Docs
test1test2
6.5
6.5
  • ElastiFlow Documentation
  • Unified Flow Collector
    • General Configuration
    • Changelog
    • Maxmind GeoIP2 and GeoLite2
    • RiskIQ PassiveTotal
    • Network Interfaces
    • User-Defined Metadata
    • Docker
    • Linux
    • Unified Flow Collector Introduction
    • System Requirements
    • Supported IEs
    • AWS VPC Flow Log IEs
    • IPFIX IEs
    • Netflow IEs
    • sFlow IEs
  • Unified SNMP Collector
    • Device Groups
    • Changelog
    • Devices
    • Downloading Definitions
    • Enumerations
    • Objects
    • Object Groups
    • User-Defined Metadata
    • Docker
    • Network Interfaces
    • United SNMP Collector Introduction
    • Linux
    • Scheduling Rediscovery
  • Monitoring ElastiFlow
    • Liveness & Readiness
    • Metrics
    • Prometheus & Grafana
  • Configuration Reference
    • YAML Configuration Files
    • Configuration Reference Overview
    • Common
      • API
      • Licensing
      • Overview
      • Logging
      • HTTP output
      • Elasticsearch output
      • Kafka output
      • Monitor output
      • OpenSearch output
      • Splunk output
      • stdout output
      • Processor
    • Unified Flow Collector
      • Overview
      • Community/Conversation IDs
      • EF_PROCESSOR_ENRICH_TOTALS_IF_NO_DELTAS
      • Overview
      • RiskIQ PassiveTotal
      • Maxmind
      • User-Defined Metadata
      • Overview
      • Overview
      • User-Defined Metadata
      • Overview
      • Benchmark Input
      • Netflow/IPFIX/sFlow (UDP)
      • Licensing
      • Decoder/Processor
      • Sample Rate
      • Configuration Changes
    • Unified SNMP Collector
      • User-Defined Metadata
      • Overview
      • Licensing
      • SNMP Poller
      • EF_PROCESSOR_SNMP_ENUM_DEFINITIONS_DIRECTORY_PATH
  • API Reference
    • API Reference Overview
    • SNMP Operations
  • Data Platforms
    • Elastic
      • Basic Cluster
      • Advanced Cluster
      • Single Server
      • Multi-Tier Cluster
      • Single "Lab" Server
      • Elasticsearch
      • ElastiFlow vs. Filebeat and Logstash
      • RHEL/CentOS
      • Ubuntu/Debian
      • Kibana
      • ML
        • Network Security
        • Machine Learning
        • Availability
          • Network Availability
          • DHCP
          • LDAP
          • DNS
          • NTP
          • RADIUS
          • TCP Sessions
        • Network Security Activity
          • Rare Autonomous System
          • Network Activity
          • Rare Conversation
          • Rare Geolocation
        • Network Security Brute Force
          • Brute Force CLI Access
          • Brute Force Remote Desktop Access
          • Brute Force Attacks
        • Network Security DDoS
          • Denial-of-Service
          • ICMP Flood Attack
          • SYN Flood Attack
          • TCP DDoS Attack
          • UDP Amplification Attack
        • Network Security Recon
          • ICMP Scan
          • Reconnaissance
          • Port Scan
        • Performance
          • Unusual ASN Traffic Volume
          • Unusual Network Interface Traffic Volume
          • Network Performance
    • Opensearch
      • Dashboards
      • Auth Sig V4
    • Splunk
      • Default Search Macro
      • Configuring Data Input & Index
      • Splunk App Installation
    • Output Configuration
  • Additional Guides
    • Catalyst (sFlow)
    • FortiGate
    • hsflowd
    • Configuring Flow Sampling on Juniper Routers
    • Junos OS (sFlow)
    • MikroTik RouterOS
    • OpenWRT (softflowd)
    • Ubiquiti EdgeRouter
    • SonicWall
    • Junos OS
    • Extending SNMP Device Support
    • Flow Device Support Overview
    • SNMP Device Support Overview
    • Generating A Support Bundle
  • FAQ
    • Flows stopped showing up in Kibana (Disk(s) Full)
    • Common reasons why you have discrepancies between ElastiFlow data & reality
    • What Are Snapshots?
    • Importing the wrong dashboards (No data)
  • Knowledge Base
    • Config
      • Elasticsearch Authentication Failure
      • CA Certificate Path Incorrect
      • license/error Invalid Segments
    • Flow
      • Bidirectional Flow Support
      • Configure the UDP Input
      • Flow Records Not Received
      • Netflow v9/IPFIX Template Not Receieved
      • Unsupported sFlow Structures
    • General
      • License Has Expired
      • License Agreement Not Accepted
    • Install
      • .deb Upgrade Fails File Overwrite
    • Operation
      • Flow Collector Queues 90% Full
      • Dashboard Updates
      • Change elastiflow-* Index Name?
  • Elastic Stack Deployment
  • Download Links
Powered by GitBook
On this page
  • Access the switch CLI
  • Enter global configuration mode
  • Configure sFlow settings
  • Configure sFlow agent IP address
  • Enable sFlow on interfaces
  • Save the configuration
  • Verify the configuration
  1. Additional Guides

