sFlow Export Format
The sFlow Collector supports parsing of the three main sFlow export versions: 2, 4, and 5. Flow information will be gathered from either the flow packet header provided in the export packet or the IP Flow information data format. Only IPv4 flows are currently supported.
Because sFlow does not provide switch time information, the start time for the flow will be reported as the uptime of the device when the export packet was received, as reported in the export packet header. The last switch time will be the same as the first switch time since this information is unknown and cannot be estimated. This restriction means the flow data rate cannot be calculated.
sFlow Collector
The sFlow Collector parses received export packets using the published export format to collect the following fields from either the packet header or the IP Flow information format.
• IPv4 source address
• IPv4 destination address
• Input interface
• Output interface
• Flow byte count
• First switched time
• Layer 4 source port
• Layer 4 destination port
• IP protocol number
• ToS
Because sFlow does not provide timely information, the start time for the flow will be reported as the uptime of the device when the export packet was received, as reported in the export packet header. The last switch time will be the same as the first switch time since this information is unknown and cannot be estimated. This restriction means the flow data rate cannot be calculated.
The flow byte count will be calculated using the following formula:
J-Flow Collection
The J-Flow Collector will collect the following fields from either the packet header or the IP flow information format:
• IPv4 source address
• IPv4 destination address
• Input interface
• Output interface
• Flow byte count
• First switched time
• Last switched time
• Layer 4 source port
• Layer 4 destination port
• IP protocol number
• ToS