I want to approximate network traffic in bytes by writing a sFlow collector that receives sFlow datagrams, parses them, extracts key information only and applies a formula that summarizes the traffic in bytes for a particular IP source. What I am interested in is the formula and the key information I have to extract.
2 Answers
The frame_length field is defined on page 35 of the sFlow version 5 spec, https://sflow.org/sflow_version_5.txt
unsigned int frame_length; /* Original length of packet before
sampling.
Note: For a layer 2 header_protocol,
length is total number of octets
of data received on the network
(excluding framing bits but
including FCS octets).
Hardware limitations may
prevent an exact reporting
of the underlying frame length,
but an agent should attempt to
be as accurate as possible. Any
octets added to the frame_length
to compensate for encapsulations
removed by the underlying hardware
must also be added to the stripped
count. */
This field is printed as sampledPacketSize by sflowtool, https://github.com/sflow/sflowtool
The sampling_rate field is defined on page 29 of the aforementioned document. Moreover, the sampling rate is also configured on the switch.
unsigned int sampling_rate; /* sFlowPacketSamplingRate */
A simple way of calculating bytes for an sFlow data source is to sum the frame_length values and multiply by the sampling rate.
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.– Ron Maupin ♦Commented Apr 19, 2019 at 15:00
sFlow collects samples specified in 1/n fraction. Polling is specified in seconds.
Basically, you just multiply a sample by n and divide by s to get estimated packets/s.
