I want to approximate network traffic in bytes by writing a sFlow collector that receives sFlow datagrams, parses them, extracts key information only and applies a formula that summarizes the traffic in bytes for a particular IP source. What I am interested in is the formula and the key information I have to extract.
The frame_length field is defined on page 35 of the sFlow version 5 spec, https://sflow.org/sflow_version_5.txt
unsigned int frame_length; /* Original length of packet before sampling. Note: For a layer 2 header_protocol, length is total number of octets of data received on the network (excluding framing bits but including FCS octets). Hardware limitations may prevent an exact reporting of the underlying frame length, but an agent should attempt to be as accurate as possible. Any octets added to the frame_length to compensate for encapsulations removed by the underlying hardware must also be added to the stripped count. */
This field is printed as sampledPacketSize by sflowtool, https://github.com/sflow/sflowtool
The sampling_rate field is defined on page 29 of the aforementioned document. Moreover, the sampling rate is also configured on the switch.
unsigned int sampling_rate; /* sFlowPacketSamplingRate */
A simple way of calculating bytes for an sFlow data source is to sum the frame_length values and multiply by the sampling rate.
sFlow collects samples specified in 1/n fraction. Polling is specified in seconds.
Basically, you just multiply a sample by n and divide by s to get estimated packets/s.