sFlow

This chapter describes Arista's implementation of sFlow, including configuration instructions and command descriptions. Topics covered by this chapter include:

sFlow Conceptual Overview

sFlow Technology

sFlow is a multi-vendor sampling technology that continuously monitors application level traffic flow at wire speed simultaneously on all interfaces. sFlow provides gigabit speed quantitative traffic measurements without impacting network performance.

sFlow has the following network traffic monitoring characteristics:

  • sFlow provides a network view of active route usage that measures network traffic.
  • sFlow is scalable to 10 Gb/s without impacting switch performance or the network load.
  • sFlow is implemented on a wide range of devices, without requiring additional memory and CPU.
  • sFlow is an industry standard.

An sFlow configuration consists of:

  • sFlow agents, embedded on network equipment, that monitor traffic and generate data.
  • sFlow collectors that receive and analyze sFlow data.

Arista switches include an sFlow agent that monitors ingress data through all Ethernet interfaces.

sFlow Agents

The sFlow agent is a software process that runs as part of the network management software within an Arista switch. It combines interface counters and flow samples into sFlow datagrams that are sent to an sFlow collector. Packets typically include flow samples and state information of the forwarding/routing table entries associated with each sample. Additional data can be gathered for entries originated by BGP.

The sFlow Agent performs minimal processing when packaging data into datagrams. Immediate data forwarding minimizes agent memory and CPU requirements.

sFlow Collector

An sFlow collector is a server that runs software that analyzes and reports network traffic. Collectors receive flow samples and counter samples respectively as sFlow datagrams from sFlow agents.

Arista switches reference a collectors IP address and UDP port as a configurable setting through a CLI command. Arista switches do not include sFlow collector software.

sFlow Data

The sFlow Agent uses two forms of sampling: statistical packet-based sampling of switched flows and time-based sampling of network interface statistics.

  • Switched flow sampling: A sample is taken by either copying the packet's header or extracting feature data from the packet.
  • Interface statistics sampling: Counter sampling extracts statistics by periodically polling each data source on the device.

sFlow implements flow sampling and counter sampling as part of an integrated system. An sFlow datagram incorporates both sample types.

Arista sFlow Implementation

Arista switches provide a single sFlow agent instance that samples ingress traffic from all Ethernet and port channel interfaces. The switch provides two levels of settings for enabling sFlow:

  • a global setting that enables packet sampling on the entire switch.
  • interface settings that control sampling on individual interfaces when sFlow is globally enabled.

sFlow default settings include:

  • global: sFlow and BGP sFlow export are globally disabled.
  • Ethernet and port channel interfaces: sFlow is enabled on all interfaces when it is enabled globally. BGP sFlow export is likewise enabled on all interfaces when it is enabled globally.

The switch performs sFlow polling when sFlow is globally enabled. The CLI provides commands that globally disable sampling while counter polling remains enabled. Sample enabling is not controllable on individual interfaces.

The switch sends sFlow datagrams to the collector located at an IP address specified by a global configuration command. If the collector destination is not configured, the switch samples data without transmitting the resulting datagrams.

Although the CLI enforces the configured sampling rate limit, it may drop samples if it cannot handle the number of samples it receives over a specified period. Under normal operation, the maximum packet sample rate is one per 16384 packets. The CLI allows for higher sampling rates by using the dangerous keyword.

The switch can also be configured to allow the routing agent to export BGP information to the sFlow agent. When BGP sFlow export is enabled, sFlow will add BGP information to packets whose destination is a BGP route.

The following lists describe sFlows sampling behavior relative to different packet types:

  • Packets that are sampled:

    • CPU
    • IP Options and MTU violations
    • Flooded packets
    • Multicast packets

  • Packets that are not sampled:

    • LACP frames
    • LLDP frames
    • STP BPDUs
    • IGMP packets
    • PAUSE frames
    • PIM hello packets
    • CRC error frames
    • Packets dropped by ACLs or due to VLAN violations

sFlow and Mirroring

The sFlow and Mirroring is supported using the same interface for both a mirroring session and sFlow at the same time. But when sFlow and mirroring is configured on the same interface, the TAP Aggregation is not supported. And when TAP Aggregation mode is enabled, the interface configured as a source for both a mirroring session and sFlow will only mirror packets, and sFlow samples are not produced.

