Thanks Peter, In a practical switch the filtering stage would be possibly the packet-filters etc. and if it passes through it goes for routing/switching, where the sampler may choose to send it for measurement.
That should be the behavior as well, my question stemmed from the observation of sFlow implementation of a major chip vendor, which sends *every* packet , even if it should never have been processed. BR, -Sujay On Wed, Oct 21, 2009 at 7:23 PM, Peter Phaal <peter.ph...@inmon.com> wrote: > The sampling point occurs after the packet has been accepted for processing. > > From section 3.1 of the sFlow version 5 specification, > http://www.sflow.org/sflow_version_5.txt: > > Packet Flow Sampling is accomplished as follows: When a packet > arrives on an interface, the Network Device makes a filtering > decision to determines whether the packet should be dropped. If the > packet is not filtered a destination interface is assigned by the > switching/routing function. At this point a decision is made on > whether or not to sample the packet. > > You should also look at the definition of Packet Flow and Packet Flow > Sampling in section 2. Terminology and Architecture. > > Peter > >> -----Original Message----- >> From: owner-sf...@sflow.org [mailto:owner-sf...@sflow.org] On Behalf Of >> sujay gupta >> Sent: Wednesday, October 21, 2009 2:34 AM >> To: sflow@sflow.org >> Subject: [sFlow] packet sampling point >> >> Hi Group, >> Should sFlow capture packets on the wire or only those packets which >> the device has to process? >> For example if the packet, ether mac is not the NIC's it will be >> dropped before L2 processing( assume no bridging) , but then should >> sFlow , packet sampling should sample this packet? >> >> If it does the flow info would not be what is crosssing the switch. >> >> Consider a broadcast link on a switch where there is numerous >> crosstalk between hosts, the sFlow would send all this data as flow >> info, even though it has not participated in it ! >> >> Is this what the collector is interested in? >> >> BR, >> -Sujay
