Configuring sFlow·· 1

sFlow overview·· 1

Introduction to sFlow·· 1

sFlow operation· 2

Configuring sFlow·· 2

Configuring the sFlow agent and sFlow collector 2

Configuring flow sampling· 3

Configuring counter sampling· 3

Displaying and maintaining sFlow·· 3

sFlow configuration example· 4

Troubleshooting sFlow configuration· 5

The remote sFlow collector cannot receive sFlow packets 5

 

 

NOTE: The switch supports two operation modes: standalone (default) and IRF. For more information about IRF mode, see IRF Configuration Guide.

 

sFlow overview

Introduction to sFlow

Sampled Flow (sFlow) is a traffic monitoring technology mainly used to collect and analyze traffic statistics.

As shown in Figure 1, the sFlow system involves an sFlow agent embedded in a switch and a remote sFlow collector. The sFlow agent collects traffic statistics and packet information from the sFlow-enabled interfaces on the switch, encapsulates them into sFlow packets. When an sFlow packet buffer overflows, or an sFlow packet ages out (the aging time is one second), the sFlow agent sends the packet to a specified sFlow collector. The sFlow collector analyzes the sFlow packets and displays the results.

sFlow has the following two sampling mechanisms:

·           Flow sampling: Packet-based sampling, used to obtain packet content information.

·           Counter sampling: Time-based sampling, used to obtain port traffic statistics.

Figure 1 sFlow system

 

As a traffic monitoring technology, sFlow has the following advantages:

·           Supporting traffic monitoring on Gigabit and higher-speed networks.

·           Providing good scalability to allow one sFlow collector to monitor multiple or more sFlow agents.

·           Saving cost by embedding the sFlow agent in a switch, instead of using a dedicated sFlow agent switch.

 

NOTE: The switch supports only the sFlow agent function.

 

sFlow operation

sFlow operates as follows:

1.       Configure the sFlow agent and sFlow collector on the switch.

2.       With flow sampling enabled on an Ethernet interface, the sFlow agent samples packets and encapsulates them into sFlow packets. See “Configuring flow sampling” for the configuration.

3.       With counter sampling enabled on an Ethernet interface, the sFlow agent periodically collects the statistics of the interface and encapsulates the statistics into sFlow packets. See ”Configuring counter sampling” for the configuration.

Configuring sFlow

Complete the following tasks before sFlow can operate normally:

·           Configuring the IP address, and flow sampling or counter sampling of the sFlow collector on the device.

·           Configuring the sFlow collector.

Configuring the sFlow agent and sFlow collector

The sFlow feature enables the remote sFlow collector to monitor the network and analyze sFlow packet statistics.

To configure the sFlow agent and sFlow collector:

 

Step	Command	Remarks
1.      Enter system view.	system-view	N/A
2.      Specify the IP address for the sFlow agent.	sflow agent { ip ip-address | ipv6 ipv6-address }	Optional. Not specified by default. The device periodically checks the existence of the sFlow agent address. If the sFlow agent has no IP address configured, the device automatically selects an interface IP address for the sFlow agent but does not save the selected IP address. NOTE: ·       H3C recommends that you configure an IP address manually for the sFlow agent. ·       Only one IP address can be specified for the sFlow agent on the device.
3.      Configure the sFlow collector.	sflow collector collector-id { { ip ip-address | ipv6 ipv6-address } | datagram-size size | description text | port port-number | time-out seconds } *	By default, the device presets a number of sFlow collectors. Use the display sflow command to display the parameters of the preset sFlow collectors.
4.      Specify the source IP address of sent sFlow packets.	sflow source { ip ip-address | ipv6 ipv6-address } *	Optional. Not specified by default.

 

Configuring flow sampling

To configure flow sampling:

 

Step	Command	Remarks
1.      Enter system view.	system-view	N/A
2.      Enter Ethernet interface view.	interface interface-type interface-number	N/A
3.      Set the Flow sampling mode.	sflow sampling-mode { determine | random }	Optional. The switch does not support the random keyword. The default mode is determine.
4.      Set the rate for flow sampling.	sflow sampling-rate rate	No packet is sampled by default.
5.      Set the maximum copied length of a sampled packet.	sflow flow max-header length	Optional. By default, up to 128 bytes of a sampled packet can be copied. H3C recommends that you use the default value.
6.      Specify the sFlow collector for flow sampling of the sFlow Agent.	sflow flow collector collector-id	No collector is specified for flow sampling by default.

