sFlow
sFlow (Sampled Flow) is a network monitoring protocol designed for high-speed networks. Unlike NetFlow and IPFIX, which capture complete flow records, sFlow uses packet sampling to provide scalable and efficient traffic analysis. Monitoring agents embedded in network devices sample packets and send them to a central collector.
Versions
The sflow device collects sFlow v5. Datagrams declaring any other version are rejected.
Structure
An sFlow datagram is layered: a datagram header carries a number of samples, each sample carries flow records, and a flow record carries the sampled packet's decoded fields. The three tables below follow that nesting.
Datagram Header
| Field | Description |
|---|---|
Version | Always 5 |
IPVersion | Address family of the agent address |
AgentIP | IP address of the device performing sampling |
SubAgentId | Distinguishes multiple agents on one device |
SequenceNumber | Running datagram counter, for loss detection |
Uptime | Milliseconds since the agent booted |
SamplesCount | Number of samples in this datagram |
Flow Sample
| Field | Description |
|---|---|
SamplingRate | Ratio of sampled packets to total packets |
SamplePool | Total packets that could have been sampled |
Drops | Packets dropped due to a lack of resources |
Input | Interface the packet was received on |
Output | Interface the packet was forwarded to |
SampleSequenceNumber | Per-source sequence counter for this sample stream |
FrameLength | Original length of the sampled frame in bytes |
OriginalLength | Length of the packet before any truncation |
Stripped | Bytes removed from the end of the sampled packet |
Expanded flow samples carry the interfaces as InputIfFormat/InputIfValue and OutputIfFormat/OutputIfValue instead of the plain Input and Output.
Sampled Packet
| Field | Description |
|---|---|
SrcIP | Source IP address |
DstIP | Destination IP address |
SrcPort | Source port number |
DstPort | Destination port number |
Protocol | Transport protocol |
TcpFlags | TCP control flags |
An extended switch record adds SrcVlan and DstVlan —two directional VLAN identifiers rather than a single one.
Sample Types
The sample header's format field distinguishes flow samples (1), counter samples (2), expanded flow samples (3), expanded counter samples (4) and drop samples (5).
Only flow samples and expanded flow samples are emitted. Counter samples are decoded and then discarded, so interface counter statistics do not reach a pipeline.
Emitted Fields
The names above are those of the sFlow datagram on the wire. They are not the field names that reach a pipeline: the collector converts each sample to ECS 8.11.0 before emitting it, so a sample arrives as source.ip, destination.port, network.bytes and their siblings.