Configure sFlow | Configure sFlow for network traffic monitoring | NetFlow and sFlow Configuration Guide on Cisco 8000 Series Routers, Cisco IOS XR Releases

Configure sFlow to monitor network traffic using sampled data.

Enable sFlow to monitor network traffic by collecting sampled data from network devices.

sFlow provides visibility into network traffic patterns and supports efficient monitoring.

sFlow is used to monitor network traffic by collecting sampled data from network devices, allowing administrators to analyze traffic patterns and optimize network performance.

This task guides you through configuring sFlow on network devices.

Monitoring sampled data helps identify network issues and supports troubleshooting.

Before you begin

Ensure you have access to the device configuration interface and the necessary privileges to modify sFlow settings.

Verify that the device supports sFlow and that you have administrative access.

Follow these steps to configure sFlow for network traffic monitoring.

Procedure

Access the device configuration interface.

Example:

Access the CLI or GUI configuration interface for the network device.

Ensure you are connected to the device and have the required privileges.

Administrative access is required to configure sFlow.


If...	Then...
The device supports sFlow.	Proceed with configuration steps.
You lack administrative privileges.	Request access from your network administrator.
The device does not support sFlow.	Consult device documentation for alternative monitoring options.

The device configuration interface is accessible for sFlow setup.

Enable sFlow on the desired interfaces.

Example:

Enable sFlow on each interface where traffic monitoring is required.

Choose interfaces based on monitoring needs.

Enabling sFlow on multiple interfaces increases visibility.


If...	Then...
You enable sFlow on all interfaces.	All traffic is monitored using sampled data.
You enable sFlow on selected interfaces.	Only traffic on those interfaces is monitored.
No interfaces are selected.	sFlow does not monitor any traffic.

sFlow is enabled on the specified interfaces.

Specify the sampling rate and collector destination.

Example:

Configure the sampling rate and set the collector IP address and port.

Adjust the sampling rate to balance accuracy and resource usage.

Lower sampling rates provide more detailed data but use more resources.


If...	Then...
The sampling rate is set low.	More detailed traffic data is collected.
The sampling rate is set high.	Less detailed data is collected, reducing resource usage.
The collector destination is not configured.	sFlow data is not exported for analysis.

Sampling rate and collector destination are configured for sFlow.

Save the configuration to apply changes.

Example:

Save the device configuration to activate sFlow monitoring.

Saving the configuration ensures sFlow settings persist after device reboot.

Unsaved changes may be lost if the device restarts.


If...	Then...
Configuration is saved.	sFlow settings are applied and persist after reboot.
Configuration is not saved.	sFlow settings may be lost after device restart.
Device supports automatic saving.	Changes are applied without manual intervention.

sFlow configuration is saved and monitoring begins.

sFlow is enabled and begins monitoring network traffic using sampled data.

What to do next

Verify sFlow operation by checking traffic statistics and collector reports.

Review collected data to ensure sFlow is functioning as expected.

sFlow guidelines and limitations

Describes the guidelines and limitations for configuring and operating sFlow on Cisco platforms.

The following list outlines the general guidelines and limitations for sFlow configuration and operation on Cisco platforms:

When egress sFlow is enabled, the Layer 2 information of ingress packets is captured instead of the egress interface. This behavior is not supported on the 88-LC1-12TH24FH-E and 88-LC1-52Y8H-EM line cards.
sFlow samples are combined into UDP packets and forwarded to sFlow collectors for analysis. UDP is a connectionless protocol and does not ensure delivery of data. Using sFlow as a flow source could lead to inaccurate representations of traffic volumes, bidirectional flows, and a reduction in alerting capabilities.
Only one sampler configuration per router is allowed.
A sampling interval of 1 out of 262,144 packets as the maximum is supported.
From Cisco IOS XR Releases 25.2.2, 25.4.2, and 26.1.1 onwards, when using sFlow monitoring over a Bridge-Group Virtual Interface (BVI), the sFlow records report the BVI interface handle (ifh) instead of the physical interface handle. This indicates that the sFlow data reflects the BVI interface as the source or destination interface in the flow records rather than the underlying physical interface.

The following guidelines apply to flow exporter configuration:

When sFlow is on a bundle with members located on different line cards (LCs), flows are exported with the same ifindex id for the bundle interface. However, they have distinct sub-agent ids and sequence numbers.
A maximum of 8 export destinations per monitor map for both IPv4 and IPv6 are allowed.

The following guidelines apply to flow monitor configuration:

Ingress sFlow is supported on Cisco 8200 and Cisco 8800 Series Routers.
Egress sFlow is supported only on Cisco 8200 Series Routers.

The following guidelines apply to interface support:

Up to 2000 L3 interfaces are supported.
Tunnel and Ethernet PseudoWire (PW) interfaces are not supported.
ARP, multicast, broadcast, and IP-in-IP packets are excluded from the sampling process.

