SONiC's High-Frequency Telemetry (HFT) framework today streams port, queue, and buffer counters via TAM_COUNTER_SUBSCRIPTION, IPFIX, and OpenTelemetry — a well-established path from ASIC to CounterSyncd to Collector. Per-flow telemetry, however, is currently outside HFT's scope: SAI_TAM_TELEMETRY_TYPE_FLOW exists in the SAI specification but is under-specified, and SONiC has no ingestion path for flow records.
This session presents work to close that gap. We extend HFT to carry per-flow IPFIX records — for both operator-configured flows, defined by ACL entries bound to a TAM object via the existing SAI_ACL_ENTRY_ATTR_ACTION_TAM_OBJECT action, and hardware auto-learned flows, enabled by a new switch-level SAI attribute being proposed upstream. We walk through the SAI additions, the CounterSyncd extensions needed to consume flow templates, and the CONFIG_DB and STATE_DB schema.

Target Applications: ML-based traffic analytics, elephant-flow detection, tenant SLA monitoring, and security anomaly workflows — all of which need per-flow visibility that today's HFT cannot provide.