♥ 0 |
We would like to use as high sampling frequency as possible, i.e. going below the dangerous sampling rate limit of 16384. If the switch fails to sample a packet the sFlow protocol contains a counter for that, named drops. See struct flow_sample in https://sflow.org/sflow_version_5.txt Does the sflow agent detect drops? |
Hi Plundgren, Considering you are running sflow and not sflow hardware acceleration, if you sample at higher rates i.e. go below the default sampling rate limit 16384, there are chances based on the rate, the traffic is rate limited by Control plane policing. Since we know that for sflow (and not sflow hardware acceleration) the packets are punted to the CPU for further processing. So such cases you might see drops on the “cpu counters queue”. In 7280E/R & 7500E/R platform switches, under the CPU counters queue we will see drops incrementing under the CoppSystemSflow.
For 7050,7250,7260,7060 and 7300 platforms, under the CPU counters queue will see drop incrementing under the sflow.
-------------------------------------------------------------------------------- In the case of 7160 platforms, you will see drops under Q28 under cpu counters. In 7160, Q28 maps to XP_SFLOW_RC_SAMPLE.
To add further, there is specifically no explicit counter for sflow in 7150 platform but we can figure out if there are drops possibly could be due to sflow if the following counters increment.
Just to be more clear the discard counters under show sflow detail do not state discards due to high sampling rate but state discards if the packets forwarded by the hardware to the sflow agent is malformed.
If you are running sflow hardware acceleration it would be best to refer the following document. As per the document, under sflow hardware counters, Receive Packet Drop Count states the number of packet samples arrived to the accelerator but could not be processed; this can indicate a too aggressive sampling rate.
Hope this helps! Let me know if there are any further queries. Thanks, |
Post your Answer
You must be logged in to post an answer.