sFlow, short for "sampled flow", is an industry standard forpacket export at Layer 2 of theOSI model. sFlow was originally developed by InMon Corp.[1] It provides a means for exporting truncated packets, together with interface counters for the purpose of network monitoring. Maintenance of the protocol is performed by the sFlow.org consortium,[2] the authoritative source of the sFlow protocol specifications. The current version of sFlow is v5.
An sFlow system consists of multiple devices performing two types of sampling: random sampling ofpackets[7] orapplication layer operations,[8] and time-based sampling of counters.[7] The sampled packet/operation and counter information, referred to asflow samples andcounter samples respectively, are sent assFlow datagrams to a central server running software that analyzes and reports on network traffic; thesFlow collector.[9]
Based on a defined sampling rate, an average of 1 out of n packets/operations is randomly sampled. This type of sampling does not provide a 100% accurate result, but it does provide a result with quantifiable accuracy.[10]
A polling interval defines how often the network device sends interface counters. sFlow counter sampling is more efficient thanSNMP polling when monitoring a large number of interfaces.[11]
The sampled data is sent as aUDP packet to the specified host and port. Theofficial port number for sFlow is port 6343.[12] The lack of reliability in the UDP transport mechanism does not significantly affect the accuracy of the measurements obtained from an sFlow agent. If counter samples are lost then new values will be sent when the next polling interval has passed. The loss of packet flow samples results in a slight reduction of the effective sampling rate.
The UDP payload contains thesFlow datagram. Each datagram provides information about the sFlow version, the originating device’sIP address, a sequence number, the number of samples it contains and one or more flow and/or counter samples.
A well known alternative isNetFlow[15] (see below). Moreover, depending on the IT resources available it could be possible to perform full packet captures[16] using dedicated network taps (which are then subsequently analysed).
NetFlow andIPFIX are flow export protocols that aim at aggregating packets intoflows. After that, flow records are sent to a collection point for storage and analysis.[15] sFlow, however, has no notion offlows or packet aggregation at all.
sFlow allows for exporting packet data chunks and interface counters, which are non-typical features of flow export protocols. Note however that (recent)IPFIX developments provide a means for exportingSNMPMIB variables[17] and packet data chunks.[18]
While flow export can be performed with 1:1 sampling (i.e., considering every packet), this is typically not possible with sFlow, as it was not designed to do so. Sampling forms an integral part of sFlow, aiming to provide scalability for network-wide monitoring.[19]
