Is sflow imprecise?

[Marco1986]

Hi,

i configured sflow on my 6600-24G-switch. I used the following commands:

--Destination-IP
sflow 1 destination 192.168.0.10
--Polling incomming Traffic on all Uplinkports, every 60 seconds
sflow 1 polling 14,16,18,22-23 60
--sampling 8000 pakets for each port in 60 seconds
sflow 1 sampling 14,16,18,22-23 8000

All sample ports are uplinkports with a bandwidth of 100, or 1000 MBit/s. The sflow statistic will be sent to our monitoring-server (PRTG). In prtg i have configured a sflow-sensor and bandwidth sensor. My problem is, that the bandwidth sensor show me a bandwidth from 50 MBit/s while the sflow sensor show me a bandwidth from 80 MBit/s.Is sflow really so imprecise?? After one month I had analyze the sflow-statistic for the IP-Adress of our ISA-proxy-server. The result was a traffic volume of 5600 GByte. The ISA-Proxy can also monitor there owne traffic volume. The result is a volume of 2600 GByte.

I have try to change the number of sample packets to 500 and 20.000 but the result is every time the same.

Is there a failure in my config or is the problem, that sflow only show a really misrepresentation?

Sorry, but my english s not the yellow from the egg :-)

Marco

[Tore Valberg]

Hi

Sflow is definitely not exact, but should give you a good estimate.

But from 50 - 80 sounds way off.

Could you run the following test:

Instead of PRTG, run a test with sflowtrend. And let sflowtrend enable sflow on the switch using snmp.

Redo your test and see if the result is just as inaccurate.

If you see the same using another software, i would recommend you to call HP and open a support case.

Tore

[netvis]

You would expect sFlow to report a significantly larger number of bytes than the ISA-Proxy. sFlow operates at layer 2 and is including the Ethernet, IP, TCP and HTTP headers. The ISA-Proxy is probably reporting application level bytes only.

I think you also might be misunderstanding the sampling rate settings. The polling interval applies only to counters and has nothing to do with packet sampling.

A packet sampling rate setting of 8000 means that 1 in 8000 packets is sampled. It doesn't mean that you will get 8000 samples every 60 seconds as the comment in your configuration file suggested.

A sampling rate of 8000 is high for typical 100Mbps and 1Gbps links. You should try the default settings described here:
http://blog.sflow.com/2009/06/sampling-rates.html

You might also find the article on accuracy and sampling rate useful:
http://blog.sflow.com/2009/05/scalability-and-accuracy-of-packet.html

One of the features of sFlow is that you can calculate the accuracy of the results using the the sFlow data itself. To get the most out of the technology you need to use a tool that fully supports sampling. sFlowTrend was mentioned in the previous reply to your question. You can download it at:
http://www.sflowtrend.com/

[Marco1986]

Hi,

I had changed the sflow to following settings (thanks for your links...):

--Destination-IP
sflow 1 destination 192.168.0.10
--Polling uplinkport to ISP, every 60 seconds
sflow 1 polling 14 60
--sampling 500 pakets for each port in 60 seconds
sflow 1 sampling 14 500

But now, in my sFlow collector I see under destination IP only the public Network addresses of our DMZ.

I untderstand, that when I go to google.de the proxy-address download the google-Site from google.de (source google.de, destination "public adress of our proxy-Server").

But i Didn't see any traffic from our Webservers to the internet or any traffic from our Mail-Server to other mail-servers in the internet, but see traffic from internet-mail servers to our mail-server...

Why I see only incomming traffic, no outgoing traffic? I read, that when flow control is enabled sflow sending only incomming pakets, but flow-control is disabled on all ports...

[Tore Valberg]

Aha

I would upgrade the software. Following was fixed in K.14.48:
sFlow (PR_0000015656) â Outbound sampling using sFlow is not functioning.

K.14.60 is available
http://h10144.www1.hp.com/customercare/support/software/summarypages/k-j8692-c.htm

Tore