1

Hi Network Masters,

I have recently gotten my network devices to export sFlow records to my sFlow collector. Trouble is, all those sFlow exports are being sent across my network in cleartext. A lot of Google searching plus reading through the sFlow standards doc leads me to think that sFlow (v5.0) does not support any encryption mechanism, and that if I want to encrypt device-to-collector traffic, I'll have to do it within the network, i.e., set up IPSEC tunnels or something.

Does this seem correct? Or is there a way that I'm missing? Thanks

  • 1
    Why would you require encryption? The sFlow data doesn't show anything more than the kind of traffic (MACs, frame sizes, IPs, L4 protocols/ports). Normally, you pass the sFlow records within the management VLAN, so there's no way for end nodes to intercept. Of course, you could also route & tunnel. – Zac67 Dec 24 '19 at 23:11
1

Yes, all the sFlow datagrams are plaintext.
In general, you don't need to be worried about it. If you concern that someone sniffs these datagrams and finds out what has been happening with your local network, you must concern about the security of your local network. Because, if someone entered your local network, they can also get the sFlow information without using sFlow datagrams. In this case, there is a lot of method to getting overview information of a network.

However, if you are sending these datagrams to outside, the encryption feature of the IPSec tunnel can help you.

By THIS link, another method is the SSH tunnel with python scripting.

| improve this answer | |
1

sFlow itself doesn't support encryption.

As a protocol usually run within a site, it is often forwarded through the management VLAN or a dedicated VLAN, out of the reach of end nodes. If you forward sFlow information across sites, those sites are usually connected by some kind of secure VPN tunnel anyway (IPsec, MPLS, SSL).

sFlow holds aggregated information about the current flows in a network (VLAN, MAC addresses, sizes, IP addresses, transport layer protocols & ports), so securing this information isn't that crucial.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.