When a router samples a packet, it creates a tiny record (usually 64–128 bytes of the packet header—source IP, destination IP, port, protocol). It wraps this in an sFlow datagram (UDP) and fires it out to a collector.
The analyzer (e.g., ntopng, pmacct, InMon Traffic Sentinel, ELK with sFlow plugin) runs a high-performance UDP receiver. It tags each sample with arrival time and validates the datagram.
InMon made sFlow an open standard (RFC 3176, later 7452), free for any vendor to implement. Unlike Cisco's proprietary NetFlow (which required complex stateful tracking on the router), sFlow was and ran entirely in hardware on the ASIC. This was much cheaper and safer for routers. Chapter 2: The Problem the Analyzer Solves sFlow solved export , but not analysis . sflow analyzer
What does that mean for my network right now?
The analyzer took the impossible problem—watching billions of packets per second—and reduced it to a manageable stream of samples, then turned those samples into answers. It is the ultimate example of "a little data, well analyzed, is better than all the data, unanalyzed." When a router samples a packet, it creates
This is written as a technical narrative. Prologue: The Blindness Problem In the late 1990s and early 2000s, enterprise networks were growing exponentially. Network engineers faced a critical paradox: traffic was increasing, but visibility was decreasing.
What the industry needed was —a way to look at a statistically significant fraction of traffic and infer the whole picture. Chapter 1: The Birth of sFlow (2001) In 2001, InMon Corporation (founded by Peter Phaal, who had previously worked on packet sampling at Sprint) published a revolutionary idea: sFlow (Sampled Flow). It tags each sample with arrival time and
It looks like: [eth1][sampled][TCP][10.0.0.1:54322 -> 8.8.8.8:443][1/1000]