Wednesday, November 11, 2015

sFlow Test

sFlow Test has been released on GitHub, The suite of checks is intended to validate the implementation of sFlow on a data center switch. In particular, the tests are designed to verify that the sFlow agent implementation provides measurements under load with the accuracy needed to drive SDN control applications, including:
Many of the tests can be run while the switches are in production and are a useful way of verifying that a switch is configured and operating correctly.

The stress tests can be scaled to run without specialized equipment. For example, the recommended sampling rate for 10G links in production is 1-in-10,000. Driving a switch with 48x10G ports to 30% of total capacity would require a load generator capable of generating 288Gbit/s. However, dropping the sampling rate to 1-in-100 and generating a load of 2.88Gbit/s is an equivalent test of the sFlow agent's performance and can be achieved by two moderately powerful servers with 10G network adapters.

For example, using the test setup above, run an iperf server on Server2:
iperf -su
Then run the following sequence of tests on Server1:

ping -f -c 100000 $TGT
sleep 40
curl http://$RT:8008/app/sflow-test/scripts/test.js/load/json?bps=100000000
iperf -c $TGT -t 40 -u -b 100M
curl http://$RT:8008/app/sflow-test/scripts/test.js/load/json?bps=0
sleep 40
curl http://$RT:8008/app/sflow-test/scripts/test.js/load/json?bps=200000000
iperf -c $TGT -t 40 -u -b 200M
curl http://$RT:8008/app/sflow-test/scripts/test.js/load/json?bps=0
sleep 40
curl http://$RT:8008/app/sflow-test/scripts/test.js/load/json?bps=300000000
iperf -c $TGT -t 40 -u -b 300M
curl http://$RT:8008/app/sflow-test/scripts/test.js/load/json?bps=0
The results of the test are shown in the screen capture at the top of this article. The test pattern is based on the article Large flow detection and the sequence of steps in Load (show in gold) are accurately tracked by the Flows metric (shown in red). The Counters metric (shown in blue) doesn't accurately track the shape of the load and is delayed, but the peaks are consistent with Load and Flows values.

The table below the two strip charts shows that all the tests have passed:

  • test duration The test must run for at least 5 minutes (300 seconds)
  • check sequence numbers Checks that sequence numbers for datagrams and measurements are correctly reported and that measurements are delivered in order
  • check data sources Checks that sampling rates and polling intervals are correctly configured and that data is being received
  • sampled packet size Checks to make sure that sampled packet sizes are correctly reported
  • random number generator Tests the hardware random number generator used for packet sampling
  • compare byte flows and counters Checks that Bits per Second values (shown in the upper strip chart) are consistently reported by interface counters and by packet sampling
  • compare packet flows and counters Checks that Packets per Second values (shown in the lower strip chart) are consistently reported by interface counters and by packet sampling.
  • check ingress port information Verifies that ingress port information is included with packet samples

The project provide an opportunity for users and developers to collaborate on creating a set of tests that capture operational requirements and that can be used in product selection and development. An effective test application will help increase the quality of sFlow implementations and ensure that they address the need for measurement in SDN control applications.


  1. hi Peter,
    I need to get the ipsrc, ipdest, tcp src port, tcp dest port , timestamp of the sampling packet. Can you tell me how can I get those information? Thank you very much!

    1. You can see which packet fields are visible in your traffic by querying /flowkeys/json using the REST API, or flowKeys() using the JavaScript API. The full list of possible keys is on

      The specific flow definition you are looking for is, keys:'ipsource,ipdestination,tcpsourceport,tcpdestinationport'

      sFlow-RT won't give you the timestamps of individual packet samples, but you can configure the log:true option when you define the flow and can the access the start and end timestamps in the logged flow records, see RESTflow

    2. hi,I also want to get the ipsrc, ipdest, src port, dest port,pps,bps, can you tell me what do you do ?

    3. The easiest way to get this information would be to install the flow-trend application.

      Writing Applications describes the APIs for defining and querying flows.


  2. The flow and count field is refers to the flow sampling and count sampling of sflow? And the load field on my chart always is 0?

    1. Yes, the Counters metric is derived from counters records and the Flows metric is determined from packet samples.

      The load is set by a REST call in the traffic generation script to indicate the generated load, e.g.
      curl http://$RT:8008/app/sflow-test/scripts/test.js/load/json?bps=200000000