I tēnei wā o ngā whatunga tere-nui me ngā hanganga kapua-taketake, kua noho te aroturukitanga o ngā waka whatunga wā-tūturu, whai hua hei poutokomanawa mō ngā mahi hangarau mōhiohio pono. I te mea ka whānui haere ngā whatunga ki te tautoko i ngā hononga 10 Gbps+, ngā tono ipu, me ngā hoahoa tohatoha, kāore e taea te whakamahi i ngā tikanga aroturuki waka tuku iho—pērā i te hopu pākete katoa—nā te nui o te utu rauemi. Koinei te wāhi e whai wāhi mai ai a sFlow (sampled Flow): he kawa whakawhitiwhiti whatunga māmā, paerewa kua hangaia hei whakarato tirohanga whānui ki ngā waka whatunga me te kore e whakararu i ngā taputapu whatunga. I roto i tēnei tuhinga, ka whakautua e mātou ngā pātai tino nui mō sFlow, mai i tōna whakamāramatanga taketake ki tōna mahi whaihua i roto i ngā Network Packet Brokers (NPB).
1. He aha te sFlow?
He kawa aroturuki waka whatunga tuwhera, paerewa-umanga a sFlow i whakawhanakehia e Inmon Corporation, i tautuhia i roto i te RFC 3176. He rerekē ki te mea e kīia ana e tōna ingoa, kāore he arorau "aroturuki rere" ā-roto o sFlow—he hangarau telemetry e ahu mai ana i te tauira e kohikohi ana, e kaweake ana hoki i ngā tatauranga waka whatunga ki tētahi kaikohi pokapū hei tātari. Kāore i rite ki ngā kawa āhuahanga pērā i a NetFlow, kāore a sFlow e penapena i ngā rekoata rere ki ngā taputapu whatunga; engari, ka hopukina e ia ngā tauira iti, e whakaatu ana i ngā tatau waka me ngā taputapu, kātahi ka tukuna wawetia ēnei raraunga ki tētahi kaikohi hei tukatuka.
I tōna pūtake, kua hangaia a sFlow mō te tauine me te iti o te whakamahinga rauemi. Kua whakauruhia ki roto i ngā taputapu whatunga (ngā pana, ngā pouara, ngā pareārai ahi) hei Ākena sFlow, e āhei ai te aroturuki wā-tūturu i ngā hononga tere-nui (tae atu ki te 10 Gbps me tua atu) me te kore e whakaiti i te mahi a te taputapu, te putanga whatunga rānei. Mā tōna paerewa ka whakarite kia hototahi puta noa i ngā kaihoko, ka waiho hei whiringa whānui mō ngā taiao whatunga kanorau.
2. He pēhea te mahi a sFlow?
E whakahaerehia ana a sFlow i runga i tētahi hoahoa māmā, e rua ngā wāhanga: sFlow Agent (kua whakauruhia ki roto i ngā taputapu whatunga) me sFlow Collector (he tūmau pokapū mō te kohikohi me te tātari raraunga). E aro ana te tukanga mahi ki ngā tikanga tauira matua e rua—te tauira mōkihi me te tauira taupatupatu—me te kaweake raraunga, e ai ki ngā taipitopito i raro nei:
2.1 Ngā Wāhanga Matua
- sFlow Agent: He kōwae pūmanawa māmā kua hangaia ki roto i ngā taputapu whatunga (hei tauira, ngā pana Cisco, ngā pouara Huawei). Ko tāna mahi he kohikohi i ngā tauira hokohoko me ngā raraunga kaute, he whakakotahi i ēnei raraunga ki roto i ngā sFlow Datagrams, ā, he tuku atu ki te kaikohi mā te UDP (tauranga taunoa 6343).
- sFlow Collector: He pūnaha pokapū (tinana, mariko rānei) e whiwhi ana, e wetewete ana, e rongoa ana, e tātari ana hoki i ngā sFlow Datagrams. Kāore i rite ki ngā kaikohi NetFlow, me whakahaere e ngā kaikohi sFlow ngā pane mōkihi mata (te nuinga o te wā he 60–140 paita ia tauira) me te wetewete i aua pane hei tango i ngā māramatanga whai tikanga—mā tēnei ngāwari ka taea te tautoko i ngā mōkihi kore-paerewa pērā i te MPLS, VXLAN, me te GRE.
