sFlow is a standard protocol designed to monitor the traffic flow by sampling packets.
In a business environment, where there is a great amount of traffic going through the network, the sFlow protocol can prove to be very useful for network administrators. It helps with detection of any abnormal traffic caused by congestion and potential attacks.
This article describes steps needed to configure sFlow on VigorConnect 1.5.0 (and later versions) with compatible DrayTek VigorSwitches.
The following switches support the sFlow feature:
| VigorSwitch | Firmware Required |
|---|---|
| G2280x | 2.5.1 or later |
| G2540x | 2.6.0 or later |
| P2280x | 2.5.1 or later |
| P2540x | 2.6.0 or later |
How to start using sFlow to monitor the traffic
1. Enable sFlow on the switch
a) Select a Profile ID, e.g. 1
b) Set Enable Profile to Enable
c) Edit Packet Sampling if needed (400 by default)
Packet Sampling Rate means how many packets are captured. The higher the number, the better accuracy of the data.
d) Edit Counter Sampling Interval if needed (30 by default)
Counter Sampling Interval is the number of seconds before the next packet sample is being captured.
e) Select Collector Address Type (IPv4 of VigorConnect server used here)
f) Set Collector Address (VigorConnect server IPv4 address we use is 192.168.1.10)
g) Edit Collector Port if necessary (6343 by default)
h) Select All (or some specific) Data Source Ports
i) Press Apply to save the settings
2. Enable sFlow on VigorConnect
sFlow is disabled by default on VigorConnect. Right-click the VigorConnect icon in the system tray to see available menu options. You may need to press Stop first in order to access the Setup configuration page shown below.
Switch to Network Flow tab and Enable sFlow Counter Sampling Interval. Press OK. Then right-click again to Start VigorConnect.
3. Register a VigorSwitch to VigorConnect.
- Go to VigorConnect Dashboard and click the Discover button in the New Devices section.
- When the scanning process is completed select the VigorSwitch that you want to manage with VigorConnect and use the Add button to add them to the network.
- Then navigate to the Root Network drop-down section and select your switch
4. Apply sFlow settings profile
Go to [Device Menu] > [Configuration] > [sFlow Settings]
a) Select the same Profile ID, e.g. 1
b) Set Enable Profile to Enable
c) Press Apply to save the profile.
The "update Profile Successful" message should appear
Monitor the traffic
Once sFlow is set up and collecting traffic information, go to [Device Menu] > [Monitoring] > [sFlow]
a) Device Overview
This page illustrates the outline of the traffic including the usage, frequency of each port/protocol/destination/source IP, and the statistics depicted in a form of the pie charts. The network administrator can select Destination and Source IP to analyse the traffic.
b) In the top right corner, the network administrator can choose time range and the frequency of the data being refreshed by VigorConnect
c) Device Port Status
This page focuses on the traffic of a selected port the network administrator wants to monitor.
Both, inbound and outbound flow usage can be monitored along with Flow Faults, In/Out Discards, In/Out Errors, In/Out Broadcast Packets, In/Out Multicast Packets. This is a great tool to assist with any troubleshooting networking issues.
d) Device Attack Detection
This page helps the network administrator to monitor the Flood Attack. sFlow can help to analyse multiple types of flood attacks
How do you rate this article?