Understanding sFlow

Architecture of an sFlow System

As shown in Figure 1, an sFlow system consists of an sFlow agent embedded in a Huawei switch and a remote sFlow collector. The sFlow agent obtains traffic statistics from an interface using sampling and encapsulates them into sFlow packets. When an sFlow packet buffer overflows or an sFlow packet expires (expiry period: 1 second), the agent sends the sFlow packets to the collector. The collector analyzes these sFlow packets and displays traffic statistics in a report.

Figure 1 sFlow system

sFlow Sampling

An sFlow agent provides flow sampling and counter sampling.

Flow sampling

With flow sampling, an agent samples ingress packets, egress packets, or both on an interface based on a sampling rate, and parses the packets to obtain information about packet data content. Flow sampling focuses on traffic attributes to monitor and parse traffic behaviors on the network.

**Table 1** Main fields in flow sampling packets
Field	Description
Raw packet	Records the entire packet or part of the packet header.
Ethernet Frame Data	Analyzes Ethernet headers in Ethernet frames.
IPv4 Data	Analyzes IPv4 headers in IPv4 packets that are forwarded at Layer 3.
IPv6 Data	Analyzes IPv6 headers in IPv6 packets that are forwarded at Layer 3.
Extended Switch Data	Records VLAN translation and 802.1Q priority mapping information in Ethernet frames. VLAN ID 0 indicates an invalid VLAN.
Extended Router Data	Records routing information for packets.

Counter sampling

With counter sampling, an agent periodically obtains traffic statistics on an interface. Table 2 describes the main fields in counter sampling packets. In contrast with flow sampling, counter sampling focuses on traffic statistics on an interface rather than traffic details.

**Table 2** Main fields in counter sampling packets
Field	Description
Generic Interface Counters	Records basic information and traffic statistics on an interface.
Ethernet Interface Counters	Records traffic statistics on an Ethernet interface.
Processor Information	Records CPU usage and memory usage of a device.

sFlow Packet

sFlow packets are encapsulated in UDP packets. By default, sFlow packets are transmitted by known port 6343. sFlow packets use the following packet header formats: Flow sample, Expanded Flow sample, Counter sample, and Expanded Counter sample. Expanded Flow sample and Expanded Counter sample are additions in sFlow version 5 and are extensions to Flow sample and Counter sample, but they are not compatible with earlier versions. All expanded sampling packets must be encapsulated with the expanded sampling packet header.