Network Monitoring using sFlow®

What is sFlow®?

sFlow® Architecture

sFlow® Architecture

sFlow® Protocol

sFlow® Protocol

sFlow® Protocol

sFlow® Protocol

sFlow® Protocol

sFlow® Protocol

sFlow® Protocol

sFlow® Protocol

sFlow® Sampling Machanism

Packet Flow Sampling Sampling Rate = Total_Packets/Total_Samples Random Number Approach

Periodical Counter Sampling List of Counter Sources Max_Sample_Rate; Polling & Random start Can be combined with Flow Sample

sFlow® Protocol

[Packet Capture]

sFlow® Collector

[sFlowTrend®]

What can you do with sFlow®?

• FCAPS –F (detecting, diagnosing network problems)

(abnormal traffic pattern)–P (congestion mgmt – flow switching, rate limiting,

route profiling, provisioning more bandwidth) –S (suspicious activity, source of DoS attack)–A (billing & charge-back)

Advantages of sFlow®

• Low Cost – sFlow agent is simple to implement & add negligible costs.

• Detailed Data – Captures samples with complete packet header – allows analysis of L2-L7 flows.

• Scalable – samples are collected by ASICs (10G or 100G doesn’t matter); thousands of nodes can be monitored by single sFlow® Collector*.

Advantages of sFlow®sFlow can also used in SDNs.*

*http://blog.sflow.com/2013/04/sdn-packet-broker.html

Comparison of sFlow® with other technologies

Comparison of sFlow® with other technologies

Comparison of sFlow® with other technologies

Comparison of sFlow® with other technologies

Comparison of sFlow® with other technologies