RE: Comparison between sampled SFlow and Interface-Statistic

Christian,

Because sFlow exports the first part of the packet (including the L2 header)
it is possible for sFlow collectors to accurately calculate the L2 bytes.
This means that the sFlow traffic flow data should match the SNMP counters.

sFlow can be implemented on ingress, or egress, or both ingress and egress.
There are existimg implementations of all three.

sFlow also exports the ingress and egress port for the sampled packet. This
means that even if the switch is exporting ingress only samples, then an
sFlow collector can also infer egress traffic. With an sFlow collector such
as sFlowTrend, you can then easily compare ifInOctet trends with ingress
traffic and similarly for ifOutOctets and egress traffic.

Regards,

Sonia Panchen
-------------
Sonia Panchen
InMon Corp
sonia.panchen@inmon.com
+1 (530) 621 0362
 

> -----Original Message-----
> From: owner-sflow@sflow.org [mailto:owner-sflow@sflow.org] On
> Behalf Of Christian Hammers
> Sent: Tuesday, August 07, 2007 1:58 PM
> To: Alexander Czutka
> Cc: sflow@sflow.org
> Subject: Re: [sFlow] Comparison between sampled SFlow and
> Interface-Statistic
>
> On Tue, Aug 07, 2007 at 04:19:14AM -0700, Alexander Czutka wrote:
> > a customer of mine is complaining about the difference between the
> > data which he samples with SFlow and SNMP.
>
> Be aware that SNMP ifInOctets also counts the Ethernet and IP
> header so small differences are to be expected.
>
> > I put a single switch and transferred traffic between a
> client and a
> > server. Then I compared the amount of sflow-data with the
> > interface-values.
> >
> > (I changed the polling and sampling interval to 1). There
> was a gap of
> > 50 % when I transferred 500 Mbytes.
>
> IIRC, sFlow is, like NetFlow only enabled on input interfaces
> whereas SNMP usually queries incoming and outgoing bytes from
> one interface.
> Maybe this explains the "exactly" 50%.
>
> So what you was supposed to do was to account the incoming
> traffic on the switch uplink port and the incoming traffic on
> the switch' customer port with netflow and in the other test
> incoming and outgoing traffic of just the customer port with SNMP.
>
> bye,
>
> -christian-
>
> --
> Christian Hammers WESTEND GmbH |
> Internet-Business-Provider
> Technik CISCO Systems Partner -
> Authorized Reseller
> Im S|sterfeld 6 Tel
> 0241/701333-11
> ch@westend.com D-52072 Aachen Fax
> 0241/911879
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> - - - - - - Die Gesellschaft ist eingetragen im
> Handelsregister Aachen unter HRB 7608
> Geschdftsf|hrer: Thomas Neugebauer, Thomas Heller,
> Michael Kolb
Received on Tue Aug 7 06:23:17 2007