Overview sFlow

sFlow is one technology used to sample and monitor the network traffic, complying with the RFC3176 standard. sFlow performs different samplings according to different configurations. The sampling process is: First analyze the packet head from the sampled packet, encapsulate as the sFlow packet according to the standard definition, and send to the third-party receiver, which is convenient for the user to analyze and monitor the traffic entering the device via the third-party receiver.

sFlow includes the following two sampling modes:

• Sampler sampling mode: It is one sampling mode provided by the switching chip, sampling the traffic entering the port at random;
• Poller sampling mode: It is one software sampling mode, used to collect the packet and traffic statistics information of the port regularly.

sFlow defines the following two roles:

• Agent role: It is the sFlow agent on the device, used to manage the two sampling modes of sFlow and execute the sampling task;
• Receiver role: It is the mapping of the third-party receiver supporting the sFlow protocol on the local device, used to save the information of the third-party receiver (such as IP address and UDP port number) and regularly send the sFlow packets buffered on the device to the third-party receiver.