The following guideline applies to load balancing sFlow traffic:

Cisco 8000 modular routers do not load balance sFlow traffic across multiple ECMP paths. When more than one path is available, the router selects only one. Typically, sending sFlow traffic over a single path is sufficient, and load balancing is not necessary.

To enable load balancing across all ECMP paths, configure the router to use multiple UDP source ports for sFlow export packets. This method, known as "source-port entropy," uses a hashing-based algorithm to select paths, resulting in multiple ECMP paths being used. This approach does not provide statistics on the number of sFlow packets per path, as the sFlow process does not know the outgoing interface used. To configure multiple source ports, use the transport udp source-port multiple command.

Configure sFlow on a router

Configure sFlow to monitor network traffic by sampling packets and exporting data to a collector for analysis.

Enable sFlow monitoring to collect traffic data from ingress and egress ports.
Export sampled data using version 5 format to a centralized sFlow analyzer.

To enable sFlow monitoring, configure the sFlow agent to use a sampling mechanism that forwards traffic data from both ingress and egress ports to a centralized data collector, also known as the sFlow analyzer. The sampled data is sent using the version 5 export format. This task provides instructions for configuring sFlow on the router. The following topology is used as a reference for configuring sFlow.

Configuring sFlow for traffic monitoring — Figure 1. sFlow Configuration

Before you begin

Ensure you have the following details before configuring sFlow:

IP address of the source: 2001:db8::0001
IP address of the sFlow collector (destination address): 2001:db8::0002
Interface of the router where sFlow will be enabled: HundredGigE 0/0/0/24
sFlow version used to transport the data to the collector: version 5

Follow these steps to configure sFlow on the router.

Procedure

Configure the flow exporter using the flow exporter-map command to specify where and how the packets should be exported.
Example:
```
Router(config)# flow exporter-map EXP-MAP
Router(config-fem)# version sflow v5
Router(config-fem)# packet-length 9000
Router(config-fem)# transport udp 6343
Router(config-fem)# source HundredGigE 0/0/0/1
Router(config-fem)# source-address 192.127.10.1
Router(config-fem)# destination 192.127.0.1
Router(config-fem)# dfbit set
          
```
The following attributes can be configured while creating exporter map:
- Export destination IP address (IPv4 or IPv6 address). The same packets can be exported to multiple IPv4 or IPv6 destinations.
- DSCP value
- Source interface and its IP address
- Transport protocol
- UDP port number, where the collector listens to the packets
- Maximum datagram length
- Don't Fragment bit (DF-bit). The DF-bit within the IP header is supported only on IPv4 transport and determines whether the router is allowed to fragment a packet.
Verify the flow exporter configuration using the show flow exporter-map command.
```
Router# show flow exporter-map EXP-MAP
Flow Exporter Map : EXP-MAP
-------------------------------------------------
Id                  : 1
Packet-Length       : 9000
DestinationIpAddr   : 192.127.0.1
VRFName             : default
SourceIfName        : HundredGigE 0/0/0/3
SourceIpAddr        : 192.127.10.1
DSCP                : 0
TransportProtocol   : UDP
TransportDestPort   : 6343

Export Version      : sFlow v5
```
- The Export Version: sFlow v5 indicates that the exporter map configuration is successful.
The flow exporter map is configured and ready for use.

Configure the flow sampler using the sampler-map command to define the sampling rate for flow samples.

Example:

Router(config)# sampler-map SAMP-MAP
Router(config-sm)# random 1 out-of 4096

Verify the sampler map configuration using the show sampler-map command.

Router# show sampler-map SAMP-MAP
Sampler Map : SAMP-MAP
-------------------------------------------------
Id:         1
Mode:       Random (1 out of 4096 Pkts)

The sampler map configuration is successful with a sample rate of 1 out of every 4096 packets.


If...	Then...
If the sample rate is set to 1 out of 4096 packets	One sample is generated for every 4096 packets.
If the sampler map is not configured	No sampling occurs for sFlow.
If the sampler map configuration is successful	Sampling begins as per the defined rate.

The flow sampler is configured and ready for use.

Configure the flow monitor using the flow monitor-map command to define the type of traffic to be monitored and the polling frequency.

Example:

Router(config)# flow monitor-map MON-MAP
Router(config-fmm)# record sflow
Router(config-fmm)# sflow options
Router(config-fmm-sflow)# extended-router
Router(config-fmm-sflow)# extended-gateway
Router(config-fmm-sflow)# if-counters polling-interval 120
Router(config-fmm-sflow)# input ifindex physical
Router(config-fmm-sflow)# output ifindex physical
Router(config-fmm-sflow)# sample-header size 200
Router(config-fmm-sflow)# exporter EXP-MAP

You can export input and output interface handles if the ingress or egress interface is a bundle or a Bridge-Group Virtual Interface (BVI).

Verify the monitor map configuration using the show flow monitor-map command.

