Sflow

Making the Network Visible www.sflow.org

Traffic Monitoring using sFlow®
With the ever-increasing reliance on network services for business critical applications, the smallest change in network usage can impact network performance and reliability. This has a direct impact on the ability to conduct key business functions and on the cost of maintaining network services. By providingunprecedented visibility into network usage and active routes of even today's high-speed and complex networks, sFlow provides the data required to effectively control and manage network usage, ensuring that network services provide a competitive advantage. Examples of the applications of sFlow data are: • • • • • • • • Detecting, diagnosing, and fixing network problems Real-time congestion managementUnderstanding application mix (e.g. P2P, Web, DNS etc) and changes Usage accounting for billing and charge-back Audit trail analysis to identify unauthorized network activity and trace the sources of denial-ofservice attacks Route profiling and peering optimization Trending and capacity planning. sFlow provides a network-wide view of usage and active routes. It is a scalable technique for measuringnetwork traffic, collecting, storing, and analyzing traffic data. This enables tens of thousands of interfaces to be monitored from a single location. sFlow is scalable, enabling it to monitor links of speeds up to 10Gb/s and beyond without impacting the performance of core internet routers and switches, and without adding significant network load. sFlow is a low cost solution. It has been implementedon a wide range of devices, from simple L2 workgroup switches to high-end core routers, without requiring additional memory and CPU. sFlow is an industry standard with a growing number of vendors delivering products with sFlow support.

sFlow is a sampling technology that meets the key requirements for a network traffic monitoring solution:

•

• •

A brief history of packet samplingPacket sampling has been used to monitor network traffic for over ten years (see Figure 1). HewlettPackard first demonstrated network-wide monitoring using packet sampling of the University of Geneva and CERN networks at Telecom ‘91. This was followed up with the introduction of networking products with embedded packet sampling capability - HP Extended RMON - in 1993. However, broad acceptance of thistechnique is only just starting, driven by the introduction of higher speed networks and the transition from shared to switched networks. Packet based sampling as an embedded network traffic monitoring technique is now compelling. In a switched environment, the most effective place to monitor traffic is within the switch/router, where all the traffic will be seen. Traditional probes will onlyhave a partial view of traffic.

Copyright  2003 sFlow.org All rights reserved

sFlow RFC 3176 published Foundry implements sFlow

Telecom 91 - HP demo Packet sampling University of Geneva CERN HP introduces EASE/Extended RMON Embedded packet sampling

Cisco, Juniper implement Packet sampling in ASICs

10Gb switched 1Gb switched

100Mb switched 100Mb shared 10Mb shared

1991 1992 19931994 1995 1996 1997 1998 1999 2000 2001 2002

Figure 1 History of Packet Sampling However, a traffic monitoring solution embedded within a switch or router must not impact forwarding performance. Switches and routers with embedded sFlow sampling technology have been available since 2001. This solution provides detailed and quantitative traffic measurements, at gigabit speeds, gives insight intoforwarding decisions, and does not impact forwarding or network performance.

What is sFlow?
sFlow is a multi-vendor sampling technology embedded within switches and routers. It provides the ability to continuously monitor application level traffic flows at wire speed on all interfaces simultaneously.
sFlow Datagram

Flow Sampling
Total_Packets = 0 Total_Samples = 0 Skip = NextSkip(Rate)...