The sFlow and Mirroring are supported on the following switch series:

DCS-7280R, DCS-7280R2, DCS-7280E, DCS-7500R, DCS-7500R2, DCS-7500E, DCS-7050X, DCS-7060X, DCS-7250X, DCS-7260X, and DCS-7300X.

However, the following switches have a limitation:

DCS-7280R, DCS-7280R2, DCS-7280E, DCS-7500R, DCS-7500R2, and DCS-7500E.

When a mirroring session and sFlow is configured on a same interface for the above devices, the following packet types are not sampled though they are sampled with only sFlow.

  • STP BPDUs
  • LACP frames
  • LLDP frames
  • OSPF packets
  • PIM HELLO packets
  • Packets dropped due to VLAN violations

sFlow Configuration Procedures

Implementing sFlow on an Arista switch consists of configuring the following agent parameters:

  1. Collector location address.
  2. Agent source address.
  3. Polling interval.
  4. Sampling rate.

Optionally, sFlow can be configured to include output interface and traffic class information in samples using the sflow sample command, and to include BGP information in samples whose destination is a BGP route using the sflow extension bgp command.

After configuring the sFlow agent, sampling is initiated by globally enabling sFlow on the switch.

Platform-specific Considerations

When BGP sFlow export is enabled on Arad platform switches (DCS-7280E and DCS-7500E), BGP information can be added to some sFlow packets with ECMP destinations.

DCS-7500E switches use actual hardware egress port information in sFlow packets. All other platforms use software simulation to determine the egress port.

Configuring the Collector Location

The sflow destination command specifies the IP address and UDP port of an sFlow collector. The switch supports multiple collectors.

Example

  • This command configures the switch to send sFlow data to collectors at 10.42.15.12, port 6100 and 10.52.12.2 port 6343 (the default sFlow port).
    switch(config)#sflow destination 10.42.15.12 6100
switch(config)#sflow destination 10.52.12.2
switch(config)#

Configuring the Agent Source Address

The sflow source command specifies the source address that the switch places in all sFlow datagrams that it sends to the collector. This address is normally set to an IP address configured on the switch.

Example

  • This command configures 10.2.9.21 as the sFlow source address.
    switch(config)#sflow source 10.2.9.21
switch(config)#

The sflow source-interface command can be alternatively used to specify the interface from which an IP address is derived that the switch places in all sFlow datagrams that it sends to the collector. This address is normally set to an IP address configured on the switch.

Example

  • This command configures VLAN interface 25 as the sFlow source interface. The switch enters the IP address for VLAN 25 in the source field of sFlow datagrams.
    switch(config)#sflow source-interface vlan 25
switch(config)#

running-config cannot simultaneously contain sflow source and sflow source-interface commands.

Configuring the Polling Interval

The sflow polling-interval command specifies the interval for sending counter data to the sFlow collector. The default interval is two seconds.

Example

  • This command configures the switch to send sFlow data every ten seconds.
    switch(config)#sflow polling-interval 10
switch(config)#

Configuring the Sampling Rate and Sample Contents

The sflow sample command sets the packet sampling rate. Packets are sampled at random intervals to avoid inaccurate sampling of periodic events. A rate of 16384 corresponds to an average sample of one per 16,384 packets. The default rate is 1048576.

Example

  • This command configures the sFlow sampling rate as 65536 (one per 65,536 packets).
    switch(config)#sflow sample 65536
switch(config)#

The sflow sample command can also optionally configure sample packets to include information about the traffic class of the sample. Traffic class is communicated by rewriting the DSCP field in the sample packet.

By default, samples include information about the output interface. To remove this information, use the [no] sflow sample output interface command.

