Re: packet sampling point

Yes mostly in a usage where connect hosts with a hub & spoke method to
the switch , the packet on the wire would not be much different than
what it intends to get.

Now I will set the discard bit, assume the packet was to be discarded,
but then it defeats the
purpose of h/w assisted sampling. What should have been marked as
discard by the filtering/switching/routing stage is now left for the
control plane to implement.

I would like to get a wider audience & perhaps mark this vendor chip
with this anamolous behavior, for developer folks in an sFlow link.

BR,
-Sujay

On Wed, Oct 21, 2009 at 12:38 PM, Peter Phaal <peter.phaal@inmon.com> wrote:
> You should use whatever sampling points are supported by the chip vendor. In
> most realistic deployment scenarios there is very little difference between
> sampling before or after the filter step.
>
> If a sampled packet is going to be discarded by the switch, then it should
> still be exported as an sFlow flow sample, but you should indicate the
> discard in the flow_sample egress port field (using the format=1 packet
> discarded code), see page 27 of the sFlow version 5 specification.
>
> Make sure that the switch chip implements random 1 in N sampling as
> described in the sFlow specification, other sampling schemes are not
> permitted (time-based, hash-based etc).
>
>> -----Original Message-----
>> From: owner-sflow@sflow.org [mailto:owner-sflow@sflow.org] On Behalf Of
>> sujay gupta
>> Sent: Wednesday, October 21, 2009 11:05 AM
>> To: peter.phaal@inmon.com
>> Cc: sflow@sflow.org
>> Subject: Re: [sFlow] packet sampling point
>>
>> Thanks Peter,
>>
>> In a practical switch the filtering stage would be possibly the
>> packet-filters etc.
>> and if it passes through it goes for routing/switching, where the
>> sampler may choose
>> to send it for measurement.
>>
>> That should be the behavior as well, my question stemmed from the
>> observation of sFlow
>> implementation of a major chip vendor, which sends *every* packet ,
>> even if it should never have
>> been processed.
>>
>> BR,
>> -Sujay
>>
>> On Wed, Oct 21, 2009 at 7:23 PM, Peter Phaal <peter.phaal@inmon.com>
>> wrote:
>> > The sampling point occurs after the packet has been accepted for
>> processing.
>> >
>> > From section 3.1 of the sFlow version 5 specification,
>> > http://www.sflow.org/sflow_version_5.txt:
>> >
>> > Packet Flow Sampling is accomplished as follows: When a packet
>> > arrives on an interface, the Network Device makes a filtering
>> > decision to determines whether the packet should be dropped. If the
>> > packet is not filtered a destination interface is assigned by the
>> > switching/routing function. At this point a decision is made on
>> > whether or not to sample the packet.
>> >
>> > You should also look at the definition of Packet Flow and Packet Flow
>> > Sampling in section 2. Terminology and Architecture.
>> >
>> > Peter
Received on Wed Oct 21 20:56:46 2009