         1     120         1     128     32768    Random    Active

Troubleshooting sFlow configuration

The remote sFlow collector cannot receive sFlow packets

Symptom

The remote sFlow collector cannot receive sFlow packets.

Analysis

The possible reasons include:

·          The sFlow collector is not specified.

·          sFlow is not configured on the interface.

·          The IP address of the sFlow collector specified on the sFlow agent is different from that of the remote sFlow collector.

·          No IP address is configured for the Layer 3 interface that sends sFlow packets,

·          An IP address is configured for the Layer 3 interface that sends sFlow packets. However, the UDP datagrams with this source IP address cannot reach the sFlow collector.

·          The physical link between the device and the sFlow collector fails.

·          The length of an sFlow packet is less than the sum of the following two values:

¡  The length of the sFlow packet header.

¡  The number of bytes that flow sampling can copy per packet.

·          The sFlow collector is bound to a non-existent VPN.

Solution

To resolve the problem:

1.        Verify that sFlow is correctly configured by using the display sflow command.

2.        Verify that a correct IP address is configured for the device to communicate with the sFlow collector.

3.        Verify that the physical link between the device and the sFlow collector is up.

4.        Verify that the length of an sFlow packet is greater than the sum of the following two values:

¡  The length of the sFlow packet header.

¡  The number of bytes (as a best practice, use the default) that flow sampling can copy per packet.

5.        Verify that the VPN bound to the sFlow collector already exists.