Glossary

sFlow

Sampled Flow

What is sFlow

sFlow (Sampled Flow) is a packet-sampling-based network traffic monitoring technology, used primarily for statistical analysis of network traffic so operators can quickly and easily spot abnormal usage patterns or growth trends.

An sFlow system consists of two parts: an sFlow Agent embedded in the network device, and a remote sFlow Collector. The Agent packages the interface statistics and traffic data it gathers into sFlow datagrams and sends them to a designated Collector, which then analyzes the received sFlow data.

sFlow performs two distinct kinds of sampling:

  • Counter sampling: time-based sampling of interface statistics. The Agent periodically gathers device CPU and memory utilization, along with interface status and traffic counters, and periodically builds sFlow packets to send to the Collector.

  • Flow sampling: packet-based sampling of the actual data stream. On a given interface, the Agent samples packets according to a configured sampling direction and sampling ratio, extracts information from the sampled packet content, and sends it to the Collector as sFlow packets.

How sFlow Works

Once the sFlow service is enabled on an Agent, it samples traffic passing through the device according to its configured sampling rate and polling interval, and encapsulates the result into the Datagram field of an sFlow packet sent to the Collector. An sFlow packet is structured as an Ethernet header, IP header, UDP header, and sFlow Datagram payload.

Counter sampling carries Generic Interface Counters — general interface statistics, including basic interface information and general traffic counters.

Flow sampling carries a Raw packet field — a captured portion of the original packet header, encapsulated into the sFlow packet and sent to the Collector.

Several configuration parameters shape this behavior:

  • Sample-rate: governs Flow sampling specifically, and can be set per-interface or globally. At an interface sample-rate of N, one in every N packets forwarded through that interface is pulled for detailed analysis. A global sample-rate can batch-adjust the rate across a switch's interfaces, but any interface with its own explicitly configured rate is unaffected by the global setting.

  • Polling interval: governs Counter sampling — how often the switch sends a Counter-type sFlow packet to the Collector. The default sample-rate is 10000 and the default polling interval is 20 seconds; smaller values improve monitoring accuracy (useful for catching bursty traffic) at the cost of more bandwidth and CPU overhead, while larger values reduce that overhead but lower detection accuracy.

  • Source / Source-interface: controls the source IP address used when the Agent builds sFlow packets. By default it's the IP of the interface actually sending the packet; source lets this be set to another IP within the same VRF, while source-interface binds it to a different interface's IP within the same VRF. Only one of the two can be configured at a time, and its VRF must match the VRF bound to the Collector.

  • Agent-id: identifies which device sent a given sFlow packet. Since the Agent-to-Collector relationship isn't necessarily one-to-one, a Collector may receive sFlow packets from multiple Agents simultaneously, and agent-id is what lets it distinguish the source device.

  • sFlow port: the UDP port used between Agent and Collector for sFlow packets, defaulting to 6343 if not otherwise configured.

Why sFlow is Beneficial

The core value of sFlow lies in giving operators lightweight, near-real-time visibility into traffic behavior without the overhead of capturing every packet:

· Low-overhead traffic visibility: Sampling — rather than full packet capture — keeps monitoring overhead low while still surfacing traffic patterns, interface load, and growth trends across a device.

· Fast detection of anomalies and attack sources: Because Flow sampling captures real packet content (source/destination IP, port, protocol type, and so on), operators can trace where abnormal or attack traffic is actually originating from, not just that a spike occurred.

· Tunable accuracy-vs-overhead tradeoff: Sample-rate and polling interval are independently adjustable, so operators can dial in more accuracy for traffic-sensitive links or more headroom for high-bandwidth links, without one setting forcing a compromise everywhere.

· Multi-device aggregation: agent-id lets a single Collector cleanly aggregate and distinguish sFlow data streaming in from many Agents at once, which is essential for fleet-wide visibility rather than one-device-at-a-time monitoring.

At Asteraix

What We Can Do at Asteraix

AsterNOS implements sFlow as a built-in, configurable traffic-visibility feature for data center switches:

· Full Counter and Flow sampling support: AsterNOS supports both Counter sampling (periodic interface/CPU/memory statistics) and Flow sampling (sampled raw packet capture) as independently configurable capabilities on the sFlow Agent.

· Granular sampling control: Sample-rate can be tuned per-interface or globally (with per-interface settings taking precedence), and polling interval can be adjusted from its default of 20 seconds — letting operators balance monitoring accuracy against bandwidth and CPU overhead per link.

· Flexible source addressing and multi-Collector support: AsterNOS supports configuring a custom source IP or source-interface (within the Collector's VRF) for sFlow packets, and agent-id lets a single Collector correctly attribute sFlow data received from multiple AsterNOS switches at once.

· Standard port and easy integration: sFlow packets are sent over UDP port 6343 by default, matching what standard sFlow Collector and visualization tooling expects out of the box.

· Typical deployment: An AsterNOS switch sits between two networks with sFlow Agent enabled, sending both Counter and Flow sFlow packets to a Collector reachable over the management network. Once configured — sFlow enabled, sample-rate and polling interval set, and the Collector's destination IP configured — the Collector can listen on port 6343, visualize the incoming sFlow packets, gauge overall device traffic volume from the Counter data, and inspect the raw Datagram content from Flow packets to spot and trace anomalous or attack traffic.