2.2 Ngā Tikanga Tauira Matua
E rua ngā tikanga tauira tautoko a sFlow hei whakataurite i te tirohanga me te whai huatanga o ngā rauemi:
1- Te Tauira Mōkihi: Ka tātai matapōkeretia e te Kaihoko ngā mōkihi e tomo mai ana/e puta atu ana i ngā atanga e aroturukitia ana. Hei tauira, ko te tere tauira o te 1:2048 te tikanga ka hopukina e te Kaihoko te 1 o ia 2048 mōkihi (te tere tauira taunoa mō te nuinga o ngā taputapu). Engari ko te hopu i ngā mōkihi katoa, ka kohia e ia ngā paita tuatahi o te pane mōkihi (te nuinga o te wā he 60–140 paita), kei roto ngā mōhiohio nui (IP pūtake/taunga, tauranga, kawa) me te whakaiti i te utu nui. Ka taea te whirihora i te tere tauira, ā, me whakarerekē i runga i te rahinga o te waka whatunga—ka whakapai ake ngā reiti teitei ake (he maha atu ngā tauira) i te tika engari ka whakanui ake i te whakamahinga rauemi, ko ngā reiti iti ake ka whakaiti i te utu nui engari ka ngaro pea ngā tauira waka onge.
2- Te Tauira Taurite: Haunga ngā tauira mōkihi, ka kohia e te Kaihoko ngā raraunga taurite mai i ngā atanga whatunga (hei tauira, ngā paita i tukuna/whiwhia, ngā hekenga mōkihi, ngā reiti hapa) i ngā wā kua whakaritea (taunoa: 10 hēkona). Ka whakaratohia e ēnei raraunga he horopaki mō te hauora o te taputapu me te hononga, me te tāpiri i ngā tauira mōkihi hei tuku i tētahi pikitia katoa o te mahi whatunga.
2.3 Te Kaweake me te Tātari Raraunga
Kia kohia, ka whakakōpikopikohia e te Kaihoko ngā tauira mōkihi, ka tatau i ngā raraunga ki roto i ngā sFlow Datagrams (ngā mōkihi UDP) ka tukuna atu ki te kaikohi. Ka tātarihia e te kaikohi ēnei raraungagrams, ka kohikohi i ngā raraunga, ka whakaputa i ngā whakaaturanga, ngā pūrongo, ngā matohi rānei. Hei tauira, ka taea e ia te tautuhi i ngā mea tino kōrero, te kite i ngā tauira waka rerekē (hei tauira, ngā whakaeke DDoS), te aroturuki rānei i te whakamahinga o te whānui o te roanga o te wā. Kei roto i ia raraungagram te tere tauira, e āhei ai te kaikohi ki te whakawhānui i ngā raraunga hei whakatau tata i te nui o te waka katoa (hei tauira, 1 tauira i roto i te 2048 e tohu ana i te ~2048x o te waka kua tirohia).
3. He aha te Uara Matua o sFlow?
Ko te uara o sFlow i ahu mai i tōna huinga ahurei o te tauine, te iti o te utu, me te paerewa—e aro ana ki ngā uauatanga matua o te aroturuki whatunga hou. Ko ōna uara matua ko:
3.1 Te Utu Rauemi Iti
He rerekē tēnei i te hopunga mōkihi katoa (e hiahiatia ana te penapena me te tukatuka i ia mōkihi) me ngā kawa āhua pēnei i a NetFlow (e pupuri ana i ngā ripanga rere i runga i ngā taputapu), ka whakamahia e sFlow te tauira, ā, ka karohia te rokiroki raraunga ā-rohe. Ka whakaitihia e tēnei te whakamahinga o te PTM, te mahara, me te whānui o te raraunga i runga i ngā taputapu whatunga, he mea tino pai mō ngā hononga tere-teitei me ngā taiao he iti ngā rauemi (hei tauira, ngā whatunga pakihi iti-ki-waenga). Kāore e hiahiatia he whakapai ake i ngā taputapu, i ngā mahara rānei mō te nuinga o ngā taputapu, ka whakaitihia ngā utu whakatinanatanga.
