Understanding How to Use sFlow Technology for Network Monitoring on an EX Series Switch
sFlow technology is a monitoring technology for high-speed switched or routed networks. sFlow monitoring technology randomly samples network packets and sends the samples to a monitoring station. You can configure sFlow technology on a Juniper Networks EX Series Ethernet Switch to continuously monitor traffic at wire speed on all interfaces simultaneously.
sFlow technology uses the following two sampling mechanisms:
- Packet-based sampling: Samples one packet out of a specified number of packets from an interface enabled for sFlow technology.
- Time-based sampling: Samples interface statistics at a specified interval from an interface enabled for sFlow technology.
The sampling information is used to create a network traffic visibility picture. Juniper Networks JUNOS Software fully supports the sFlow version 5 standard described at sFlow.org (see www.sflow.org).
 |
Note: sFlow technology on EX Series switches samples only raw packet headers. A raw Ethernet packet is the complete Layer 2 network frame. |
An sFlow monitoring system consists of an sFlow agent embedded in the switch and a centralized collector. The sFlow agent’s two main activities are random sampling and statistics gathering. It combines interface counters and flow samples and sends them across the network to the sFlow collector.
EX Series switches adopt the distributed sFlow architecture. The sFlow agent has two separate sampling entities that are associated with each packet forwarding engine. These sampling entities are known as subagents. Each subagent has a unique ID that is used by the collector to identify the data source. A subagent has its own independent state and forwards its own sample messages to the sFlow agent. The sFlow agent is responsible for packaging the samples into datagrams and sending them to the sFlow collector. Because sampling is distributed across subagents, the protocol overheads associated with sFlow are significantly reduced at the collector. If the mastership assignment changes in a Virtual Chassis setup, sFlow technology continues to function.
|
Note: JUNOS Software on EX Series switches supports sFlow version 5. |
The sFlow collector uses the sFlow agent’s IP address to determine the source of the sFlow data. The IP address assigned to the agent is based on the following order of priority of interfaces configured on the switch:
1. Virtual management Ethernet (VME) interface
2. Management Ethernet interface
If any of the above interfaces have not been configured, the IP address of any Layer 3 interface or the routed VLAN (RVI) interface is used as the IP address for the agent. At least one interface must be configured for an IP address to be assigned to the agent.
sFlow data can be used to provide network traffic visibility information. The IP address to be assigned to source data can be configured. If it has not been configured, the IP address of the configured Gigabit Ethernet interface, 10-Gigabit Ethernet interface, or the routed VLAN interface (RVI) is used as the source IP address. Infrequent sampling flows are not reported in the sFlow information, but over time the majority of flows are reported. Based on a defined sampling rate, 1 out of N packets is captured and sent to the collector. This type of sampling does not provide a 100 percent accurate result in the analysis, but it does provide a result with quantifiable accuracy. A polling interval defines how often the sFlow data for a specific interface are sent to the collector, but an sFlow agent is free to schedule polling.
EX Series switches uses adaptive sampling to ensure both sampling accuracy and efficiency. Adaptive sampling is a process of monitoring the overall incoming traffic rate on the network device and providing intelligent feedback to interfaces to dynamically adapt their sampling rate to the traffic conditions. Interfaces on which incoming traffic exceeds the system threshold are penalized so that all violations can be regulated without affecting the traffic on other interfaces. Every 5 seconds the agent checks interfaces to get the number of samples, and interfaces are grouped based on the slot that they belong to. The top 5 interfaces that produce the highest samples are selected. Using the binary backoff algorithm, the sampling load on these top 5 interfaces is reduced to half and adjusted on interfaces that have a lower sample rate. Therefore when the processor limit is reached , the sampling rate is adapted such that it does not load the processor any further. If the switch is rebooted, the adaptive sample rate is reset to the user configured sample rate. Also, if you modify the sample rate the adaptive sample rate changes.
The advantage of adaptive sampling is that the switch continues to operate at its optimum level even when there is a change in the traffic patterns in the interfaces. You do not need to make any changes. Since the sampling rate is adapted dynamically based on the network conditions, the resources are utilized optimally thereby resulting in an high performance network.
|
Note: Since sFlow technology on EX Series switches does not support graceful restart, when a graceful restart occurs the adaptive sample rate is set to the user configured sample rate. |