Catalyst (sFlow)

Here's a general guideline to configure sFlow on a supported Cisco Catalyst switch, such as the Catalyst 2960L and Catalyst 1000:

Access the switch CLI

Connect to your Cisco Catalyst switch via SSH or a console cable. If connecting via SSH, use a tool like PuTTY or the built-in SSH client in your terminal, and enter the switch's IP address, username, and password to log in.

Enter global configuration mode

Once logged in, enter global configuration mode by typing the following command:

configure terminal

Configure sFlow settings

To configure sFlow settings, including the IP address and port of the remote flow collector, use the following commands:

sflow collector id ID ip x.x.x.x udp-port yyyy datagram-size zzzz

Replace ID with the ID of this collector definition, x.x.x.x with the IP address of your sFlow collector, yyyy with the desired port number for the sFlow collector (e.g., 6343), and zzzz with the maximum size, in bytes, of the UDP datagram containing sFlow records that is allowed to be sent (e.g., 1280 for 1280 bytes).

Configure sFlow agent IP address

To set the sFlow agent IP address, use the following command:

sflow agent ip x.x.x.x

Replace x.x.x.x with the IP address to be used as the sFlow agent IP address.

Enable sFlow on interfaces

To enable sFlow on the desired interfaces, use the following commands:

interface INTERFACE_NAME
sflow flow-sampling DIRECTION id ID rate yyyy hdr-size zzzz
exit

Replace INTERFACE_NAME with the name of the interface for which you want to enable sFlow (e.g., GigabitEthernet1/0/1). Replace DIRECTION with the direction of traffic, input or output, that is to be sampled, ID with the ID of the collector definition to which the sFlow records are to be sent, yyyy with the sampling rate (e.g., 1024 for 1 in 1024 packets), and zzzz with the number of bytes to included from the sampled IP packet.

This step should be repeated for all interfaces for which sFlow sampling is desired.

Save the configuration

To save your configuration changes, exit global configuration mode and use the following command:

copy running-config startup-config

Verify the configuration

To verify that sFlow is configured correctly, use the following command:

show sflow

This command should display the sFlow settings you just configured. For example:

Agent:
------
IP : 192.0.2.11

Collector:
----------
Max number of collectors : 2

 Id |           Collector IP        | Port | Max Datagram size
--------------------------------------------------------------
 1  | 192.168.100.10                  | 6343 | 1280

Please note that these instructions may not apply to all Cisco Catalyst switches, as sFlow support varies between models. Ensure that your specific switch model supports sFlow before attempting to configure it.

PreviousAdditional GuidesNextFortiGate