Re: packet sampling point

From: sujay gupta <>
Date: 10/21/09
Message-ID: <>

Thanks Peter,

In a practical switch the filtering stage would be possibly the
packet-filters etc.
and if it passes through it goes for routing/switching, where the
sampler may choose
to send it for measurement.

That should be the behavior as well, my question stemmed from the
observation of sFlow
implementation of a major chip vendor, which sends *every* packet ,
even if it should never have
been processed.


On Wed, Oct 21, 2009 at 7:23 PM, Peter Phaal <> wrote:
> The sampling point occurs after the packet has been accepted for processing.
> From section 3.1 of the sFlow version 5 specification,
> Packet Flow Sampling is accomplished as follows: When a packet
> arrives on an interface, the Network Device makes a filtering
> decision to determines whether the packet should be dropped. If the
> packet is not filtered a destination interface is assigned by the
> switching/routing function. At this point a decision is made on
> whether or not to sample the packet.
> You should also look at the definition of Packet Flow and Packet Flow
> Sampling in section 2. Terminology and Architecture.
> Peter
>> -----Original Message-----
>> From: [] On Behalf Of
>> sujay gupta
>> Sent: Wednesday, October 21, 2009 2:34 AM
>> To:
>> Subject: [sFlow] packet sampling point
>> Hi Group,
>> Should sFlow capture packets on the wire or only those packets which
>> the device has to process?
>> For example if the packet, ether mac is not the NIC's it will be
>> dropped before L2 processing( assume no bridging) , but then should
>> sFlow , packet sampling should sample this packet?
>> If it does the flow info would not be what is crosssing the switch.
>> Consider a broadcast link on a switch where there is numerous
>> crosstalk between hosts, the sFlow would send all this data as flow
>> info, even though it has not participated in it !
>> Is this what the collector is interested in?
>> BR,
>> -Sujay
Received on Wed Oct 21 11:06:35 2009

This archive was generated by hypermail 2.1.8 : 02/17/10 PST