Show 80 – SFlow and IP Accounting

During the EuroNOG conference I recorded a conversation about SFlow with Elisa Jasinska who is Senior Packet Herder at Limelight Networks. ( That’s what is says on her business card).

Joining me is Ivan Pepelnjak to cover the SFlow basisc and some f the more advanced ideas that you need to be thinking of when looking a IP Accounting.

Show Topics

We kept the agenda simple –

SFlow: Why, What, How

About Ela

Ela Jasinska is a Senior Network Architect at Limelight Networks. Her work is focused on introducing new technologies to Limelight’s global network footprint as well as designing tools to manage and maintain the platform. She built and now operates Limelight’s Phoenix based Internet exchange, Arizona IX.

Previously Elisa has been working as a Network Engineer at the Amsterdam Internet Exchange, on projects such as AMS-IX’s route server deployment and their sFlow accounting software, as well as day-to-day operations of the exchange point.

PMAcct – Open Source OpenFlow accounting PMACCT

AMSIX Frame Size Distribution

Greg Ferro
Greg Ferro is a Network Engineer/Architect, mostly focussed on Data Centre, Security Infrastructure, and recently Virtualization. He has over 20 years in IT, in wide range of employers working as a freelance consultant including Finance, Service Providers and Online Companies. He is CCIE#6920 and has a few ideas about the world, but not enough to really count. He is a host on the Packet Pushers Podcast, blogger at and on Twitter @etherealmind and Google Plus.
Greg Ferro
Greg Ferro
Greg Ferro
  • Mschipp

    FYI vendors NMS also do sFlow collection – for a quick out of the box type setup.

    e.g. Brocade Network Advisor will also act as a sFlow collector and give give coloured graphs for L2 and L3.

    HP PCM+ does likewise.

    • Mschipp

      When sFlow is enabled on a Layer 2 or
      Layer 3 switch, the system performs the following sFlow-related tasks:

      Samples traffic flows by copying
      packet header information
      Identifies ingress and egress
      interfaces for the sampled flows
      Combines sFlow samples into UDP
      packets and forwards them to the sFlow collectors for analysis
      Forwards byte and packet count data,
      or counter samples, to sFlow collectors

      sFlow is described in RFC 3176, “InMon
      Corporation’s sFlow: A Method for Monitoring Traffic in Switched and Routed Networks”.

      Also sFlow version 5 support setting the packet size from the default value of 256 bytes to a max of 1300 bytes.

      As for CPU load – I have found that enabling sFlow of all ports on a Brocade box will generate approx 5-18% cpu load.  This is not a problem as without sFlow the CPU sits at 1 or 2% – this box was a 384 port router.