Administrator Guide

sFlow
sFlow is a standard-based sampling technology embedded within switches and routers which is used to monitor network traffic. It is
designed to provide traffic monitoring for high-speed networks with many switches and routers.
Topics:
• Overview
• Implementation Information
• Enabling and Disabling sFlow on an Interface
• Enabling sFlow Max-Header Size Extended
• sFlow Show Commands
• Configuring Specify Collectors
• Changing the Polling Intervals
• Back-Off Mechanism
• sFlow on LAG ports
• Enabling Extended sFlow
Overview
The Dell EMC Networking Operating System (OS) supports sFlow version 5.
sFlow is a standard-based sampling technology embedded within switches and routers which is used to monitor network traffic. It is
designed to provide traffic monitoring for high-speed networks with many switches and routers. sFlow uses two types of sampling:
• Statistical packet-based sampling of switched or routed packet flows.
• Time-based sampling of interface counters.
The sFlow monitoring system consists of an sFlow agent (embedded in the switch/router) and an sFlow collector. The sFlow agent
resides anywhere within the path of the packet and combines the flow samples and interface counters into sFlow datagrams and forwards
them to the sFlow collector at regular intervals. The datagrams consist of information on, but not limited to, packet header, ingress and
egress interfaces, sampling parameters, and interface counters.
Application-specific integrated circuits (ASICs) typically complete packet sampling. sFlow collector analyses the sFlow datagrams received
from different devices and produces a network-wide view of traffic flows.
Implementation Information
Dell EMC Networking sFlow is designed so that the hardware sampling rate is per line card port-pipe and is decided based on all the ports
in that port-pipe.
If you do not enable sFlow on any port specifically, the global sampling rate is downloaded to that port and is to calculate the port-pipe’s
lowest sampling rate. This design supports the possibility that sFlow might be configured on that port in the future. Back-off is triggered
based on the port-pipe’s hardware sampling rate.
For example, if port 1 in the port-pipe has sFlow configured with a 16384 sampling rate while port 2 in the port-pipe has sFlow configured
but no sampling rate set, the system applies a global sampling rate of 512 to port 2. The hardware sampling rate on the port-pipe is then
set at 512 because that is the lowest configured rate on the port-pipe. When a high traffic situation occurs, a back-off is triggered and the
hardware sampling rate is backed-off from 512 to 1024. Note that port 1 maintains its sampling rate of 16384; port 1 is unaffected because
it maintains its configured sampling rate of 16384.:
• If the interface states are up and the sampling rate is not configured on the port, the default sampling rate is calculated based on the
line speed.
• If the interface states are shut down, the sampling rate is set using the global sampling rate.
• If the global sampling rate is non-default, for example 256, and if the sampling rate is not configured on the interface, the sampling rate
of the interface is the global non-default sampling rate, that is, 256.
To avoid the back-off, either increase the global sampling rate or configure all the line card ports with the desired sampling rate even if
some ports have no sFlow configured.
50
748 sFlow