Prerequisites:
Microsoft Hyper-V
Host sFlow extension installation files - download here
Configuration Steps:
To enable sFlow statistics collection in a Hyper-V environment, there are two main configuration steps:
Installing the Host sFlow switch extension on each Hyper-V server you wish to monitor
Enable the sFlow Traffic Monitoring extension on each virtual switch
In order to allow the packets to reach the sensor, firewall ports may need to be opened. The sFlow data is sent via UDP on port 6343. The source address of the sFlow packets will be the address of the Hyper-V server and the target address will be the address specified in the collector parameter in the configuration. It is possible to change the default port from 6343, but this will also require changing the sflow_port parameter in the network sensor configuration file.
Host sFlow Extension Installation
Run the MSI to install the extension.
Accept the license agreement and select a folder for installation
In the sampling parameters screen, disable the parameter to configure using DNS-SD and in the sFlow collector field, enter the address of the Faddom Server or sensor you wish to collect the traffic.
This cannot be set to localhost or to one of the local IP addresses of the Hyper-V server.
Complete the installation of the extension.
Enabling the sFlow Traffic Monitor extension
After installing the switch extension, it needs to be enabled on the virtual switches. This can be done through Hyper-V Manager. Note that only switches connected to an External network can be monitored using sFlow.
Open the Virtual Switch Manager
For each switch, you would like to monitor, click on the + icon and select Extensions.
Under Switch extensions select the sFlow Traffic Monitoring extension and enable it.
Click Apply to save the changes. You may get a warning that the pending changes may disrupt network connectivity. Enabling the sFlow extension should not disrupt any connectivity on the server.
Changing the sFlow configuration
After the initial setup of the host sFlow extension, changes can be made to its configuration in the registry. The following parameters are relevant for the Faddom installation:
collector – The IP address of the system to which the sFlow will be sent (the Faddom Sensor)
samplingRate – Determines the number of packets that will be sampled to send over sFlow. I.E. a sampling rate of 20 means that only 1 in 20 packets will be sent over sFlow.
Steps:
Open the Registry Editor (regedit.exe)
Navigate to the key HKLM\SYSTEM\CurrentControlSet\Services\hsflowd\Parameters
Make necessary changes to the parameters.
Restart the Host sFlow Agent service in Windows services for the changes to take effect.
Host sFlow is a third-party tool and if you can find the Windows documentation for it here.