How does sFlow count traffic statistics?

[522690]

Hello, all!

I have read a lot about sFlow, but still can't understand some things.

- Is every N packet ( according to sampling rate)  sent to the sFlow collector with interface bandwidth statistics? Or sFlow accumulate a particular amount of  packets and send it together with aggregated statistics?

- For example, during one hour sFlow captured  100 packets from one user for 5 flows.  40 packets belongs to google.com, 20 to microsoft,com, 20 to SQL server, 20 to Outlook server. Also, sFlow collector has a interface traffic counters from sFlow messages, 100Mb.  Am i right, that bandwidth per flow will be calculated in same proportions - i.e 40Mb google.com, 20Mb microsoft.com, etc?

Thanks!

[Peter Phaal]

Each packet sample carries information on the sampling probability and a counter of the number of packets that were eligible for sampling. The sampling metadata included with each packet sample is what allows the sFlow analyzer to properly aggregate and scale flow data:

https://sflow.org/packetSamplingBasics/index.htm

Independently, the sFlow agent also periodically sends standard MIB2 interface counters (e.g. ifInOctets, ifOutOctets, etc.) for each interface, eliminating the need to use SNMP to poll for the information.

The counters and samples provide complementary information. For example, metadata like ifSpeed in the counters can be used to scale flow rates to calculate utilizations.   Rare events, like packet errors and discards, are accurately captured in the hardware counters (ifInDiscards, ifInErrors, ifOutDiscards, ifOutErrors), and the packet samples can be used to determine the traffic flowing through the port.

[Evgeniy Lipinskiy]

Thanks for reply and links, it is clear for me now. 

чт, 25 июл. 2019 г. в 20:45, Peter Phaal <peter...@gmail.com>:

--
You received this message because you are subscribed to the Google Groups "sFlow" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sflow+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sflow/387618e9-eba6-4d43-b91a-6cace77f8386%40googlegroups.com.