How to include multicast traffic in sFlow from Procurve?

[Don Thomas Jacob]

We have an HP Procurve on which we are doing some sFlow testing.

From what we find, the normal sFlow configuration is not including the multicast traffic information. We enable sFlow using root MIB 1.3.6.1.4.1.14706.1 on the ProCurve.

Is there any specific MIB we need to use to include multicast traffic in the exported sFlow?

Regards,
Don Thomas
ManageEngine NetFlow Analyzer

[Tore Valberg]

Hi Don

As far as i know, ProCurve Sflow should contain multi-cast traffic as well by default.

What platform are you running, and what firmware?

At least i know K platform does sample multi-cast.

[Steve Britt]

Don,

The ProCurve switches are supposed to consider every frame in/out of an interface when sampling, including MAC multicast and broadcast traffic. Perhaps you're not running a large enough percentage through to show up amongst other things in the stream ...? I've done quite a bit of development on sFlow collectors using ProCurve equipment as my data source and I can state without question that they do sample multicast. Although I suppose it's possible that there is a bug in the specific device type that you have - what model is it?

There are also a couple of devices with quirks regarding sampling of inbound or outbound (don't remember which) traffic - traffic is sampled in the other direction though. You should make sure that whatever device you're testing has the latest firmware revision.

Regards,

SVB

[Don Thomas Jacob]

Hi Tore and Steve,

Sorry for the delay. The switch is a ProCurve 5412 running IOS K.13.71

The device is used in out network and we know that there is multicast traffic in our network. We have set the sampling rate as 4096 on the device.

We do not see any multicast traffic withing the analyzer.

Any possible issues with the switch firmware?

Regards,
Don Thomas
ManageEngine NetFlow Analyzer

[Tore Valberg]

Hi Don

There should not be an issue preventing you from seeing multicast on that build, but you might want to try K.14.60 in your testing.
http://h10144.www1.hp.com/customercare/support/software/summarypages/k-j8692-c.htm

Do you know how much in Port % utilization the multicast traffic consist of?
Do you see other traffic?

What output do you get from the command
"show sflow 1 destination" ?

You also might want to contact Support to have a case opened.

Tore