Traffic monitoring on HP Aruba switches with sFlow and PRTG
Originally published on July 22, 2021 by Jasmin Kahriman
Last updated on July 22, 2021 • 13 minute read
There are two ways of monitoring your network traffic. SNMP Traffic sensor will show you incoming, outgoing, and total amount of traffic, but if you want to identify the major sources of traffic and eliminate bottlenecks, you should be using our xFlow sensors. And this blog post will focus on one of those sensors: sFlow and monitoring traffic on HP Aruba switches. I will show you how to configure sFlow via CLI and add a native sFlow sensor.
sFlow (short for "sampled flow") is a sampling technology for network monitoring invented by InMon and HP. InMon later open-sourced sFlow to ensure it could be used across networks based on multiple vendors' switches such as Huawei, MikroTik, Arista, Allied Telesis, and many others.
The sFlow sensor receives traffic data from an sFlow v5-compatible device and shows the traffic by type. Because PRTG fully supports sFlow Version 5 (the most common version), switches and routers supplying data via sFlow can be monitored with a great deal of ease. PRTG offers several possibilities for individually processing the bandwidth consumption data it gathers, as well as for the data's subsequent presentation. sFlow technology puts little strain on the CPU load and data line, and allows for the collection of detailed data. As part of monitoring, you can read or export graphs that show bandwidth metrics (live data, 2 days, 30 days, 365 days).
Network graph available within sFlow sensor
So, let’s start with some hands-on.
Part I: Enable sFlow on HPE Aruba switch
You must first enable sFlow v5 export on the HP Aruba switch for this sensor to work. The switch must send the flow data stream to the IP address of the probe system that has this sensor (either a local probe or a remote probe). Please note that the configuration of your HP switch might differ depending on the switch model you have, so please check the official HP documentation.
Open PuTTY, add your HPE Aruba switch IP/port, choose SSH and click Open to connect to switch. You need to include credentials to access your switch.
Connect to your switch using SSH
Type the following sFlow commands to enable and configure sFlow instances via the CLI. You need first to enter configuration mode, and then enable and configure sFlow.
#sFlow 1 destination <PRTG Probe IP> <port number>
#sFlow 1 polling 1-28 20
#sFlow 1 sampling all 1-28 100
Here is an output of my configuration.
Part II: Add sFlow sensor
PRTG has two sensors, sFlow sensor and sFlow (Custom) sensor. The only difference is that with the sFlow (Custom) sensor, you can define your own channel definitions to divide traffic into different channels.
Once you add a sensor, you will need to define the sensor name and enter the UDP port number on which PRTG should listen for sFlow packets. There is also the option „Sender IP Address“ which allows you to receive flow data from a specific device. If there are more active NICs on your PRTG probe device, you will need to select the one on which PRTG listens to sFlow packets under „Receive sFlow Packets on IP Address“. „Stream Data Handling“ is only for troubleshooting purposes and it should be disabled.
Select the categories into which PRTG sorts the traffic. If you select No, the traffic of this group counts towards the default channel 'Other'. If you select Yes, each category is visible as one channel. If you select Detail, each Content is visible as one channel.
You can also use filters to be more specific about IPs or ports you want to monitor. For example, if you would like to monitor flow data for a specific IP address then you need to add a filter SourceIP [192.168.88.55]. Or if you want to monitor FTP communication, then you will need to add filter Port in Include Filter.
You are done. Now wait a few minutes until PRTG gathers flow data from your switch.
The sFlow sensor includes three default toplists and allows you to create the custom one (e.g. VPN bandwidth). Three default toplists are Top Talkers, Top Connection, and Top Protocols. Top Talkers shows bandwidth usage by source and destination IP address, Top Connection shows bandwidth usage by source and destination, IP, port, used protocols and consumed bandwidth, and Top Protocols shows bandwidth usage by protocol.
PRTG looks at all network packets and collects the bandwidth information for all IPs, ports, and protocols. This creates a huge amount of data for analysis. To reduce the amount of data that is actually stored, PRTG only stores the top 100 entries of each Toplist in the database at the end of a specified Toplist period by default. If you open one of the available toplists, you can enlarge the diagram or print it as a PDF by clicking on Print This Toplist.
Part III: Data visualization
PRTG lets you configure your dashboard so you can keep a constant eye on your data consumption! With the PRTG Map Designer feature, you can create custom web pages as maps, or dashboards, that represent your network. You can add the primary toplist of a sensor by navigating to Graphs > Primary toplist of a sensor.
For sake of sharing, I do recommend monitoring all other relevant metrics for your HP Aruba switches such as Ping time, Uptime, CPU Load, Free RAM, Health Status, and others.
Are you running HP or any other sFlow capable device in your network? If so, I am curious to learn how you monitor them.