Skip to content

sFlow traffic and port counters

Let switches that send sFlow fill the Traffic tab, and see how busy every port is, with errors, discards and duplex problems.

4 min read · For admins

Many switches send sFlow rather than NetFlow: a sample of the packets they forward and, every 20 to 30 seconds, the counters of every port. Monitaria turns the samples into the same traffic views NetFlow gives you, and the counters into how busy each port is, with errors, discards and half duplex. You need switches that send sFlow version 5, and UDP 6343 open from them to the collector.

1. Turn on the receiver

  1. Open Settings › sFlow and tick Receive sFlow (version 5).
  2. Keep UDP port 6343, the standard sFlow port, unless something else uses it. It can't be the NetFlow port while NetFlow is on.
  3. Under Accept sFlow only from these switches, enter your switches' addresses or networks, for example 192.0.2.20, 198.51.100.0/24. Choose Save.
  4. Within a few seconds the page says Listening on UDP 0.0.0.0:6343, or why it can't listen.
  5. Allow UDP 6343 from the switches to the collector in any firewall between them.

2. Point your switches at the collector

On each switch, set the collector's address and port, a sampling rate and a counter polling interval, and turn sFlow on for every port. Sample about 1 packet in 1,000 on 1 Gbit/s ports and 1 in 2,000 to 4,000 on 10 Gbit/s ports, and poll counters every 20 to 30 seconds. The Switch setup panel has examples for Aruba / HPE (ArubaOS-Switch), Juniper (Junos) and Cisco Nexus (NX-OS) with this collector's address filled in. On an Aruba switch:

sflow 1 destination 192.0.2.10 6343
sflow 1 sampling 1-48 1024
sflow 1 polling 1-48 30

Tip: Use the address the switch is monitored at as its sFlow agent address. That is how its ports reach its device dialog, how Monitaria reads its port names over SNMP, and how people limited to some sites see its data. Cisco NX-OS samples nothing until sflow agent-ip is set.

3. Confirm it works

Within a minute the switch appears under Agents with a sending badge, and as an exporter in the Traffic tab. Click its number under Ports to see every port over the last hour, 24 hours or 7 days. Lost counts datagrams that never arrived and Skipped counts packets a busy switch couldn't sample; both mean the traffic shown is lower than real. Anything refused is listed under Ignored datagrams or Unreadable datagrams, with the reason.

Where sFlow shows up

  • Traffic: an sFlow switch is an exporter like any NetFlow router, with top talkers, applications, traffic by site, unusual traffic, calls and video, and traffic alerts. NetFlow itself doesn't need to be on: sFlow counts as a flow source on its own. Settings › NetFlow lists the switch under Flow sources too, as sFlow.
  • Ports (sFlow), in the switch's device dialog: the 10 busiest ports over the last 24 hours, with Show all … ports for the rest.
  • For each port: now, average, peak (the busiest 5 minutes), 95th percentile and load against the port speed, plus errors and discards for the period. The buttons above the table filter to busy ports, ports with errors or discards, ports in half duplex, and ports that are down or shut.
  • A switch can usually send sFlow to two collectors, so an existing tool keeps receiving while you try Monitaria.

Good to know

  • sFlow data stays on the collector. Flow data is kept as long as Keep flow data for in Settings › NetFlow; port counters are kept for 7 days in 5-minute detail.
  • Traffic is an estimate from samples. With 10,000 samples behind a number it is within about 2% (95% of the time); with 100 samples, within about 20%. Quiet hosts and short periods have few samples.
  • Only sFlow version 5 is read. Other versions, and NetFlow sent to the sFlow port by mistake, are listed under Unreadable datagrams with what to change.
  • sFlow over UDP can't be authenticated: anything that can reach the port can send samples and claim any agent address. Fill in the accepted switches and add a firewall rule so only your switches can send.
  • Port names come from SNMP when the switch is monitored at its agent address and answers SNMP; otherwise a port is shown by number, such as Port 12. Monitaria never sends SNMP to an agent address it doesn't monitor.
  • With only sFlow on, the Traffic tab says where to send sFlow until the first samples arrive, and the Getting started step Turn on NetFlow or sFlow counts as done.