{{Short description|Network packet standard}} {{Lowercase title}} '''sFlow''', short for "sampled flow", is a standard for packet export at Layer 2 of the OSI model. sFlow was originally developed by InMon Corp.<ref>{{Cite web|url=https://inmon.com/technology/index.php|title = InMon: SFlow}}</ref> It provides a means for exporting truncated packets, together with interface counters for the purpose of network monitoring. Maintenance of the protocol is performed by the sFlow.org consortium,<ref name="sFlow.org">{{cite web | url = http://www.sflow.org/ | title = sFlow.org - Making the Network Visible | publisher = sFlow.org | accessdate = 2016-03-09 }}</ref> the authoritative source of the sFlow protocol specifications. The current version of sFlow is v5.
== Operation == sFlow uses mandatory sampling to achieve scalability<ref name="Jedwab">{{cite web | url = http://www.hpl.hp.com/techreports/92/HPL-92-35.pdf | title = Traffic Estimation for the Largest Sources on a Network, Using Packet Sampling with Limited Storage | first1 = Jonathan | last1 = Jedwab | first2 = Peter | last2 = Phaal | first3 = Bob | last3 = Pinna |date=March 1992 | publisher = HP Labs | accessdate = 2016-03-09 }}</ref> and is, for this reason, applicable to high speed networks (gigabit per second speeds and higher).<ref name="Jasinska">{{cite web | url = https://events.ccc.de/congress/2006/Fahrplan/attachments/1137-sFlowPaper.pdf | title = sFlow, I can feel your traffic | first = Elisa | last = Jasinska |date=December 2006 | publisher = Amsterdam Internet Exchange (AMS-IX) | accessdate = 2016-03-09 }}</ref> sFlow is supported by multiple network device manufacturers<ref name="Network Equipment">{{cite web | url = http://www.sflow.org/products/network.php | title = sFlow Products: Network Equipment | publisher = sFlow.org | accessdate = 2016-03-09 }}</ref> and network management software vendors.<ref name="Software">{{cite web | url = http://www.sflow.org/products/collectors.php | title = sFlow Products: sFlow Collectors | publisher = sFlow.org | accessdate = 2016-03-09 }}</ref>
An sFlow system consists of multiple devices performing two types of sampling: random sampling of packets<ref name="sFlow Version 5">{{cite web | url = http://www.sflow.org/sflow_version_5.txt | title = sFlow Version 5 | first1 = Peter | last1 = Phaal | first2 = Marc | last2 = Lavine |date=July 2004 | publisher = sFlow.org | accessdate = 2014-06-26 }}</ref> or application layer operations,<ref name="sFlow Host Structures">{{cite web | url = http://www.sflow.org/sflow_host.txt | title = sFlow Host Structures | first1 = Peter | last1 = Phaal | first2 = Robert | last2 = Jordan |date=July 2010 | publisher = sFlow.org | accessdate = 2010-10-23 }}</ref> and time-based sampling of counters.<ref name="sFlow Version 5" /> The sampled packet/operation and counter information, referred to as ''flow samples'' and ''counter samples'' respectively, are sent as ''sFlow datagrams'' to a central server running software that analyzes and reports on network traffic; the ''sFlow collector''.<ref>{{cite web | url = http://www.sflow.org/sFlowOverview.pdf | title = Traffic Monitoring using sFlow | year = 2003 | publisher = sFlow.org | accessdate = 2010-10-23 }}</ref>
=== Flow samples === Based on a defined sampling rate, an average of 1 out of n packets/operations is randomly sampled. This type of sampling does not provide a 100% accurate result, but it does provide a result with quantifiable accuracy.<ref name="packet sampling basics">{{cite web | url = http://www.sflow.org/packetSamplingBasics/index.htm | title = Packet Sampling Basics | first1 = Peter | last1 = Phaal | first2 = Sonia | last2 = Panchen | year = 2002 | publisher = sFlow.org | accessdate = 2010-10-23 }}</ref>
=== Counter samples === A polling interval defines how often the network device sends interface counters. sFlow counter sampling is more efficient than SNMP polling when monitoring a large number of interfaces.<ref name="LHCb">{{cite web | url = http://cdsweb.cern.ch/record/1216160/files/LHCb-CONF-2009-047.pdf | title = Management of the LHCb network based on SCADA system | first1 = G. | last1 = Liu | first2 = N. | last2 = Neufeld |date=December 2009 | publisher = CERN | accessdate = 2010-10-23 }}</ref>
=== sFlow datagrams === The sampled data is sent as a UDP packet to the specified host and port. The official port number for sFlow is port 6343.<ref name="assigned port">{{cite web | url = https://www.iana.org/assignments/port-numbers | title = Port Numbers | publisher = IANA | accessdate = 2010-10-23 }}</ref> The lack of reliability in the UDP transport mechanism does not significantly affect the accuracy of the measurements obtained from an sFlow agent. If counter samples are lost then new values will be sent when the next polling interval has passed. The loss of packet flow samples results in a slight reduction of the effective sampling rate.
