WESM zl Management and Configuration Guide WT.01.28 and greater

13-3
sFlow Agent
Overview
On the Wireless Edge Services zl Module, data sources are RP radios, and “n,” the
packet sampling rate, is configurable per-radio and sampling instance (up to six per
radio). In other words, the module orders radios to send approximately every “nth”
packet to the module’s sFlow agent to be sampled, packaged, and sent to the sFlow
receiver or receivers.
Note Only 802.11 data frames are sampled. The sFlow agent does not sample management
and control frames such as beacons.
The sFlow agent packages samples into small datagrams which include, among other
information:
■ sampled packets’ headers
The agent decrypts an encrypted header before sampling it.
■ sampled packets’ inbound or outbound interface
For a wireless network, the inbound interface is the radio.
■ information about the how sampled packets are being forwarded
The extra information in the datagram helps an sFlow receiver to create a detailed,
as well as accurate and up-to-date, picture of network activity. An advantage of sFlow
is that datagrams are nonetheless compact and do not require a large amount of
network bandwidth. The sampled packets are approximately 7 percent of the original
packet size, and several samples can fit in a single datagram. The same datagrams
that include packet samples can also include counters reported by polled radios (see
“Counter Polling by the sFlow Agent” on page 13-3). Since only some packets are
sampled, sFlow creates very little overhead. For example, if you set the sampling rate
to one packet in 100, flow sampling only adds about .7 percent overhead.
The module uses datagram version 5, and the default datagram size is 1400 bytes.
(The size is configurable although you should usually accept the default. See
“Manually Configuring sFlow Receiver Instances Using the Web Browser Interface”
on page 13-7 for more information.)
Counter Polling by the sFlow Agent
In addition to sampling approximately every “nth” packet, the Wireless Edge Services
zl Module’s sFlow agent can sample the counters tracked by radios. These counters
include traffic statistics such as the number of inbound frames, outbound frames, and
retransmitted frames.
Counter polling works with flow sampling to create a more comprehensive picture
of network traffic. The counters for total traffic supplement the more detailed
information collected for samples.