topic Re: sflow on HP2848 in Switches, Hubs, and Modems

sflow on HP2848

Andrea Francesconi — Wed, 08 Jun 2005 08:44:26 GMT

Hi. I try to collect sflow data from HP Procurve 2848 to an ntop machine; how I can config HP2848 to send sflow information to a particular ip?

SNMP is already up and correctly work.

Re: sflow on HP2848

Les Ligetfalvy — Wed, 08 Jun 2005 09:06:25 GMT

Correct me if I am wrong, but I thought that sflow is "pulled" by the machine and not "pushed" by the switch.

Re: sflow on HP2848

Andrea Francesconi — Wed, 08 Jun 2005 09:16:02 GMT

> Correct me if I am wrong, but I thought that > sflow is "pulled" by the machine and not
> "pushed" by the switch.

Can be true, yes.
Can I verify if sflow traffic is correctly send out from Procurve? I not find a lot of docs about sflow... =(

Re: sflow on HP2848

Les Ligetfalvy — Wed, 08 Jun 2005 10:39:08 GMT

You have my simpathy. I have been trying to find info on RMON in the following post but to no avail.
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=752662

I think PCM+ can pull ease and/or sflow data from the switches but how it does it is beyond my level of competence.

Sorry

Re: sflow on HP2848

Jeff Brownell — Thu, 09 Jun 2005 06:26:49 GMT

Below are the quickie ways to enable sflow via the console/telnet/ssh management interface. Note where the port number goes.

Set destination Ip (the IP of the collector station--Note that ip address is in hex but withOUT the leading 0x!!!! This
is 15.29.16.93):

setmib sFlowRcvrAddress.1 -o 0F1D105D

Enable Receiver:
setmib sFlowRcvrOwner.1 -D Jeff sFlowRcvrTimeout.1 -i 100000000

Set flow sampling sampling rate to 37 on port 53.
setmib 1.3.6.1.4.1.14706.1.1.5.1.4.11.1.3.6.1.2.1.2.2.1.1.53.1 -i 37
Port 55, rate of 20:
setmib 1.3.6.1.4.1.14706.1.1.5.1.4.11.1.3.6.1.2.1.2.2.1.1.55.1 -i 20
Port 5, rate of 20:
setmib 1.3.6.1.4.1.14706.1.1.5.1.4.11.1.3.6.1.2.1.2.2.1.1.5.1 -i 20

Now set the enable to true/1:
Port 53:
setmib 1.3.6.1.4.1.14706.1.1.5.1.3.11.1.3.6.1.2.1.2.2.1.1.53.1 -i 1
Port 55:
setmib 1.3.6.1.4.1.14706.1.1.5.1.3.11.1.3.6.1.2.1.2.2.1.1.55.1 -i 1
Port 5:
setmib 1.3.6.1.4.1.14706.1.1.5.1.3.11.1.3.6.1.2.1.2.2.1.1.5.1 -i 1

Set counter polling interval:

Interval of 8 seconds, port 53:
setmib 1.3.6.1.4.1.14706.1.1.6.1.4.11.1.3.6.1.2.1.2.2.1.1.53.1 -i 8
Interval of 7 seconds, port 55:
setmib 1.3.6.1.4.1.14706.1.1.6.1.4.11.1.3.6.1.2.1.2.2.1.1.55.1 -i 7
Interval of 50 seconds, port 5:
setmib 1.3.6.1.4.1.14706.1.1.6.1.4.11.1.3.6.1.2.1.2.2.1.1.5.1 -i 50

Now set the enable to true/1:

Port 53:
setmib 1.3.6.1.4.1.14706.1.1.6.1.3.11.1.3.6.1.2.1.2.2.1.1.53.1 -i 1
Port 55:
setmib 1.3.6.1.4.1.14706.1.1.6.1.3.11.1.3.6.1.2.1.2.2.1.1.55.1 -i 1
Port 5:
setmib 1.3.6.1.4.1.14706.1.1.6.1.3.11.1.3.6.1.2.1.2.2.1.1.5.1 -i 1

Disabling:

To totally kill all sampling and to release the receiver just set timeout
to 0:
setmib sFlowRcvrTimeout.1 -i 0

If you want to keep the receiver and just disable flow sampling, you can EITHER
set the sampling rate to 0 or set enable to false/0:

Disable flow sampling on port 53 by setting enable FALSE:
setmib 1.3.6.1.4.1.14706.1.1.5.1.3.11.1.3.6.1.2.1.2.2.1.1.53.1 -i 0

