02-21-2012 08:59 AM
Can someone provide me more background on how sflow is used or correct me if I'm wrong?
Its my understanding that sflow takes samples when it takes these samples it reads the packets to calculate the amount of traffic by reading the header data and sequence information. I need to know how accurate is this sampled information? If I setup 500 rate of sampling and 1500 rate of sampling they should (in my mind) come up with almost identical traffic calculations if the information is truly calculated from the tcp headers and sequence information.
Otherwise if they are skewed then the data is strictly looking at data that is sampled and not calculating throughput based on header and sequence information in the tcp stream.
I would like to setup SFLOW to be able to track customers "CIT" but only if its proven accurate.
Thoughts or Ideas?
02-27-2012 01:42 AM
Some informaiton on sFlow below.
sFlow is a standards-based protocol that allows network traffic to be sampled at a user-defined rate for the purpose of monitoring traffic flow patterns and identifying packet transfer rates on user-specified interfaces.
When sFlow is enabled on a Layer 2 or Layer 3 switch, the system performs the following sFlow-related tasks:
sFlow version 5
sFlow version 5 enhances and modifies the format of the data sent to the sFlow collector. sFlow version 5 introduces several new sFlow features and also defines a new datagram syntax used by the sFlow agent to report flow samples and interface counters to the sFlow collector.
sFlow version 5 adds support for the following:
sFlow version 5 is backward-compatible with sFlow version 2. By default, the sFlow agent exports sFlow version 5 flow samples by default, but you can configure the device to export the data in sFlow version 2 format. You can switch between sFlow version 2 and sFlow version 5 formats. The
sFlow collector automatically parses each incoming sample and decodes it based on the version number.
* So as you can see it also sends the byte and packet data too.
* Many customer use sFlow for this (accounting/billing)
* Lowering the sample rate to will better results depending on your types of traffic
* Setting the sample rate lower will increase CPU load (default is 512, suggest no lower 128, but you must test it in your network)
* Make sure you are using a sFlow version 5 collector