3.2 Te Whakapūmautanga Teitei
Kua hangaia a sFlow kia tauinehia ki ngā whatunga hou. Ka taea e te kaikohi kotahi te aroturuki i ngā tekau mano o ngā atanga puta noa i ngā rau o ngā taputapu, e tautoko ana i ngā hononga tae atu ki te 100 Gbps me tua atu. Mā tana tikanga tauira ka whakarite ahakoa te pikinga o te rahinga o ngā raraunga, ka noho tonu te whakamahinga rauemi a te Agent—he mea nui mō ngā pokapū raraunga me ngā whatunga taumata-kaikawe me ngā kawenga raraunga nui.
3.3 Te Tirohanga Whānui o te Whatunga
Mā te whakakotahi i te tauira mōkihi (mō ngā ihirangi waka) me te tauira taupatupatu (mō te hauora o te taputapu/hononga), ka whakaratohia e sFlow te tirohanga whānui ki te waka whatunga. Ka tautokohia te waka mai i te Papa 2 ki te Papa 7, ka taea ai te aroturuki i ngā tono (hei tauira, te tukutuku, P2P, DNS), ngā kawa (hei tauira, TCP, UDP, MPLS), me ngā whanonga a ngā kaiwhakamahi. Mā tēnei tirohanga ka āwhina i ngā tīma IT ki te kite i ngā aukati, ki te rapu raruraru, me te arotau i te mahi whatunga.
3.4 Te Whakapūmautanga o te Kaihoko-Kōtahi
Hei paerewa tuwhera (RFC 3176), e tautokona ana a sFlow e ngā kaihoko whatunga nui katoa (Cisco, Huawei, Juniper, Arista) ā, ka honoa ki ngā taputapu aroturuki rongonui (hei tauira, PRTG, SolarWinds, sFlow-RT). Mā tēnei ka whakakorea te raka o ngā kaihoko, ā, ka taea e ngā whakahaere te whakamahi i a sFlow puta noa i ngā taiao whatunga kanorau (hei tauira, ngā taputapu Cisco me Huawei whakauru).
4. Ngā horopaki tono noa o sFlow
Nā te maha o ngā whakamahinga o sFlow, he pai mō ngā momo taiao whatunga, mai i ngā pakihi iti ki ngā pokapū raraunga nui. Ko ngā āhuatanga tono tino noa ko:
4.1 Te Aroturukitanga Whatunga Pokapū Raraunga
Ka whakawhirinaki ngā pokapū raraunga ki ngā hononga tere-teitei (10 Gbps+) ā, ka tautoko i ngā mano tini o ngā mīhini mariko (VM) me ngā tono ipu. Ka whakaratohia e sFlow te tirohanga wā-tūturu ki te hokohoko whatunga rau-tuarā, ka āwhina i ngā tīma IT ki te kite i ngā "rerenga arewhana" (ngā rere nui, roa te ora e whakararuraru ana), te arotau i te tohatoha whānui, me te whakatau i ngā take whakawhitiwhiti kōrero i waenga i te VM/ipu. He maha ngā wā ka whakamahia me te SDN (Whatunga Tautuhi-Pūmanawa) hei whakahohe i te hangarau hokohoko hihiri.
4.2 Te Whakahaere Whatunga o te Papa Hinonga
Me whai aroturukitanga utu-whai hua, ka taea te whakawhanui i ngā puni hinonga hei aroturuki i te haere o ngā kaimahi, hei whakatinana i ngā kaupapa here whānui, me te kimi i ngā hapa (hei tauira, ngā taputapu kāore i whakamanahia, te tiritiri kōnae P2P). Nā te iti o te utu whakahaere a sFlow he mea tino pai mō ngā pana me ngā pouara o te puni, ka taea ai e ngā tīma IT te tautuhi i ngā poaka whānui, te arotau i te mahi tono (hei tauira, Microsoft 365, Zoom), me te whakarite i te hononga pono mō ngā kaiwhakamahi mutunga.
4.3 Ngā Mahi Whatunga Pae-Kawe
Ka whakamahia e ngā kaiwhakahaere waea te sFlow hei aroturuki i ngā whatunga tuara me te uru atu ki te whatunga, hei aroturuki i te nui o te waka, te whakaroa, me ngā reiti hapa puta noa i ngā mano tini o ngā atanga. Ka āwhina i ngā kaiwhakahaere ki te arotau i ngā hononga hoa, te kite wawe i ngā whakaeke DDoS, me te tuku pire ki ngā kiritaki i runga i te whakamahinga whānui (kaute whakamahinga).