If you want to keep the receiver and just disable counter polling, you can EITHER
set the interval to 0 or set enable to false/0:

Disable counter polling on port 53 by setting enable FALSE:
setmib 1.3.6.1.4.1.14706.1.1.6.1.3.11.1.3.6.1.2.1.2.2.1.1.53.1 -i 0

Re: sflow on HP2848

Andrea Francesconi — Thu, 09 Jun 2005 09:52:42 GMT

Thank you Jeff for your reply.
I do:

HP2848(config)# setMIB sFlowRcvrAddress.1 -o C0A80A63
sFlowRcvrAddress.1 = c0 a8 0a 63

HP2848(config)# setMIB sFlowRcvrOwner.1 -D Jeff sFlowRcvrTimeout.1 -i 100000000

sFlowRcvrOwner.1 = Jeff
sFlowRcvrTimeout.1 = 100,000,000

but when I digit:

HP2848(config)# setMIB 1.3.6.1.4.1.14706.1.1.5.1.4.11.1.3.6.1.2.1.2.2.1.1.53.1
-i 20
1.3.6.1.4.1.14706.1.1.5.1.4.11.1.3.6.1.2.1.2.2.1.1.53.1: Unable to create.

What's wrong?

Re: sflow on HP2848

Jeff Brownell — Fri, 10 Jun 2005 08:47:37 GMT

Andrea,

I would say that you dont have a port 53 on your switch. Do a 'walkmib sFlowFsPacketSamplingRate' to see how many ports you have. If it's a 2848 then 48 is as high as you go...

Jeff

Re: sflow on HP2848

Steve Britt — Wed, 15 Jun 2005 17:52:22 GMT

Andrea,

In the examples that Jeff gave, replace the "53", "55", or "5" used as example port numbers in his commands with the correct ifIndex of each port that you wish to enable sFlow on. You must follow each step that Jeff enumerates for every such port.

On the topic of switch ifIndex values (i.e. 53 in the examples vs. your 48-port switch) you should note that depending upon your switch configuration you could actually have a "virtual" port numbered in the 50s. When a trunk or mesh is enabled on a ProCurve switch that supports sFlow, the MIB variables of the trunk or mesh constituent ports become inaccessible and are replaced by a "virtual" port that is created to represent the entire traffic flow of the mesh or trunk. So in other words if you created a trunk using ports 1, 2, and 3 of a switch the sFlow MIB variables for ifIndex values 1, 2, and 3 would subsequently "disappear" from the MIB and would be replaced with a corresponding set of MIB entries that allow sFlow to be applied to the entire trunk as an aggregate; the new MIB entries would be numbered using an ifIndex that is out of range of the device's physical ports. This creation of a virtual port allows applications to monitor aggregated traffic flow through a mesh or trunk quite simply by having the agent do the "assemblage" of data from the constituent ports within the trunk or mesh. You can determine which ifIndex has been assigned to a trunk or mesh by looking at the ifDescr fields within the MIB-II ifTable.

Re: sflow on HP2848

Steve Britt — Wed, 15 Jun 2005 18:16:41 GMT

Andrea,

Also, for more information about sFlow in general you can check out sflow.org.

With regard to Les' comments about how sFlow works (pulled or pushed) it is pushed from the agent. The management application must set up the sFlow MIB (essentially performing the same steps that Jeff enumerated) so that it points to the appropriate IP address and UDP socket number. Then the switch agent can operate autonomously in terms of dispatching flow and/or counter samples via UDP packets that are directed to the configured port of the management station. The management application must periodically refresh the receiver timeout value to ensure that the agent keeps sending samples - this is a failsafe mechanism so that when a management application dies or otherwise disappears the agent eventually stops sending samples to the now-defunct UDP port.

Steve

Re: sflow on HP2848

Andrea Francesconi — Thu, 16 Jun 2005 03:23:04 GMT

Jeff,

only few time ago I found the time to try your commands, and they work perfectly! Thank you for your tricks!

Steve,

example port numbers are ok, as you image. In your post you tell me that trunk is considered as a "virtual" port that can give me information as the same of a real port, right? How VLANs works? What is the way to enable sFlow also for VLANs stats?

Re: sflow on HP2848

Steve Britt — Fri, 17 Jun 2005 15:56:55 GMT

Andrea,

Although there is a provision in the sFlow specification for providing optional counters that are specific to each VLAN, the ProCurve sFlow implementation does not implement this optional counter group. So, in short, there is no "virtual port" sort of convenient way to monitor a VLAN as there is with a trunk or mesh.

