sflow on HP2848

[Andrea Francesconi]

Hi. I try to collect sflow data from HP Procurve 2848 to an ntop machine; how I can config HP2848 to send sflow information to a particular ip?

SNMP is already up and correctly work.

[Les Ligetfalvy]

Correct me if I am wrong, but I thought that sflow is "pulled" by the machine and not "pushed" by the switch.

[Andrea Francesconi]

> Correct me if I am wrong, but I thought that > sflow is "pulled" by the machine and not
> "pushed" by the switch.

Can be true, yes.
Can I verify if sflow traffic is correctly send out from Procurve? I not find a lot of docs about sflow... =(

[Les Ligetfalvy]

You have my simpathy. I have been trying to find info on RMON in the following post but to no avail.
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=752662

I think PCM+ can pull ease and/or sflow data from the switches but how it does it is beyond my level of competence.

Sorry

[Jeff Brownell · Accepted solution]

Below are the quickie ways to enable sflow via the console/telnet/ssh management interface. Note where the port number goes.

Set destination Ip (the IP of the collector station--Note that ip address is in hex but withOUT the leading 0x!!!! This
is 15.29.16.93):

setmib sFlowRcvrAddress.1 -o 0F1D105D

Enable Receiver:
setmib sFlowRcvrOwner.1 -D Jeff sFlowRcvrTimeout.1 -i 100000000

Set flow sampling sampling rate to 37 on port 53.
setmib 1.3.6.1.4.1.14706.1.1.5.1.4.11.1.3.6.1.2.1.2.2.1.1.53.1 -i 37
Port 55, rate of 20:
setmib 1.3.6.1.4.1.14706.1.1.5.1.4.11.1.3.6.1.2.1.2.2.1.1.55.1 -i 20
Port 5, rate of 20:
setmib 1.3.6.1.4.1.14706.1.1.5.1.4.11.1.3.6.1.2.1.2.2.1.1.5.1 -i 20

Now set the enable to true/1:
Port 53:
setmib 1.3.6.1.4.1.14706.1.1.5.1.3.11.1.3.6.1.2.1.2.2.1.1.53.1 -i 1
Port 55:
setmib 1.3.6.1.4.1.14706.1.1.5.1.3.11.1.3.6.1.2.1.2.2.1.1.55.1 -i 1
Port 5:
setmib 1.3.6.1.4.1.14706.1.1.5.1.3.11.1.3.6.1.2.1.2.2.1.1.5.1 -i 1

Set counter polling interval:

Interval of 8 seconds, port 53:
setmib 1.3.6.1.4.1.14706.1.1.6.1.4.11.1.3.6.1.2.1.2.2.1.1.53.1 -i 8
Interval of 7 seconds, port 55:
setmib 1.3.6.1.4.1.14706.1.1.6.1.4.11.1.3.6.1.2.1.2.2.1.1.55.1 -i 7
Interval of 50 seconds, port 5:
setmib 1.3.6.1.4.1.14706.1.1.6.1.4.11.1.3.6.1.2.1.2.2.1.1.5.1 -i 50

Now set the enable to true/1:

Port 53:
setmib 1.3.6.1.4.1.14706.1.1.6.1.3.11.1.3.6.1.2.1.2.2.1.1.53.1 -i 1
Port 55:
setmib 1.3.6.1.4.1.14706.1.1.6.1.3.11.1.3.6.1.2.1.2.2.1.1.55.1 -i 1
Port 5:
setmib 1.3.6.1.4.1.14706.1.1.6.1.3.11.1.3.6.1.2.1.2.2.1.1.5.1 -i 1

Disabling:

To totally kill all sampling and to release the receiver just set timeout
to 0:
setmib sFlowRcvrTimeout.1 -i 0

If you want to keep the receiver and just disable flow sampling, you can EITHER
set the sampling rate to 0 or set enable to false/0:

