Open Network Featured Article

Industry-standard, sFlow-capable network equipment is starting to become a fixture in today’s networks, and is enabling a range of software-defined networking (SDN) use cases. (sFlow is the standard for monitoring high-speed switched and routed networks.) For those that have yet to make the transition, just a few simple steps are required in order to get started.

The sFlow architecture provides cost-effective, real-time, network-wide, multi-vendor visibility by shifting intelligence from network hardware to external software. This software-defined analytics approach dovetails perfectly with the SDN-led networking transformation.

“Streaming sFlow-based telemetry unlocks value in SDN by providing feedback to SDN controllers so that they can dynamically allocate resources in response to changing demand,” explained Peter Phaal, the original inventor and a co-author of the sFlow standard, in a column. He is also president and a founder of InMon Corp. “Analytics-driven SDN is poised to disrupt the router market, replacing expensive, custom hardware with commodity switches.”

Getting started is fairly easy. Plenty of hardware vendors have already incorporated sFlow, including Cisco, Arista, Juniper QFX/EX, Dell (News - Alert), HPE, Brocade, Cumulus, Big Switch, Pica8 and Quanta. As a result, multi-vendor traffic monitoring is now a base feature of the network switches and no longer requires the cost and complexity of taps, mirror/SPAN ports, and add-on monitoring hardware.

“The instrumentation is built into the switch ASICs and provides line rate monitoring at 1, 10, 25, 40, 50, and 100G,” explained Phaal. “Enable sFlow on every port on every switch in the network for full visibility. Configuration is simple: Designate a server to receive the sFlow telemetry stream and configure each of the switches to send sFlow to the server. Minimal configuration is required on the switches: a polling interval for interface counters and a packet sampling rate. Start with the default 30 second polling interval and select sampling rates based on port speed using the formula, sampling rate = gigabits per second x 1,000. For example, use a sampling rate setting of 10,000 for a 10G port.”

As far as use cases, automated traffic engineering is one primary application for sFlow telemetry: for instance, one can dynamically optimize WAN paths using OpenDaylight. And, it can be used for DDoS mitigation, generating revenue for ISPs in the process by combining sFlow telemetry with OpenDaylight to deliver DDoS mitigation as a service.

In the network virtualization space, enabling extensibility in OVN by Huawei and IBM (News - Alert) at the 2015 Fall Open vSwitch conference demonstrated sFlow telemetry and the OVN controller driving dynamic service chaining actions.

These are but a few—many more will come to the fore this year, Phaal predicts.

“Commercial impact of sFlow-based telemetry in SDN/NFV solutions will increase in 2016 as the solutions demonstrated in 2015 are released as products and merchant silicon-based switches continue to displace legacy hardware,” Phaal said. “Merchant silicon vendors are helping to accelerate this trend by enhancing visibility and control capabilities to support SDN.”