0

I want to approximate network traffic in bytes by writing a sFlow collector that receives sFlow datagrams, parses them, extracts key information only and applies a formula that summarizes the traffic in bytes for a particular IP source. What I am interested in is the formula and the key information I have to extract.

0

The frame_length field is defined on page 35 of the sFlow version 5 spec, https://sflow.org/sflow_version_5.txt

 unsigned int frame_length;      /* Original length of packet before
                                      sampling.
                                      Note: For a layer 2 header_protocol,
                                            length is total number of octets
                                            of data received on the network
                                            (excluding framing bits but
                                            including FCS octets).
                                            Hardware limitations may
                                            prevent an exact reporting
                                            of the underlying frame length,
                                            but an agent should attempt to
                                            be as accurate as possible. Any
                                            octets added to the frame_length
                                            to compensate for encapsulations
                                            removed by the underlying hardware
                                            must also be added to the stripped
                                            count. */

This field is printed as sampledPacketSize by sflowtool, https://github.com/sflow/sflowtool

The sampling_rate field is defined on page 29 of the aforementioned document. Moreover, the sampling rate is also configured on the switch.

   unsigned int sampling_rate;    /* sFlowPacketSamplingRate */

A simple way of calculating bytes for an sFlow data source is to sum the frame_length values and multiply by the sampling rate.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Apr 19 at 15:00
0

sFlow collects samples specified in 1/n fraction. Polling is specified in seconds.

Basically, you just multiply a sample by n and divide by s to get estimated packets/s.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.