Re: sFlow sample - multiple flow data formats

Hi Peter,

Peter Phaal wrote:
> The specification is a little vague about the meaning of multiple
> sampled_ethernet, sampled_ipv4 and sampled_ipv6 records in a flow_sample.
> It's hard to see how a device would be able to populate many of these
> records if it didn't have access to the packet header (in which case it
> would be required to send a sampled_header instead). In any event the only
> situation where you could see repetition of records would be if the flow
> sample represented a tunneled packet (i.e. ipv6 over ipv4, ipv4 over ipv4 or
> ipv4 over ipv6). In this situation it could make sense to encode multiple
> records in network stack order (information from the start of the packet
> header first).

Thanks for the info.

Regards

-- 
Elisa Jasinska
http://www.ams-ix.net