4.4 Te Aroturukitanga Haumarutanga Whatunga
He taputapu whai hua a sFlow mō ngā tīma haumarutanga, nā te mea ka taea e ia te kite i ngā tauira waka rerekē e pā ana ki ngā whakaeke DDoS, ngā matawai tauranga, ngā pūmanawa kino rānei. Mā te tātari i ngā tauira mōkihi, ka taea e ngā kaikohi te tautuhi i ngā takirua IP pūtake/taunga rerekē, te whakamahinga kawa ohorere, te pikinga ohorere rānei o te waka—ka whakaoho i ngā whakatūpato mō ētahi atu rangahau. Nā tōna tautoko mō ngā pane mōkihi mata ka tino whai hua mō te kite i ngā waka whakaeke kore-paerewa (hei tauira, te waka DDoS kua whakamunatia).
4.5 Te Whakamahere Pūmanawa me te Tātari Auaha
Mā te kohikohi i ngā raraunga hokohoko o mua, ka taea e ngā tīma hangarau mōhiohio te tautuhi i ngā au (hei tauira, ngā pikinga o te whānui o te whatunga i ngā wā, te tipu haere o te whakamahinga o ngā taupānga) me te whakamahere i ngā whakapainga whatunga i runga i te matawhānui. Hei tauira, ki te whakaatu ngā raraunga sFlow ka piki ake te whakamahinga o te whānui o te whatunga mā te 20% ia tau, ka taea e ngā tīma te whakarite tahua mō ngā hononga tāpiri, ngā whakapainga taputapu rānei i mua i te puta o te raruraru.
5. Ngā Here o te sFlow
Ahakoa he taputapu aroturuki kaha a sFlow, he herenga ā-roto anō ōna me whai whakaaro ngā whakahaere ina whakatinanahia:
5.1 Te Tauhokohoko mō te Tika o te Tauira
Ko te herenga nui rawa atu o sFlow ko tōna whakawhirinaki ki te tauira. Tērā pea ka ngaro i ngā reiti tauira iti (hei tauira, 1:10000) ngā tauira waka onge engari he mea nui (hei tauira, ngā rerenga whakaeke poto), ko ngā reiti tauira teitei ka piki ake te utu rauemi. Hei tāpiri, ka puta mai he rerekētanga tatauranga i te tauira—tērā pea kāore e 100% te tika o ngā whakatau tata mō te rahinga waka katoa, ka raru pea tēnei mō ngā take whakamahinga e hiahia ana ki te tatau waka tika (hei tauira, te utu mō ngā ratonga tino nui).
5.2 Kāore he Horopaki Rere Katoa
He rerekē tēnei i a NetFlow (e hopu ana i ngā rekoata rere katoa, tae atu ki ngā wā tīmatanga/mutunga me ngā paita/mōkihi katoa mō ia rere), ka hopu noa a sFlow i ngā tauira mōkihi takitahi. Nā tēnei ka uaua ki te whai i te huringa ora katoa o te rere (hei tauira, te tautuhi i te wā i tīmata ai te rere, te roa o te wā, te tapeke o te whānui o te hononga).
5.3 Tautoko iti mō ētahi atanga/aratau
He maha ngā taputapu whatunga e tautoko ana i te sFlow i ngā atanga ā-tinana anake—tērā pea kāore e tautokona ngā atanga mariko (hei tauira, ngā atanga iti VLAN, ngā hongere tauranga) me ngā aratau puranga. Hei tauira, kāore ngā pana Cisco e tautoko i te sFlow ina whakaarahia i te aratau puranga, ka whakawhāiti i tōna whakamahinga i roto i ngā whakatinanatanga pana puranga.
5.4 Te Whakawhirinakitanga ki te Whakatinanatanga o te Māngai
Ko te whai huatanga o sFlow e whakawhirinaki ana ki te kounga o te whakatinanatanga o te Agent i runga i ngā taputapu whatunga. Tērā pea he iti te arotautanga o ngā Agent o ētahi taputapu iti-mutunga, o ētahi taputapu tawhito rānei, ā, ka nui rawa ngā rauemi e pau ana, ka kore rānei e tika te whakarato tauira. Hei tauira, he puhoi ngā CPU o ētahi pouara e ārai ana i te whakatakoto i ngā reiti tauira tino pai, ka whakaiti i te tika o te kitenga mō ngā whakaekenga pēnei i te DDoS.
