Re: packet sampling point

Thanks Peter,

In a practical switch the filtering stage would be possibly the
packet-filters etc.
and if it passes through it goes for routing/switching, where the
sampler may choose
to send it for measurement.

That should be the behavior as well, my question stemmed from the
observation of sFlow
implementation of a major chip vendor, which sends *every* packet ,
even if it should never have
been processed.

BR,
-Sujay

On Wed, Oct 21, 2009 at 7:23 PM, Peter Phaal <peter.phaal@inmon.com> wrote:
> The sampling point occurs after the packet has been accepted for processing.
>
> From section 3.1 of the sFlow version 5 specification,
> http://www.sflow.org/sflow_version_5.txt:
>
> Packet Flow Sampling is accomplished as follows: When a packet
> arrives on an interface, the Network Device makes a filtering
> decision to determines whether the packet should be dropped. If the
> packet is not filtered a destination interface is assigned by the
> switching/routing function. At this point a decision is made on
> whether or not to sample the packet.
>
> You should also look at the definition of Packet Flow and Packet Flow
> Sampling in section 2. Terminology and Architecture.
>
> Peter
>
>> -----Original Message-----
>> From: owner-sflow@sflow.org [mailto:owner-sflow@sflow.org] On Behalf Of
>> sujay gupta
>> Sent: Wednesday, October 21, 2009 2:34 AM
>> To: sflow@sflow.org
>> Subject: [sFlow] packet sampling point
>>
>> Hi Group,
>> Should sFlow capture packets on the wire or only those packets which
>> the device has to process?
>> For example if the packet, ether mac is not the NIC's it will be
>> dropped before L2 processing( assume no bridging) , but then should
>> sFlow , packet sampling should sample this packet?
>>
>> If it does the flow info would not be what is crosssing the switch.
>>
>> Consider a broadcast link on a switch where there is numerous
>> crosstalk between hosts, the sFlow would send all this data as flow
>> info, even though it has not participated in it !
>>
>> Is this what the collector is interested in?
>>
>> BR,
>> -Sujay
Received on Wed Oct 21 11:06:35 2009