 

Configuring counter sampling

To configure counter sampling:

 

Step	Command	Remarks
1.      Enter system view.	system-view	N/A
2.      Enter interface view.	interface interface-type interface-number	N/A
3.      Set the interval for counter sampling.	sflow counter interval seconds	Counter sampling is disabled by default.
4.      Specify the sFlow collector for counter sampling.	sflow counter collector collector-id	No collector is specified for counter sampling by default.

 

Displaying and maintaining sFlow

 

Task	Command	Remarks
Display sFlow configuration and operation information (in standalone mode).	display sflow [ slot slot-number ] [ | { begin | exclude | include } regular-expression ]	Available in any view
Display sFlow configuration and operation information (in IRF mode).	display sflow [ chassis chassis-number slot slot-number ] [ | { begin | exclude | include } regular-expression ]	Available in any view

 

sFlow configuration example

 

NOTE: By default, Ethernet, VLAN, and aggregate interfaces are down. Before configuring them, bring them up with the undo shutdown command.

 

Network requirements

As shown in Figure 2, Host A is connected with Server through Device (sFlow agent).

Enable sFlow (including flow sampling and counter sampling) on GigabitEthernet 3/0/2 to monitor traffic on the port. Device sends sFlow packets through GigabitEthernet 3/0/1 to the sFlow collector, which analyzes the sFlow packets and displays results.

Figure 2 Network diagram

 

Configuration procedure

1.       Configure the sFlow agent and sFlow collector

# Add GigabitEthernet 3/0/1 to VLAN 2, and configure the IP address of VLAN-interface 2.

<Device> system-view

[Device] vlan 2

[Device-vlan2] quit

[Device] interface gigabitethernet 3/0/1

[Device-GigabitEthernet3/0/1] port access vlan 2

[Device-GigabitEthernet3/0/1] quit

[Device] interface vlan-interface 2

[Device-Vlan-interface2] ip address 3.3.3.1 16

[Device-Vlan-interface2] quit

# Specify the IP address of the sFlow agent.

[Device] sflow agent ip 3.3.3.1

# Specify ID 2, IP address 3.3.3.2, the default port number, and description of netserver for the sFlow collector.

[Device] sflow collector 2 ip 3.3.3.2 description netserver

2.       Configure flow sampling

# Set the flow sampling mode and sampling rate.

[Device-GigabitEthernet3/0/2] sflow sampling-mode determine

[Device-GigabitEthernet3/0/2] sflow sampling-rate 4000

# Specify flow collector 2 to receive the flow sampling data.

[Device-GigabitEthernet3/0/2] sflow flow collector 2

3.       Configure flow sampling

# Set the Flow sampling mode and sampling rate.

[Device-GigabitEthernet3/0/2] sflow sampling-mode determine

[Device-GigabitEthernet3/0/2] sflow sampling-rate 4000

# Specify sFlow collector 2 for flow sampling.

[Device-GigabitEthernet3/0/2] sflow flow collector 2

# Display the sFlow configuration and operation information.

<Device> display sflow

sFlow Version: 5

sFlow Global Information:

Agent        IP:3.3.3.1(CLI)

Source  Address:

Collector Information:

ID   IP                        Port  Aging      Size   Description

1                              6343  0          1400

2    3.3.3.2                   6343  N/A        1400   netserver

3                              6343  0          1400

4                              6343  0          1400

5                              6343  0          1400

6                              6343  0          1400

7                              6343  0          1400

8                              6343  0          1400

9                              6343  0          1400

10                             6343  0          1400

sFlow Port Information:

Interface CID  Interval(s) FID  MaxHLen   Rate      Mode     Status

GE3/0/2     2     120        2   128       4000     determine   Active

The output shows that GigabitEthernet 3/0/2 enabled with sFlow is active, the counter sampling interval is 120 seconds, the Flow sampling rate is 4000, all of which indicate sFlow operates normally.

Troubleshooting sFlow configuration

The remote sFlow collector cannot receive sFlow packets

Symptom

The remote sFlow collector cannot receive sFlow packets.

Analysis

·           The sFlow collector has no IP address specified.

·           No interface is enabled with sFlow to sample data.

·           The IP address of the sFlow collector specified on the sFlow agent is different from that of the remote sFlow collector.

·           No IP address is configured for the Layer 3 interface on the switch, or the IP address is configured, but the UDP packets with the IP address being the source cannot reach the sFlow collector.

·           The physical link between the switch and the sFlow collector fails.

Solution

1.       Check whether sFlow is correctly configured by displaying sFlow configuration with the display sflow command.

2.       Check whether the correct IP address is configured for the switch to communicate with the sFlow collector.

3.       Check whether the physical link between the switch and the sFlow collector is normal.