  • These commands configure sFlow to include traffic class information in samples but to exclude output interface data.
    switch(config)#no sflow sample output interface
switch(config)#sflow sample rewrite dscp
switch(config)#

Enabling BGP sFlow Export

The sflow extension bgp command enables BGP sFlow export. When it is enabled, the routing agent will export the BGP routing table and autonomous system path information to the sFlow agent. When sFlow receives a sampled packets whose destination is a BGP route, it will look up the following additional BGP routing information and include it in the sample:

  • next hop IP
    • AS numbers
    • AS system path to the destination
    • communities
    • local pref

On Arad platform switches (DCS-7280E and DCS-7500E), BGP sFlow export will also add the above BGP information to sample packets with ECMP destination routes unless they exit the switch via a trunk port or subinterface. When egress port is a trunk port or subinterface, the sample packet will only include AS path information from the first path of the ECMP route and a BGP next hop of 0.

On all other switch platforms, ECMP destination routes will include AS path information from the first path, but will identify the BGP next hop as 0.

Note: A BGP instance must be configured on the switch for BGP sFlow export to operate. See the Border Gateway Protocol(BGP) chapter for details.

Example

  • These commands configure a BGP instance in AS 50 and enable BGP sFlow export globally.
    switch(config)#router bgp 50
switch(config-router-bgp)#exit
switch(config)#sflow extension bgp
switch(config)#

Extended Switch and Router Information

By default, extended switch and router information is added to sFlow sample packets.

Extended switch information includes the following:

  • source and destination VLANs and priorities

Extended router information includes the following:

  • IP version and address of next-hop router
    • source and destination mask lengths

The no form of sflow extension switch and no form of sflow extension router commands prevent the addition of extended switch and router information to sFlow sample packets.

Example

  • These commands prevent extended switch and router information from being added to sFlow sample packets.
    switch(config)#no sflow extension switch
switch(config)#no sflow extension router
switch(config)#

Enabling sFlow

The sflow run command globally enables sFlow on the switch. The sflow enable command controls sFlow operation on Ethernet and port channel interfaces when sFlow is globally enabled. The sflow enable command has no effect when sFlow is globally disabled.

Example

  • These commands enable sFlow on the switch, then disables sFlow on Ethernet interface 10.
    switch(config)#sflow run
switch(config)#interface ethernet 10
switch(config-if-Et10)#no sflow enable
switch(config)#

sFlow Configuration Commands

This section contains descriptions of sFlow commands.

Global Configuration Commands

Interface Configuration Commands

Privileged EXEC Command

sFlow Display Commands

clear sflow counters

The clear sflow counters command resets the global sFlow statistics, which includes the number of samples and sample pool. The hardware trigger count is not reset.

The show sflow command displays global sFlow statistics.

Command Mode

Privileged EXEC

Command Syntax

clear sflow counters

Example
  • This command resets the sFlow counters.
    switch#clear sflow counters
switch#

[no] sflow sample output interface

By default, sFlow samples include information about the output interface of the sampled packet. The no sflow sample output interface command prevents sFlow from including that information.

Command Mode

Global Configuration

Command Syntax

no sflow sample output interface

Examples
  • This command configures sFlow to not include output interface information in samples.
    switch(config)#no sflow sample output interface
switch(config)#

sflow destination

The sflow destination command specifies an sFlow collector IP address and UDP port. The switch supports sFlow collector addresses through multiple sFlow destination commands in running-config.

The no sflow destination and default sflow destination commands remove the specified sFlow collector IP address by deleting the corresponding sflow destination command from running-config.

Command Mode

Global Configuration

Command Syntax

sflow destination dest_addr [UDP_PORT]

no sflow destination dest_addr [UDP_PORT]

default sflow destination dest_addr [UDP_PORT]

Parameters

  • dest_addr sflow collectors IP address.
  • UDP_PORT sFlow collectors data reception port. Options include:
    • <No parameter> port number 6343 (default).
    • port_num port number. Value ranges from 0 to 65535.
Example
  • This command configures the switch to send sFlow data to the collector located at 10.42.15.12; the collector receives the data through UDP port 6100.
    switch(config)#sflow destination 10.42.15.12 6100
switch(config)#

sflow enable

The sflow enable command enables sFlow on the configuration mode interface when sFlow is globally enabled. By default, sFlow is enabled on all interfaces when sFlow is globally enabled (sflow run). The sflow enable command is required only when running-config contains a no sflow enable statement for the specified interface.

