The sFlow Dropped Packet Notification Structures extension was published in October 2020. Extending sFlow to provide visibility into dropped packets offers significant benefits for network troubleshooting, providing real-time network wide visibility into the specific packets that were dropped as well the reason the packet was dropped. This visibility instantly reveals the root cause of drops and the impacted connections. Packet discard records complement sFlow's existing counter polling and packet sampling mechanisms and share a common data model so that all three sources of data can be correlated, for example, packet sampling reveals the top consumers of bandwidth on a link, helping to get to the root cause of congestion related packet drops reported for the link.
Today the following network operating systems include support for the drop notification extension in their sFlow agent implementations:
- Arista Dropped packet notifications with Arista Networks
- Cisco Dropped packet notifications with Cisco 8000 Series Routers
- Linux Linux as a network operating systemUsing sFlow to monitor dropped packets
- NVIDIA NVIDIA Cumulus Linux 5.11 for AI / ML
- VyOS VyOS 1.4 LTS released
Two additional sFlow dropped packet notification implementations are in the pipeline and should be available later this year:
- SONiC The Switch Abstraction Interface (SAI) 1.14.0 release in 2024 added support for TAM Mirror-on-Drop to Local host via Generic Netlink, laying the foundation needed to add sFlow dropped packet notification support to the open source SONiC network operating system. The Dropped Packet Notification (MOD) support pull request is currently being reviewed and the feature should be available in SONiC by the end of 2025.
- VPP The sflow: egress-sampling and drop-monitoring patch currently being reviewed adds dropped packet notification support to the Vector Packet Processing (VPP) sFlow implementation. If the patch passes review it should be available by the end of 2025.
If your network vendor is on the list, follow the instructions in the linked articles to try out drop monitoring, if not, ask about your vendor's plans to implement the sFlow drop notification extension.
