The Design And Implementation Of Network Monitoring System Based On Sflow

In recent years, the size and traffics of network have been Increased rapidly, with the popularization of Peer-to-Peer download, Internet voice communications, video conferencing and other multimedia services. This provides great opportunities for network providers to improve and expand network services, and meantime brings rigorous challenges for rational planning of network structure, stable and safe operation of network. Without supervision, let the network size and traffic expand, will not only waste the network resources, more importantly, the quality and safety of network communications can not be guaranteed. Network traffic monitoring, which is a real-time traffic statistics of network, provides a new way for network providers to discover abnormal traffics and optimize network structure.sFlow is a network traffic monitoring system based on data packet sampling. Compared to the traditional monitoring technologies, such as port mirroring, simple network management and NetFlow, sFlow can achieve a real-time and continuous monitoring towards the whole network at lower cost. sFlow network traffic monitoring system is composed of sFlow agent and sFlow collector.sFlow agent, which is embedded in the network core equipment, is responsible for data collection. sFlow grabs the traffic information in real time, and packags them into sFlow packets, then sends the packets to the collector for analyzing. sFlow can be divided into user-mode and kernel-mode. User thread is responsible for handling the HA, VPN-events, interface-events, data preservation and recovery, configuration and so on. Kernel thread is used to implement packet sampling, data packaging and sending.This paper briefly introduces the current commonly used network traffic monitoring technologies, and analyses their shortcomings, on which basis we focus on the working principles and technology advantages of sFlow. Then goes deeper into the principles, functions, design and implementation of H3C’s network equipments, especially parts of the implementation of the automatically IP address finding, flow sampling and counter sampling of sFlow agent, and demonstrates the main functions of sFlow.