Forum Discussion

3 Replies

Sort By
  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Jun 10, 2013
    sflow was introduced in 11.2: http://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote-ltm-11-2-0.html

     

     

    netflow would have to be written in iRules and sent via sideband connections, likely.
  • dihris_116090's avatar
    dihris_116090
    Icon for Nimbostratus rankNimbostratus
    Jun 11, 2013
    Hello Jason,

     

     

    Thank you for your answer.

     

    I'm aware that sflow was introduces in 11.2 though the support is limited only to counter sampling on only VLANs and interfaces. This limitation does not give me what I'm looking for like "Top Talkers", "Top Conversations", etc. On top of that the sflow format from F5 devices is not understandable for Monitoring systems like PRTG or Solarwinds.

     

    Do you know sFlow receiver that supports the F5 devices sflow format?

     

    Is there any documentation about netflow in iRules? I would really like to setup netflow through iRules for F5 devices

     

     

    Thanks,

     

    Dinko
    • Richard_Shuford's avatar
      Richard_Shuford
      Ret. Employee
      May 11, 2016
      Although the names of the protocols are similar, NetFlow and sFlow are really different technologies. sFlow was designed to minimize the processing burden on networking equipment, so the normal sFlow implementation (such as the one in Big-IP) does not keep track of individual connections; its job is to send packet samples and summary data to an external management receiver. The burden of analyzing the the sampled packets and deciding if a given set of packets constitutes a "flow" is the job of the sFlow receiver. I suspect that SolarWinds has some products that accept sFlow data, but you should also see if Inmon offers something useful. As to the specific need for "connections" data, did you see this other thread in DevCentral? https://devcentral.f5.com/codeshare/connection-list-via-icontrolrest-api