Overview
sFlow (sampled Flow) is a multi-vendor alternative to NetFlow. Unlike NetFlow, which tracks every flow, sFlow uses statistical sampling to capture a portion of the traffic, which reduces the processing load on the network device.
Key Characteristics
- Sampling: Captures 1 out of every N packets (e.g., 1 out of 1000).
- Layer 2-7 Visibility: Can provide information about Ethernet headers, IP headers, and even application data.
- Real-time: Samples are sent immediately to a collector, providing a near real-time view of network traffic.
Use Case
Monitoring traffic in very high-speed data center networks where tracking every flow would be too resource-intensive.