Re: Re[2]: about sFlow instance

Hello Kobayshi-san,

There is nothing to stop you from configuring two sampler instances
to send to the same collector. It is allowed. You could configure
each instance to send to a different UDP port (e.g. 6343 and 6344).
That way the collector can separate them easily. Otherwise it would
have to separate them using the samplingRate field (which is sent
with each flow-sample).

In terms of the sFlow MIB: you would do this by reserving two slots
in the sFlowRcvrTable. For example, say you want to double-monitor
interface 1, and send the data to a collector on 192.168.4.5, using
ports 6343 and 6344:

The receiver table might look like this:

sFlowRcvrTable
     sFlowRcvrEntry (sFlowRcvrIndex=1, sFlowRcvrAddress=192.168.4.5,
sFlowRcvrPort=6343)
     sFlowRcvrEntry (sFlowRcvrIndex=2, sFlowRcvrAddress=192.168.4.5,
sFlowRcvrPort=6344)

And the flow-sampling table might look like this:

sFlowFsTable
     sFlowFsEntry (sFlowFsDataSource=ifIndex.1, sFlowFsInstance=1,
sFlowFsReceiver=1, sFlowFsPacketSamplingRate=400)
     sFlowFsEntry (sFlowFsDataSource=ifIndex.1, sFlowFsInstance=2,
sFlowFsReceiver=2, sFlowFsPacketSamplingRate=1)

If your switch/router does not support multiple receivers and
multiple sampler instances, then you may have to just change the
sampling rate to 1 and do the sub-sampling at the collector instead.

regards,
neil

On Aug 26, 2005, at 5:54 AM, kobayashi atsushi wrote:

> Hello Neil McKee,
>
> Thank you for your answer.I understood your comment.
> I think that the concept of sFlow instance is very useful.
> For example,I want to use the sFlow in the following case.
>
> The one port(e.g. one interface line card ) have two sflow instance.
> The one instance is always used by sampling to get the traffic matrix.
> In that case,the Sampling Rate of this instance may be 1024.
> When the traffic cause a trouble of network,the other instance is used
> for analyzing instead of a traffic mirroring.In that case,the Sampling
> Rate of this instance could be 1.This instance have the flow sample of
> the header type and don't have the counter sample.
> This instance is used during temporary period.
>
>> From network operator's position,it is almost impossible to using a
>>
> mirroring,because of remote position.I want to use a sFlow instead of
> this.
>
> I want to have one or more sFlow instances that operate a different
> action.
>
> In such case,I understood that each sFlow instances should be
> assign each
> collectors in sFlow ver.5 standard.
> But,I want to use same collector if possible.
>
> Can you think what is other implement in the such case?
>
> regards,
>
> On Thu, 25 Aug 2005 12:49:55 -0700
> neil mckee <neil.mckee@inmon.com> wrote:
>
>
>> Hello Kobayashi-san,
>>
>> The purpose of these data-source instances is to allow two collectors
>> to monitor the same switch or router. It is unlikely that two
>> instances would ever be configured to send sFlow to the same
>> collector on the same UDP port. There would be no advantage in doing
>> that. That is why there is no instance field in the datagram. Were
>> you asking because you want to detect this as an error condition?
>>
>> You are correct that the instances should operate in parallel and be
>> independent of one another. Ideally there would be a separate
>> hardware sampling engine for each instance (with a separate random
>> number generator). However, the reality is that most hardware
>> implementations have only one sampling engine available for each
>> interface. The discussion about cascading and sub-sampling was to
>> show how you can still make the instances operate independently and
>> in parallel, even when they are sharing the same hardware sampling
>> engine below (the hardware is configured to sample with a rate equal
>> to the highest-common-factor, and in software each instance uses
>> sub-
>> sampling to get back to their desired sampling rate).
>>
>> Does this answer your question?
>>
>> regards,
>> Neil McKee
>>
>>
>>
>> On Aug 24, 2005, at 8:29 PM, kobayashi atsushi wrote:
>>
>>
>>> Hi,
>>>
>>> I have some question about sFlow instance in sFlow version 5.
>>> I understood that the Data Source can have one or more sFlow
>>> instances
>>> that have their own Sampling Rate in sFlow version 5.
>>> But,the sFlow version 5 datagram doesn't contain the field of sFlow
>>> instance.I wonder that the sFlow Agent can't send the sampling
>>> rate of
>>> sFlow instance.
>>>
>>> For example,there are two sFlow instances in some Data source.Their
>>> Sampling Rate was different and these sFlow instances operate by
>>> parallel.
>>> I think that the Flow sample that is sampled by one instance
>>> should be
>>> distinguished in sFlow datagram.
>>>
>>> In page 10 of the sFlow version 5 document,it is described as a
>>> example
>>> that two sFlow instance operate by cascade(sub-sampling).
>>> I wonder that sFlow instances can't operate by parallel.
>>>
>>> I want to know in detail about sFlow instance.
>>> Any help will be appreciated.
>>>
>>> Regards,
>>>
>>> ---
>>> KOBAYASHI ATSUSHI <akoba@nttv6.net>
>>> NTT Information Sharing Platform Lab.
>>>
>>>
>>
>>
>
> ---
> KOBAYASHI ATSUSHI <akoba@nttv6.net>
> NTT Information Sharing Platform Lab.
> tel:0422-59-3978 fax:0422-59-5652
Received on Fri Aug 26 11:03:15 2005