5.5 Te Tirohanga Waka Whakamuna Iti
Ka hopukina noa e sFlow ngā pane mōkihi—ka huna e te waka kua whakamunatia (hei tauira, TLS 1.3) ngā raraunga kawenga, ā, kāore e taea te tautuhi i te tono tuturu, i te ihirangi rānei o te rerenga. Ahakoa ka taea tonu e sFlow te whai i ngā inenga taketake (hei tauira, te pūtake/te ūnga, te rahi o te mōkihi), kāore e taea te whakarato tirohanga hohonu ki ngā whanonga waka kua whakamunatia (hei tauira, ngā kawenga kino e huna ana i roto i te waka HTTPS).
5.6 Te Uaua o te Kaikohi
He rerekē ki a NetFlow (e whakarato ana i ngā rekoata rere kua oti te tātari), me tātari e sFlow ngā pane mōkihi mata. Ka nui ake te uaua o te whakatinanatanga me te whakahaere a te kaikohi, nā te mea me whakarite e ngā tīma ka taea e te kaikohi te whakahaere i ngā momo mōkihi me ngā kawa rerekē (hei tauira, MPLS, VXLAN).
6. Me pēhea te mahi a sFlow i roto iKaihokohoko Mōkihi Whatunga (NPB)?
He taputapu motuhake te Network Packet Broker (NPB) e kohikohi ana, e tātari ana, e tohatoha ana hoki i ngā waka whatunga ki ngā taputapu aroturuki (hei tauira, ngā kaikohi sFlow, ngā IDS/IPS, ngā pūnaha hopu packet katoa). Ka mahi ngā NPB hei "pūnga waka," e whakarite ana ka whiwhi ngā taputapu aroturuki i ngā waka e tika ana e hiahiatia ana e rātou—e whakapai ake ana i te whai huatanga me te whakaiti i te taumaha o ngā taputapu. Ina whakauruhia ki te sFlow, ka whakarei ake ngā NPB i ngā kaha o sFlow mā te aro ki ōna herenga me te whakawhānui ake i tōna tirohanga.
6.1 Te Tūranga o te NPB i roto i ngā Whakatakotoranga sFlow
I roto i ngā whakatinanatanga tuku iho o te sFlow, ka whakahaerehia e ia taputapu whatunga (pana, pouara) he Āpiha sFlow e tuku tika ana i ngā tauira ki te kaikohi. Ka taea e tēnei te arahi i te taumaha rawa o te kaikohi i roto i ngā whatunga nui (hei tauira, ngā mano tini o ngā taputapu e tuku ana i ngā raraunga UDP i te wā kotahi) ā, ka uaua ki te tātari i ngā waka e kore e tika ana. Ka whakatauhia tēnei e ngā NPB mā te mahi hei Āpiha sFlow pokapū, hei kaiwhakakotahi waka rānei, penei:
6.2 Ngā Aratau Whakauru Matua
1- Te Whakatauira sFlow Pokapū: Ka kohikohi te NPB i ngā waka mai i ngā taputapu whatunga maha (mā ngā tauranga SPAN/RSPAN, ngā TAP rānei), kātahi ka whakahaere i tētahi Kaihoko sFlow hei tauira i tēnei waka kua kohikohia. Engari ko ia taputapu e tuku tauira ana ki te kaikohi, ka tukuna e te NPB tētahi awa tauira kotahi—ka whakaiti i te kawenga kaikohi, ka whakangāwari hoki i te whakahaere. He pai tēnei aratau mō ngā whatunga nui, nā te mea ka whakakotahi i te tauira, ā, ka whakarite kia rite tonu ngā reiti tauira puta noa i te whatunga.
