Re: Version 2 sflow: source_id not matching input or output port

My best guess is that you are looking at a Foundry 9604, or
something similar. They do have a port with ifIndex=99, and could
be sending sFlow v2. So you can almost certainly include this
datasource in your analysis.

If the trace includes sFlow counter samples, you'll be able to see
the ifType and ifSpeed reported there. Is it a gigabit ethernet port?

regards,
neil

On Jan 25, 2007, at 11:21 AM, brandy3389 wrote:

> Appreciate your response.
> I checked that the 'class' is always 0, when this situation
> occurs. I am replaying a file from a customer site, so I don't have
> access to the device sending the sflow packets. Do you have any
> idea if the index is bogus, and I should use the input_port? I'm
> tracking interface information by the port number.
>
> Thanks
>
> Neil McKee <neil.mckee@inmon.com> wrote:
> The source-id comes in two parts: "class" and "index". The class is
> usually 0, meaning that the index is an ifIndex number,
> corresponding to an entry in the SNMP MIB-II interfaces table. Is
> there an entry in the SNMP ifTable for ifIndex = 99? (try "snmpwalk
> -v1 -c interfaces"). It may not be a physical
> interface. For example, it might represent the interface that
> connects to the internal CPU on the device. It could even represent
> an ACL.
>
> It's also possible that the "class" could be 1, which means that the
> index is a vlan, or 2 which means the index is for entry in the
> Entity MIB. However I don't know of any implementations that use
> these options.
>
> Hope this helps.
>
> regards,
> neil
>
>
> On Jan 25, 2007, at 9:32 AM, brandy3389 wrote:
>
>> I'm seeing sflow packets with the source id of 99, which doesn't
>> match either the input port or the output port. Also, this appears
>> to occur when there is extended switch data, but not everytime. Any
>> ideas what may be causing this.
>>
>> Thanks
>>
>>
>> ---------------------------------
>> Food fight? Enjoy some healthy debate
>> in the Yahoo! Answers Food & Drink Q&A.
>
>
>
> ----------
> Neil McKee
> http://www.inmon.com
>
>
>
>
> ---------------------------------
> Check out the all-new Yahoo! Mail beta - Fire up a more powerful
> email and get things done faster.
Received on Thu Jan 25 19:19:07 2007