sFlow essential concepts and terms

The following list explains the essential sFlow terms and concepts used in network monitoring and analysis.

• Data source: A location within a network device that can make traffic measurements. Examples include physical interfaces and VLANs.

• Flow: A set of IP packets passing through a network device during a certain time interval. All packets that belong to a particular flow have a set of common properties derived from the data contained in the packet.

• Flow record: A set of key and non-key sFlow field values used to characterize flows. This record is created by inspecting packet headers and adding a description of packet information.

• sFlow agent: An entity inside the network device responsible for maintaining sFlow configuration, gathering sampled flow and counters from one or more data sources in the router, packaging them in sFlow datagram format, and exporting them to the sFlow collector.

• sFlow collector: An application that receives sFlow datagrams from one or more agents to perform further analysis and generate reports. The collector is external to the router.

• Sampling rate: The frequency that specifies how often packet sampling is performed, and determines how many packets (on average) that pass through the data source to generate a flow sample. A value of 100 means that on average, 1 out of 100 packets is randomly sampled to be exported.

• Sampling interval: The period at which counters are polled for populating the counter sample in the sFlow datagram.

• sFlow datagram: A User Datagram Protocol (UDP) datagram exported from the sFlow agent to the collector. The datagram contains information about the data source, one or more flow samples, and one or more counter samples.

• Collector address: The IP address and UDP port number of the collector. The default destination port number is 6343.