Router# show flow monitor-map MON-MAP

Flow Monitor Map : MON-MAP
-------------------------------------------------
Id:                2
RecordMapName:     sflow
ExportMapName:     EXP-MAP
ExtendedRouter:    Enabled
ExtendedGateway:   Enabled
InterfaceCounters: Enabled 
PollingInterval:   30 seconds
SampledHeaderSize: 200

Input ifhandle physical
Output ifhandle physical

The monitor map is configured successfully with the associated exporter map to monitor the interface counters at a polling interval of 30 seconds.


If...	Then...
If the monitor map is configured with an exporter map	sFlow data is exported as per the polling interval.
If the polling interval is set to 30 seconds	Interface counters are monitored every 30 seconds.
If the monitor map is not associated with an exporter map	No sFlow data is exported.

The flow monitor is configured and ready for use.

Apply sFlow on an interface using the flow datalinkframesection command in global configuration mode.

Example:

Router(config)# interface HundredGigE 0/0/0/3
Router(config)# ipv4 address 192.127.0.56 255.255.255.0
Router(config)# ipv6 address FFF2:8:DE::56/64
Router(config)# flow datalinkframesection monitor-map MON-MAP sampler SAMP-MAP ingress

Apply the monitor map MON-MAP and the sampler map SAMP-MAP on the HundredGigE 0/0/0/3 interface in the ingress direction to monitor incoming packets.

Monitor incoming packets using sFlow on the specified interface.


If...	Then...
If the monitor and sampler maps are applied to the interface	sFlow monitoring is enabled for incoming packets.
If the interface is not configured	No sFlow monitoring occurs.
If the ingress direction is specified	Only incoming packets are monitored.

sFlow is applied to the interface for traffic monitoring.

Enable sFlow on the RP (0/RP0/CPU0) or on the line card using the hw-module profile netflow sflow-enable command.

Example:

Router(config)# hw-module profile netflow sflow-enable location 0/0/CPU0

Enable sFlow on the RP or line card to activate sFlow monitoring.


If...	Then...
If sFlow is enabled on the RP or line card	sFlow monitoring is activated for the specified location.
If the location is not specified	sFlow may not be enabled on the intended hardware.
If sFlow is not enabled	No sFlow monitoring occurs.

sFlow is enabled on the RP or line card.

Reload the line card using the hw-module reset auto command.

Example:

Router# reload location 0/0/CPU0

With this configuration, sFlow is enabled on the line card.


If...	Then...
If the line card is reloaded	sFlow configuration is applied and enabled.
If the reload command is not issued	sFlow may not be active on the line card.
If sFlow is enabled after reload	Traffic monitoring begins on the line card.

sFlow is enabled and active on the line card.

Verify the statistics of exported traffic flow at the producer and exporter using show flow platform producer statistics location and show flow exporter commands.

Example:

Router# show flow platform producer statistics location 0/0/CPU0
Netflow Platform Producer Counters:
IPv4 Ingress Packets:                        0
IPv4 Egress Packets:                         0
IPv6 Ingress Packets:                        0
IPv6 Egress Packets:                         0
MPLS Ingress Packets:                        0
MPLS Egress Packets:                         0
IPFIX315 Ingress Packets:                    0
IPFIX315 Egress Packets:                     0
sFlow Ingress Samples:                  100000
Drops (no space):                            0
Drops (other):                               0
Unknown Ingress Packets:                     0
Unknown Egress Packets:                      0
Worker waiting:                              0

Router# show flow exporter EXP-MAP location 0/0/CPU0
Wed June 21 04:21:36.263 UTC
Flow Exporter: EXP-MAP 
Export Protocol: sFlow v5 
Flow Exporter memory usage: 5247776
Used by flow monitors: MON-MAP

Status: Normal
Transport:   UDP
Destination: 192.127.0.1     (6343) VRF default
Source:      192.127.10.1    (6331)
Flows exported:                               50245 (9631004 bytes)
Flows dropped:                                    0 (0 bytes)

Packets exported:                              7372 (19262008 bytes)
Packets dropped:                                  0 (0 bytes)

Total export over last interval of:
  1 hour:                                      7363 pkts
                                            9629960 bytes
                                              50236 flows
  1 minute:                                      12 pkts
                                               1392 bytes
                                                 12 flows
  1 second:                                       0 pkts
                                                  0 bytes
                                                  0 flows

The sFlow configuration with flow and packet data is successful on the router.


If...	Then...
If the statistics show exported flows and packets	sFlow is successfully monitoring and exporting traffic data.
If no flows or packets are exported	Check the configuration for errors.
If drops are reported	Investigate for resource or configuration issues.

sFlow statistics confirm successful traffic monitoring and export.

sFlow is configured on the router, enabling traffic monitoring and export of sampled data to the collector for analysis.

What to do next

Analyze the traffic using the UDP datagram and sampled data collected at the sFlow collector.

Review the sampled data at the sFlow collector to validate traffic monitoring.

This image shows an example of sampled data that has been collected at the sFlow collector.