Monitoring BIG-IP System Traffic with sFlow

Overview: Configuring network monitoring with sFlow

sFlow is an industry-standard technology for monitoring high-speed switched networks. You can configure the BIG-IP system to poll internal data sources and send data samples to an sFlow receiver. You can then use the collected data to analyze the traffic that traverses the BIG-IP system. This analysis can help you understand traffic patterns and system usage for capacity planning and charge back, troubleshoot network and application issues, and evaluate the effectiveness of your security policies.

Task summary

Perform these tasks to configure performance monitoring of the BIG-IP system using an sFlow device.

1. Adding a performance monitoring sFlow receiver

2. Setting global sFlow polling intervals and sampling rates for data sources

3. Setting the sFlow polling interval and sampling rate for a VLAN

4. Setting the sFlow polling interval and sampling rate for a profile

5. Setting the sFlow polling interval for an interface

6. Viewing sFlow data sources, polling intervals, and sampling rates

Adding a performance monitoring sFlow receiver

Gather the IP addresses of the sFlow receivers that you want to add to the BIG-IP system configuration. You can use IPv4 and IPv6 addresses.

Note: You can add an sFlow receiver to the BIG-IP system only if you are assigned either the Resource Administrator or Administrator user role. 

Add an sFlow receiver to the BIG-IP system when you want to use the receiver to monitor system performance.

1. On the Main tab, click System > sFlow > Receiver List.

   The sFlow screen opens.

2. Click Add.

   The New Receiver properties screen opens.

3. In the Name field, type a name for the sFlow receiver.

4. In the Address field, type the IPv4 or IPv6 address on which the sFlow receiver listens for UDP datagrams.

   Note: The IP address of the sFlow receiver must be reachable from a self IP address on the BIG-IP system.

5. From the State list, select Enabled.

6. Click Finished.

Setting global sFlow polling intervals and sampling rates for data sources

You can configure the global sFlow polling intervals and sampling rates for data sources on the BIG-IP system, only if you are assigned either the Resource Administrator or Administrator user role.

You can configure separate sFlow global polling intervals for the system, VLANs, interfaces, and HTTP profiles, and separate sFlow global sampling rates for VLANs and HTTP profiles.

1. On the Main tab, click System > sFlow > Global Settings.

   The sFlow screen opens.

2. In the Name column, click a type of data source.

   The properties screen for that type of data source opens.

3. In the Polling Interval field, type the maximum interval in seconds between polling by the sFlow agent.

4. In the Sampling Rate field, type the ratio of packets observed to the number of samples you want the BIG-IP system to generate.

   For example, a sampling rate of 2000 specifies that one sample will be randomly generated for every 2000 packets observed.

5. Click Update.

6. Repeat this procedure to set the global polling interval and sampling rate for the other types of data sources.

   Note: You cannot configure sampling rates for the system or interface data sources.

Setting the sFlow polling interval and sampling rate for a VLAN

You can configure the sFlow polling interval and sampling rate for a specific VLAN, only if you are assigned either the Resource Administrator or Administrator user role.

Change the sFlow settings for a specific VLAN when you want the traffic flowing through the VLAN to be sampled at a different rate than the global sFlow settings on the BIG-IP system.

1. On the Main tab, click Network > VLANs.

   The VLAN List screen opens.

2. In the Name column, click the relevant VLAN name.

   The New VLAN screen opens.

3. From the Polling Interval list, select Specify, and type the maximum interval in seconds between polling by the sFlow agent of this VLAN.

4. From the Sampling Rate list, select Specify, and type the ratio of packets observed at this VLAN to the samples you want the BIG-IP system to generate.

   For example, a sampling rate of 2000 specifies that 1 sample will be randomly generated for every 2000 packets observed.

5. Click Update.

Setting the sFlow polling interval and sampling rate for a profile

You can configure the sFlow polling interval and sampling rate for an HTTP profile, only if you are assigned either the Resource Administrator or Administrator user role.

Change the sFlow settings for a specific HTTP profile when you want the traffic flowing through the virtual server (to which the profile is assigned) to be sampled at a different rate than the global sFlow settings on the BIG-IP system.

1. On the Main tab, click Local Traffic > Profiles > Services > HTTP.

   The HTTP profile list screen opens.

2. Click the name of a profile.

3. From the Polling Interval list, select Specify, and type the maximum interval in seconds between polling by the s Flow agent of this profile.

4. From the Sampling Rate list, select Specify, and type the ratio of packets observed at the virtual server associated with this profile to the samples you want the BIG-IP system to generate.

   For example, a sampling rate of 2000 specifies that one sample will be randomly generated for every 2000 packets observed.

5. Click Update.

Setting the sFlow polling interval for an interface

You can configure the sFlow polling interval for a specific interface, only if you are assigned either the Resource Administrator or Administrator user role.

Change the sFlow settings for a specific interface when you want the traffic flowing through the interface to be sampled at a different rate than the global sFlow settings on the BIG-IP system.

1. On the Main tab, click Network > Interfaces > Interface List.

   The Interface List screen displays the list of interfaces on the system.

2. In the Name column, click an interface number.

   This displays the properties of the interface.