The UDP payload contains the ''sFlow datagram''. Each datagram provides information about the sFlow version, the originating device’s IP address, a sequence number, the number of samples it contains and one or more flow and/or counter samples.
== sFlow versions == {| class="wikitable" style="margin: 0 auto; text-align: left" |- ! |Version ! |Comment |- ! |v1 | |Initial version |- ! |v2 | |(Unknown) |- ! |v3 | |Adds support for ''extended_url'' information.<ref name="RFC3176">{{cite IETF | title = InMon Corporation's sFlow: A Method for Monitoring Traffic in Switched and Routed Networks | rfc = 3176 | sectionname = sFlow Datagram Format | last1 = Phaal | first1 = Peter | last2 = Panchen | first2 = Sonia | last3 = McKee | first3 = Neil |date=September 2001 | publisher = IETF | accessdate = 2014-06-20 }}</ref> |- ! |v4 | |Adds support BGP communities.<ref name="RFC3176" /> |- ! |v5 | |Several protocol enhancements.<ref name="sFlow_v5">{{cite web | url = http://sflow.org/sflow_version_5.txt | title = sFlow Version 5 | publisher = sFlow.org | accessdate = 2014-06-20 }}</ref> This is the current version, which is globally supported. |}
== Related technologies ==
A well known alternative is NetFlow<ref name="Flow_Monitoring_Tutorial">{{cite journal | last1 = Hofstede | first1 = Rick | last2 = Celeda | first2 = Pavel | last3 = Trammell | first3 = Brian | last4 = Drago | first4 = Idilio | last5 = Sadre | first5 = Ramin | last6 = Sperotto | first6 = Anna | last7 = Pras | first7 = Aiko | title = Flow Monitoring Explained: From Packet Capture to Data Analysis with NetFlow and IPFIX | url =https://iris.polito.it/bitstream/11583/2658703/1/tutorial.pdf | journal = IEEE Communications Surveys & Tutorials | volume = 16 | issue = 4 | pages = 2037–2064 | doi = 10.1109/COMST.2014.2321898 | year = 2014 | s2cid = 14042725 }}</ref> (see below). Moreover, depending on the IT resources available it could be possible to perform full packet captures<ref>{{cite web | url = https://blog.sflow.com/2011/11/tcpdump.html | title = Packet capture | publisher = sFlow.org | accessdate = 2019-07-13 }}</ref> using dedicated network taps (which are then subsequently analysed).
=== NetFlow, IPFIX === * NetFlow and IPFIX are flow export protocols that aim at aggregating packets into flows. After that, flow records are sent to a collection point for storage and analysis.<ref name= Flow_Monitoring_Tutorial /> sFlow, however, has no notion of flows or packet aggregation at all. * sFlow allows for exporting packet data chunks and interface counters, which are non-typical features of flow export protocols. Note however that (recent) IPFIX developments provide a means for exporting SNMP MIB variables<ref name="IPFIX_SNMP_MIB">{{cite web | url = http://tools.ietf.org/html/draft-ietf-ipfix-mib-variable-export | title = Exporting MIB Variables using the IPFIX Protocol | publisher = IETF | accessdate = 2014-06-19 }}</ref> and packet data chunks.<ref name="IPFIX_IE_IANA">{{cite web | url = https://www.iana.org/assignments/ipfix/ipfix.xhtml | title = IP Flow Information Export (IPFIX) Entities | publisher = IANA | accessdate = 2014-06-19 }}</ref> * While flow export can be performed with 1:1 sampling (''i.e.'', considering every packet), this is typically not possible with sFlow, as it was not designed to do so. Sampling forms an integral part of sFlow, aiming to provide scalability for network-wide monitoring.<ref name="sFlow_scalability_sampling">{{cite web | url = http://blog.sflow.com/2009/05/scalability-and-accuracy-of-packet.html | title = Scalability and accuracy of packet sampling | publisher = sFlow.org | accessdate = 2014-06-19 }}</ref>
==See also== * NetFlow * Network Management * Packet analyzer * RMON
==References== {{reflist}}
== External links == * [http://www.sflow.org/ Official site] * [http://www.pcwdld.com/netflow-vs-sflow Differences between Sflow vs Netflow]
{{DEFAULTSORT:Sflow}} Category:Computer network analysis