The analyzer (e.g., ntopng, pmacct, InMon Traffic Sentinel, ELK with sFlow plugin) runs a high-performance UDP receiver. It tags each sample with arrival time and validates the datagram.
When a router samples a packet, it creates a tiny record (usually 64–128 bytes of the packet header—source IP, destination IP, port, protocol). It wraps this in an sFlow datagram (UDP) and fires it out to a collector. sflow analyzer
In a cloud-native environment, sFlow agents run on virtual switches (Open vSwitch). The analyzer cross-references sFlow samples with orchestrator APIs. It can show: "Pod frontend-7d8f9 is talking to database postgres-0 using 200 Mbps of TLS traffic—this is anomalous." The analyzer (e
A modern analyzer (e.g., FastNetMon, Akvorado) uses sFlow to watch for SYN floods. When a DDoS starts, the analyzer detects the anomaly in <1 second, extracts the victim IP from the sFlow samples, and automatically injects a BGP FlowSpec rule to block the attack at the router—all without human intervention. It wraps this in an sFlow datagram (UDP)
This is written as a technical narrative. Prologue: The Blindness Problem In the late 1990s and early 2000s, enterprise networks were growing exponentially. Network engineers faced a critical paradox: traffic was increasing, but visibility was decreasing.
The analyzer sees: "1 packet for 192.168.1.100 -> 203.0.113.50, sample rate 1/1000". It immediately multiplies: This represents 1,000 real packets . It then multiplies by average packet size (from the header, say 500 bytes) to get 500,000 bytes (4 Mbits) of traffic contributed by that flow.
It looks like: [eth1][sampled][TCP][10.0.0.1:54322 -> 8.8.8.8:443][1/1000]