3. From the Polling Interval list, select Specify, and type the maximum interval in seconds between polling by the sFlow agent of this interface.

4. Click the Update button.

Viewing sFlow data sources, polling intervals, and sampling rates

You can view details about the data sources that the BIG-IP system can poll for information to send to your sFlow receivers. For example, you can view current polling intervals and sampling rates, or determine if you want to add or remove specific data sources.

1. On the Main tab, click System > sFlow > Data Sources.

   The sFlow Data Sources HTTP screen opens. You can view information about the virtual server that is the data source.

2. On the menu bar, click Data Sources, and select Interfaces.

   The sFlow Data Sources HTTP screen opens. You can view information about the interface that is the sFlow data source.

3. On the menu bar, click Data Sources, and select System.

   The sFlow Data Sources HTTP screen opens. You can view information about the system that is the sFlow data source.

4. On the menu bar, click Data Sources and select VLAN.

   =The sFlow Data Sources HTTP screen opens. You can view information about the VLAN that is the sFlow data source.

sFlow receiver settings

This table names and describes the sFlow receiver settings in the Configuration utility.

sFlow global settings

This table names and describes the sFlow global settings in the Configuration utility.

sFlow counters and data

This table names and categorizes the sFlow counters and informational data that the BIG-IP system sends to sFlow receivers. Note that the resource type corresponds to the value in the Name column on the sFlow global settings screen. The table also includes the source of the data and an example value.

sFlow HTTP Request sampling data types

This table names and categorizes the sFlow HTTP Request sampling data types that the BIG-IP system sends to sFlow receivers.

This is an example of IPv4 HTTP Request sampling data:

startDatagram =================
datagramSourceIP 10.0.0.0
datagramSize 376
unixSecondsUTC 1370017719
datagramVersion 5
agentSubId 3
agent 192.27.88.20
packetSequenceNo 16
sysUpTime 1557816000
samplesInPacket 1
startSample -------------------
sampleType_tag 0:1
sampleType FLOWSAMPLE
sampleSequenceNo 1
sourceId 3:2
meanSkipCount 1
samplePool 1
dropEvents 0
inputPort 352
outputPort 1073741823
flowBlock_tag 0:2102
extendedType proxy_socket4
proxy_socket4_ip_protocol 6
proxy_socket4_local_ip 10.1.0.0
proxy_socket4_remote_ip 10.1.0.0
proxy_socket4_local_port 40451
proxy_socket4_remote_port 80
flowBlock_tag 0:2100
extendedType socket4
socket4_ip_protocol 6
socket4_local_ip 10.0.0.0
socket4_remote_ip 10.0.0.0
socket4_local_port 80
socket4_remote_port 40451
flowBlock_tag 0:2206
flowSampleType http
http_method 2
http_protocol 1001
http_uri /index.html
http_host 10.10.10.250
http_referrer http://asdfasdfasdf.asdf
http_useragent curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 
 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2
http_authuser Aladdin
http_mimetype text/html; charset=UTF-8
http_request_bytes 340
http_bytes 8778
http_duration_uS 1930
http_status 200
endSample   ----------------------
endDatagram ======================      

sFlow VLAN sampling data types

This table names and categorizes the sFlow VLAN sampling data types that the BIG-IP system sends to sFlow receivers.

This is an example of IPv4 VLAN sampling data:

startDatagram =============================================
datagramSourceIP 10.0.0.0
datagramSize 180
unixSecondsUTC 1370016982
datagramVersion 5
agentSubId 2
agent 192.27.88.20
packetSequenceNo 1
sysUpTime 1557079000
samplesInPacket 1
startSample -----------------------------------------------
sampleType_tag 0:1
sampleType FLOWSAMPLE
sampleSequenceNo 1
sourceId 0:352
meanSkipCount 128
samplePool 38
dropEvents 0
inputPort 352
outputPort 1073741823
flowBlock_tag 0:1
flowSampleType HEADER
headerProtocol 1
sampledPacketSize 66
strippedBytes 0
headerLen 64
headerBytes 00-01-D7-E6-8A-03-00-50-56-01-10-0E-08-00-45-00-00-
 34-D8-A4-40-00-40-06-39-10-0A-0A-0A-02-0A-0A-0A-FA-9D-77-00-50-
 33-97-00-00-EA-00-5D-80-80-10-00-FA-AF-B0-00-00-01-01-08-0A-44-
 4B-27-FA-67-51
dstMAC 0001d7e68a03
srcMAC 00505601100e
IPSize 52
ip.tot_len 52
srcIP 10.0.0.0
dstIP 10.0.0.1
IPProtocol 6
IPTOS 0
IPTTL 64
TCPSrcPort 40311
TCPDstPort 80
TCPFlags 16
flowBlock_tag 0:1001
extendedType SWITCH
in_vlan 3195
in_priority 0
out_vlan 0
out_priority 0
endSample   ---------------------------------------------------
endDatagram   =================================================

Implementation result

You now have an implementation in which the BIG-IP® system periodically sends data samples to an sFlow receiver, and you can use the collected data to analyze the performance of the BIG-IP system.