2- Te Tātari me te Arotau i te Waka: Ka taea e ngā NPB te tātari i te waka i mua i te tauira, me te whakarite kia ko ngā waka e tika ana anake (hei tauira, te waka mai i ngā whatunga iti nui, ngā tono motuhake) ka tauirahia e te sFlow Agent. Ka whakaitihia te maha o ngā tauira ka tukuna ki te kaikohi, ka whakapai ake i te whai huatanga me te whakaiti i ngā whakaritenga rokiroki. Hei tauira, ka taea e te NPB te tātari i te waka whakahaere ā-roto (hei tauira, SSH, SNMP) kāore e hiahiatia he aroturuki, me te arotahi ki te sFlow ki te waka kaiwhakamahi me te tono.
3- Te Whakakotahitanga Tauira me te Hononga: Ka taea e ngā NPB te whakakotahi i ngā tauira sFlow mai i ngā taputapu maha, kātahi ka hono i ēnei raraunga (hei tauira, te hono i te waka mai i tētahi IP pūtake ki ngā ūnga maha) i mua i te tukunga atu ki te kaikohi. Mā tēnei ka hoatu he tirohanga whānui ake ki te kaikohi mō ngā rerenga whatunga, e aro ana ki te herenga a sFlow ki te kore e aroturuki i ngā horopaki rerenga katoa. Ka tautokohia hoki e ētahi NPB matatau te whakarerekē i ngā reiti tauira hihiri i runga i te rahinga waka (hei tauira, te whakanui ake i ngā reiti tauira i te wā e piki haere ana te waka hei whakapai ake i te tika).
4- Te Taurite me te Wātea Nui: Ka taea e ngā NPB te whakarato ara taurite mō ngā tauira sFlow, kia kore ai he raraunga e ngaro mēnā ka rahua te kaikohi. Ka taea hoki e rātou te taurite i ngā tauira puta noa i ngā kaikohi maha, kia kore ai tetahi kaikohi kotahi e noho hei aukati.
6.3 Ngā Painga Whaihua o te Whakaurunga NPB + sFlow
He maha ngā painga matua o te whakauru i te sFlow ki tētahi NPB:
- Tauineine: Ka taea e ngā NPB te whakahaere i te whakahiatotanga me te tauira o ngā waka, ka taea ai e te kaikohi sFlow te tauine hei tautoko i ngā mano tini o ngā taputapu me te kore e taumaha rawa.
- Te Tika: Mā te whakatikatika i te tere tauira hihiri me te tātari waka ka whakapai ake i te tika o ngā raraunga sFlow, ka whakaiti i te mōrearea o te ngaronga o ngā tauira waka nui.
- Whai Huatanga: Mā te whakamahi i te tauira me te tātari pokapū ka whakaitihia te maha o ngā tauira e tukuna ana ki te kaikohi, ka whakaitihia te whānui o te raraunga me te whakamahinga rokiroki.
- Whakahaerenga Māmā: Ka whakakotahi ngā NPB i te whirihoranga me te aroturukitanga o te sFlow, ka kore e hiahiatia te whirihora i ngā Kaihoko i runga i ngā taputapu whatunga katoa.
Whakamutunga
He kawa aroturuki whatunga māmā, tauine, ā, he paerewa hoki a sFlow e aro ana ki ngā wero ahurei o ngā whatunga tere-nui o ēnei rā. Mā te whakamahi i te tauira hei kohikohi i ngā waka me te tatau raraunga, ka whakaratohia he tirohanga whānui me te kore e whakaiti i te mahi a te taputapu—he mea tino pai mō ngā pokapū raraunga, ngā umanga, me ngā kaikawe. Ahakoa he herenga ōna (hei tauira, te tika o te tauira, te horopaki rere iti), ka taea te whakaiti i ēnei mā te whakauru i a sFlow me te Network Packet Broker, e whakapūmau ana i te tauira, e tātari ana i ngā waka, ā, e whakarei ake ana i te tauine.
Ahakoa kei te aroturuki koe i tētahi whatunga puni iti, i tētahi pūtake kawe nui rānei, ka tukuna e sFlow tētahi otinga utu-whai hua, kore-kaihoko hei whiwhi māramatanga mahi mō te mahi a te whatunga. Ina honoa ki tētahi NPB, ka kaha ake—ka taea ai e ngā whakahaere te whakanui ake i ā rātou hanganga aroturuki me te pupuri i te tirohanga i te tipu haere o ā rātou whatunga.
Te wā tuku: Hui-tanguru-05-2026
