Lenovo ThinkSystem NE2552E, Application Manual

Page: 545 / 574

© Copyright Lenovo 2018
545
Chapter 39. sFLOW
The NE2552E supports sFlow technology for monitoring traffic in data networks.
The switch includes an embedded sFlow agent which can be configured to sample
network traffic and provide continuous monitoring information of IPv4 traffic to a
central sFlow analyzer.
The switch is responsible only for forwarding sFlow information. A separate sFlow
analyzer is required elsewhere on the network in order to interpret sFlow data.
Note:
Lenovo ENOS 8.4 does not support IPv6 for sFLOW.
sFlow Statistical Counters
The NE2552E can be configured to send network statistics to an sFlow analyzer at
regular intervals. For each port, a polling interval of 5 to 60 seconds can be
configured, or 0 (the default) to disable this feature.
When polling is enabled, at the end of each configured polling interval, the
NE2552E reports general port statistics and port Ethernet statistics.
sFlow Network Sampling
In addition to statistical counters, the NE2552E can be configured to collect
periodic samples of the traffic data received on each port. For each sample, 128
bytes are copied, UDP ‐ encapsulated, and sent to the configured sFlow analyzer.
For each port, the sFlow sampling rate can be configured to occur once each 256 to
65536 packets, or 0 to disable (the default). A sampling rate of 256 means that one
sample will be taken for approximately every 256 packets received on the port. The
sampling rate is statistical, however. It is possible to have slightly more or fewer
samples sent to the analyzer for any specific group of packets (especially under
low traffic conditions). The actual sample rate becomes most accurate over time,
and under higher traffic flow.
sFlow sampling has the following restrictions:
 Sample Rate—The fastest sFlow sample rate is 1 out of every 256 packets.
 ACLs—sFlow sampling is performed before ACLs are processed. For ports
configured both with sFlow sampling and one or more ACLs, sampling will
occur regardless of the action of the ACL.
 Port Mirroring—sFlow sampling will not occur on mirrored traffic. If sFlow
sampling is enabled on a port that is configured as a port monitor, the mirrored
traffic will not be sampled.
Note:
Although sFlow sampling is not generally a CPU ‐ intensive operation,
configuring fast sampling rates (such as once every 256 packets) on ports under
heavy traffic loads can cause switch CPU utilization to reach maximum. Use larger
rate values for ports that experience heavy traffic.