sFlow
Defined in RFC 3176, sFlow is meant to help administrators adjust network traffic patterns in complex enterprise, metropolitan service provider and high-performance computing environments with thousands of nodes and significant bandwidth requirements.
In an sFlow-enabled network, agents are embedded in network switch or router ASIC chips to sample network traffic. The sFlow management information base controls the sFlow agent, which captures, formats and forwards the packet samples to a central RFC 3176 data collector creating a datagram. By statistically sampling network traffic, network administrators gain a system-wide view of the traffic, network security and application traffic sources throughout the network.
With typical data gathering, RFC 3176 doesn't add significant network load, which is in contrast to software-based proprietary vendor approaches to traffic monitoring. The only sFlow packet sampling work done in software on the device is a few simple lookups, marshalling data into a datagram and queuing the datagram for transmission.
When a packet is sampled, its header is extracted and placed into an sFlow datagram or detailed map of the packet's network journey, which includes header, I/O source, destination and interface statistics. This datagram then is sent immediately to the sFlow Collection Server, a central data collector and analyzer.
One collection server can gather datagrams from more than 20,000 switch ports, decoding the packet headers and other information to present detailed Layer 2 to Layer 7 usage statistics.
Because the datagram immediately is sent to the collection server, memory requirements are extremely small and bounded, meaning that complex memory management software is unnecessary. This lets the sampling standard be implemented in simple Layer 2 switches to high-end core routers without requiring additional memory or CPU.
Additional resources
sflow.org
Vendor and end-user organization. Site has tutorials and lists of sFlow-enabled products and applications.
Management research center
Latest management news, analysis and links from Network World Fusion.
Add a comment
