Traffic monitoring on HP Aruba switches with sFlow and PRTG

Published by Jasmin Kahriman
Last updated on January 23, 2024 • 13 minute read

There are two ways of monitoring your network traffic. SNMP Traffic sensor will show you incoming, outgoing, and total amount of traffic, but if you want to identify the major sources of traffic and eliminate bottlenecks, you should be using our flow sensors. And this blog post will focus on one of those sensors: sFlow and monitoring traffic on HP Aruba switches. I will show you how to configure sFlow via CLI and add a native sFlow sensor.

traffic monitoring on hp aruba switches with sflow and prtg

sFlow (short for "sampled flow") is a sampling technology for network monitoring invented by InMon and HP. InMon later open-sourced sFlow to ensure it could be used across networks based on multiple vendors' switches such as Huawei, MikroTik, Arista, Allied Telesis, and many others.

The sFlow sensor receives traffic data from an sFlow v5-compatible device and shows the traffic by type. Because PRTG fully supports sFlow Version 5 (the most common version), switches and routers supplying data via sFlow can be monitored with a great deal of ease. PRTG offers several possibilities for individually processing the bandwidth consumption data it gathers, as well as for the data's subsequent presentation. sFlow technology puts little strain on the CPU load and data line, and allows for the collection of detailed data. As part of monitoring, you can read or export graphs that show bandwidth metrics (live data, 2 days, 30 days, 365 days).

Aruba_Graph Network graph available within sFlow sensor

So, let’s start with some hands-on.

Part I: Enable sFlow on HPE Aruba switch

You must first enable sFlow v5 export on the HP Aruba switch for this sensor to work. The switch must send the flow data stream to the IP address of the probe system that has this sensor (either a local probe or a remote probe). Please note that the configuration of your HP switch might differ depending on the switch model you have, so please check the official HP documentation.

Open PuTTY, add your HPE Aruba switch IP/port, choose SSH and click Open to connect to switch. You need to include credentials to access your switch.

Aruba_Putty Connect to your switch using SSH

Type the following sFlow commands to enable and configure sFlow instances via the CLI. You need first to enter configuration mode, and then enable and configure sFlow.

#config
#sFlow 1 destination <PRTG Probe IP> <port number>
#sFlow 1 polling 1-28 20
#sFlow 1 sampling all 1-28 100
#write memory

Here is an output of my configuration.

Configure sFlow on HP Aruba switch via the CLI

Part II: Add sFlow sensor

PRTG has two sensors, sFlow sensor and sFlow (Custom) sensor. The only difference is that with the sFlow (Custom) sensor, you can define your own channel definitions to divide traffic into different channels.

Once you add a sensor, you will need to define the sensor name and enter the UDP port number on which PRTG should listen for sFlow packets. There is also the option „Sender IP Address“ which allows you to receive flow data from a specific device. If there are more active NICs on your PRTG probe device, you will need to select the one on which PRTG listens to sFlow packets under „Receive sFlow Packets on IP Address“. „Stream Data Handling“ is only for troubleshooting purposes and it should be disabled.

sFlow specific settings

Select the categories into which PRTG sorts the traffic. If you select No, the traffic of this group counts towards the default channel 'Other'. If you select Yes, each category is visible as one channel. If you select Detail, each Content is visible as one channel.

sFlow channel configuration

You can also use filters to be more specific about IPs or ports you want to monitor. For example, if you would like to monitor flow data for a specific IP address then you need to add a filter SourceIP [192.168.88.55]. Or if you want to monitor FTP communication, then you will need to add filter Port[21] in Include Filter.

Include or exclude a filtering

You are done. Now wait a few minutes until PRTG gathers flow data from your switch.

The sFlow sensor includes three default toplists and allows you to create the custom one (e.g. VPN bandwidth). Three default toplists are Top Talkers, Top Connection, and Top Protocols. Top Talkers shows bandwidth usage by source and destination IP address, Top Connection shows bandwidth usage by source and destination, IP, port, used protocols and consumed bandwidth, and Top Protocols shows bandwidth usage by protocol.

Top lists

PRTG looks at all network packets and collects the bandwidth information for all IPs, ports, and protocols. This creates a huge amount of data for analysis. To reduce the amount of data that is actually stored, PRTG only stores the top 100 entries of each Toplist in the database at the end of a specified Toplist period by default. If you open one of the available toplists, you can enlarge the diagram or print it as a PDF by clicking on Print This Toplist.

Top Connections

Part III: Data visualization

PRTG lets you configure your dashboard so you can keep a constant eye on your data consumption! With the PRTG Map Designer feature, you can create custom web pages as maps, or dashboards, that represent your network. You can add the primary toplist of a sensor by navigating to Graphs > Primary toplist of a sensor.

Map object: Primary toplist of a sensor

For sake of sharing, I do recommend monitoring all other relevant metrics for your HP Aruba switches such as Ping time, Uptime, CPU Load, Free RAM, Health Status, and others.

Monitoring HP Aruba switch with different sensors