The no sflow enable command disables sFlow on the configuration mode interface. When sFlow is globally disabled, this command persists in running-config but has no effect on switch operation.

The default sflow enable command removes the corresponding no sflow enable command from running-config enabling sFlow capability on the interface.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Command Syntax

sflow enable

no sflow enable

default sflow enable

Examples
  • These commands enable sFlow on the switch and disable sFlow on Ethernet interface 12.
    switch(config)#sflow run
switch(config)#interface ethernet 12
switch(config-if-Et12)#no sflow enable
switch(config-if-Et12)#
  • This command removes the no sflow enable command for Ethernet interface 12 from running-config, enabling sFlow on the interface whenever sFlow is globally enabled.
    switch(config-if-Et12)#sflow enable
switch(config-if-Et12)#

sflow extension bgp

The sflow extension bgp command enables BGP export to sFlow. When enabled, this feature the routing agent will export the BGP routing table and autonomous system path information to the sFlow agent. When sFlow receives a sampled packets whose destination is a BGP route, it will look up the following additional BGP routing information and include it in the sample:

  • next hop IP
    • AS numbers
    • AS system path to the destination
    • communities
    • local pref

The no sflow extension bgp and default sflow extension bgp commands disable BGP export to sFlow by deleting the corresponding sflow extension bgp command from running-config.

Note: A BGP instance must be configured on the switch for BGP sFlow export to operate. See the Border Gateway Protocol chapter for details.

Command Mode

Global Configuration

Command Syntax

sflow extension bgp

no sflow extension bgp

default sflow extension bgp

Guidelines

BGP sFlow export behaves differently on different switch platforms as follows:

  • DCS-7500E switches use actual hardware egress port information in sFlow packets. All other platforms use software simulation to determine the egress port.
  • On Arad platform switches (DCS-7280E and DCS-7500E), BGP sFlow export works for sample packets with ECMP destination routes unless they exit the switch via a trunk port or subinterface. When egress port is a trunk port or subinterface, the sample packet will only include AS path information from the first path of the ECMP route and a BGP next hop of 0.
  • On all other switch platforms, ECMP destination routes will include AS path information from the first path, but will identify the BGP next hop as 0.
  • DCS-7500E switches use actual hardware egress port information in sFlow packets. All other platforms use software simulation to determine the egress port.
Example
  • These commands configure a BGP instance in AS 50 and enable BGP sFlow export globally.
    switch(config)#router bgp 50
switch(config-router-bgp)#exit
switch(config)#sflow extension bgp
switch(config)#

sflow extension router

By default, the switch provides extended router information in sFlow packets, including the IP version and address of the next-hop router and source and destination mask lengths.

The no version of the sflow extension router command prevents this information from being included in sFlow packets.

The sflow extension router and default sflow extension router commands restore the default behavior by deleting the corresponding no sflow extension router command from running-config.

Command Mode

Global Configuration

Command Syntax

sflow extension router

no sflow extension router

default sflow extension router

Example
  • This command prevents the switch from including extended router information in sFlow packets.
    switch(config)#no sflow extension router 
switch(config)#

sflow extension switch

By default, the switch provides extended switch information in sFlow packets, including source and destination VLANs and priorities.

The no version of the sflow extension switch command prevents this information from being included in sFlow packets.

The sflow extension switch and default sflow extension switch commands restore the default behavior by deleting the corresponding no sflow extension switch command from running-config.

Command Mode

Global Configuration

Command Syntax

sflow extension switch

no sflow extension switch

default sflow extension switch

Example
  • This command prevents the switch from including extended switch information in sFlow packets. 
    switch(config)#no sflow extension switch 
switch(config)#

sflow polling-interval

The sflow polling-interval command specifies the counters polling interval. The switch uses this interval to schedule a ports counter data transmissions to the sFlow collector.

The default interval is two seconds.

The no sflow polling-interval and default sflow polling-interval commands revert the polling interval to the default of two seconds by removing the sflow polling-interval command from running-config.

