Yes mostly in a usage where connect hosts with a hub & spoke method to the switch , the packet on the wire would not be much different than what it intends to get.
Now I will set the discard bit, assume the packet was to be discarded, but then it defeats the purpose of h/w assisted sampling. What should have been marked as discard by the filtering/switching/routing stage is now left for the control plane to implement. I would like to get a wider audience & perhaps mark this vendor chip with this anamolous behavior, for developer folks in an sFlow link. BR, -Sujay On Wed, Oct 21, 2009 at 12:38 PM, Peter Phaal <peter.ph...@inmon.com> wrote: > You should use whatever sampling points are supported by the chip vendor. In > most realistic deployment scenarios there is very little difference between > sampling before or after the filter step. > > If a sampled packet is going to be discarded by the switch, then it should > still be exported as an sFlow flow sample, but you should indicate the > discard in the flow_sample egress port field (using the format=1 packet > discarded code), see page 27 of the sFlow version 5 specification. > > Make sure that the switch chip implements random 1 in N sampling as > described in the sFlow specification, other sampling schemes are not > permitted (time-based, hash-based etc). > >> -----Original Message----- >> From: owner-sf...@sflow.org [mailto:owner-sf...@sflow.org] On Behalf Of >> sujay gupta >> Sent: Wednesday, October 21, 2009 11:05 AM >> To: peter.ph...@inmon.com >> Cc: sflow@sflow.org >> Subject: Re: [sFlow] packet sampling point >> >> Thanks Peter, >> >> In a practical switch the filtering stage would be possibly the >> packet-filters etc. >> and if it passes through it goes for routing/switching, where the >> sampler may choose >> to send it for measurement. >> >> That should be the behavior as well, my question stemmed from the >> observation of sFlow >> implementation of a major chip vendor, which sends *every* packet , >> even if it should never have >> been processed. >> >> BR, >> -Sujay >> >> On Wed, Oct 21, 2009 at 7:23 PM, Peter Phaal <peter.ph...@inmon.com> >> wrote: >> > The sampling point occurs after the packet has been accepted for >> processing. >> > >> > From section 3.1 of the sFlow version 5 specification, >> > http://www.sflow.org/sflow_version_5.txt: >> > >> > Packet Flow Sampling is accomplished as follows: When a packet >> > arrives on an interface, the Network Device makes a filtering >> > decision to determines whether the packet should be dropped. If the >> > packet is not filtered a destination interface is assigned by the >> > switching/routing function. At this point a decision is made on >> > whether or not to sample the packet. >> > >> > You should also look at the definition of Packet Flow and Packet Flow >> > Sampling in section 2. Terminology and Architecture. >> > >> > Peter
