packet sampling point

[sujay gupta]

Hi Group,
Should sFlow capture packets on the wire or only those packets which
the device has to process?
For example if the packet, ether mac is not the NIC's it will be
dropped before L2 processing( assume no bridging) , but then should
sFlow , packet sampling should sample this packet?

If it does the flow info would not be what is crosssing the switch.

Consider a broadcast link on a switch where there is numerous
crosstalk between hosts, the sFlow would send all this data as flow
info, even though it has not participated in it !

Is this what the collector is interested in?

BR,
-Sujay

[Peter Phaal]

The sampling point occurs after the packet has been accepted for processing.

From section 3.1 of the sFlow version 5 specification,

http://www.sflow.org/sflow_version_5.txt:

Packet Flow Sampling is accomplished as follows: When a packet
arrives on an interface, the Network Device makes a filtering
decision to determines whether the packet should be dropped. If the
packet is not filtered a destination interface is assigned by the
switching/routing function. At this point a decision is made on
whether or not to sample the packet.

You should also look at the definition of Packet Flow and Packet Flow
Sampling in section 2. Terminology and Architecture.

Peter

-----Original Message-----
sujay gupta
Sent: Wednesday, October 21, 2009 2:34 AM
Subject: [sFlow] packet sampling point
Hi Group,
Should sFlow capture packets on the wire or only those packets which
the device has to process?
For example if the packet, ether mac is not the NIC's it will be
dropped before L2 processing( assume no bridging) , but then should
sFlow , packet sampling should sample this packet?
If it does the flow info would not be what is crosssing the switch.
Consider a broadcast link on a switch where there is numerous
crosstalk between hosts, the sFlow would send all this data as flow
info, even though it has not participated in it !
Is this what the collector is interested in?
BR,
-Sujay

[sujay gupta]

Thanks Peter,

In a practical switch the filtering stage would be possibly the
packet-filters etc.
and if it passes through it goes for routing/switching, where the
sampler may choose
to send it for measurement.

That should be the behavior as well, my question stemmed from the
observation of sFlow
implementation of a major chip vendor, which sends *every* packet ,
even if it should never have
been processed.

BR,
-Sujay

Post by Peter Phaal
The sampling point occurs after the packet has been accepted for processing.
From section 3.1 of the sFlow version 5 specification,
Packet Flow Sampling is accomplished as follows: When a packet
arrives on an interface, the Network Device makes a filtering
decision to determines whether the packet should be dropped. If the
packet is not filtered a destination interface is assigned by the
switching/routing function. At this point a decision is made on
whether or not to sample the packet.
You should also look at the definition of Packet Flow and Packet Flow
Sampling in section 2. Terminology and Architecture.
Peter

-----Original Message-----
sujay gupta
Sent: Wednesday, October 21, 2009 2:34 AM
Subject: [sFlow] packet sampling point
Hi Group,
Should sFlow capture packets on the wire or only those packets which
the device has to process?
For example if the packet, ether mac is not the NIC's it will be
dropped before L2 processing( assume no bridging) , but then should
sFlow , packet sampling should sample this packet?
If it does the flow info would not be what is crosssing the switch.
Consider a broadcast link on a switch where there is numerous
crosstalk between hosts, the sFlow would send all this data as flow
info, even though it has not participated in it !
Is this what the collector is interested in?
BR,
-Sujay

[Peter Phaal]

You should use whatever sampling points are supported by the chip vendor. In
most realistic deployment scenarios there is very little difference between
sampling before or after the filter step.

If a sampled packet is going to be discarded by the switch, then it should
still be exported as an sFlow flow sample, but you should indicate the
discard in the flow_sample egress port field (using the format=1 packet
discarded code), see page 27 of the sFlow version 5 specification.

Make sure that the switch chip implements random 1 in N sampling as
described in the sFlow specification, other sampling schemes are not
permitted (time-based, hash-based etc).

-----Original Message-----
sujay gupta
Sent: Wednesday, October 21, 2009 11:05 AM
Subject: Re: [sFlow] packet sampling point
Thanks Peter,
In a practical switch the filtering stage would be possibly the
packet-filters etc.
and if it passes through it goes for routing/switching, where the
sampler may choose
to send it for measurement.
That should be the behavior as well, my question stemmed from the
observation of sFlow
implementation of a major chip vendor, which sends *every* packet ,
even if it should never have
been processed.
BR,
-Sujay

Post by Peter Phaal
The sampling point occurs after the packet has been accepted for

processing.

Post by Peter Phaal
From section 3.1 of the sFlow version 5 specification,
Packet Flow Sampling is accomplished as follows: When a packet
arrives on an interface, the Network Device makes a filtering
decision to determines whether the packet should be dropped. If the
packet is not filtered a destination interface is assigned by the
switching/routing function. At this point a decision is made on
whether or not to sample the packet.
You should also look at the definition of Packet Flow and Packet Flow
Sampling in section 2. Terminology and Architecture.
Peter

[sujay gupta]

Yes mostly in a usage where connect hosts with a hub & spoke method to
the switch , the packet on the wire would not be much different than
what it intends to get.

Now I will set the discard bit, assume the packet was to be discarded,
but then it defeats the
purpose of h/w assisted sampling. What should have been marked as
discard by the filtering/switching/routing stage is now left for the
control plane to implement.

I would like to get a wider audience & perhaps mark this vendor chip
with this anamolous behavior, for developer folks in an sFlow link.

BR,
-Sujay

Post by Peter Phaal
You should use whatever sampling points are supported by the chip vendor. In
most realistic deployment scenarios there is very little difference between
sampling before or after the filter step.
If a sampled packet is going to be discarded by the switch, then it should
still be exported as an sFlow flow sample, but you should indicate the
discard in the flow_sample egress port field (using the format=1 packet
discarded code), see page 27 of the sFlow version 5 specification.
Make sure that the switch chip implements random 1 in N sampling as
described in the sFlow specification, other sampling schemes are not
permitted (time-based, hash-based etc).

-----Original Message-----
sujay gupta
Sent: Wednesday, October 21, 2009 11:05 AM
Subject: Re: [sFlow] packet sampling point
Thanks Peter,
In a practical switch the filtering stage would be possibly the
packet-filters etc.
and if it passes through it goes for routing/switching, where the
sampler may choose
to send it for measurement.
That should be the behavior as well, my question stemmed from the
observation of sFlow
implementation of a major chip vendor, which sends *every* packet ,
even if it should never have
been processed.
BR,
-Sujay

Post by Peter Phaal
The sampling point occurs after the packet has been accepted for

processing.

Post by Peter Phaal
From section 3.1 of the sFlow version 5 specification,
Packet Flow Sampling is accomplished as follows: When a packet
arrives on an interface, the Network Device makes a filtering
decision to determines whether the packet should be dropped. If the
packet is not filtered a destination interface is assigned by the
switching/routing function. At this point a decision is made on
whether or not to sample the packet.
You should also look at the definition of Packet Flow and Packet Flow
Sampling in section 2. Terminology and Architecture.
Peter