sFlow Latency Exports Would be Nice

Is there an sFlow solution that supports some sort of Latency export? Many products such as Cisco routers, SonicWALLs and the nBox are exporting latency information about flows in IPFIX or NetFlow.  Citrix NetFlow (or IPFIX) could be next to join the bandwagon. Where is sFlow’s latency solution?

Understanding latency requires the stateful watch of all packets in a flow. It is my understanding that sFlow samples packets without regard for flows. I wonder if sFlow can be retrofitted somehow to support more technologies (e.g. jitter, packet loss, latency, etc.) like NetFlow and IPFIX.

I learned recently that Arista Networks supports sFlow and also exports non-sFlow information that provides insight into possible issues that could lead to latency.  Below we see the “amount of packet buffer utilized per port” in CSV format:

Arista7124SX(config-if-Et6)#show queue-monitor length csv

Report generated at 2011-03-15 12:34:01
2011-03-15 12:34:01.05722,Et6,3188
2011-03-15 12:34:01.05789,Et6,3187
2011-03-15 12:34:01.05859,Et6,3188
2011-03-15 12:34:01.05930,Et6,3188
2011-03-15 12:34:01.06003,Et6,3187
2011-03-15 12:34:01.06072,Et6,3187
2011-03-15 12:34:01.06141,Et6,3187
2011-03-15 12:34:01.06212,Et6,3187
2011-03-15 12:34:01.06282,Et6,3187
2011-03-15 12:34:01.06355,Et6,3188

The format is Date, Time(Hr,Min,Sec.Fraction), Interface, Queue-Length

The Arista switch can be configured to trigger a message every time a specified watermark is hit (with a granularity of around 4microseconds). Once the watermark is reached, the repeat events are dampened to once per 700microseconds.   What you see above in the sample output is a port which has a watermark of 3187 and it is being continually congested.

In practice, you might choose to set the watermarks of uplink interfaces to a low number so that you see a constant trigger (around every 700us) which in turn provides a read out of the actual queue-depth at that time. The relevance of what other ports are doing and how many buffers are in use will vary by chip architecture (i.e. shared buffers or per port buffers).

If companies like Arista Networks that support sFlow, NetFlow or IPFIX could export their buffers, we could then trend the packet buffer consumption over time.  One of Aritsta’s target markets is financial institutions where traffic needs to reach the destination in the shortest possible amount of time. Network Administrators at banks and trading companies would probably like to have web access to these types of trends.

Oct 2013 Update: We have since built a Arista log to IPFIX gateway.  Contact our sales team if you are interested.

In the mean time, perhaps someone from sFlow can submit a comment to this blog?  We will continue to support sFlow, IPFIX, NetFlow, NetStream, jFlow, AppFlow and other flow technologies.