Disable flow sampling on port 53 by setting enable FALSE:
setmib 1.3.6.1.4.1.14706.1.1.5.1.3.11.1.3.6.1.2.1.2.2.1.1.53.1 -i 0

If you want to keep the receiver and just disable counter polling, you can EITHER
set the interval to 0 or set enable to false/0:

Disable counter polling on port 53 by setting enable FALSE:
setmib 1.3.6.1.4.1.14706.1.1.6.1.3.11.1.3.6.1.2.1.2.2.1.1.53.1 -i 0

[Andrea Francesconi]

Thank you Jeff for your reply.
I do:

HP2848(config)# setMIB sFlowRcvrAddress.1 -o C0A80A63
sFlowRcvrAddress.1 = c0 a8 0a 63

HP2848(config)# setMIB sFlowRcvrOwner.1 -D Jeff sFlowRcvrTimeout.1 -i 100000000

sFlowRcvrOwner.1 = Jeff
sFlowRcvrTimeout.1 = 100,000,000

but when I digit:

HP2848(config)# setMIB 1.3.6.1.4.1.14706.1.1.5.1.4.11.1.3.6.1.2.1.2.2.1.1.53.1
-i 20
1.3.6.1.4.1.14706.1.1.5.1.4.11.1.3.6.1.2.1.2.2.1.1.53.1: Unable to create.

What's wrong?

[Jeff Brownell]

Andrea,

I would say that you dont have a port 53 on your switch. Do a 'walkmib sFlowFsPacketSamplingRate' to see how many ports you have. If it's a 2848 then 48 is as high as you go...

Jeff

[Steve Britt]

Andrea,

In the examples that Jeff gave, replace the "53", "55", or "5" used as example port numbers in his commands with the correct ifIndex of each port that you wish to enable sFlow on. You must follow each step that Jeff enumerates for every such port.

On the topic of switch ifIndex values (i.e. 53 in the examples vs. your 48-port switch) you should note that depending upon your switch configuration you could actually have a "virtual" port numbered in the 50s. When a trunk or mesh is enabled on a ProCurve switch that supports sFlow, the MIB variables of the trunk or mesh constituent ports become inaccessible and are replaced by a "virtual" port that is created to represent the entire traffic flow of the mesh or trunk. So in other words if you created a trunk using ports 1, 2, and 3 of a switch the sFlow MIB variables for ifIndex values 1, 2, and 3 would subsequently "disappear" from the MIB and would be replaced with a corresponding set of MIB entries that allow sFlow to be applied to the entire trunk as an aggregate; the new MIB entries would be numbered using an ifIndex that is out of range of the device's physical ports. This creation of a virtual port allows applications to monitor aggregated traffic flow through a mesh or trunk quite simply by having the agent do the "assemblage" of data from the constituent ports within the trunk or mesh. You can determine which ifIndex has been assigned to a trunk or mesh by looking at the ifDescr fields within the MIB-II ifTable.

[Steve Britt]

Andrea,

Also, for more information about sFlow in general you can check out sflow.org.

With regard to Les' comments about how sFlow works (pulled or pushed) it is pushed from the agent. The management application must set up the sFlow MIB (essentially performing the same steps that Jeff enumerated) so that it points to the appropriate IP address and UDP socket number. Then the switch agent can operate autonomously in terms of dispatching flow and/or counter samples via UDP packets that are directed to the configured port of the management station. The management application must periodically refresh the receiver timeout value to ensure that the agent keeps sending samples - this is a failsafe mechanism so that when a management application dies or otherwise disappears the agent eventually stops sending samples to the now-defunct UDP port.

Steve

[Andrea Francesconi]

Jeff,

only few time ago I found the time to try your commands, and they work perfectly! Thank you for your tricks!

Steve,

example port numbers are ok, as you image. In your post you tell me that trunk is considered as a "virtual" port that can give me information as the same of a real port, right? How VLANs works? What is the way to enable sFlow also for VLANs stats?