Procurve 2824/2810 - SFLOW seems to be of limited use?

[Martin Rushworth]

Hi,

I have been testing sflow on a couple of 2810's and 2824's including the latest software. It seems like sflow is of very limited use on these switches and wondered if anyone disagreed with me and had got satisfactory results. They seem like they might work pretty ok for seeing statistically what is roughly happening on a network under normal use, but as far as measuring how much data is going through per host, per port (and all the other interesting possible analysis) they seem to produce really inaccurate (very low) results. I have it working very accurately on other brand switches and routers. When i say inaccurate, I am comparing the bandwidth graphs generated by polling the interface counters and comparing these to graphs of bandwidth from my sflow collector.

They don't seem to be able to report the statistics fast enough, I see a high number of "dropped samples" when I do "show sflow all". I experimented by just enabling one interface, and sampling every 4096 packets, and still saw drops. The number of flows and packets on the graphs seem to square off at a certain rate which also indicates a performance issue in the reporting. When I compare the incoming sflow packets from an HP (with tcpdump) they seem to come in at a very slow rate, even when the switch is pushing a lot of bandwidth through it. When I compare this to the packets coming from another vendor switch, the packets come at a much much faster rate when there is a lot of bandwidth on the switch. I have verified with wireshark/tshark that the data is being received properly, there are no gaps in sequence numbers, etc.

Coupled with the fact that its difficult to configure them, sflow can only be enabled for a finite time and configuration is lost across reboots I am so far thinking that these switches are not really suitable for sflow.

Some details of my setup...

show sflow all

sflow agent

Version : 1.3;HP;N.11.08
Agent Address : 10.64.20.68

sflow destination

sflow : Enabled
Datagrams Sent : 21393
Destination Address : 10.32.17.203
Receiver Port : 23520
Owner : nfdump
Timeout (seconds) : 99981639
Max Datagram Size : 1400
Datagram Version Support : 5

sflow sampling-polling

sflow destination Enabled

Port | Sampling Dropped | Polling
| Enabled Rate Header Samples | Enabled Interval
----- + ------- -------- ------ ---------- + ------- --------
1 Yes 512 128 88175 Yes 20
2 Yes 512 128 17 Yes 20
3 Yes 512 128 198369 Yes 20
4 Yes 512 128 0 Yes 20
5 Yes 512 128 123 Yes 20
6 Yes 512 128 68 Yes 20
7 Yes 512 128 0 Yes 20
8 Yes 512 128 0 Yes 20
9 Yes 512 128 4 Yes 20
10 Yes 512 128 0 Yes 20
11 Yes 512 128 0 Yes 20
12 Yes 512 128 0 Yes 20
13 Yes 512 128 0 Yes 20
14 Yes 512 128 198242 Yes 20
15 Yes 512 128 86615 Yes 20
16 Yes 512 128 0 Yes 20
17 Yes 512 128 0 Yes 20
18 Yes 512 128 0 Yes 20
19 Yes 512 128 0 Yes 20
20 Yes 512 128 37 Yes 20
21 Yes 512 128 0 Yes 20
22 Yes 512 128 0 Yes 20
23 Yes 512 128 0 Yes 20
24 Yes 512 128 0 Yes 20

I have quite a lot of these switches and was hoping to run this feature on them so i would be very happy if someone wanted to disagree :)

Martin

P.S. This thread has been moved from Switches, Hubs, Modems (Legacy ITRC forum) to ProCurve / ProVision-Based. -HP Forum Moderator

[netvis]

Martin,

You should try sFlowTrend. It supports the sFlow MIB and will automatically configure sFlow, renew the timeouts and restore monitoring after a switch reboot.

If you are using a tool that doesn't natively support sFlow then you might not be seeing all the traffic. sFlow operates at layer 2 and will report on all traffic (including spanning tree, ARP etc), not just TCP/IP. Also sFlow exports interface counters and these should exactly match what you are getting using SNMP polling. Again, if you aren't using a native sFlow analyzer you might not be seeing that data.

sFlowTrend is free and you can download it from here:
http://www.inmon.com/products/sFlowTrend.php

Peter

[David_Mitchell]

Hi Martin,

I appreciate it was a long time ago when you posted this but I was wandering if you determined an answer to your question?

I am currently looking at a flat network made up of only HP Procurve 2810,2824 and 2848 switches and I need to implement sFlow to capture traffic flows to determine a redesign to a datacentre model over a WAN.

I have no monitoring software, but I can install pretty much anything I need to get the job done (so long as its free)!

Obviously if these switches can't be trusted with the sFlow data they are sending back to the Manager I am stuffed, so I am hoping you resolved your issue with something along the lines of a dedicated sFlow manager as suggested in your first reply

Any help would be greatley appreciated

David