--- title: '' description: Telegraf plugin for collecting metrics from SFlow url: https://docs.influxdata.com/telegraf/v1/input-plugins/sflow/ estimated_tokens: 1563 product: Telegraf Enterprise version: v1 publisher: InfluxData canonical: https://docs.influxdata.com/telegraf/v1/input-plugins/sflow/ date: '2026-05-21T20:10:18+02:00' lastmod: '2026-05-21T20:10:18+02:00' --- ========== * Telegraf v1.14.0+ [Plugin source](https://github.com/influxdata/telegraf/tree/v1.39.1/plugins/inputs/sflow/)[Download configuration](https://raw.githubusercontent.com/influxdata/telegraf/refs/tags/v1.39.1/plugins/inputs/sflow/sample.conf) # SFlow Input Plugin This service plugin produces metrics from information received by acting as a[SFlow V5](https://sflow.org/sflow_version_5.txt) collector. Currently, the plugin can collect Flow Samples of Ethernet / IPv4, IPv4 TCP and UDP headers. Counters and other header samples are ignored. Please use the [netflow plugin](/telegraf/v1/plugins/#input-netflow) for a more modern and sophisticated implementation. This plugin produces high cardinality data, which when not controlled for will cause high load on your database. Please make sure to [filter](/telegraf/v1/configuration/#metric-filtering) the produced metrics or configure your database to avoid cardinality issues! **Introduced in:** Telegraf v1.14.0**Tags:** network**OS support:** all ## Service Input This plugin is a service input. Normal plugins gather metrics determined by the interval setting. Service plugins start a service to listen and wait for metrics or events to occur. Service plugins have two key differences from normal plugins: 1. The global or plugin specific `interval` setting may not apply 2. The CLI options of `--test`, `--test-wait`, and `--once` may not produce output for this plugin ## Global configuration options Plugins support additional global and plugin configuration settings for tasks such as modifying metrics, tags, and fields, creating aliases, and configuring plugin ordering. See [CONFIGURATION.md](/telegraf/v1/configuration/#plugins) for more details. ## Configuration ```toml # SFlow V5 Protocol Listener [[inputs.sflow]] ## Address to listen for sFlow packets. ## example: service_address = "udp://:6343" ## service_address = "udp4://:6343" ## service_address = "udp6://:6343" service_address = "udp://:6343" ## Set the size of the operating system's receive buffer. ## example: read_buffer_size = "64KiB" # read_buffer_size = "" ``` ## Metrics * sflow * tags: * agent\_address - IP address of the agent obtaining the sflow sample and sent it to this collector * source\_id\_type - type of flow\_sample or flow\_sample\_expanded structures * source\_id\_index - index of flow\_sample or flow\_sample\_expanded structures * input\_ifindex - input value of flow\_sample or flow\_sample\_expanded structures * output\_ifindex - output value of flow\_sample or flow\_sample\_expanded structures * sample\_direction - source\_id\_index, netif\_index\_in and netif\_index\_out * header\_protocol - header\_protocol field of sampled\_header structures * ether\_type - ethernet type of an ETHERNET-ISO88023 header * src\_ip - source IP address of IPv4 or IPv6 structures * src\_port - source port of TCP or UDP structures * src\_port\_name - name of the source port * src\_mac - source MAC address of an ETHERNET-ISO88023 header * src\_vlan - source VLAN of extended\_switch structure * src\_priority - source priority of extended\_switch structure * src\_mask\_len - length of source mask of extended\_router structure * dst\_ip - destination IP address of IPv4 or IPv6 structures * dst\_port - destination port of TCP or UDP structures * dst\_port\_name - name of the destination port * dst\_mac - destination MAC address of an ETHERNET-ISO88023 header * dst\_vlan - destination VLAN of extended\_switch structure * dst\_priority - destination priority extended\_switch structure * dst\_mask\_len - length of destinationd mask of extended\_router structure * next\_hop - next hop of extended\_router structure * ip\_version - IP version of IPv4 or IPv6 structures * ip\_protocol - IP protocol of IPv4 or IPv6 structures * ip\_dscp - IP DSCP of IPv4 or IPv6 structures * ip\_ecn - IP ECN of IPv4 or IPv6 structures * tcp\_urgent\_pointer - urgent pointer of TCP structure * fields: * bytes (int) - product of frame length and packets * drops (int) - drops field of flow\_sample or flow\_sample\_expanded structures * packets (int) - sampling\_rate field of flow\_sample or flow\_sample\_expanded structures * frame\_length (int) - frame\_length field of sampled\_header structures * header\_size (int) - header\_size field of sampled\_header structures * ip\_fragment\_offset (int) - ip\_ver field of IPv4 structures * ip\_header\_length (int) - ip\_ver field of IPv4 structures * ip\_total\_length (int) - ip\_total\_len field of IPv4 structures * ip\_ttl (int) - ip\_ttl field of IPv4 structures or ip\_hop\_limit field IPv6 structures * tcp\_header\_length (int) - size field of TCP structure. This value is specified in 32-bit words. It must be multiplied by 4 to produce a valuein bytes. * tcp\_window\_size (int) - window\_size field of TCP structure * udp\_length (int) - length field of UDP structures * ip\_flags (int) - ip\_ver field of IPv4 structures * tcp\_flags (int) - TCP flags of TCP IP header (IPv4 or IPv6) ## Troubleshooting The [sflowtool](https://github.com/sflow/sflowtool) utility can be used to print sFlow packets, and compared against the metrics produced by Telegraf. ```sh sflowtool -p 6343 ``` If opening an issue, in addition to the output of sflowtool it will also be helpful to collect a packet capture. Adjust the interface, host and port as needed: ```sh sudo tcpdump -s 0 -i eth0 -w telegraf-sflow.pcap host 127.0.0.1 and port 6343 ``` ## Example Output ```text sflow,agent_address=0.0.0.0,dst_ip=10.0.0.2,dst_mac=ff:ff:ff:ff:ff:ff,dst_port=40042,ether_type=IPv4,header_protocol=ETHERNET-ISO88023,input_ifindex=6,ip_dscp=27,ip_ecn=0,output_ifindex=1073741823,source_id_index=3,source_id_type=0,src_ip=10.0.0.1,src_mac=ff:ff:ff:ff:ff:ff,src_port=443 bytes=1570i,drops=0i,frame_length=157i,header_length=128i,ip_flags=2i,ip_fragment_offset=0i,ip_total_length=139i,ip_ttl=42i,sampling_rate=10i,tcp_header_length=0i,tcp_urgent_pointer=0i,tcp_window_size=14i 1584473704793580447 ```