RE: packet sampling point

You should use whatever sampling points are supported by the chip vendor. In
most realistic deployment scenarios there is very little difference between
sampling before or after the filter step.

If a sampled packet is going to be discarded by the switch, then it should
still be exported as an sFlow flow sample, but you should indicate the
discard in the flow_sample egress port field (using the format=1 packet
discarded code), see page 27 of the sFlow version 5 specification.

Make sure that the switch chip implements random 1 in N sampling as
described in the sFlow specification, other sampling schemes are not
permitted (time-based, hash-based etc).

> -----Original Message-----
> From: owner-sflow@sflow.org [mailto:owner-sflow@sflow.org] On Behalf Of
> sujay gupta
> Sent: Wednesday, October 21, 2009 11:05 AM
> To: peter.phaal@inmon.com
> Cc: sflow@sflow.org
> Subject: Re: [sFlow] packet sampling point
>
> Thanks Peter,
>
> In a practical switch the filtering stage would be possibly the
> packet-filters etc.
> and if it passes through it goes for routing/switching, where the
> sampler may choose
> to send it for measurement.
>
> That should be the behavior as well, my question stemmed from the
> observation of sFlow
> implementation of a major chip vendor, which sends *every* packet ,
> even if it should never have
> been processed.
>
> BR,
> -Sujay
>
> On Wed, Oct 21, 2009 at 7:23 PM, Peter Phaal <peter.phaal@inmon.com>
> wrote:
> > The sampling point occurs after the packet has been accepted for
> processing.
> >
> > From section 3.1 of the sFlow version 5 specification,
> > http://www.sflow.org/sflow_version_5.txt:
> >
> > Packet Flow Sampling is accomplished as follows: When a packet
> > arrives on an interface, the Network Device makes a filtering
> > decision to determines whether the packet should be dropped. If the
> > packet is not filtered a destination interface is assigned by the
> > switching/routing function. At this point a decision is made on
> > whether or not to sample the packet.
> >
> > You should also look at the definition of Packet Flow and Packet Flow
> > Sampling in section 2. Terminology and Architecture.
> >
> > Peter
Received on Wed Oct 21 12:40:12 2009