sflow

Overview ¶

Package sflow decodes sFlow v5 datagrams per the InMon publicly-published sFlow v5 specification (sflow.org). sFlow is the packet-sampling counterpart to NetFlow (covered by `netflow_v5_decode`): instead of summarising per-flow state, sFlow exports a configurable 1-in-N sample of the packets transiting a device, plus periodic interface counters.

Operationally, sFlow is the dominant monitoring telemetry on every modern datacenter switch — Arista, Cisco Nexus, HP, Juniper QFX, Mellanox, Cumulus — because it scales linearly with link speed regardless of flow churn (whereas NetFlow's per-flow state grows with churn). DDoS-detection, capacity planning, and security-NDR platforms all consume sFlow.

Wrap-vs-native judgement

Native. The sFlow v5 spec is fully public; the wire
format is XDR-encoded (network-byte-order, 4-byte
aligned). A 32-byte datagram header is followed by N
(Sample Type + Length + Data) records, each carrying
either a Flow Sample (per-packet) or a Counter Sample
(per-interface periodic). No crypto, no compression.
Operators paste sFlow bytes (UDP destination port 6343)
from a `tcpdump -X udp port 6343` line or a Wireshark
Follow-UDP-Stream view and get the documented header +
sample breakdown.

What this package covers

• **Datagram common header** (variable; 28 or 40 bytes):

• bytes 0-3: Version (uint32 BE; must be 5).

• bytes 4-7: Agent Address Type (uint32 BE; 1 IPv4, 2 IPv6).

• then 4 bytes IPv4 or 16 bytes IPv6 Agent Address.

• next 4 bytes: Sub-Agent ID (uint32 BE).

• next 4 bytes: Sequence Number (uint32 BE; per-Agent monotonic — gaps signal datagram loss).

• next 4 bytes: System Uptime (uint32 BE; ms since agent boot).

• next 4 bytes: Sample Count (uint32 BE; number of samples in this datagram).

• **Sample walker** — repeated 8-byte header (Sample Type uint32 BE + Sample Length uint32 BE) + sample body. The Sample Type is split into top 12 bits (Enterprise; 0 for standard sFlow) + bottom 20 bits (Format). **4-entry standard sample format table**: 1 Flow Sample, 2 Counter Sample, 3 Expanded Flow Sample, 4 Expanded Counter Sample (Expanded uses uint64 ifIndex fields for bonded interfaces above 2^32 — same body otherwise).

• **Flow Sample body** (Format 1):

• Sequence Number (uint32 BE).

• Source ID: top 8 bits **Source Class** (0 ifIndex, 1 smonVlanDataSource, 2 entPhysicalEntry) + low 24 bits **Source Index** (typically ifIndex of the sampler).

• **Sampling Rate** (uint32 BE; 1-in-N).

• Sample Pool (uint32 BE; total packets seen so far on this source).

• Drops (uint32 BE; cumulative buffer drops).

• Input Interface Index (uint32 BE).

• Output Interface Index (uint32 BE; high bits encode special meanings — Discarded, Multiple, Unknown — surfaced as a Note when set).

• Number of Flow Records (uint32 BE) + N Flow Records.

• **Flow Record types** (most common):

• **1 Raw Packet Header** — Header Protocol (uint32 BE; **6-entry name table**: 1 Ethernet / 11 802.11 / 12 IPv4 / 13 IPv6 / 21 PPP / 22 PPPoE) + Frame Length on wire (uint32 BE) + Stripped octets (uint32 BE; bytes trimmed from start, typically the L2 framing) + Original Sampled Header Length (uint32 BE) + Header Bytes (capped hex preview).

• **2 Ethernet Frame Data** — Length + 6-byte src MAC + 6-byte dst MAC + EtherType.

• **3 IPv4 Data** — Length + Protocol (IP proto number) + 4-byte src + 4-byte dst + uint32 src port + uint32 dst port + uint32 TCP flags + uint32 ToS.

• **4 IPv6 Data** — same shape but with 16-byte addresses and an IPv6 priority.

• **Counter Sample body** (Format 2):

• Sequence Number (uint32 BE).

• Source ID (same split as Flow Sample).

• Number of Counter Records (uint32 BE) + N records.

• **Counter Record type 1 (Generic Interface Counters)** — full 88-byte body: ifIndex / ifType / ifSpeed (uint64) / ifDirection / ifStatus / ifInOctets (uint64) / ifInUcastPkts / ifInMulticastPkts / ifInBroadcastPkts / ifInDiscards / ifInErrors / ifInUnknownProtos / ifOutOctets (uint64) / ifOutUcastPkts / ifOutMulticastPkts / ifOutBroadcastPkts / ifOutDiscards / ifOutErrors / ifPromiscuousMode.

What this package does NOT cover (deliberately out of scope)

• UDP framing — feed sFlow bytes after the UDP header strip. sFlow runs on UDP destination port 6343.

• sFlow v4 and earlier — the wire format changed significantly; v5 has been the standard since 2003.

• Per-Counter-Record dissection beyond Generic Interface Counters (Ethernet / Token Ring / 802.11 / VG / VLAN / Processor / Radio counters) — surfaced as raw hex; a future iteration could add them.

• Raw Packet Header inner dissection — the captured header bytes are surfaced as hex; the operator feeds them into the appropriate `*_decode` Spec (e.g. `ip_packet_decode`) based on the Header Protocol.

• sFlow agent state-machine reasoning (sampling-rate drift, polling-interval skew) — higher-level analysis.