Command Mode

Global Configuration

Command Syntax

sflow polling-interval interval_period

no sflow polling-interval

default sflow polling-interval

Parameters

  • interval_period polling interval (seconds). Value ranges from 0 to 3600 (60 minutes). Default is 2.
Example
  • This command configures the switch to send sFlow counter data every ten seconds.
    switch(config)#sflow polling-interval 10
switch(config)#

sflow run

The sflow run command globally enables sFlow on the switch. The default sFlow global setting is disabled. sFlow cannot be enabled on individual interfaces when it is globally disabled.

The sflow enable interface configuration command controls sFlow operation on individual Ethernet and port channel interfaces when sFlow is globally enabled. When sFlow is enabled globally, sFlow is also enabled on all interfaces by default.

The no sflow run and default sflow run commands globally disable sFlow on the switch.

Command Mode

Global Configuration

Command Syntax

sflow run

no sflow run

default sflow run

Examples
  • This command enables sFlow on the switch.
    switch(config)#sflow run
switch(config)#
  • This command globally disables sFlow.
    switch(config)#no sflow run
switch(config)#

sflow sample

The sflow sample command sets the packet sampling rate. Packets are sampled at random intervals to avoid inaccurate sampling of periodic events; the packet sampling rate defines the average number of ingress packets that pass through an interface for every packet that is sampled. A rate of 16384 corresponds to an average sample of one per 16,384 packets. The switch may drop samples if it cannot handle the configured sample rate. Under normal operation, the maximum packet sample rate is one per 16384 packets. Higher sampling rates can be specified with the dangerous option.

By default, samples include information about the output interface. To remove this information, use the [no] sflow sample output interface command.

The sflow sample command can also optionally configure sample packets to include information about the traffic class of the sample. Traffic class is communicated by rewriting the DSCP field in the sample packet.

The no sflow sample and default sflow sample commands reset the packet sampling rate to the default of 1,048,576 and remove output interface and traffic class information from samples by removing the sflow sample command from the configuration.

Command Mode

Global Configuration

Command Syntax

sflow sample SAMPLE_RATE [rewrite dscp]

no sflow sample

default sflow sample

Parameters

  • SAMPLE_RATE size of the packet sample from which one packet is selected. Default sample size is 1048576 packets. Options include:
    • recommended_rate Integer between 16384 to 16777215.
      • dangerous any_rate permits overriding the recommended range of sampling rates. The any_rate value range varies by platform:

        fm6000 1 to 65535

        trident 1 to 16777216

rewrite dscp configures sFlow to rewrite the DSCP field of sample packets to indicate the traffic class of the original packet.

Examples
  • This command configures the sFlow sampling rate as 65536 (one per 65,536 packets).
    switch(config)#sflow sample 65536
switch(config)#
  • This command configures the sFlow sampling rate as 256 (one per 256 packets).
    switch(config)#sflow sample dangerous 25
switch(config)#
  • This command configures sFlow to include traffic class information in samples.
    switch(config)#sflow sample rewrite dscp
switch(config)#

sflow source

The sflow source command specifies the IP address used in the Agent address filed of the IPv4 sFlow datagram that the switch sends to the collector. This command cannot be used if running-config contains an sflow source-interface command.

The no sflow source and default sflow source commands remove the sflow source command from running-config.

Command Mode

Global Configuration

Command Syntax

sflow source source_addr

no sflow source

default sflow source

Parameters

  • source_addr source IP address (dotted decimal notation).
Example
  • This command configures 10.2.9.21 as the sFlow source address.
    switch(config)#sflow source 10.2.9.21
switch(config)#

sflow source-interface

The sflow source-interface command specifies the source IP address that is set to the IP's of the specified interfaces that the switch sends to the collector. Both, the Agent address in the IPv4 sFlow datagram as well as the source IP address sent to the collector are specified in sFlow packet. This command cannot be used if running-config contains an sflow source command.

The no sflow source-interface and default sflow source-interface commands remove the sflow source-interface command from running-config.