However, VLAN information can be gleaned from the flow samples by decoding the headers and tracking the VLAN information contained within them over a period of time, and then projecting the proportions from the tracked flow samples during the period onto the overall frame and octet counts from that period. At this time, this is really the only means of decoding tagged VLAN data that I am aware of.

SVB

Re: sflow on HP2848

Joel Thys — Thu, 17 Nov 2005 08:08:45 GMT

Hi,

Our SFlow collector does not support Sflow V5. How can change the version to version 4.

Up to the HP website, the HP Procurve 2848 supports the RFC 3176. And this RFC includes support for version 4 of Sflow.

Thanks in advance,

Joel

Re: sflow on HP2848

Jeff Brownell — Thu, 17 Nov 2005 11:49:50 GMT

What is the problem? You are wanting to change something on the switch or the sflow collector? or ???

Re: sflow on HP2848

netmon — Thu, 01 Jun 2006 11:33:39 GMT

Andrea,

We have a number of free tools that you might find helpful for configuring and analyzing sFlow reporting.

The tools are:
1. sflowenable is a command line utility for configuring sFlow on Procurve switches.
2. sFlowTrend is a graphical tool for analyzing and displaying sFlow data and can automatically configure sFlow using the sFlow MIB.
3. sflowtool can convert sFlow into different formats and pretty print sFlow data.

The tools are available at:
http://www.inmon.com/technology/sflowVersion5.php

Peter

Re: sflow on HP2848

HP Delema — Mon, 11 Dec 2006 16:21:39 GMT

Hello Friends,

Following the procedure outlined by Jeff Brownell gives our Scrutinizer SFlow collector only counters and whatâ s more, it seems to inexplicably un-configure itself and stop sending anywhere from 1-3 hours after itâ s originally set.

Has anyone else tested his posting?

Mike

Re: sflow on HP2848

Lei.Ma — Mon, 11 Dec 2006 21:38:41 GMT

whatever you use HP PCM+ or other sflow collector software you can see the flow about source and destination ip address pairs.

for my personal, i use the SflowTrend to collect the sflow sample.
you can download the software from below website, it's free.

http://www.inmon.com/products/sFlowTrend.php

i hope it's helpful.

ray ma

Re: sflow on HP2848

MattS_3 — Thu, 17 Jan 2008 19:58:39 GMT

If I have a modular switch, do I need to use, say, port F14 rather than a numbered port? For some reason, I cannot get the commands to work:

Set flow sampling sampling rate to 37 on port F14.
setmib 1.3.6.1.4.1.14706.1.1.5.1.4.11.1.3.6.1.2.1.2.2.1.1.F14.1 -i 37

I get the error: "cannot translate variable"

Re: sflow on HP2848

MattS_3 — Thu, 17 Jan 2008 20:52:16 GMT

I have 6 modules, the first five of which are the 24-port 10/100 modules.

A1-A24 are 10/100
B1-B24 are 10/100
C1-C24 are 10/100
D1-D24 are 10/100
E1-E24 are 10/100
F1-F24 are 10/100/1000

The port I really care about is F14, so if you count up, it would be port 134. Is this correct?

Re: sflow on HP2848

beovax — Wed, 09 Dec 2009 21:16:56 GMT

sorry to be stupid but can some one please explain what the the sampling and pollong does? If I leave the polling disabled I still get results using our analyaser - do I need polling?

also I see about 1500 dropped samples every hour on one of our ports. Sampling rate is set to 80, is this normal?

Re: sflow on HP2848

netvis — Thu, 10 Dec 2009 07:29:58 GMT

A sampling rate of 80 is very low (unless you have very little traffic on your network). The following article provides suggested sampling rates for different link speeds and typical traffic levels:
http://blog.sflow.com/2009/06/sampling-rates.html

The sFlow agent performs two types of monitoring: packet sampling for measuring traffic flows and counter polling for monitoring link utilization. If your traffic analyzer doesn't support sFlow counter polling, then you don't need to enable counter polling.

However, to get the most out of sFlow it is worth using an sFlow analyzer that supports all the capabilities of the protocol (packet decoding, counter polling, auto-configuration using sFlow MIB etc). The sFlowTrend application (mentioned earlier on this thread) is free and fully supports the sFlow features on HP switches:
http://www.sflowtrend.com/