Command Mode

Global Configuration

Command Syntax

sflow source-interface INT_NAME

no sflow source-interface

default sflow source-interface

Parameters

  • INT_NAME Interface type and number. Options include:
    • interface ethernet e_num Ethernet interface specified by e_num.
    • interface loopback l_num Loopback interface specified by l_num.
    • interface management m_num Management interface specified by m_num.
    • interface port-channel p_num Port-Channel Interface specified by p_num.
    • interface vlan v_num VLAN interface specified by v_num.
Example
  • This command configures the sFlow source address as the IP address assigned to the loopback 0 interface.
    switch(config)#sflow source-interface loopback 0
switch(config)#

show sflow interfaces

The show sflow interfaces command displays the interfaces where sFlow is enabled.

The show sflow command displays configured sFlow parameters, operational status, and statistics.

Command Mode

EXEC

Command Syntax

show sflow interfaces

Examples
  • This command displays the show sflow interface message when sFlow is globally disabled.
    switch#show sflow interfaces
sFlow Interface (s):
--------------------
sFlow is not running
  • This command displays the show sflow interface message when sFlow is globally enabled and enabled on all interfaces.
    switch(config)#sflow run
switch(config)#show sflow interfaces
Default sFlow configuration for an interface: Disable
sFlow Interface (s):
--------------------
Ethernet1running(Counter)
Ethernet2running(Counter)
Ethernet3running(Flow,Counter)
Ethernet4running(Flow,Counter)
Ethernet5running(Flow,Counter)

show sflow

The show sflow command displays configured sFlow parameters, operational status, and statistics.

The show sflow interfaces command displays the interfaces where sFlow is enabled.

Command Mode

EXEC

Command Syntax

show sflow [detail]

Parameters

  • detail adds hardware sampling status and number of discarded samples to the information displayed.
Example
  • This command displays the base sFlow information.
     switch#show sflow 
! Displaying counters that may be stale 
sFlow Configuration 
------------------- 
Destinations: None (default) 
Source(s): 
 0.0.0.0 ( default ) ( VRF: default ) 
 :: ( default ) ( VRF: default ) 
Sample Rate: 1048576 ( default ) 
Polling Interval (sec): 2.0 ( default ) 
Rewrite DSCP value: No 
Status 
------ 
Running: No 
Polling On: No 
Sampling On: No 
Send Datagrams: 
 No ( Sflow not running ) ( VRF: default ) 
BGP Export: 
 No ( VRF: default ) 
Hardware Sample Rate: 1044480 
Statistics 
 --More-- 
! Displaying counters that may be stale 
sFlow Configuration 
------------------- 
Destinations: None (default) 
Source(s): 
 0.0.0.0 ( default ) ( VRF: default )
:: ( default ) ( VRF: default ) 
Sample Rate: 1048576 ( default ) 
Polling Interval (sec): 2.0 ( default )
 Rewrite DSCP value: No 
Status 
------ 
Running: No 
Polling On: No
Sampling On:
 No Send Datagrams:
No ( Sflow not running ) ( VRF: default )
BGP Export:
No ( VRF: default ) 
Hardware Sample Rate: 1044480

Statistics
 ----------
Total Packets: 0 
Number of Samples: 0 
Sample Pool: 0 
Hardware Trigger: 0 
Number of Datagrams: 0
  • This command displays the expanded sFlow information.
    switch#show sflow detail
! Displaying counters that may be stale
sFlow Configuration
-------------------
Destinations: None (default)
Source(s):
0.0.0.0 ( default ) ( VRF: default )
:: ( default ) ( VRF: default )
Sample Rate: 1048576 ( default )
Polling Interval (sec): 2.0 ( default )
Rewrite DSCP value: No

Status
------
Running: No
Polling On: No
Sampling On: No
Send Datagrams:
No ( Sflow not running ) ( VRF: default )
BGP Export:
No ( VRF: default )
Hardware Sample Rate: 1044480
Hardware Sampling On: No
Sample Output Interface: Yes
Sample Switch Extension: Yes
Sample Router Extension: Yes

Statistics
----------
Total Packets: 0
Number of Samples: 0
Sample Pool: 0
Hardware Trigger: 0
Number of Datagrams: 0
Number of Samples Discarded: 0